ANNEX I

Standard information document and EC type-approval certificate for the type-approval of motor vehicles with regard to AEBS

PART 1

Information document

MODEL

Information document No … relating to the EC type-approval of a type of vehicle with regard to advanced emergency braking systems (AEBS).

The following information shall be supplied in triplicate and include a list of contents. Any drawings shall be supplied in appropriate scale and in sufficient detail on size A4 or on a folder of A4 format. Photographs, if any, shall show sufficient detail.

If the systems, components or separate technical units referred to in Annex I to Regulation (EU) No 347/2012 have electronic controls, information concerning their performance shall be supplied.

0.   GENERAL

0.1.   Make (trade name of manufacturer): …

0.2.   Type: …

0.2.0.1.   Chassis: …

0.2.0.2.   Bodywork/complete vehicle: …

0.2.1.   Commercial name(s) (if available): …

0.3.   Means of identification of type, if marked on the vehicle (b): …

0.3.0.1.   Chassis: …

0.3.0.2.   Bodywork/complete vehicle: …

0.3.1.   Location of that marking: …

0.3.1.1.   Chassis: …

0.3.1.2.   Bodywork/complete vehicle: …

0.4.   Category of vehicle (c): …

0.5.   Name and address of manufacturer: …

0.6.   Location and method of attachment of statutory plates and location of vehicle identification number: …

0.6.1.   On the chassis: …

0.6.2.   On the bodywork: …

0.8.   Name(s) and address(es) of assembly plant(s)

0.9.   Name and address of the manufacturer’s representative (if any): …

1.   GENERAL CONSTRUCTION CHARACTERISTICS OF THE VEHICLE

1.1.   Photographs and/or drawings of a representative vehicle: …

1.2.   Dimensional drawing of the whole vehicle: …

1.3.   Number of axles and wheels: …

1.3.1.   Number and position of axles with twin wheels: …

1.3.2.   Number and position of steered axles: …

1.3.3.   Powered axles (number, position, interconnection): …

2.   MASSES AND DIMENSIONS (f) (g)

(in kg and mm) (Refer to drawing where applicable)

2.1.   Wheelbase(s) (fully loaded) (1)

2.1.1.   Two axle vehicles: …

2.1.1.1.   Vehicles with three or more axles

2.3.   Axle track(s) and width(s)

2.3.1.   Track of each steered axle (2): …

2.3.2.   Track of all other axles (2): …

2.3.4.   Width of the foremost axle (measured at the outermost part of the tyres excluding the bulging of the tyres close to the ground): …

2.4.   Range of vehicle dimensions (overall)

2.4.1.   For chassis without bodywork

2.4.1.1.   Length (3): …

2.4.1.1.1.   Maximum permissible length: …

2.4.1.1.2.   Minimum permissible length: …

2.4.1.2.   Width (4): …

2.4.1.2.1.   Maximum permissible width: …

2.4.1.2.2.   Minimum permissible width: …

2.4.2.   For chassis with bodywork

2.4.2.1.   Length (3): …

2.4.2.1.1.   Length of the loading area: …

2.4.2.2.   Width (4): …

2.4.3.   For bodywork approved without chassis (vehicles M2 and M3)

2.4.3.1.   Length (3): …

2.4.3.2.   Width (4): …

2.6.   Mass in running order

Mass of the vehicle with bodywork and, in the case of a towing vehicle of category other than M1, with coupling device, if fitted by the manufacturer, in running order, or mass of the chassis or chassis with cab, without bodywork and/or coupling device if the manufacturer does not fit the bodywork and/or coupling device (including liquids, tools, spare wheel, if fitted, and driver and, for buses and coaches, a crew member if there is a crew seat in the vehicle) (h) (maximum and minimum for each variant): …

4.7.   Maximum vehicle design speed (in km/h) (q): …

8.   BRAKES

(The following particulars, including means of identification, where applicable, are to be given)

8.1.   Type and characteristics of the brakes as defined in point 1.6 of Annex I to Council Directive 71/320/EEC (1) including details and drawings of the drums, discs, hoses make and type of shoe/pad assemblies and/or linings, effective braking areas, radius of drums, shoes or discs, mass of drums, adjustment devices, relevant parts of the axle(s) and suspension: …

