Today's automobiles use hundreds, if not thousands, of semiconductors and various components for a variety of applications, including touch interfaces and battery management systems.

ISO (International Organization for Standardization) 26262 plays a role in strictly ensuring that increasingly complex and sophisticated applications operate safely.

However, the process of developing a design that complies with international functional safety standards and obtaining certification takes considerable time and money.

To address this issue, the semiconductor industry is providing automotive OEMs and component suppliers with a complete functional safety ecosystem that can minimize the cost, risk, and development time required to complete these certification processes, thereby easing the complexity of the process.

■ Understanding ISO 26262

Established in 2011, ISO 26262 is an international standard for the functional safety of electrical, electronic, electrical or electronic systems installed in road-going production vehicles (excluding scooters).

The 2018 revision added a section on semiconductors, which must be followed throughout the entire development process, from specification to production release.
/> Automotive OEMs and component suppliers must follow this process and document it when validating devices that operate inside road vehicles that require functional safety.

System certification is achieved through confirmation by an independent auditor that the system complies with the requirements of ISO 26262.

Applications within a car are 'classified' into different Automotive Safety Integrity Levels (ASIL) depending on their level of safety criticality.

This is because the inherent security risks are higher in each application if the system malfunctions.

So, from Grade A to D, there are safety requirements for basic components based on the severity and likelihood of potential injury and the extent to which it can be controlled.

The highest risk factor ratings for applications such as airbags, anti-lock brakes and power steering are classified as Automotive Safety Integrity Level D, while components such as tail lights are classified as Automotive Safety Integrity Level A.

Headlights and brake lights are generally classified as automotive safety integrity level B.

Systems such as cruise control are classified as C. In general, the higher the ASIL level, the greater the requirements for hardware redundancy.

Component suppliers can accelerate the design of safety-related applications and ISO 26262 certification of those applications in a number of ways.

These functional stability resources are summarized in Table 1.

First, devices must be carefully selected to include necessary functional reliability resources, such as Failure Mode Effect and Diagnostics Analysis (FMEDA) reports and safety manuals.

Additionally, devices must be supported by a development ecosystem that is qualified to create safety-critical applications.

■ Fully prepared for functional safety

Today, various integrated circuits (ICs) are used in automobiles, and in particular, microcontrollers (MCUs) are widely used in various forms.

It is used in all electronic control units (ECUs) and in all aspects of vehicles for autonomous driving and other advanced convenience functions.

Microcontrollers (MCUs) range from 8-bit MCUs that add hardware-based touch interfaces and are optimized for performance, power efficiency, and real-time control, to 32-bit MCUs that can run multithreaded applications and feature graphics, connectivity, and security features. />
In addition, there are digital signal controllers (DSCs) that combine MCU and DSP cores to provide fast, powerful, deterministic performance for sensors, motors, or power conversion.

All of these integrated circuits must meet manufacturing and performance qualification standards established by the Automotive Electronics Council (AEC).

The AEC-Q100 standard specifies a failure mechanism-based stress test qualification process for all temperature grades.

Depending on the application, the MCU must meet AEC-Q100 Grade 2, Grade 1, or Grade 0. Grade 0 is 150 degrees Celsius, Grade 1 is 125 degrees Celsius, and Grade 2 is 105 degrees Celsius.

In addition to AEC certification, additional requirements for functional safety certification vary depending on the device and application.

For example, 8-bit MCUs often include CAN FD for vehicle interfaces and smart sensor networks, and are typically used as mechanical or capacitive button UI controllers for interior spaces, steering wheels, center consoles, or as part of keyless entry systems.

Integrated hardware safety features required in these MCUs typically apply to memory, system reset, safe code execution, safe communication, and general-purpose input/output (GPIO) protection.

These features are added by integrating core-independent peripherals with power-on reset (POR), brown-out reset (BOR), windowed watchdog timer (WWDT), cyclic redundancy check (CRC), and other functions to improve operational safety and reliability (see Table 2).

Moving up a level, we have a 16-bit DSC with functional safety, which includes error detection and correction memory, built-in memory self-test (MBIST), clock monitoring, and redundant oscillators, providing fault detection, self-diagnosis, and system diagnostic capabilities. Hardware safety features such as fault mitigation are required.

Devices with these functional safety features enable the design of safety-critical, high-performance embedded, sensor interfacing, digital power, and motor control applications.

Typical applications include DC/DC systems, on-board chargers (OBC), actuators and sensors (position, pressure), touch and other control devices targeting ASIL B or ASIL C compliance.

Table 3 shows how a DSC with functional safety functions.

