FMEAYou Bought an ASIL-B Storage Device. Is Your Safety Analysis Done?-compute SSD example through HARA, FTA, FMEA and TARA

On a dark blue SSD board, three floating blue blocks connect by dotted lines to one glowing red controller chip. Memory chips line the right side, and a separate store marked with a shield sits in front of the board.

VisualPro Tech Brief

You Bought an ASIL-B Storage Device. Is Your Safety Analysis Done?

What a component certificate hands over and what it leaves behind: a central-compute SSD example through HARA, FTA, FMEA and TARA

Category: VWAY Technical Article
Published: Nov 6, 2026
Read time: About 8 min

ISO 26262SEooCASIL decompositionCommon causeFTATARAAutomotive storage

01Summary

Automotive storage products now advertise functional safety and cybersecurity certifications. Choosing a certified part is a good start, but it does not finish the analysis on the vehicle side. A component certificate holds within the assumptions the supplier made, and the integrator has to check that the vehicle keeps to them. We analyzed a fictional educational SSD in VisualPro. On paper, the design split ASIL C into ASIL B and ASIL A, yet two controller failures turned out to be single points of failure, because the map data and its verification reference sat behind the same controller. Moving the reference to a separate store removed the first-order cut sets from the FTA. FMEA traced power, write volume and temperature back to integration design, and in TARA, AES-256 stopped only one threat out of three.

02What the Article Tells Us and What It Doesn't

In a November 5 article, the German electronics publication all-electronics argued that zonal architecture, OTA and V2X in SDVs are turning storage into a part where safety and security overlap. Its example, a Silicon Motion automotive SSD controller, is described as certified to AEC-Q100, ISO 26262 ASIL-B and ASPICE CL3.

Keep three things in mind. The article states that it is based on material from that company. The wording we found in the 2023 product announcement goes as far as "ASPICE compliance", and we have not seen the original certificates. The article gives no failure rates or specific safety mechanisms, and it describes ISO 21434 as conformity, not certification.

One term in the article is still useful: SEooC (Safety Element out of Context), a safety element developed without a specific vehicle in mind.

03What a Component Certificate Hands Over and What It Leaves

A supplier builds an SEooC part around assumed conditions of use. Those assumptions are written in the safety manual and passed to the integrator. If they do not hold in your vehicle, you cannot reuse the part's safety argument as it stands.

What the certificate shows	The question left for the vehicle side
The supplier's development process and safety mechanisms were assessed against a target level	What is the ASIL of the safety goals that depend on this part?
Operation is supported under defined temperature, power and usage conditions	Do our mounting location, power supply and write volume stay within them?
The part can diagnose its internal failures	Does the vehicle receive that result and respond safely?
Stored data is encrypted	Who manages the keys, and who stops tampering through legitimate paths?

Let's follow these questions through a fictional example.

04Example: A Central-Compute SSD Sharing One Controller

This configuration was made for education. One SSD in the central computer is shared by driving assist, infotainment and OTA virtual machines. We assume the controller is certified to ASIL-B. Driving assist reads map data from the SSD, and host software checks integrity with a checksum.

All ratings, scores and failure rates below are assumptions made for illustration. They are not values from a real product.

HARA: The Part's Level Is Not the Safety Goal's Level

VisualPro HARA hazard analysis screen. HA-1 is outdated or wrong map data leading to lane departure, rated S3, C2, ASIL C. HA-2 is map data not provided so driving assist disengages, rated S2, C2, ASIL B. — Figure 1. VisualPro HARA hazard analysis screen: wrong map data is calculated as ASIL C and missing data as ASIL B (empty columns removed; screen text translated)

Malfunction	Hazardous event	S	E	C	ASIL
Provides outdated or wrong map data as if it were valid	Driving assist on a highway leaves the lane because of an old map	S3	E4	C2	C
Does not provide map data when needed	Driving assist on a highway switches off without warning	S2	E4	C2	B

The first safety goal is ASIL C, and the controller is ASIL-B. So the design team chooses ASIL decomposition: ASIL B(C) for the SSD side and ASIL A(C) for the host integrity check. In the table, the levels add up. But ASIL decomposition comes with a condition: the decomposed elements must be sufficiently independent.

FTA: Two "Independent" Elements Were Tied to One Controller

Suppose the checksum used for the integrity check is stored on the same SSD as the map data. If a NAND error corrupts only the data, the checksum catches it. But if the controller returns a previous version of a block, the data and the checksum come back old together. They match each other, so the check passes. A healthy check program makes no difference.

VisualPro FTA screen. Under the top OR gate are an AND gate combining a NAND data error with an integrity check software failure, and an OR gate combining a controller firmware error with a mapping table error. The minimal cut set table below lists EVT3 and EVT4 each on their own. — Figure 2. VisualPro FTA T0 screen and minimal cut sets: controller events EVT3 and EVT4 each cause the top event alone; the red outline marks the selected cut set (screen text translated)

The T0 structure has three cut sets.

Cut set	Order	Meaning
Controller firmware returns a previous block version	First	This one failure causes the top event
Controller internal mapping table error	First	This one failure causes the top event
NAND data error + host integrity check failure	Second	The dual structure the designer intended

The ASIL decomposition table shows only the second-order case. The two first-order cases appear only once you draw the FTA.

The Fix: Move the Reference Outside the Controller

Keep a signed reference value and a version number in a separate secure store. Now, if the controller returns an old block, it no longer matches the value in the separate store and gets rejected.

