Foreword

Introduction

1Scope

2Normative references

3Terms and definitions

4A semiconductor component and its partitioning

4.1How to consider semiconductor components

4.1.1Semiconductor component development

4.2Dividing a semiconductor component in parts

4.3About hardware faults, errors and failure modes

4.3.1Fault models

4.3.2Failure modes

4.3.3The distribution of base failure rate across failure modes

4.4About adapting a semiconductor component safety analysis to system level

4.5Intellectual Property (IP)

4.5.1About IP

4.5.1.1Understanding IP

4.5.1.2Types of IP

4.5.2Category and safety requirements for IP

4.5.3IP lifecycle

4.5.3.1Introduction

4.5.3.2IP as SEooC

4.5.3.3IP designed in context

4.5.3.4IP use through evaluation of hardware element

4.5.3.5IP use through the “proven in use” argument

4.5.4Work products for IP

4.5.4.1List of work products for IP

4.5.4.2Safety plan

4.5.4.3Safety requirements allocated to the IP design

4.5.4.4Hardware design verification and verification review of the IP design

4.5.4.5Safety analysis report

4.5.4.6Analysis of dependent failures

4.5.4.7Confirmation measures

4.5.4.8Development interface agreement

4.5.4.9Integration documentation set

4.5.4.10Applicability of work products to IP categories

4.5.5Integration of black-box IP

4.6Base failure rate for semiconductors

4.6.1General notes on base failure rate estimation

4.6.1.1Introduction

4.6.1.2Quantitative target values and reliability prediction

4.6.1.3Difference between systematic and random failures

4.6.1.4Effect of failure recovery mechanisms

4.6.1.5Considerations about non-constant failure rates

4.6.1.6Techniques and sources for base failure rate estimation

4.6.1.7Documentation on the assumptions for base failure rate calculation

4.6.1.8Transient fault quantification

4.6.1.9Notes on component package failure rate

4.6.1.10Consideration of power-up time and power-down time

4.6.2Permanent base failure rate calculation methods

4.6.2.1Permanent base failure rate calculation using or based on industry sources

4.6.2.1.1Model for reliability prediction of electronics components (former IEC TR 62380)

4.6.2.1.1.1How to combine λ and λ

4.6.2.1.1.2Temperature de-rating

4.6.2.1.1.3Package base failure rate calculation

4.6.2.1.1.4Example of failure rate resulting from electrical overstress

4.6.2.1.2SN 29500

4.6.2.1.2.1Example of computation for a semiconductor component

4.6.2.1.2.2Failure rate calculation for the semiconductor component example without non-operating phase

4.6.2.1.2.3Failure rate calculation for the semiconductor component example with non-operating phase

4.6.2.1.2.4Method to split SN 29500 overall failure rate into die and package failure rates

4.6.2.1.3FIDES Guide

4.6.2.2Permanent base failure rate calculation using field data statistics

4.6.2.2.1Exponential model method

4.6.2.2.2Calculation example of hardware component failure rate

4.6.2.3Base failure rate calculation using accelerated life tests

4.6.2.4Failure rate distribution methods

4.6.2.5Base Failure Rate for MCM

4.7Semiconductor dependent failure analysis

4.7.1Introduction to DFA

4.7.2Relationship between DFA and safety analysis

4.7.3Dependent failure scenarios

4.7.4Distinction between cascading failures and common cause failures

4.7.5Dependent failure initiators and mitigation measures

4.7.5.1List of dependent failure initiators and related mitigation measures

4.7.5.2Verification of mitigation measures

4.7.6DFA workflow

4.7.6.1DFA decision and identification of hardware and software elements (B1)

4.7.6.2Identification of DFI (B2)

4.7.6.3Sufficiency of insight provided by the available information on the effect of identified DFI (B3 & B4)

4.7.6.4Consolidation of list of relevant DFI (B5)

4.7.6.5Identification of necessary safety measures to control or mitigate DFI (B6)

4.7.6.6Sufficiency of insight provided by the available information on the defined mitigation measures (B7 & B8)

4.7.6.7Consolidate list of safety measures (B9)

4.7.6.8Evaluation of the effectiveness to control or to avoid the dependent failures (B10)

4.7.6.9Assessment of risk reduction sufficiency and if required improve defined measures (B11 & B12)

4.7.7Examples of dependent failures analysis

4.7.8Dependent failures between software element and hardware element

4.8Fault injection

4.8.1General

4.8.2Characteristics or variables of fault injection

4.8.3Fault injection results

4.9Production and Operation

4.9.1About Production

4.9.2Production Work Products

4.9.3About service (maintenance and repair), and decommissioning

4.10Interfaces within distributed developments

4.11Confirmation measures

4.12Clarification on hardware integration and verification

5Specific semiconductor technologies and use cases

5.1Digital components and memories

5.1.1About digital components

5.1.2Fault models of non-memory digital components

5.1.3Detailed fault models of memories

5.1.4Failure modes of digital components

5.1.5Example of failure mode definitions for common digital blocks

5.1.6Qualitative and quantitative analysis of digital component

5.1.7Notes on quantitative analysis of digital components

5.1.7.1How to consider permanent faults of digital components

5.1.7.2How to consider transient faults of digital components

5.1.7.2.1Failure rate of transient fault

5.1.7.2.2Classification of transient fault

5.1.8Example of quantitative analysis

5.1.9Example of techniques or measures to detect or avoid systematic failures during design of a digital component

5.1.9.1Principles, techniques or measures to detect or avoid systematic failures during RTL design

