External Use

TM

Design Functional Safety

Compliant ECU

APF-AUT-T0644

A U G . 2 0 1 4

Yolanda Xi , Gavin Zhang

TM

External Use 1

Passive Safety

Active Safety

Predictive Safety

Evolution of Vehicle Safety Systems… And the Arrival of

Functional Safety

Functional Safety

Covers systems for

• Chassis & Safety

• Powertrain

• Body

Injury Free Accident Free Semi Autonomous

Driving

2000-2010 2010-2020 2020-2030

Market trends

1. Vision zero - no fatalities

2. Safe Comfort & Asssistance

3. Green Technology

4. Automation

TM

External Use 2

Functional Safety & Standard

Functional safety is the absence of unreasonable risk due to

hazards caused by malfunctioning behavior of electrical/electronic

systems.

IEC 61508 ISO 26262

Generic Industry Functional safety of electrical

/electronic/ programmable electronic safety-related systems, applicable to all kind of industry

.

Safety Integrity Levels

SIL 1, SIL 2, SIL 3, SIL 4

Publication date

More than 10 years ago

Automotive Industry Adaptation of the Functional Safety

standard IEC 61508 for Automotive Electric/Electronic Systems

Automotive Safety Integrity Levels

ASIL A, ASIL B, ASIL C, ASIL D

Publication date

Nov 2011

TM

External Use 3

Determination of ASIL and Safety Goals

• For each Hazardous event, determine the ASIL based on Severity, Exposure & Controllability

• Then formulate safety goals to prevent or mitigate each event, to avoid unreasonable risk

Reference ISO 26262-3:2011

TM

External Use 4

Target Metrics for ASIL

• Associate the following target metrics to each safety goal −Single-point fault metric (SPFM)

−Latent-fault metric (LFM)

−Probabilistic Metric for random Hardware Failures (PMHF)

Reference ISO 26262-5:2011

TM

External Use 5

History of Freescale Functional Safety Solutions

• Gen 1 Safety More than 10 years experience of safety development in the area of

MCU & SBC

• Gen 2 Safety First general market MCU, MPC5643L Certified ISO 26262!

• Gen 3 Safety From 2012, multiple MCUs in Body, Chassis and Powertrain are

being designed and developed according to ISO 26262

Ge

n 1

Sa

fety

Ge

n 2

Sa

fety

Ge

n 3

Sa

fety

MPC5744P/MPC5777K/etc 55 nm

2000

2008

PowerSBC

MPC5643L – 90 nm

Custom Safety Platform for Braking

Fun

ctio

nal S

afe

ty S

olu

tion

s

PowerSBC

2012

• Voltage Supervision

• Fail-Safe State Machine

• Fail-Safe IO

• Advanced Watchdog

• Voltage Supervision

• Fail-Safe State Machine

• Fail-Safe IO

• Advanced Watchdog

• 32-bit Dual-Core MCU

• Developed according to ISO 26262

• Target Applications for Chassis – ASILD

• 32-bit Dual/Quad-Core MCU

• Developed according to ISO 26262

• Target Applications Chassis & P/T for – ASILD

•Safe methodology, Architecture, SW and tools

• Started to ship in 2000 first safe MCU for braking

applications

• IEC 61508 / ISO 26262 compliance achieved at system level

(top down approach)

• MCU features are a key enabler for SIL3 / ASILD

Custom IC

TM

External Use 6

Automotive ISO 26262

Industrial IEC 61508

Safety

Support

Safety

Process

Safety

Software

Safety

Hardware

IEC 61508

Generic Industry standard,

applicable to electrical / electronic /

programmable electronic safety-

related systems.

