These challenges are being overcome as the semiconductor industry provides original equipment manufacturers (OEMs) and automotive suppliers with complete functional safety ecosystems that minimize the cost, risk, and development time required to complete this certification process
Understanding ISO 26262:
ISO 26262 covers specifications for the functional safety of electrical and/or electronic systems installed in mass-produced road vehicles (excluding mopeds). Published in 2011 and revised in 2018 to include a section on semiconductors, this ISO standard mandates a development process from specification to production launch. Original equipment manufacturers (OEMs) and automotive suppliers must follow and document this process when certifying devices for use in road vehicles requiring functional safety.
System certification is achieved through confirmation by an independent auditor that the system meets the requirements of ISO 26262. Applications within a vehicle are categorized into various Automotive Safety Integrity Levels (ASILs) based on their safety criticality. Some applications carry a higher inherent safety risk if an electrical or electronic system failure occurs. The levels, from A to D, are based on the severity and likelihood of potential injuries and the degree to which they can be controlled, and there are associated safety requirements for the underlying components. ASIL D represents the highest level of hazard in automotive applications such as airbags, anti-lock brakes, and power steering. Components such as taillights are classified as ASIL-A. Headlights and brake lights are typically classified as ASIL-B. A system such as cruise control is classified as ASIL-C. Generally, the higher the ASIL level, the greater the hardware redundancy requirements.
Component suppliers can help in many ways to expedite the design of a safety application and its ISO 26262 certification. These functional safety resources are shown in Figure 1. First, devices must be carefully selected to encompass the necessary functional safety resources. These resources include Failure Mode, Effects, and Diagnostics (FMEDA) reports and safety manuals. The devices must also have the support of a qualified development ecosystem to create security-critical applications.
Figure 1: Certified functional safety resources and development ecosystem
Preparing for Functional Safety:
A variety of integrated circuits are used in modern automobiles. Microcontrollers (MCUs) are especially prevalent in a wide variety of forms. They are required for all electronic control units (ECUs) and are used throughout the vehicle to add convenience features such as autonomous driving and many other sophisticated functions. They range from 8-bit MCUs optimized for performance, energy efficiency, and real-time control, with added hardware-based touch interfaces, to 32-bit MCUs that can run multithreaded applications and have graphics, connectivity, and safety features. In addition, there are digital signal controllers (DSCs) that combine an MCU with a DSP engine to deliver deterministic, robust, and fast performance for sensors, motors, or power conversion. Each of these integrated circuits must first meet the automotive qualification standards for manufacturing and performance established by the Automotive Electronics Council (AEC). The AEC-Q100 standards define a qualification process based on resistance testing to failure mechanisms at various temperature ranges. Depending on the application, a MCU must meet the requirements of AEC Q100 Grade 2, Grade 1, or Grade 0. Grade 0 = 150°C, Grade 1 = 125°C, and Grade 2 = 105°C.
Beyond AEC qualification, additional requirements for specific functional safety features depend on the device and application. For example, 8-bit MCUs often include CAN bus for automotive interfacing and smart sensor networks and are commonly used as user interface (UI) controllers for mechanical and capacitive buttons in the passenger compartment, on the steering wheel, the center console, or as part of a keyless entry system. The embedded hardware safety features required by these MCUs typically relate to memory, system reset, secure code execution, secure communication, and protection of general-purpose inputs and outputs (GPIOs). These are added by integrating dedicated kernel-independent peripherals (CIPs) and other functions, such as power-on reset (POR), partial power-off reset (BOR), windowed watchdog timer (WWDT), and cyclic redundancy check (CRC) to improve operational safety and reliability (see Figure 2).
Figure 2: 8-bit MCU with functional safety hardware features.
Moving up the scale to 16-bit functionally safe DSCs, the necessary hardware safety features typically include memory with error detection and correction, memory-integrated self-diagnostics (MBIST), redundant clock and oscillator control, and other features for fault detection, self-diagnostic and system diagnostic capabilities, and fault mitigation. These functionally safe devices enable the design of high-performance, safety-critical embedded applications, sensor interconnects, digital power supplies, and motor control. Typical applications include DC/DC systems, on-board chargers (OBCs), actuators and sensors (position, pressure), touch units, and other control units that meet up to ASIL B or ASIL C standards. Figure 3 shows an example of the features of a functionally safe DSC.
Figure 3: Example of a 16-bit DSC with functional safety.
