  With the advent of ISO 26262 there is an increased emphasis on top-down
design in the automotive industry. ISO 26262 lacks detailed requirements for
its various constituent phases. The lack of guidance becomes evident for the
reuse of legacy components and subsystems, leaving vehicle architects and
safety engineers to rely on experience without methodological support for their
decisions. This poses challenges in the industry which is undergoing many
significant changes due to new features like connectivity, electrification and
automation. Here we focus on automated driving where multiple subsystems, both
new and legacy, need to coordinate to realize a safety-critical function. This
paper introduces a method to support consistent design of an ISO 26262 work
product, the Functional Safety Concept (FSC). The method addresses a need
within the industry for architectural analysis, rationale management and reuse
of legacy subsystems. The method makes use of an existing work product, the
diagnostic specifications of a subsystem, to assist in performing a systematic
assessment of the influence a human driver, in the design of the subsystem. The
output of the method is a report with an abstraction level suitable for a
vehicle architect, used as a basis for decisions related to the FSC such as
generating a Preliminary Architecture (PA) and building up argumentation for
verification of the FSC. The proposed method is tested in a safety-critical
braking subsystem at one of the largest heavy vehicle manufacturers in Sweden,
Scania C.V. AB. The results demonstrate the benefits of the method including
(i) reuse of pre-existing work products, (ii) gathering requirements for
automated driving functions while designing the PA and FSC, (iii) the
parallelization of work across the organization on the basis of expertise, and
(iv) the applicability of the method across all types of subsystems.