5.1.10Verification using fault injection simulation

5.1.10.1General

5.1.10.2About verification of fault models different than stuck-at

5.1.11Example of safety documentation for a digital component

5.1.12Examples of safety mechanisms for digital components and memories

5.1.13Overview of techniques for digital components and memories

5.1.13.1Memory monitoring using error-detection-correction codes (ECC)

5.1.13.2Modified checksum

5.1.13.3Memory signature

5.1.13.4Block replication (for example double memory with hardware or software comparison)

5.1.13.5RAM Pattern test

5.1.13.6Parity bit

5.1.13.7RAM March test

5.1.13.8Running checksum/CRC

5.2Analogue/mixed signal components

5.2.1About analogue and mixed signal components

5.2.2Analogue and mixed signal components and failure modes

5.2.2.1About failure modes

5.2.2.2About transient faults

5.2.3Notes about safety analysis

5.2.3.1General

5.2.3.2Level of granularity of analysis

5.2.3.3Deriving failure mode distributions for analogue components

5.2.3.4About safe faults

5.2.3.5Example of quantitative analysis for an analogue component

5.2.3.6Dependent failures analysis

5.2.3.7Verification of the architectural metrics computation

5.2.4Examples of safety mechanisms

5.2.4.1Resistive pull up/down

5.2.4.2Over & under voltage monitoring

5.2.4.3Voltage clamp (limiter)

5.2.4.4Over-current monitoring

5.2.4.5Current limiter

5.2.4.6Power on reset

5.2.4.7Analogue watchdog

5.2.4.8Filter

5.2.4.9Thermal monitor

5.2.4.10Analogue Built-in Self-Test (Analogue BIST)

5.2.4.11ADC monitoring

5.2.4.12ADC attenuation detection

5.2.4.13Stuck on ADC channel detection

5.2.5Avoidance of systematic faults during the development phase

5.2.6Example of safety documentation for an analogue/mixed-signal component

5.3Programmable logic devices

5.3.1About programmable logic devices

5.3.1.1General

5.3.1.2About PLD types

5.3.1.3Functional safety lifecycle tailoring for PLD

5.3.1.3.1General

5.3.1.3.2ISO 26262‑2 (management of functional safety)

5.3.1.3.3ISO 26262‑3 (concept phase)

5.3.1.3.4ISO 26262‑4 (product development at the system level)

5.3.1.3.5ISO 26262‑5 (product development at the hardware level)

5.3.1.3.6ISO 26262‑6 (product development at the software level)

5.3.1.3.7ISO 26262‑7 (production and operation)

5.3.2Failure modes of PLD

5.3.3Notes on safety analyses for PLDs

5.3.3.1Quantitative analysis for a PLD

5.3.3.1.1Example of PLD die failure rate calculation using the model in 4.6.2.1.1

5.3.3.1.2Example of a transient failure rate calculation for PLDs

5.3.3.1.3Example of distribution of PLD failure rate to failure modes

5.3.3.1.4Verification of completeness and correctness of safety mechanism implementation with respect to hardware

5.3.3.2Dependent failure analysis for a PLD

5.3.4Examples of safety mechanisms for PLD

5.3.5Avoidance of systematic faults for PLD

5.3.5.1Avoiding systematic faults in the implementation of PLD

5.3.5.2About PLD supporting tools

5.3.5.3Avoiding systematic faults for PLD users

5.3.6Example of safety documentation for a PLD

5.3.7Example of safety analysis for PLD

5.4Multi-core components

5.4.1Types of multi-core components

5.4.2Implications of ISO 26262 series of standards for multi-core components

5.4.2.1Introduction

5.4.2.2Clarifications on Freedom from interference (FFI) in multi-core components

5.4.2.3Timing requirements in multi-core component

5.5Sensors and transducers

5.5.1Terminology of sensors and transducers

5.5.2Sensors and transducers failure modes

5.5.2.1Production processes and failure modes

5.5.2.2Microelectromechanical causes of failure

5.5.3Safety analysis for sensors and transducers

5.5.3.1Considerations in the determination and allocation of base failure rate

5.5.3.2DFA for sensors and transducers

5.5.3.3Quantitative analysis

5.5.4Examples of safety measures for sensors and transducers

5.5.4.1Sealed Proof Mass Filter

5.5.4.2Redundant Diaphragms

5.5.4.3Offset Cancellation

5.5.4.4Transducer specific self-test

5.5.4.5Automatic gain control

5.5.4.6Sensitivity adjustment

5.5.4.7MEMS specific non E/E safety mechanisms

5.5.4.8Dedicated measures for sensors

5.5.5About avoidance of systematic faults for sensors and transducers

5.5.6Example of safety documentation for sensors and transducers

Annex AExample on how to use digital failure modes for diagnostic coverage evaluation (informative)

A.1Example of evaluation of a DMA safety mechanism

A.1.1Description of the use case

A.1.2Description of the safety mechanisms

A.1.3Definition of the failure modes and estimation of diagnostic coverage

A.1.3.1DMA_FM1: no requested data transfer

A.1.3.2DMA_FM2: data transfer without a request

A.1.3.3DMA_FM3: data transfer too early/too late

A.1.3.4DMA_FM4: incorrect output

Annex BExamples of dependent failure analysis (informative)

B.1Microcontroller example

B.1.1Description

B.1.2Dependent failure analysis

B.2Analogue example

B.2.1Description

B.2.2Dependent failures by shared supply voltage regulator

B.2.3Dependent failures by coupling mechanism

Annex CExamples of quantitative analysis for a digital component (informative)

C.1Description

Annex DExamples of quantitative analysis for analogue component (informative)

D.1Description

D.1.1Example of computation of failure rate for analogue component

Annex EExamples of quantitative analysis for PLD component (informative)

E.1Architecture of the example

E.2PLD external measures

E.3PLD internal measures

Bibliography