Integrity levels

SIL 1, SIL 2, SIL 3, SIL 4

Pub date: More than 10 years ago

Continuous Improvement

Process evaluation, assessments /

audits and gap-analysis exist to

ensure processes are continually

optimized

Safety Analysis

Selected products defined &

designed from the ground up with

safety analysis being done at each

step of the process

Assessments / Audits

Safety Confirmation Measures

Automotive Software

AUTOSAR OS & MCAL

Core Self Test

Device Self Test; Complex Drivers

Software Partnerships

Partnering with leading third-party

software providers for automotive

and industrial

People

Regional functional safety experts

Documentation

Safety Application Notes / Safety

Manual / FMEDA

ISO 26262

Automotive Industry standard,

adaptation of IEC 61508 for

electrical/electronic systems within

road vehicles

Integrity levels

ASIL A, ASILB, ASIL C, ASILD

Pub date: Target end 2011

Quality Management

ISO TS 16949 Certified Quality

Management System

Hardware - Zero Defects

Software – SPICE Level 3

Organization

Safety is an integral part of the

Freescale world wide organization

Project Management

Configuration & Change

Management, Quality Management,

Requirements Management,

Architecture & Design, Verification

& Validation

Microcontrollers

Lockstep Cores, ECC on Memories

Redundant Functions, Internal

Monitors, Built In Self Test, Fault

Collection & Control

Analog and Power Management

Voltage Monitors, External Error

Monitor, Advanced Watchdog,

Built In Self Test

Sensors

Timing Checker, Digital Scan of

Signal Chains, DSI3 or PSI5 Safety

Data links

Functional Safety Standards

Freescale Quality Foundation

SafeAssure Approach: The Four Key Elements

TM

External Use 7

SafeAssure Products

To view the latest SafeAssure product table visit www.freescale.com/SafeAssure

Target Market

Product Type

Product Target Applications Safety

Process Safety Hardware Safety Support

Automotive MCUs

Qorivva MPC5746M

Diesel Engine Management Direct Injection Engines Electronically Controlled Transmissions Gasoline Engine Management

ISO 26262 ASIL D

Integrated Safety Architecture e.g.; Multicore, delayed lockstep, e2eECC, replicated peripherals, LBIST & MBIST, FCCU

FMEDA Safety Manual

Qorivva MPC577xK

77 GHz RADAR System Adaptive Cruise Control Surround View Park Assist System Blind Spot Detection Cross Traffic Alert Autonomous Emergency Braking Systems Side Impact Assistance Sensor Fusion

ISO 26262 ASIL D

Integrated Safety Architecture: Multicore delayed lockstep, e2e ECC, replicated peripherals, LBIST & MBIST, FCCU

FMEDA Safety Manual

Qorivva MPC5748G

Battery Monitoring High End Body Control Module Infotainment Gateway Central Gateway / In-Vehicle Networking

ISO 26262 ASIL B

Integrated Safety Architecture e.g.: Multicore, e2eECC, LBIST & MBIST, clock and under voltage monitoring, FCCU

FMEDA Safety Manual

Qorivva MPC5777M

Direct Injection Engines Common Rail Diesel Injection Systems Electronically Controlled Transmissions Diesel Engine Management Gasoline Engine Management

ISO 26262 ASIL D

Integrated Safety Architecture e.g.; Dual core, delayed lockstep, e2eECC, replicated peripherals, LBIST & MBIST, FCCU

FMEDA Safety Manual

Qorivva MPC5744P

Electric Power Steering (EPS) Braking and Stability Control 77 GHz RADAR System Safety Domain Control

ISO 26262 ASIL D

Integrated Safety Architecture e.g.; Dual core, delayed lockstep, e2eECC, replicated peripherals, LBIST & MBIST, FCCU

FMEDA Safety Manual

Qorivva MPC567xK

77 GHz RADAR System Front View Camera

FSL QM Integrated Safety Architecture e.g.; Dual core, lockstep or dual parallel processing, replicated peripherals, FCCU

FMEDA Safety Manual

Qirovva MPC564xL

77 GHz RADAR System Electric Power Steering (EPS) Braking and Stability Control

ISO 26262 ASIL D

Integrated Safety Architecture e.g.; Dual core, lockstep or dual parallel processing, replicated peripherals, FCCU