8.2.   Operating diagram, description and/or drawing of the braking system described in point 1.2 of Annex I to Directive 71/320/EEC including details and drawings of the transmission and controls: …

8.2.1.   Service braking system: …

8.2.2.   Secondary braking system: …

8.2.4.   Any additional braking system: …

8.3.   Control and transmission of trailer braking systems in vehicles designed to tow a trailer: ……

8.4.   Vehicle is equipped to tow a trailer with electric/pneumatic/hydraulic (*1) service brakes: yes/no (*1)

8.5.   Anti-lock braking system

8.5.1.   description of system operation (including any electronic parts), electric block diagram, hydraulic or pneumatic circuit plan: …

8.6.   Calculation and curves according to the Appendix to point 1.1.4.2 of the Appendix to Annex II to Directive 71/320/EEC or to the Appendix to Annex XI thereto, if applicable: …

8.7.   Description and/or drawing of the energy supply, also to be specified for power-assisted braking systems: …

8.7.1.   In the case of compressed-air braking systems, working pressure p2 in the pressure reservoir(s): ……

8.7.2.   In the case of vacuum braking systems, the initial energy level in the reservoir(s): …

13.   SPECIAL PROVISIONS FOR BUSES AND COACHES

13.1.   Class of vehicle: Class III/Class B (*1)

Explanatory notes

PART 2

MODEL

(maximum format: A4 (210 × 297 mm))

EC TYPE-APPROVAL CERTIFICATE

Communication concerning:

—	EC type-approval (2)

—	Extension of EC type-approval (2)

—	Refusal of EC type-approval (2)

—	Withdrawal of EC type-approval (2)

of a type of vehicle with regard to advanced emergency braking systems (AEBS)

with regard to Commission Regulation (EU) No 347/2012 as amended and complying with approval level 1 (2)/approval level 2 (2)

EC type-approval Number: _

Reason for extension:

SECTION I

0.1.   Make (trade name of manufacturer):

0.2.   Type:

0.2.1.   Commercial name(s) (if available)

0.3.   Means of identification of type if marked on the vehicle (3)

0.3.1.   Location of that marking:

0.4.   Category of vehicle (4):

0.5.   Name and address of manufacturer:

0.8.   Names and address(es) of assembly plant(s):

0.9.   Representative of the manufacturer

SECTION II

1.   Additional information (where applicable): See Addendum

2.   Technical service responsible for carrying out the tests:

3.   Date of test report:

4.   Number of test report:

5.   Remarks (if any): See Addendum

6.   Place:

7.   Date:

8.   Signature:

Attachments

:

Information package. Test report.

---

(b)  If the means of identification of type contains characters not relevant to describe the vehicle, component or separate technical unit types covered by this information document, such characters shall be represented in the documentation by the symbol ‘?’ (e.g. ABC??123??).

(c)  Classified according to the definitions set out in Part A of Annex II to Directive 2007/46/EC of the European Parliament and of the Council (OJ L 263, 9.10.2007, p. 1).

(f)  Where there is one version with a normal cab and another with a sleeper cab, both sets of masses and dimensions are to be stated.

(g)  Standard ISO 612: 1978 — Road vehicles — Dimensions of motor vehicles and towed vehicles — terms and definitions.

(1)  

(g1)	Motor vehicle and drawbar trailer: term No 6.4.1. Semi-trailer and centre-axle trailer: term No 6.4.2. Note In the case of a centre-axle trailer, the axis of the coupling shall be considered as the foremost axle.

(2)  

(g4)	Term No 6.5.

(3)  

(g5)	Term No 6.1 and for vehicles other than those of category M1: point 2.4.1 of Annex I to Directive 97/27/EC of the European Parliament and of the Council (OJ L 233, 25.8.1997, p. 1). In the case of trailers, the lengths shall be specified as mentioned in term No 6.1.2 of Standard ISO 612: 1978.

(4)  

(g7)	Term No 6.2 and for vehicles other than those of category M1: point 2.4.2 of Annex I to Directive 97/27/EC.

(h)  The mass of the driver and, if applicable, of the crew member is assessed at 75 kg (subdivided into 68 kg occupant mass and 7 kg luggage mass according to ISO Standard 2416: 1992), the fuel tank is filled to 90 % and the other liquid containing systems (except those for used water) to 100 % of the capacity specified by the manufacturer.

(q)  With respect to trailers, maximum speed permitted by the manufacturer.

