Metric · Safety & Security
Diagnostic coverage
The percentage of a part's dangerous failure rate that a given safety mechanism detects or controls in time. Values are claimed as low, medium or high (typically 60, 90 or 99 percent) and must be justified by analysis or fault injection.
- Also known as
- DC
- Type
- Metric
- Domain
- Safety & Security, Safety metrics
- Also relevant to
- Test & DFT
Notes
Table-based claims from IEC 61508 and ISO 26262 annexes are increasingly challenged in favour of measured coverage.
Overview
Diagnostic coverage is the share of a hardware element's failure rate that its safety mechanisms detect or control in time, expressed as a percentage. It is the key number for judging how well a safety mechanism, such as error-correcting code, a lockstep processor or logic BIST, protects a chip against random hardware faults. Coverage is claimed per mechanism and failure mode, and every claim must be backed by analysis or simulation evidence.
How it works
The calculation starts from a failure mode analysis. Each part of the chip is given a failure rate, usually in FIT, and that rate is shared out across its failure modes. For each mode the analyst asks whether a safety mechanism will detect it, or bring the system to a safe state, within the time allowed. The detected or controlled part of the rate divided by the total relevant rate is the diagnostic coverage. A failure modes, effects and diagnostic analysis (FMEDA) gathers these figures across the design.
The values feed the hardware architectural metrics of ISO 26262. The single-point fault metric reflects how much of the dangerous failure rate is covered, so that no single fault can violate a safety goal unnoticed; the latent fault metric reflects coverage of faults that could stay hidden until a second fault occurs. For ASIL D, the highest automotive integrity level, the targets are at least 99 per cent and at least 90 per cent respectively, so the coverage of each mechanism matters. IEC 61508, the general functional safety standard, uses a related measure, the safe failure fraction.
Claims need evidence. Suppliers support their figures with analysis and with fault simulation that injects faults into a model of the design and checks that the mechanism catches them. Coverage that relies on a periodic test, such as logic BIST at start-up, also depends on the test finishing within its diagnostic time interval.
Examples
- Error-correcting code on an embedded SRAM, credited with high coverage of single-bit faults in the memory array.
- A dual-core lockstep processor whose comparator flags a fault in either core as soon as their outputs differ.
- Logic BIST at key-on credited with coverage of latent faults in safety logic, provided it finishes within the allowed interval.
- A fault injection campaign showing that a watchdog catches fewer failure modes than first assumed, lowering its claimed coverage.
Why it matters
Functional safety architects and safety analysis engineers calculate and defend diagnostic coverage, designers build the mechanisms, safety verification engineers run fault injection campaigns, and assessors review the evidence. Coverage figures decide whether a chip can meet the hardware metrics for its target ASIL, and so which automotive functions it can be sold into.
Related terms
Part of the Safety & Security glossary, with every term in the topic and the lifecycles, tools and standards that use them.
Where it appears on the Hub
Used on 12 pages of the Hub. In each group, the pages that mention it most come first.
Lifecycle stages and gates
Suggest an improvement
Suggest an improvement to this entry
A clearer definition, an example, a correction or a source an editor can check. Editors review every suggestion before the entry changes.
Last reviewed . Written by The Semiconductor Hub editorial team. The full glossary