Functional safety
Functional safety
Functional safety for the ASG in-vehicle control architecture: the EMC, environmental and ISO 26262 ASIL-D verification completed at bench level on the blocks and control units, and the vehicle-programme steps that follow.
Status as of September 2026.
In one sentence ASG’s blocks and control units have passed bench-level EMC and environmental testing and ISO 26262 ASIL-D verification; the vehicle-level safety case is built on that, inside each programme.
Where it stands today
ASG is a real-time in-vehicle control architecture: one synchronous ring for power and data, universal zone blocks, and a shared vehicle-state window committed every millisecond. Functional safety for that architecture is being built the way it is for any new E/E technology - from the component outward.
The component and protocol work is done: electromagnetic compatibility, noise immunity, thermal and environmental endurance, and ISO 26262 verification against ASIL-D requirements, all at bench level, plus domain integration on two OEM platforms. What remains is the work that can only be done in a vehicle, by the programme that builds it.
- Complete
Component and protocol bench verification
EMC and EMI, noise immunity, thermal and environmental endurance, hardware- and software-in-the-loop, fault injection and stress benching - on the ASG blocks and control units.
- Complete
Domain integration on two OEM platforms
ASG integrated into a vehicle domain at two manufacturers - one commercial-vehicle, one passenger-car - and run alongside the existing electronics without EMC disturbance in either direction.
- Within the vehicle programme
Vehicle-level validation and sign-off
In-vehicle integration testing against the programme’s own hazard analysis and safety goals - the step the bench work leads up to, not a repeat of it.
- Where the programme requires it
Independent functional-safety assessment
A production programme targeting ASIL D will normally call for an independent assessment of the safety case. That is arranged within the programme, on the integrated vehicle.
ASG is a control architecture offered for integration into a vehicle programme - not a certified, off-the-shelf part that can be procured and installed. Everything on this page describes what has been verified, and where the responsibility for the rest sits.
How the architecture carries safety
These properties do not make ASG safe on their own - a safety case is always made against a specific vehicle. They do remove several of the failure modes that make one hard to build on an asynchronous bus.
-
One writer per signal
Every signal is written by exactly one function. Two features cannot fight over an output, so there is no arbitration to get wrong.
-
One state, every millisecond
The whole vehicle state is committed together on a 1 ms grid. A function reads one coherent snapshot, not messages that arrived at different times.
-
Timing fixed by design
The 1 ms window does not change with the number of blocks. Adding a function does not consume frame time or move another function’s deadline.
-
Local reaction built in
Each block reacts to an overcurrent within about 10 µs - an electronic fuse in the block itself, so a short is contained without a central relay box.
The mechanism behind each of these is set out in the technology section.
Electromagnetic robustness
EMC and EMI
Electromagnetic compatibility has been tested on the bench and in domain integration on two production vehicle platforms - one commercial-vehicle manufacturer, one passenger-car manufacturer. In both, the result was the same in both directions that matter:
- ASG was not influenced by external electromagnetic induction - it kept running through the fields present in a working vehicle.
- ASG did not induce electromagnetic interference into neighbouring components - it shared the vehicle volume, and the ring carried power alongside data, without disturbing the electronics around it.
Noise immunity
Beyond conducted and radiated EMC, the protocol and its physical layer carry a noise and transient margin that is much higher than CAN or LIN, and comfortably inside what automotive environments demand. The single synchronous ring is the reason: there is no bus arbitration to corrupt, and no per-message timing that can slip under interference.
Thermal and environmental
ASG’s synchronous protocol structure derives from one proven under the thermal-cycling, vacuum and pressure extremes of spaceflight - an environment well beyond anything a road vehicle sees. That heritage is in the structure of the protocol, not a claim that the automotive product is space-qualified.
On the automotive side, the blocks and control units have been through thermal and stress benching: changing temperature and load held near the limits of the operating envelope while behaviour is monitored. Full automotive thermal qualification for a given platform - temperature grade, cycle count, mission profile - is carried out within that platform’s programme.
ISO 26262 verification
The ASG blocks and control units are developed to ISO 26262. Their safety mechanisms and edge-case behaviour have been verified at bench level against the requirements for ASIL D, the highest of the standard’s integrity levels. ISO 26262 allows this class of verification to be carried out in-house, and that is the stage ASG is at.
- Hardware-in-the-loop
- The real ASG block and control-unit hardware driven against a simulated vehicle, exercising I/O, timing and fault response under realistic load.
- Software-in-the-loop
- The control software run against a model of the system, checking logic and safety-mechanism behaviour ahead of hardware.
- Fault injection
- Faults introduced deliberately - corrupted inputs, lost frames, stuck outputs, power disturbance - to confirm each safety mechanism detects and reacts as specified, including at the edges.
- Environmental and stress benching
- Temperature, load and electrical disturbance held near the limits of the operating envelope while the safety behaviour is monitored.
Applied to the ASG blocks and control units. Described by method only; no standard references or test levels are published here.
The bench tests proved the safety mechanisms and the edge cases: each mechanism detects the fault it is meant to and moves the system to a safe state within its time budget.
This work covers the ASG components. It does not cover, and is not meant to cover, the item-level ISO 26262 activities that are specific to each vehicle - the hazard analysis, the safety goals, the ASIL assignment - or the in-vehicle validation that confirms them. Those sit with the vehicle programme, and where that programme requires an independent functional-safety assessment, it is arranged there, on the integrated vehicle.
What ASG is, and isn’t, today
It is
- A control architecture - the protocol, the universal blocks and the real-time vehicle-state model - offered for integration into a vehicle programme.
- Backed by the bench-level EMC, environmental and ISO 26262 ASIL-D verification described above, on the components and the protocol, plus domain integration at two OEMs.
- Available to evaluate now - in the browser simulator, and on the bench with your own platform.
It is not
- A certified, off-the-shelf part with a catalogue number to procure and fit.
- A finished vehicle-level safety case - that is made against a specific vehicle, by the programme that builds it.
- A replacement for the OEM’s own ISO 26262 item development, integration and validation.
Common questions
Is ASG ISO 26262 certified, or ASIL-D certified?
Under ISO 26262, an integrity level such as ASIL D is assigned to a safety goal for a specific item in a specific vehicle, not to a generic component or protocol. ASG’s blocks and control units are developed to ISO 26262, and their safety mechanisms and edge cases have been verified at bench level against ASIL-D requirements. The item-level work - hazard analysis, safety goals, ASIL assignment - and any independent assessment sit within the vehicle programme.
Has ASG been tested for electromagnetic compatibility?
Yes. EMC has been tested on the bench and in domain integration on two production vehicle platforms - one commercial-vehicle manufacturer and one passenger-car manufacturer. In both, ASG was not disturbed by external electromagnetic fields and did not induce interference into neighbouring vehicle systems.
How does ASG’s noise immunity compare with CAN and LIN?
Its margin to automotive noise and transient conditions is substantially greater than CAN or LIN, and comfortably inside what automotive environments require. The single synchronous ring has no bus arbitration to corrupt and no per-message timing to slip.
Does the bench and integration testing mean ASG is ready to fit to a production vehicle?
Bench and domain-integration testing verify the ASG components and the protocol. Vehicle-level validation, and the OEM’s own item-level ISO 26262 work for that vehicle, are the steps that follow. ASG is a control architecture offered for integration, not a catalogue part to procure and install.
Can we evaluate ASG before committing to a programme?
Yes. The browser simulator lets you build a vehicle from components and watch the architecture behave. From there, talk to us about a bench or integration evaluation on your own platform.