(1)   OJ L 202, 6.9.1971, p. 37.

(*1)  Delete where not applicable (there are cases where nothing needs to be deleted when more than one entry is applicable).

(2)  Delete where not applicable.

(3)  If the means of identification of type contains characters not relevant to describe the vehicle, component or separate technical unit types covered by this information, such characters shall be represented in the documentation by the symbol ‘?’ (e.g. ABC??123??).

(4)  As defined in Section A of Annex II to Directive 2007/46/EC.

ANNEX II

Requirements and tests for the type-approval of motor vehicles with regard to AEBS

1.   Requirements

1.1.   General requirements

1.1.1.   Any vehicle covered by the scope of this Regulation shall, with regard to the AEBS fitted, meet the performance requirements set out in points 1.1 to 1.6.2 of this Annex and shall be equipped with an anti-lock braking function in accordance with the performance requirements of Annex 13 of UNECE Regulation No 13 (1).

1.1.2.   The effectiveness of the AEBS shall not be adversely affected by magnetic or electrical fields. This shall be demonstrated by compliance with UNECE Regulation No 10, 03 series of amendments.

1.1.3.   Conformity with the safety aspects of complex electronic control systems shall be demonstrated by meeting the requirements of Annex III.

1.2.   Performance requirements

1.2.1.   The system shall provide the driver with appropriate warnings as described in points 1.2.1.1 to 1.2.1.3:

1.2.1.1.

A collision warning when the AEBS has detected the possibility of a collision with a preceding vehicle of category M, N or O in the same lane which is travelling at a slower speed, has slowed to a halt or is stationary having not being identified as moving. The warning shall be as specified in point 1.5.1.

1.2.1.2.

A failure warning when there is a failure in the AEBS that prevents the requirements of this Annex being met. The warning shall be as specified in point 1.5.4. 1.2.1.2.1. There shall not be an appreciable time interval between each self-check by the AEBS, and subsequently there shall not be an appreciable delay in illuminating the warning signal, in the case of an electrically detectable failure.

1.2.1.3.

A deactivation warning, if the vehicle is equipped with a means to manually deactivate the AEBS, shall be given when the system is deactivated. This shall be as specified in point 1.4.2.

1.2.2.   Subsequent to the warning(s) referred to in point 1.2.1.1, and subject to the provisions of points 1.3.1, 1.3.2 and 1.3.3, there shall be an emergency braking phase having the purpose of significantly decreasing the speed of the subject vehicle. This shall be tested in accordance with points 2.4 and 2.5.

1.2.3.   The AEBS shall be active at least within the vehicle speed range of 15 km/h up to the maximum design speed of the vehicle, and at all vehicle load, unless manually deactivated in accordance with point 1.4.

1.2.4.   The AEBS shall be designed to minimise the generation of collision warning signals and to avoid autonomous braking in situations where the driver would not recognise an impending forward collision. This shall be demonstrated in accordance with point 2.8.

1.3.   Interruption by the driver

1.3.1.   The AEBS may provide the means for the driver to interrupt the collision warning phase. However, when a vehicle braking system is used to provide a haptic warning, the system shall provide the driver with a means to interrupt the warning braking.

1.3.2.   The AEBS shall provide the means for the driver to interrupt the emergency braking phase.

1.3.3.   In the cases referred to in points 1.3.1 and 1.3.2, the interruption may be initiated by any positive action (e.g. kick-down, operating the direction indicator control) that indicates that the driver is aware of the emergency situation. The vehicle manufacturer shall provide a list of these positive actions to the technical service at the time of type-approval and it shall be annexed to the test report referred to in Section II of Part 2 of Annex I.

1.4.   When a vehicle is equipped with a means to deactivate the AEBS function, the following conditions shall apply as appropriate:

1.4.1.

The AEBS function shall be automatically reinstated at the initiation of each new ignition cycle.

1.4.2.

A constant optical warning signal shall inform the driver that the AEBS function has been deactivated. The yellow warning signal specified in point 1.5.4 may be used for this purpose.

1.5.   Warning indication

1.5.1.   The collision warning referred to in point 1.2.1.1 shall be provided by at least two modes selected from acoustic, haptic or optical.