FMEDA Safety Manual System Level Application Note

Qorivva MPC5604P

Airbags Electric Power Steering (EPS)

FSL QM Single core, SEC/DED ECC, Clock Monitoring Unit, Low Voltage Detector, FCU

FMEDA Safety Application Note

TM

External Use 8

SafeAssure Products (Continue)

To view the latest SafeAssure product table visit www.freescale.com/SafeAssure

Target Market

Product Type

Product Target Applications Safety

Process Safety Hardware Safety Support

Automotive

Analog and Power Management

MC33907 Electric Power Steering (EPS) Safety critical motor control Vehicle dynamic and chassis control

ISO 26262 ASIL D

Integrated Safety Architecture e.g.; Voltage Monitoring and Fail Safe state Machine (ABIST, LBIST), FCCU Monitoring for Dual Core Lock Step Mode, Several HW diagnostic to cover SPF, LT

Safety Manual FMEDA System Level Application Note

MC33908 Integrated Chassis Domain Safety Critical Motor Control

ISO 26262 ASIL D

Safety Manual FMEDA System Level Application Note

MC33789 PSI5 Airbag System FSL QM 4x PSI5 Host Safing Block

Safety FMEA

MC33926 Valve control in Powertrain applications

FSL QM Output state flag Thermal Shutdown

Safety FMEA

Sensor

Xtrinsic MMA16xx and Xtrinsic MMA26xx

Airbags, DSI2.5 Satellite FSL QM DSI2.5 safety bus Triggered self test, Over-damped MEMS

FTA

Xtrinsic MMA17xx and Xtrinsic MMA27xx

Airbags, DSI3.0 Satellite FSL QM DSI3.0 safety bus Triggered self test, Over-damped MEMS

FTA

Xtrinsic MMA51xx and Xtrinsic MMA52xx

Airbags, PSI5 Satellite FSL QM PSI5 safety bus Triggered self test, Over-damped MEMS

FTA

Xtrinsic MMA65xx and Xtrinsic MMA68xx

Airbags, Main ECU FSL QM SPI w/ CRC Triggered self test, Over-damped MEMS

FTA

Xtrinsic MMA69xx Braking and Stability Control FSL QM SPI w/ CRC Triggered self test, Over-damped MEMS

FTA

Industrial MCUs

Qorivva MPC564xL

Aerospace Anesthesia Unit Monitor Input-Output Control (I/O Control) Process Control, Temperature Control Programmable Logic Control (PLC) Motor Drivers Robotics Safety Shutdown Systems

ISO 26262 ASIL D

Integrated Safety Architecture e.g.;: Dual core, lockstep or dual parallel processing, replicated peripherals, FCCU

FMEDA Safety Manual System Level Application Note

Qorivva MPC567xK Ventilators and Respirators FSL QM FMEDA Safety Manual

TM

External Use 9

HW Example:

MPC5643L Safety Mechanisms

9

Fault Collection Unit

• detects when errors

have occurred

• indicates error to

external

• independent of

software operation

Flash

• ECC

RAM

• ECC

Temp Sensor

• redundant

CRC Unit

• Application Signature

Flexray

PMU

• internal Vreg

• redundant Vmonitor

Sphere of Replication:

• Replicated e200Core

• replicated eDMA

• redundant INTC, SWT, etc

• redundant MMU

• RC Units at Gates to non

redundant sphere

Clock Monitoring

• Detects and mitigates

clock disturbances

• PLL

Timer

• eTimer0 channels

“isolated”

ADC

• On Line Assisted

Hardware BIST

XBAR + MPU:

• redundant

• RC Units at Gates to non

redundant sphere

Cross Bar Switch

I/O Bridge

BA

M

Memory Protection Unit

Cross Bar Switch

Memory Protection Unit

FlexRay

RC

FlexRay

RC

RC RC

FLASH (ECC)

SRAM (ECC)