VisualPro FTA screen. Under the top OR gate are two AND gates. The second combines an OR gate of controller errors with a failure of the comparison against the separate secure store. The minimal cut set table below lists three second-order cut sets: EVT5 with EVT6, EVT8 with EVT7, and EVT9 with EVT7. — Figure 3. VisualPro FTA T1 screen and minimal cut sets: with the reference separated, every cut set is second order; the red outline marks the selected cut set (screen text translated)

Structure	First-order cut sets	Second-order cut sets
T0 Reference on the same SSD	2	1
T1 Reference in a separate store	0	3

The part stays the same. Only the vehicle-side structure changed. Because the failure rates are assumptions, this article compares cut set structure, not calculated values.

FMEA: What Breaks the Supplier's Assumptions Sits on the Vehicle Side

VisualPro DFMEA risk analysis screen. Three failure causes, namely mounting temperature exceeded, insufficient hold-up time during OTA writes and log volume exceeded, have current controls, occurrence and detection entered. All have design FMEA action priority H. — Figure 4. VisualPro DFMEA risk analysis screen: all three failure causes are calculated as AP H (empty columns removed; screen text translated)

Failure cause	Failure mode	Failure effect	S	O	D	AP
Mounting temperature exceeds the supplier's assumed range	Data retention drops and uncorrectable errors increase	Driving assist uses wrong map data	9	4	6	H
Hold-up time is too short when power is lost during an OTA write	Metadata corruption makes the stored image unreadable	Some vehicle functions do not start after an update	7	5	7	H
Log volume exceeds the supplier's assumption	Write endurance runs out and the drive turns read-only	Some vehicle functions do not start after an update	7	6	6	H

A component certificate cannot answer any of these three causes. Checking the part's temperature grade tells you nothing until you measure the actual mounting location, and as OTA adds features after SOP, write volume drifts from the original calculation. That is why test plans need to move from the bare part to in-vehicle conditions.

TARA: What AES-256 Stops and What It Doesn't

VisualPro TARA risk calculation and treatment decision screen. TH-2, map data tampering, is Medium, Severe, risk level 4, Reducing. TH-1, reading NAND directly, is Very Low, Major, risk level 1, Retaining. TH-3, shared key extraction, is Low, Major, risk level 2, Reducing. — Figure 5. VisualPro TARA risk calculation and treatment decision screen: the highest-risk threat is TH-2, which encryption does not stop (screen text translated)

Threat	Attack potential total	Feasibility	Impact	Risk level	Decision
Remove the SSD and read NAND directly	42	Very Low	Major	1	Retaining
A compromised infotainment VM tampers with map data over the shared path	18	Medium	Severe	4	Reducing
Extract a shared key from one vehicle and decrypt data across the model	22	Low	Major	2	Reducing

Encryption of stored data directly stops the first threat. The second requests a write with legitimate rights, so it gets through regardless of encryption. The third is about key management, not cipher strength. So the countermeasure for the highest-risk threat becomes "separate storage areas per virtual machine and verify signatures before use". That signature check leads to the same design as the reference separation found in the FTA. Here, safety analysis and security analysis point to the same countermeasure.

05Five Things to Check When You Receive a Component Certificate

What to check	Where to look	What the example showed
The product, firmware version and scope on the original certificate, and whether it is a certification or a conformity claim	Certificate, supplier documents	Sources mix "certified" and "compliant"
The ASIL of safety goals that depend on the part	HARA	Part ASIL-B, safety goal ASIL C
Resources shared by decomposed elements	FTA common causes	Two first-order cut sets from one controller
Gaps between the safety manual's assumptions and your design	FMEA failure causes	Temperature, hold-up time, write volume
Scope of encryption, key management, access control on shared paths	TARA	Encryption stops one threat out of three

06How to Do This in VisualPro, and the Limits

VisualPro keeps HARA, FTA, DFMEA and TARA in one project. We entered this example as four modules in one project, and the tool calculated ASIL, AP, risk levels and cut sets.

VisualPro does not replace everything. Real failure rates have to come from supplier data and testing. Judging whether a certificate is valid, or whether the independence behind an ASIL decomposition is sufficient, belongs to engineers and assessors. This example does not cover part-level FMEDA.

07Frequently Asked Questions

Q1Can an ASIL-B certified part be used in an ASIL C or D function?

In some cases, yes. ASIL decomposition is the typical route. The decomposed elements must be sufficiently independent, though. Shared resources can create a single point of failure in the FTA, as in this example, so check for them first.

Q2What do we still have to do with an SEooC certified part?

Compare the safety manual's assumptions with your vehicle's conditions one by one. If an assumption does not hold, change the design or work it out with the supplier. Connecting the part's diagnostic results to a safe vehicle response is also the integrator's job.

Q3Does AES-256 encryption on the storage device lower risk in TARA?

It helps against threats that remove the storage medium and read it. Tampering through legitimate paths and shared key leaks must be assessed separately. Splitting attack paths by threat shows how far encryption actually reaches.

A certified part reduces your work, but it does not remove it. The day you receive the certificate is the day you start checking your vehicle's assumptions.

References

· all-electronics, "Speicher wird zum Sicherheitsfaktor" (2026-11-05) — Read article

· Silicon Motion, August 2023 product announcement — View source

· Intertek, "Exploring Safety Elements out of Context" (2026-01-15) — View source

· Renesas, applying ISO 26262 to SEooC software — View source

· ISO 26262 Road vehicles — Functional safety — ISO page

Want to check a part's assumptions in one project?

We can show you how to look at one key component through HARA, FTA, FMEA and TARA together.

VWAY Co., Ltd. | sales@vwaycorp.com

Website | VisualPro FTA | VisualPro TARA | VisualPro Lite

Back to list

Newsroom

Technical Resources