Functional Safety
Functional Safety (ISO 26262) is the systematic approach to ensuring that electronic systems in safety-critical applications (automotive, medical, industrial) continue to operate correctly or fail safely in the presence of hardware faults — requiring chip designers to implement fault detection, diagnostic coverage, and redundancy mechanisms at the silicon level, with automotive ICs needing to meet specific ASIL (Automotive Safety Integrity Level) ratings that dictate maximum allowable failure rates of 10-100 FIT (Failures In Time, per billion hours).
ASIL Levels
| ASIL | Risk Level | Example | SPFM Target | LFM Target | Random HW Metric |
|---|---|---|---|---|---|
| QM | No safety requirement | Infotainment | — | — | — |
| ASIL A | Low | Rear lights | — | — | — |
| ASIL B | Medium | Instrument cluster | ≥ 90% | ≥ 60% | < 100 FIT |
| ASIL C | High | Airbag controller | ≥ 97% | ≥ 80% | < 100 FIT |
| ASIL D | Highest | Steering, braking, ADAS | ≥ 99% | ≥ 90% | < 10 FIT |
- SPFM: Single Point Fault Metric — %% of single faults that are detected or safe.
- LFM: Latent Fault Metric — %% of latent (undetected) faults covered by periodic tests.
- FIT: Failures In Time — failures per 10⁹ device-hours.
FMEDA (Failure Mode Effects and Diagnostic Analysis)
- Systematic analysis of every component/block in the chip:
- What failure modes exist? (Stuck-at, transient, drift, open, short)
- What is the effect of each failure? (Safe, dangerous, detected, latent)
- What diagnostic coverage exists? (BIST, ECC, watchdog, lockstep)
- Output: Quantitative FIT rate for safe, dangerous detected, dangerous undetected faults.
- Required for ISO 26262 compliance documentation.
Hardware Safety Mechanisms
| Mechanism | What It Protects | Diagnostic Coverage |
|---|---|---|
| ECC (SECDED) | Memory (SRAM, cache) | 99%+ for single-bit, detected multi-bit |
| Lockstep CPU | Processor logic | 99%+ (dual redundant execution) |
| Watchdog timer | Software hang | 60-90% (detects non-response) |
| CRC on buses | Data transfer | 99%+ for data corruption |
| Memory BIST | SRAM array | 95%+ stuck-at fault detection |
| Logic BIST | Random logic | 80-95% stuck-at fault detection |
| Parity | Register files, FIFOs | 99%+ single-bit |
| Voltage/temp monitors | Supply and thermal | 90%+ for out-of-spec operation |
Lockstep Architecture
- Two identical CPU cores execute same instructions in parallel.
- Cycle-by-cycle comparison of outputs → any mismatch → fault detected → safe state.
- Provides ~99% diagnostic coverage for random logic faults.
- Cost: 2× CPU area, ~2× power for the redundant core.
- Used in: ARM Cortex-R series (automotive MCUs), Intel automotive SoCs.
Safety Analysis Flow
1. Concept phase: Define safety goals and ASIL decomposition.
2. Design phase: Add safety mechanisms (ECC, lockstep, BIST).
3. FMEDA: Quantify failure rates and diagnostic coverage.
4. Fault injection: Simulate faults in RTL → verify detection by safety mechanisms.
5. Verification: Formal + simulation coverage of safety properties.
6. Documentation: Safety manual, FMEDA report, dependent failure analysis.
Functional safety is the gating requirement for semiconductor products entering automotive and safety-critical markets — as autonomous driving and ADAS push chip complexity to billions of transistors, achieving ASIL-D compliance demands that safety be architected into the silicon from day one, with failure detection mechanisms consuming 15-30% of die area and representing a fundamental design constraint alongside performance and power.