The timing of the warning signals shall be such that they provide the possibility for the driver to react to the risk of collision and take control of the situation, and shall also avoid nuisance for the driver by too early or too frequent warnings. This shall be tested in accordance with points 2.4.2 and 2.5.2.

1.5.2.   A description of the warning indication and the sequence in which the collision warning signals are presented to the driver shall be provided by the vehicle manufacturer at the time of type-approval and recorded in the test report.

1.5.3.   Where an optical means is used as part of the collision warning, the optical signal may be the flashing of the failure warning signal specified in point 1.2.1.2.

1.5.4.   The failure warning referred to in point 1.2.1.2 shall be a constant yellow optical warning signal.

1.5.5.   Each AEBS optical warning signal shall be activated either when the ignition (start) switch is turned to the ‘on’ (run) position or when the ignition (start) switch is in a position between the ‘on’ (run) and ‘start’ that is designated by the manufacturer as a check position (initial system (power-on)). This requirement does not apply to warning signals shown in a common space.

1.5.6.   The optical warning signals shall be visible even by daylight; the satisfactory condition of the signals must be easily verifiable by the driver from the driver’s seat.

1.5.7.   When the driver is provided with an optical warning signal to indicate that the AEBS is temporarily not available, for example due to inclement weather conditions, the signal shall be constant and yellow in colour. The failure warning signal specified in point 1.5.4 may be used for this purpose.

1.6.   Provisions for the periodic technical inspection

1.6.1.   At a periodic technical inspection it shall be possible to confirm the correct operational status of the AEBS by a visible observation of the failure warning signal status, following a ‘power-ON’ and any bulb check.

In the case of the failure warning signal being in a common space, the common space must be observed to be functional prior to the failure warning signal status check.

1.6.2.   At the time of type-approval, the means to protect against simple unauthorised modification of the operation of the failure warning signal chosen by the manufacturer shall be confidentially outlined.

Alternatively, this protection requirement is fulfilled when a secondary means of checking the correct operational status of the AEBS is available.

2.   Test procedures

2.1.   Test conditions

2.1.1.   The test shall be performed on a flat, dry concrete or asphalt surface affording good adhesion.

2.1.2.   The ambient temperature shall be between 0 °C and 45 °C.

2.1.3.   The horizontal visibility range shall allow the target to be observed throughout the test.

2.1.4.   The tests shall be performed when there is no wind liable to affect the results.

2.2.   Vehicle conditions

2.2.1.   Test weight

The vehicle shall be tested in a condition of load to be agreed between the manufacturer and the Technical Service. No alteration shall be made once the test procedure has begun.

2.3.   Test targets

2.3.1.   The target used for the tests shall be a regular high volume series production passenger car of category M1 AA saloon, or alternatively a ‘soft target’ representative of such a vehicle in terms of its identification characteristics applicable to the sensor system of the AEBS under test (2).

2.3.2.   Details that enable the target(s) to be specifically identified and reproduced shall be recorded in the vehicle type-approval documentation, as referred to in point 4.6 of the Addendum to Section II of Part 2 of Annex I.

2.4.   Warning and activation test with a stationary target

2.4.1.   The subject vehicle shall approach the stationary target in a straight line for at least two seconds prior to the functional part of the test with a subject vehicle to target centreline offset of not more than 0,5 m.

The functional part of the test shall start when the subject vehicle is travelling at a speed of 80 ± 2 km/h and is at a distance of at least 120 m from the target.

From the start of the functional part until the point of collision there shall be no adjustment to any control of the subject vehicle by the driver other than slight adjustments to the steering control to counteract any drifting.

2.4.2.   The timing for the collision warning modes referred to in point 1.5.1 shall comply with the following:

2.4.2.1.

At least one haptic or acoustic warning mode shall be provided no later than the values specified in:   For approval level 1: Column B of the table in Appendix 1   For approval level 2: Column B of the table in Appendix 2 These values are to be achieved before the start of the emergency braking phase.

2.4.2.2.

At least two warning modes shall be provided no later than the values specified in:   For approval level 1: Column C of the table in Appendix 1   For approval level 2: Column C of the table in Appendix 2 These values are to be achieved before the start of the emergency braking phase.

2.4.2.3.

Any speed reduction during the warning phase shall not exceed either 15 km/h or 30 % of the total subject vehicle speed reduction, whichever is higher.

