Division 3.4.3

The manufacturer shall provide the technical authorities with an explanation of the design provisions built into ‘the System’ so as to generate safe operation under fault conditions. Possible design provisions for failure in ‘the System’ are for example:

1. (a)

   fall-back to operation using a partial system;

2. (b)

   change-over to a separate back-up system;

3. (c)

   removal of the high level function.

In case of a failure, the driver shall be warned for example by warning signal or message display. When the system is not deactivated by the driver, e.g. by turning the ignition (run) switch to ‘off’, or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.