Like all functionally safe MCUs, 32-bit MCUs require hardware features including error-correcting code (ECC) memory and fault injection, memory-integrated self-test (MBIST), timer systems including backup oscillators and clock fault detection, and GPIO pins with electrostatic discharge (ESD) protection (see Figure 4). System monitors are also important, including hardware POR, BOR, WDT, and CRC functionality, as well as a memory protection unit. 32-bit MCUs are used in a wide range of applications, from passenger compartment systems to advanced driver assistance systems (ADAS), for functional safety.
Figure 4: Example of a 32-bit MCU prepared for functional safety.
It is possible to achieve even ASIL C/D safety levels with standard MCUs and DSCs by combining the main MCU or DSC with a secondary or safety coprocessor. This is achieved using the ASIL decomposition principle: the combination of two ASIL B compliant subsystems can be used to achieve a higher ASIL such as ASIL C/D:
ASIL C = ASIL B (C) + ASIL A (C)
ASIL D = ASIL B (D) + ASIL B (D) = ASIL C (D) + ASIL A (D)
The breakdown is achieved by segmenting the security requirements against the actual devices.
Development Tools and Certification Support:
Design tool packages certified for functional safety as part of a comprehensive development ecosystem can facilitate compliance with the verification and validation requirements specified in ISO 26262. This is especially true for MCU- and DSC-based designs. Tool vendors work with independent assessment and certification agencies to certify functional safety compilers. This is typically accompanied by additional documentation, such as a certificate, a functional safety manual, a safety plan, and tool classification and qualification reports for compilers, the integrated development environment (IDE), and debuggers and programmers. This functional safety documentation package simplifies tool qualification and final application certification.
Ideally, a code coverage tool should also be used in the design process to measure how well the code has been tested and determine which parts of the software have been executed. The code coverage tool should also be included in the classification and qualification reports. Look for a tool that can test in a single pass without breaking the code into blocks and requiring extensive hardware modifications, expensive software, and significant effort searching for relevant information in large data files. Application certification requires code test data, so single-pass code coverage tools play a vital role in streamlining the process and accelerating time to market.
To develop an automotive application that meets ISO 26262, an engineer will need several additional resources from the semiconductor supplier, beyond just the device datasheet. The availability of functional safety packages provides OEMs and automotive suppliers with what they need at various stages of the evaluation and design cycle. These packages should include certified safety manuals, FMEDA reports, and, in some cases, diagnostic software such as certified self-test libraries for the relevant ASILs.
The FMEDA report quantifies the device's failure modes, its failure rate distribution over time (FIT), and the corresponding detection methods to help create a coverage plan. Another important resource is the Safety Manual (SM). It provides detailed information on the failure detection methods mentioned in the FMEDA report and offers recommendations on how the device should be used for safer operation. It includes a description of dependent failures and hardware features for detecting systematic failures, which can be used to develop diagnostic libraries. Functional safety diagnostic libraries can help assess the operational status of a system under fault conditions, detect random system failures, and achieve functional safety objectives. Selecting a device that offers a third-party certified FMEDA report and Safety Manual, along with diagnostic libraries, simplifies the certification efforts for a safety-critical application.
Developing a safety-critical application begins by defining the safety objectives and the desired level of safety. A basic functional safety package provides essential resources such as FMEDA, a safety manual, and certification to begin assessing target functional safety levels and designing a safety-critical automotive application.
A basic functional safety package for an MCU-based design would ideally include an ASIL B Ready certified FMEDA, a safety manual, and ASIL B/C compliant diagnostic libraries, combined with a reference application to help designers understand how these resources can be used to develop a safety-critical application following the ISO 26262 process. A starter package helps accelerate the design cycle and develop an ASIL B or C compliant application.
A comprehensive functional safety package can expand the offering to include certified diagnostic libraries containing source code and safety analysis reports relevant to designs up to ASIL B/C. Since many end customers require certification of a safety-critical application, the comprehensive package accelerates the certification process.
Automobiles are becoming increasingly sophisticated, and their level of electronics is constantly growing. It is increasingly important that today's functionally safe products for automotive applications support development ecosystems that offer certified functional safety resources to meet the requirements of ISO 26262. Integrated circuit suppliers can also help automotive customers protect their long-term investment in this rigorous development and certification process. They can guarantee that parts used in a certified system will continue to be supplied as long as the customer wishes to order them, eliminating the risk of a forced redesign due to a part unexpectedly reaching its end of life (EOL). This increases confidence that certification will not only be completed quickly and easily, but also only need to be done once.
AUTHOR: By Jacob Lunn Lassen, Technical Engineer, Functional Safety with Microchip Technology
Microchip Technology Incorporated