2.4.3.   The collision warning phase shall be followed by the emergency braking phase.

2.4.4.   The emergency braking phase shall not start before a TTC equal to or less than 3,0 seconds.

Compliance shall be verified by either actual measurement during the test or using documentation provided by the vehicle manufacturer, as agreed between the Technical Service and the vehicle manufacturer.

2.4.5.   The total speed reduction of the subject vehicle at the time of the impact with the stationary target shall be not less than the value specified in:

For approval level 1: Column D of the table in Appendix 1

For approval level 2: Column D of the table in Appendix 2

2.5.   Warning and activation test with a moving target

2.5.1.   The subject vehicle and the moving target shall travel in a straight line, in the same direction, for at least two seconds prior to the functional part of the test, with a subject vehicle to target centreline offset of not more than 0,5 m.

The functional part of the test shall start with the subject vehicle travelling at a speed of 80 ± 2 km/h, and the moving target at a speed of the value specified in:

For approval level 1: Column H of the table in Appendix 1

For approval level 2: Column H of the table in Appendix 2

The separation distance between the subject vehicle and the moving target shall be at least 120 m.

From the start of the functional part of the test until the subject vehicle comes to a speed equal to that of the target there shall be no adjustment to any subject vehicle control by the driver other than slight steering adjustments to counteract any drifting.

2.5.2.   The timing for the collision warning modes referred to in point 1.5.1 shall comply with the following:

2.5.2.1.

At least one haptic or acoustic warning mode shall be provided no later than the value specified in:   For approval level 1: Column E of the table in Appendix 1   For approval level 2: Column E of the table in Appendix 2 These values are to be achieved before the start of the emergency braking phase.

2.5.2.2.

At least two warning modes shall be provided no later than the value specified in:   For approval level 1: Column F of the table in Appendix 1   For approval level 2: Column F of the table in Appendix 2 These values are to be achieved before the start of the emergency braking phase.

2.5.2.3.

Any speed reduction during the warning phase shall not exceed either 15 km/h or 30 % of the total subject vehicle speed reduction, whichever is higher.

2.5.3.   The collision warning phase shall be followed by the emergency braking phase, which shall result in the subject vehicle not impacting the moving target.

2.5.4.   The emergency braking phase shall not start before a TTC equal to or less than 3,0 seconds.

Compliance shall be verified by either actual measurement during the test or using documentation provided by the vehicle manufacturer, as agreed between the Technical Service and the vehicle manufacturer.

2.6.   Failure detection test

2.6.1.   Simulate an electrical failure, for example by disconnecting the power source to any AEBS component or disconnecting any electrical connection between AEBS components. When simulating an AEBS failure, neither the electrical connections for the driver warning signal referred to in point 1.5.4 nor the optional manual AEBS deactivation control referred to in point 1.4 shall be disconnected.

2.6.2.   The failure warning signal referred to in point 1.5.4 shall be activated and remain activated not later than 10 seconds after the vehicle has been driven at a speed greater than 15 km/h and be reactivated immediately after a subsequent ignition ‘off’ ignition ‘on’ cycle with the vehicle stationary as long as the simulated failure exists.

2.7.   Deactivation test

2.7.1.   For vehicles equipped with means to deactivate the AEBS, turn the ignition (start) switch to the ‘on’ (run) position and deactivate the AEBS. The warning signal referred to in point 1.4.2 shall be activated. Turn the ignition (start) switch to the ‘off’ position. Again, turn the ignition (start) switch to the ‘on’ (run) position and verify that the previously activated warning signal is not reactivated, thereby indicating that the AEBS has been reinstated as specified in point 1.4.1. If the ignition system is activated by means of a ‘key’, that requirement shall be fulfilled without removing the key.

2.8.   False reaction test

2.8.1.   Two stationary vehicles, of category M1 AA saloon, shall be positioned:

(a)	so as to face in the same direction of travel as the subject vehicle;

(b)	with a distance of 4,5 m between them (3);

(c)	with the rear of each vehicle aligned with the other.

2.8.2.   The subject vehicle shall travel for a distance of at least 60 m, at a constant speed of 50 ± 2 km/h to pass centrally between the two stationary vehicles.

During the test there shall be no adjustment of any subject vehicle control other than slight steering adjustments to counteract any drifting.

