ISO 26262 functional safety for an automotive SoC connects vehicle hazards to goals, requirements, architecture, verification, and production controls. An Automotive Safety Integrity Level does not label a transistor or prove a device safe by itself; it expresses rigor for a requirement derived from hazard analysis. The supplier must show implementation, fault controls, hardware analysis, and assumptions so the vehicle integrator can complete the safety case.

The safety goal starts outside the chip and constrains everything inside it. Hazard analysis and risk assessment evaluates hazardous events using severity, exposure, and controllability, then assigns QM or ASIL A through ASIL D. A vehicle-level goal such as preventing unintended torque becomes functional and technical safety requirements with a fault-tolerant time interval, safe-state or degraded-state behavior, and interfaces. The chip receives only an allocation of that contract. A 10 ms reaction requirement, 100 ms watchdog interval, or 1 s degraded-operation window is meaningful only when derived from the system analysis; none is a universal ISO 26262 constant. Define which outputs must be inhibited, which communication remains trustworthy, which faults can be tolerated, and which external power, sensor, actuator, and software assumptions must hold.

A safety island is useful only when its independence survives the same faults it monitors. A typical island combines a lockstep or redundant core, local ROM and RAM with ECC, fault-collection and control units, watchdogs, clock and voltage monitors, BIST controllers, protected communication, and a safe-state sequencer. It can supervise a high-performance CPU or accelerator and respond when the main domain becomes unresponsive. Independence must be argued across clock, reset, power, interconnect, memory, physical placement, thermal coupling, and software. Two cores sharing one clock tree, voltage rail, reset controller, or corrupted comparator are not independent merely because their RTL instances are duplicated. Common-cause analysis, dependent-failure analysis, physical separation, diverse monitoring, and freedom from interference challenge that claim.

Lockstep comparison needs a protected comparator and controlled response. SECDED ECC corrects a single-bit memory error and detects many double-bit errors, but address, control, multi-bit, and decoder faults need other mechanisms. CRC protects transfers under a declared model; parity detects odd-bit changes; watchdogs cover timing or control flow only from meaningful checkpoints. BIST, timeout, voltage, and temperature monitors cover still different faults. A 1 MHz monitor samples every 1 µs and a 100 MHz checker cycles every 10 ns, but neither figure proves end-to-end reaction time.

FMEDA is a quantified fault-accounting model, not a decorative spreadsheet. Failure modes, effects, and diagnostic analysis allocates failure rates to hardware elements, classifies their relationship to a safety goal, credits safety mechanisms with justified diagnostic coverage, and aggregates contributions into architectural metrics and probabilistic analysis. Inputs include technology and package failure rates, mission profile, transient and permanent assumptions, safety-related use, failure-mode distribution, dependent faults, diagnostic test interval, and mechanism coverage. Outputs change when unused blocks are removed, pin assumptions change, or a mechanism depends on external software. Preserve the source and revision of every FIT rate, distribution, diagnostic claim, and exclusion so an assessor can reproduce the result.

For SPFM, the numerator penalizes single-point and residual faults relative to the safety-related failure-rate pool. In an illustrative 100 FIT pool, 1 FIT classified as single-point plus residual contribution gives SPFM = 1 − 1/100 = 99%. That arithmetic can meet the commonly cited ASIL D target of at least 99%, but only if the fault classification and 100 FIT denominator are correct. LFM evaluates latent multiple-point contribution within its applicable pool; an illustrative 50 FIT pool containing 5 FIT latent contribution gives LFM = 1 − 5/50 = 90%. These simplified calculations explain sensitivity, not a complete standard-conformant FMEDA.

PMHF evaluates random-hardware safety-goal violation using combinations, exposure, diagnostic intervals, and dependent faults; it is not simply the sum of residual FIT columns. A modeled 8 FIT is below the common 10 FIT ASIL D target, while 12 FIT is not. One FIT means one failure per billion device-hours, but a component FIT is not automatically a safety-goal PMHF. Common B/C/D targets are SPFM 90%/97%/99%, LFM 60%/80%/90%, and PMHF below 100/100/10 FIT. ASIL A has no corresponding numeric targets in those tables, but its lifecycle obligations remain.

Diagnostic coverage must be demonstrated against a declared fault universe. Numerator and denominator must share the same fault list, injection model, observation, and mechanism. If 1,000 injections produce 920 timely detections, the observed fraction is 92%; that is not automatically 92% FMEDA coverage. Fault collapsing, unreachable states, abstraction, injection location, duration, reset, and analog omissions bias results. Combine formal analysis, simulation, emulation, software or hardware injection, and bench test as appropriate; record fault, time, workload, detection, reaction, latency, and criterion.