RC

I/O Bridge

SS

CM

FL

PLL

FM

PLL

IRC

OS

C

CM

U

CM

U

CR

C

PIT

MC

XO

SC

SIU

WA

KE

TS

EN

S

TS

EN

S

AD

C

AD

C

CT

U

Fle

xP

WM

eT

IME

R

eT

IME

R

eT

IME

R

Fle

xC

AN

Fle

xC

AN

LF

LE

X

LF

LE

X

DS

PI

DS

PI

DS

PI

FC

CU

SWT

MCM

STM

INTC

eDMA CACHE

PowerPC ™ e200

MMU

VLE

CACHE

FPU Nexus

JTAG

Debug

Nexus

JTAG

Debug PMU

SWT

MCM

STM

INTC

eDMA CACHE

PowerPC ™ e200

MMU

VLE

CACHE

FPU

TM

External Use 10

MPC5643L and the Failure Classes

• Single Point Failure (SPF) − Structural redundancy

Core, cache, bus, DMA, INTC, watchdog, RAM-Ctrl, Flash-Controller

− Information redundancy

ECC on system RAM and Flash

• Latent Failure (LF) − HW-Self test

Memory, logic, some peripherals

90% coverage

• Common Cause Failure (CCF) − Measures according to IEC61508-2 Ed.2 Annex E

− Supervision of clock, power and temperature

− Independent safety clock

− Independent failure signaling

inp

ut

wro

ng

ou

tpu

t

Component

inp

ut

Component

Co

mp

ara

tor

Component

OK

inp

ut

co

rrec

t

ou

tpu

t

Component LF

TM

External Use 11

First ISO 26262 Certified MCU – Qorivva MPC5643L

• Certified by exida – an independent

accredited assessor

• Certificate issued based on a

successful assessment of the

product design, applied

development & production

processes against requirements

and work products of ISO 26262

applicable to a MCU

• MPC5643L MCU certified for use

for all Automotive Safety Integrity

Levels (ASIL), up to and including

the most stringent level, ASIL D

TM

External Use 12

Defining the MCU Safety Concept

• Objective − Define MCU ASIL derived from system level assumptions

• Application Assumptions − Safety Goals Associated “mini” HARA, ASIL

− Fault Tolerant Time Interval (FTTI / L-FTTI)

− System Safe State

• MCU Assumptions − MCU Safety Functions Associated ASIL from safety goal

− Portion of FTTI % of safety goal

− Define portion of ASIL target allocated to each safety function % of safety goal

− MCU Safe State Compatible with System Safe State

TM

External Use 13

Example – EPS System

• Application Context

− Safety Goal 1 (SG1): The EPS does not apply unintended force to the steering system (ASIL D).

Hazard: Unintended steering assist

Risk Assessment

− S3: Life threatening injuries (survival uncertain), fatal injuries

− E4: High probability

− C3: Difficult to control or uncontrollable

• MCU Assumptions

− Safety Function 1 (SF1): Execute software instructions, process data, write back result (ASIL D) -> mapped to SG1

− Portion of FTTI: 10 ms

50% of SG1 FTTI for HW safety measures

− Define portion of ASIL target allocated to each safety function

SPFM: 99%, LFM: 90%, PMHF: 10-10 hour-1 (1% of safety goal ASIL target)

− MCU Safe State (fail safe, fail indicate)

Reset, indicating an error

TM

External Use 14

Example Interaction Between Car OEM, Tier 1 & Tier 2

(Freescale)

OEM

• Safety Architecture

• Safety Concept

• ASIL Classification of Functions

Tier 1

• HW / SW offering

Tier 2 Supplier - Freescale

• Item definition

• Hazard analysis and risk assessment

• Safety Goals

• Functional Safety Concept ISO26262 Safety

Requirements &

DIA

Safety

Requirements &

DIA

Safety Manual &

Safety Analysis

Relevant

scope of

ISO26262

high

Fou

nd

atio

n

Product Safety Measures (implemented in

offering, described in Safety Manual,

quantified/qualified by Safety Analysis)

