There are some subtle but notable differences in the definition of safety culture from ISO 26262:2011 as compared to ISO 26262:2018(FDIS). ISO 26262:2011 includes 8 sub-clauses for the definition of safety culture, and ISO 26262:2018 includes 7 sub-clauses. In ISO 26262:2018, 3 sub-clauses are essentially the same as ISO 26262:2011. This blog will only focus on some details related to the 4 sub-clauses that changed significantly, so let’s get started.
- Sub-clause 5.4.2.2 reads as follows in ISO 26262:2018 – “The organization shall institute, execute and maintain organization-specific rules and processes to achieve and maintain functional safety and to comply with the requirements of the ISO 26262 series of standards.”
- The key phrase added in the FDIS version is to ‘achieve and maintain functional safety’. The word achievement implies that ‘effort’ and ‘organizational courage’ are required to comply with the standard. Functional safety is not a destination but a continuous journey, and this rewording helps to support this point.
- In ISO 26262:2011, sub-clauses 5.4.2.3 and 5.4.2.4 provide requirements for a safety anomaly resolution process. In ISO 26262:2018 these requirements were removed from the safety culture section and a dedicated section was created. Sub-clause 5.4.3 defines multiple requirements for the proper management of safety anomalies in ISO 26262:2018.
- Sub-clause 5.4.2.3 reads as follows in ISO 26262:2018 – “The organization shall institute and maintain effective communication channels between functional safety, cyber security and other disciplines that are related to the achievement of functional safety.”
- This sub-clause is a welcomed addition to the safety culture definition. The clear implication is that all organizations striving to adopt ISO 26262 must have established systems engineering processes such as Incose or ISO 15288. While diagnosing automotive organizations’ issues with adopting ISO 26262, it is common to find that having a weak or unsupported system’s engineering process is one of the more common symptoms. It is critical that organizations have a solid foundation in formal systems engineering to ensure their functional safety activities are properly supported. Additionally, the development process should account for cyber security standards like SAE J3061 and also upcoming standards like ISO 21434 which will have some similar concepts as ISO 26262.
- The last sub-clause to be highlighted in ISO 26262:2018 is 5.4.2.7 which reads as follows – “The organization shall ensure that the persons ‘responsible for achieving or maintaining functional safety, or for’ performing or supporting the safety activities are given sufficient authority to fulfil their responsibilities”. The text in green was added, the rest of the text is exactly the same as ISO 26262:2011. The additions continue to accentuate that functional safety is a process and not a destination, so organizations must continue to strive to achieve functional safety as technology continues to evolve. The point being that the functional safety solution for your product now may be slightly different in 2+ years’ time. Lastly, this is the only clause in the definition of safety culture that includes the word ‘responsible’, this word wasn’t in ISO 26262:2011. Although this is a single word, its inclusion is critical to start to establish responsibility within organizations at all levels.
To close, many aspects of the safety culture definition between both versions of ISO 26262 are very similar. However, some very targeted improvements have been made to mature the key elements of safety culture.