Diagnostic latency requires a complete timing budget. An illustrative chain can allocate 2 ms to detect, 3 ms to communicate, 4 ms to decide, and 6 ms to actuate, totaling 15 ms before margin. If the allocated FTTI is 20 ms, only 5 ms remains for jitter, contention, clock tolerance, and unmodeled delay. A watchdog set to 10 ms may still react later because qualification counters, interrupt masking, bus congestion, reset sequencing, and external actuator response add time. Measure best, nominal, and worst cases across voltage and temperature, such as 0.8 V to 1.1 V and −40° to 150°, where those are the declared device conditions rather than universal automotive limits.

ASIL decomposition changes allocation only when independence and integration obligations are proven. A higher-integrity requirement may split into redundant requirements on sufficiently independent elements using allowed combinations and inherited notation. ASIL D(D) plus QM(D) does not lower the D branch; the QM branch adds redundancy. Other combinations can lower both branch ASILs while retaining parent context, but independence, interfaces, dependent-failure analysis, verification, and integration remain. A safety island cannot absorb every requirement without traced failure propagation.

Verification must challenge both the mechanism and the safety argument around it. Tests show behavior; fault injection challenges diagnostics; formal methods prove properties within abstractions; analysis and review address systematic faults; silicon characterization measures monitors and timing; vehicle integration verifies reaction. Keysight can support timing and injection evidence, Keithley can characterize supply behavior, and NIST-traceable references support calibration. four-point probe, Hall effect, AFM, SIMS, XPS, ellipsometry, and DLTS can investigate silicon excursions but cannot establish ASIL. Link records to calibration, fixture, software, sample, condition, and requirement.

Production must preserve voltage-monitor trims, clock limits, BIST signatures, ECC, fuses, diagnostics, firmware, and traceability. Testing at 25° and 1.0 V does not cover a claimed −40° to 150° and 0.8 V to 1.1 V envelope. Safety manuals state integrator duties, external diagnostics, timing, residual risks, and prohibited configurations. Field monitoring separates hardware faults, systematic errors, overstress, no-fault-found returns, and security events for change analysis.

{ "rows": [
  { "type": "nodes", "items": [
    { "title": "Define item and hazards", "sub": "operating scenarios, severity, exposure, controllability", "tone": "neutral" },
    { "title": "Assign safety goals", "sub": "QM or ASIL A–D, safe state, FTTI, assumptions", "tone": "neutral" }
  ] },
  { "type": "arrow" },
  { "type": "group", "title": "Requirements–architecture–evidence loop", "note": "revise design or allocation when evidence does not close", "cycle": true, "loop": "trace every failure mode and verification result to its requirement", "items": [
    { "title": "Allocate requirements", "sub": "system, hardware, software, interfaces, decomposition", "tone": "green" },
    { "title": "Design mechanisms", "sub": "lockstep, ECC, CRC, BIST, watchdog, safety island", "tone": "green" },
    { "title": "Analyze FMEDA", "sub": "SPFM, LFM, PMHF, dependent failures, mission profile", "tone": "orange" },
    { "title": "Inject and verify faults", "sub": "coverage, latency, safe reaction, corner conditions", "tone": "orange" }
  ] },
  { "type": "arrow" },
  { "type": "nodes", "items": [
    { "title": "Integrate safety case", "sub": "work products, assumptions, reviews, residual risk", "tone": "green" },
    { "title": "Release and monitor", "sub": "production controls, field data, change impact", "tone": "neutral" }
  ] }
] }

The safety case closes only when claims, arguments, and evidence stay mutually consistent. An “ASIL capable” IP statement does not certify a vehicle function. The integrator must reconcile assumptions, manuals, dependent failures, configuration, board power and clocks, sensors, actuators, communication, and reaction. Track anomalies and assumptions as configuration items. Confirmation reviews, audits, and assessments examine whether work products and processes support the claimed integrity; the accountable organization retains release responsibility.

Read ISO 26262 functional safety through a quantified-risk-reduction lens rather than a checklist-compliance lens. HARA defines why a malfunction matters; architecture allocates protection; FMEDA exposes the random-hardware budget; fault injection tests coverage and timing; and the safety case binds evidence to assumptions. In the example, 1 FIT in a 100 FIT pool yields 99% SPFM, an 8 FIT PMHF lies below the ASIL D 10 FIT target, and a 15 ms reaction leaves 5 ms against a 20 ms FTTI. Those figures matter only while fault classification, mission profile, independence, systematic controls, calibration, configuration, and vehicle integration remain valid together.