2.8.3.   The AEBS shall not provide a collision warning and shall not initiate the emergency braking phase.

---

(1)  The Union acceded to that UNECE Regulation by Council Decision 97/836/EC (OJ L 346, 17.12.1997, p. 78).

(2)  The identification characteristics of the soft target shall be agreed upon between the Technical Service and the vehicle manufacturer as being equivalent to a passenger car of category M1 AA saloon.

(3)  The point of reference of each stationary vehicle for establishing the distance between the two stationary vehicles, shall be determined in accordance with ISO 612: 1978.

ANNEX III

Special requirements to be applied to the safety aspects of complex electronic vehicle control systems

1.   General

This Annex defines the special requirements for documentation, fault strategy and verification with respect to the safety aspects of complex electronic vehicle control systems for the purposes of this Regulation.

This Annex may also be applied for safety related functions which are controlled by electronic system(s).

This Annex does not specify the performance criteria for complex electronic vehicles control systems but covers the methodology applied to the design process and the information which must be disclosed to the technical service for type-approval purposes.

That information shall show that a complex electronic vehicle control system respects, under normal and fault conditions, all the appropriate performance requirements set out in this Regulation.

2.   Definitions

For the purposes of this Annex, the following definitions shall apply:

2.1.

‘Safety concept’ means a description of the measures designed into the system, for example within the electronic units, so as to address system integrity and thereby ensure safe operation even in the event of an electrical failure. The possibility of a fall-back to partial operation or even to a back-up system for vital vehicle functions may be a part of the safety concept.

2.2.

‘Electronic control system’ means a combination of units, designed to co-operate in the production of the stated vehicle control function by electronic data processing. Such systems, often controlled by software, are built from discrete functional components such as sensors, electronic control units and actuators and connected by transmission links. They may include mechanical, electro-pneumatic or electro-hydraulic elements.

2.3.	‘Complex electronic vehicle control systems’ mean those electronic control systems which are subject to a hierarchy of control in which a controlled function may be over-ridden by a higher level electronic control system/function.

2.4.

‘Higher-level control systems/functions’ mean those systems/functions which employ additional processing and/or sensing provisions to modify vehicle behaviour by commanding variations in the normal function(s) of the vehicle control system. This allows complex systems to automatically change their objectives with a priority which depends on the sensed circumstances.

2.5.	‘Units’ mean the smallest divisions of system components covered by this Annex: those combinations of components will be treated as single entities for purposes of identification, analysis or replacement.

2.6.	‘Transmission links’ mean the means used for inter-connecting distributed units for the purpose of conveying signals, operating data or an energy supply. This equipment is generally electrical but may, in some part, be mechanical, pneumatic, hydraulic or optical.

2.7.	‘Range of control’ means an output variable corresponding to the range over which the system is likely to exercise control.

2.8.	‘Boundary of functional operation’ means the boundaries of the external physical limits within which the system is able to maintain control.

3.   Documentation

3.1.   Requirements

The manufacturer shall provide a documentation package which gives access to the basic design of the complex electronic vehicle control system for which type-approval is applied (hereinafter referred to as ‘the System’) and the means by which it is linked to other vehicle systems or by which it directly controls output variables.

The function(s) of ‘the System’ and the safety concept, as laid down by the manufacturer, shall be explained.

Documentation shall be brief, yet provide evidence that the design and development has had the benefit of expertise from all the system fields which are involved.

For periodic technical inspections, the documentation shall describe how the current operational status of ‘the System’ can be checked.

3.1.1.   Documentation shall be made available in the following two parts:

(a)

the formal documentation package for the approval, containing the material listed in Section 3 (with the exception of that of point 3.4.4) which shall be supplied to the technical service at the time of submission of the type-approval application. This will be taken as the basic reference for the verification process set out in point 4;

(b)	additional material and analysis data referred to in point 3.4.4, which shall be retained by the manufacturer, but made open for inspection at the time of type-approval.

3.2.   Description of the functions of ‘the System’

A description shall be provided which gives a simple explanation of all the control functions of ‘the System’ and the methods employed to achieve the objectives, including a statement of the mechanism(s) by which control is exercised.

3.2.1.   A list of all input and sensed variables shall be provided and the working range of these defined.

3.2.2.   A list of all output variables which are controlled by ‘the System’ shall be provided and an indication given, in each case, of whether the control is direct or via another vehicle system. The range of control exercised on each such variable shall be defined.