Development Process & Methods

Quality & Quality Data

Relevant

scope of

ISO26262

medium

Overall ISO 26262 compliance is achieved

together, we each own a piece of the puzzle

Freescale Functional Safety Focus

Safety Element out of Context

Safety Manual &

Safety Analysis

TM

External Use 15

Defining the MCU Safety Concept

• Objective

− Define how MCU ASIL targets will be achieved between a mix of on-chip HW

safety measures and system level safety measures (HW/SW)

• ISO 26262-5 Annex D – Elements related to MCU

− Low application dependency: Power, Clock, Flash, SRAM & Processing Unit

− High application dependency: Digital IO & Analog IO

Reference ISO 26262-5:2011

MCU Module Classification

TM

External Use 16

Realizing the MCU Safety Concept – Qorivva MPC5744P

Redundant use of IO & Application checks

Power Monitoring

Clock Monitoring

ECC on

SRAM &

Flash

Processing Unit - Dual Core Lockstep

ECC

on

buses

Fault

Tolerant

Com.

TM

External Use 17

SafeAssure MCU Product – Qorivva MPC5744P

ISO 26262 ASIL D

• Safety assessment of MCU architecture and

development process (ISO 26262)

• helps to reduce effort and time on ECU

functional safety assessment

Integrated Safety Architecture (ISA)

• Saves development effort and time as no

complex diagnostic SW required

• CPU processing power available for running

applications

• High diagnostic coverage in HW to detect

random faults

SW deliverables provided by Freescale and

partners

• Enable support for ASIL D applications with

minimized performance degradation

• sMCAL & sOS, Selftests, SW Safety Manual

Safety enablement provided by Freescale

• Safety Manual

• FMEDA

• System Level Appication Note

TM

External Use 18

Safety Process – What does the product adhere to?

FSL QM

• Development process addresses quality at

component level

• Deliverables created available to the customer

• Safety Analysis of Architecture: Safety FMEA or

FTA

• User Guide: Safety Application Note

• Development Process evidence: PPAP, Quality

Plan (Mapping to ISO 26262 / IEC 61508

checklists)

ISO 26262 or IEC 61508

• Development process addresses quality &

functional safety at component level

• Deliverables created available to the customer

− Safety Analysis of Architecture: FMEDA or FTA

− User Guide: Safety Manual

− Development Process evidence: PPAP, Safety Plan, Certificates

TM

External Use 19

Safety Hardware – Quickly understand main

Safety features?

Main MCU Safety Measure

• Dual Core

− Lockstep

− Decoupled Parallel Mode

• Sphere of Replication

• Clock & Power monitoring

• ECC

• FCCU

• STCU (LBIST, MBIST)

Main Analog Safety Features

• Voltage & timing monitoring

• Independent Fail Safe Sate Machine

• STCU (ABIST, LBIST)

• FCCU Monitoring

• Advanced Watchdog (challenger)

Main Sensor Safety Features

• Frame counters, cyclic redundancy checkers, error-corrected NVMs, & clock monitors

TM

External Use 20

Safety Software – AutoSAR based software

Safety-Related Functional Components

• safety MCAL (sMCAL)

• safety Motor Control Lib (sMCLib)y Service Components

Safety Service Components

• Safety Library (SafeLib)

• Microcontroller Error Management

• Software support for FCCU, MEMU, LBIST, MBIST

• Hardware error collection

• Safety Error Reporting and Reaction

• safety Operating System (sOS)

HW Safety ComponentsSoftwarrtnrships

• safety Core Self Test (sCST)

• safety Peripheral Test Library (sPTLib) Partnering with leading third-party software providers for automotive and industrial

microcontroller

Safe

ty lib

rary

Operating system

sMCAL

sC

ST

/sD

ST

RTE

MCAL

Customer

Applicatio

ns

BSW

Com

p

lex sBSW

TM

External Use 21

Safety Support – FMEDA, Documentation & More

FSL QM Products - Typical Deliverables

• Safety Analysis of Architecture: Safety FMEA or

FTA

• User Guide: Safety Application Note

• Development Process evidence: PPAP, Quality Plan

(Mapping to ISO 26262 / IEC 61508 checklists)