Like all functionally safe MCUs, 32-bit MCUs require hardware features such as memory with error correction code (ECC) capability, a clock system with memory-built-in self-test (MBIST), backup oscillator and clock-fail detection, and electrostatic discharge (ESD) protection for general-purpose input/output (I/O) protection (see Table 4). In addition, system monitors and memory protection devices such as POR, BOR, WDT, and hardware CRC functions are also important parts, and 32-bit MCUs are used in various applications, from systems in indoor spaces to advanced driver-assistance systems (ADAS) for functional safety.

Standard MCUs and DSCs can be upgraded to ASIL C/D level by combining one more auxiliary MCU or DSC or by combining a safety coprocessor.

This can be achieved by utilizing the ASIL decomposition principle, which states that combining two subsystems that comply with ASIL B level can lead to ASIL C/D level.

ASIL C = ASIL B (C) + ASIL A (C)
ASIL D = ASIL B (D) + ASIL B (D) = ASIL C (D) + ASIL A (D)

Decomposition is done by separating the actual device from the safety requirements.

■ Development tools and authentication support

Leveraging a functional safety-certified design tool package as part of your overall development ecosystem can help you more easily meet the verification and validation requirements specified in ISO 26262.

This is especially useful in MCU and DSC based designs.

Tool vendors work with third-party independent assessment and certification bodies to certify their functional safety compilers. Authenticate.

Additional materials are also provided at this time, including certificates, functional safety manuals, safety plans for compilers and tool classification certification reports, integrated development environments (IDEs), debuggers, and programmers.

This functional safety documentation package can simplify the certification of the tool and the certification of the end application.

Ideally, a code coverage tool should be used during the design process to measure whether the code has been properly tested and to determine which parts of the software have and have not been exercised.

This code coverage tool should also be included in the classification and certification reports.

It's nearly impossible to find a tool that lets you test in a single pass without having to break your code into blocks, modify hardware, deploy expensive software, or expend significant effort searching for relevant information in large data files.

Because certifying an application requires data to test the code, single-path code coverage tools play a critical role in streamlining this process and accelerating time to market.

To develop automotive applications that are ISO 26262 compliant, development engineers need additional resources from semiconductor suppliers beyond the device data tables.

When purchasing a functional safety package, automotive OEMs and component suppliers can be assured of what they need at various stages of the evaluation and design cycle.

These packages should include a certified safety manual, a functional health and safety evaluation (FMEDA) report, and, in some cases, diagnostic software such as a certified self-test library for the relevant ASIL.

Impact and Diagnostic Analysis (FMEDA)) report quantifies the failure modes, failure-in-time (FIT) distribution, and detection methods of the device, facilitating the creation of a coverage plan.

Another important resource is the Safety Manual (SM), which provides details on the fault diagnosis methods specified in the FMEDA report and contains recommendations on how to use the device to ensure the safest operation.

It also details the hardware features required to detect dependent and systematic failures, which can be used for developing diagnostic libraries.

The functional safety diagnostic library helps to evaluate the operational state of the system under fault conditions, detect system failures, and achieve functional safety goals.

Select devices with a diagnostic library added to the Third-Party Certification Impact and Diagnostic Analysis (FMEDA) report and Safety Manual (SM) to streamline certification efforts for safety-critical applications.

The development of safety-critical applications begins with defining the safety goals and target safety level to be achieved.

The Functional Safety Base Package provides foundational resources such as Functional Safety Evaluation and Diagnostic Analysis (FMEDA), Safety Manual (SM), and Certification to help you get started with the assessment effort for the target functional safety level and the design effort for safety-critical automotive applications.

The functional safety starter package for MCU-based designs includes an ASIL B-level qualified impact and diagnostic analysis (FMEDA) report and a safety manual (SM), along with an ASIL B/C-level compliant diagnostic library to help developers understand the ISO 26262 development process and the reports required for compliance, and how to use the resources to develop safety-critical applications. Ideally, it would include a reference application that can be used to determine if it is possible.

Starter packages accelerate the design cycle and help develop ASIL B or C compliant applications.

The functional safety full package includes a certified diagnostic library with source code and related safety analysis reports to enable design up to ASIL B/C level in addition to the basic offering.

Since the majority of end customers request certification for safety-critical applications, the full package speeds up the certification process.

Cars are becoming more sophisticated, and the level of electronics they use is increasing.

With today's focus on functional safety for automotive applications, it is becoming increasingly important to support a development ecosystem that provides certified functional safety resources to meet ISO 26262 requirements.

Integrated circuit (IC) suppliers can also help automotive customers protect their long-term investments in such rigorous development and certification processes.

For example, it ensures that components used in a certification system will continue to be supplied for as long as a customer wants to place an order, eliminating the risk of a component unexpectedly becoming end-of-life (EOL) and forcing a redesign.

This gives customers greater confidence that authentication is quick and easy, and that they only need to do it once.

※ author
Jacob Lunn Lassen, Functional Reliability Technical Staff Engineer, Microchip Technology