3.2.3.   Limits defining the boundaries of functional operation shall be stated where appropriate to system performance.

3.3.   System layout and schematics

3.3.1.   Inventory of components

A list shall be provided, collating all the units of ‘the System’ and mentioning the other vehicle systems which are needed to achieve the control function in question.

An outline schematic showing those units in combination shall be provided with both the equipment distribution and the interconnections made clear.

3.3.2.   Functions of the units

The function of each unit of ‘the System’ shall be outlined and the signals linking it with other units or with other vehicle systems shall be shown. This may be provided by a labelled block diagram or other schematic, or by a description aided by such a diagram.

3.3.3.   Interconnections

Interconnections within ‘the System’ shall be shown by a circuit diagram for the electric transmission links, by an optical-fibre diagram for optical links, by a piping diagram for pneumatic or hydraulic transmission equipment and by a simplified diagrammatic layout for mechanical linkages.

3.3.4.   Signal flow and priorities

There shall be a clear correspondence between these transmission links and the signals carried between units.

Priorities of signals on multiplexed data paths shall be stated wherever priority may be an issue affecting performance or safety for the purpose of this Regulation.

3.3.5.   Identification of units

Each unit shall be clearly and unambiguously identifiable (e.g. by marking for hardware and marking or software output for software content) to provide corresponding hardware and documentation association.

Where functions are combined within a single unit or within a single computer, but shown in multiple blocks in the block diagram for clarity and ease of explanation, only a single hardware identification marking shall be used.

The manufacturer shall, by the use of this identification, affirm that the equipment supplied conforms to the corresponding document.

3.3.5.1.

The identification defines the hardware and software version and, where the latter changes such as to alter the function of the unit for the purpose of this Regulation, this identification shall also be changed.

3.4.   Safety concept of the manufacturer

3.4.1.   The manufacturer shall provide a statement which affirms that the strategy chosen to achieve ‘the System’ objectives will not, under non-fault conditions, prejudice the safe operation of systems which are subject to the provisions of this Regulation.

3.4.2.   In respect of software used in ‘the System’, the outline architecture shall be explained and the design methods and tools used shall be identified. The manufacturer shall be prepared, if required, to show evidence of the means by which the realisation of the system logic has been determined during the design and development process.

3.4.3.   The manufacturer shall provide the technical authorities with an explanation of the design provisions built into ‘the System’ so as to generate safe operation under fault conditions. Possible design provisions for failure in ‘the System’ are for example:

(a)	fall-back to operation using a partial system;

(b)	change-over to a separate back-up system;

(c)	removal of the high level function.

In case of a failure, the driver shall be warned for example by warning signal or message display. When the system is not deactivated by the driver, e.g. by turning the ignition (run) switch to ‘off’, or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

3.4.3.1.

If the chosen provision selects a partial performance mode of operation under certain fault conditions, then those conditions shall be stated and the resulting limits of effectiveness defined.

3.4.3.2.

If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

3.4.3.3.

If the chosen provision selects the removal of the higher level function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

3.4.4.   The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any one of those specified faults which will have a bearing on vehicle control performance or safety.

This may be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety considerations.

The chosen analytical approach(es) shall be established and maintained by the manufacturer and shall be made open for inspection by the technical service at the time of the type-approval.

3.4.4.1.

This documentation shall itemise the parameters being monitored and shall set out, for each fault condition of the type referred to in point 3.4.4, the warning signal to be given to the driver and/or to service/technical inspection personnel.

4.   Verification and Test

4.1.   The functional operation of ‘the System’, as laid out in the documents required in point 3, shall be tested as follows:

4.1.1.   Verification of the function of ‘the System’

As the means of establishing the normal operational levels, verification of the performance of the vehicle system under non-fault conditions shall be conducted against the manufacturer’s basic benchmark specification unless this is subject to a specified performance test as part of the approval procedure set out in this Regulation.

4.1.2.   Verification of the safety concept referred to in point 3.4

The reaction of ‘the System’ shall, at the discretion of the approval authority, be checked under the influence of a failure in any individual unit by applying corresponding output signals to electrical units or mechanical elements in order to simulate the effects of internal faults within the unit.

The verification results shall correspond with the documented summary of the failure analysis, to a level of overall effect such that the safety concept and execution are confirmed as being adequate.