ISO 26262 or IEC 61508 Products – Typical

Deliverables

• Safety Analysis of Architecture: FMEDA, CCA or

FTA

• User Guide: Safety Manual

• Development Process evidence: PPAP, Safety Plan,

Certificates

Local Support

• Functional Safety Field Experts

Learning

• Field Training / workshops – delivered by Local

Functional Safety FAE Experts

TM

External Use 22

What is an FMEDA?

controlled

Gates

each gate may have various

possible failure modes

unused by

safety

function

failure

switches to

safe state

failure

detected by

diagnostic

failure avoided

by design or

usage

failure rate

various failure reaction

catastrophic

event

uncontrolled FMEDA calculates

absolute:

and relative values

Uncontrolled Failure per hour

Controlled / Total Failure per hour

TM

External Use 23

How to setup FMEDA - Template

Gates

apply for each element

typical failure modes

divide circuitry in elements Gates Gates

Diagnostic

coverage

measures 1

Diagnostic

coverage

measures 3

Diagnostic

coverage

measures 4

Diagnostic

coverage

measures 2

apply for each failure model

of an element typical

diagnostic coverage

elements listed in

ISO26262-5 Table D.1

failure models listed in

ISO26262-5 Table D.1

DC assessed by engineering

judgment or analytic calculation

Approach used in FMEDA Template

TM

External Use 24

ISO 26262-5 (Elements and Failure Models)

FMEDA Supply

FMEDA Clock

FMEDA Flash

FMEDA

SRAM

Failure Rate

Table

Reference ISO 26262-5:2011

TM

External Use 25

ISO 26262-5 (Elements and Failure Models)

FMEDA

Processing

Unit

Reference ISO 26262-5:2011

TM

External Use 26

Tailor Made FMEDA

FMEDA enables temperature profile

adaptation

FMEDA enables selection of package used

FMEDA enables selection of enabled

diagnostic measures (tailor to application)

FMEDA automatically generates a specific

customer FMEDA

Called “Dynamic FMEDA”

TM

External Use 27

Dynamic FMEDA

• Additionally - FMEDA Report

− Summarizing the assumptions and the method of the inductive functional safety analysis activities based on the FMEDA carried out for the MCU

…

TM

External Use 28

Safety Support – Safety Manual

Safety Manual for Analog Solution

Safety Manual for MCU Solution

Safety Manual for MPC574xP

• Objective − Enables customers to extract the full value of

Freescale’s functional safety offering

− Simplify integration of Freescale’s safety products into applications

− A comprehensible description of all information relating to FS in a single entity to ensure integrity of information and links with datasheet

• Content − MCU Safety Context description

− MCU Safety Concept description

− System level hardware assumptions

− System level software assumptions

− Pseudo-code or C-Code to simplify adoption of safety software requirements

− FMEDA summary Full details provided in FMEDA Report

− Dependent Failures Analysis summary Full details provided in DFA Report

TM

External Use 29

Safety Support – System Level Application Notes

Design Guidelines for

• Integration of Microcontroller and Analog & Power Management device

• Explains main individual product Safety features

• Uses a typical Electrical Power steering application to explain product alignment

• Covers the ASIL D safety requirements that are satisfied by using both products: − MPC5643L requires external measures

to support a system level ASIL D safety level

− MC33907/08 provides those external measures: External power supply and monitor

External watchdog timer

Error output monitor

TM

External Use 30

Supporting Material for Functional Safety

• SafeAssure @ www.freescale.com/SafeAssure

• Certification Package under NDA

• App-Notes, White Papers, Articles

• On-demand Training

TM

© 2014 Freescale Semiconductor, Inc. | External Use

www.Freescale.com