A chip for vehicles and other safety-critical systems, developed under ISO 26262 functional safety from safety planning and hazard analysis through safety concepts, safety mechanisms, safety analyses and fault injection to the safety case, then qualified to AEC-Q100, approved for production by the customer, and supplied, changed and monitored in the field for a long vehicle life.
Automotive and safety-critical lifecycle: 13 stages, 12 gates of its own and 6 hand-offs to the Product lifecycle, from Item Definition & Safety Planning to Long-term Supply & End of Life.
13 stages, 12 gates of its own and 6 hand-offs to the Product lifecycle, 3 of the gates technical readiness reviews (TR). Each stop opens its stage; each sign opens its gate. Point at a stop or tab to it to read what the stage is for. What the codes mean
In collaboration with The Digital Electronics Blog (opens in a new tab)
A dashed sign with a TR tag is a technical readiness review gate.
An outlined sign with an arrow is a hand-off: the gate is owned by the Product lifecycle, where this lifecycle hands its work on.
In collaboration with The Digital Electronics Blog (opens in a new tab)
Turning the vehicle maker's or system supplier's requirements into a chip product plan: defining the item, or the assumptions for a safety element developed out of context, agreeing who does which safety work in a development interface agreement, and writing the safety plan and the automotive quality plan.
Concept approval gate, owned by the Product lifecycle (Concept approval)Safety plan agreed gate
Analysing how the vehicle function the chip serves could cause harm, rating each hazardous event for severity, exposure and controllability to give an Automotive Safety Integrity Level, and agreeing the safety goals the chip must support.
An outlined sign with an arrow is a hand-off: the gate is owned by the Product lifecycle, where this lifecycle hands its work on.
Deriving functional safety requirements from the safety goals, then the technical safety concept that allocates them to hardware and software, with the safety mechanisms, fault tolerant times and safe states, and the hardware safety requirements the design is built against.
Safety concept approved gateTR1: Automotive technology readiness gateTR1, technical readiness review
Designing the chip with its safety mechanisms in place: lockstep or redundant processing, error correcting codes on memories and buses, built-in self-test, voltage, clock and temperature monitors, and the isolation that keeps faults in one part from spreading to another.
Analysing the design for how it can fail and how well the safety mechanisms detect each failure: failure modes, effects and diagnostic analysis for the hardware architectural metrics, fault tree analysis for the safety goals, and dependent failure analysis for common causes and cascading faults.
Proving that each hardware safety requirement is met and that the safety mechanisms detect the faults the FMEDA claims they detect, by requirements-based verification and fault injection campaigns, with every requirement traced to its verification evidence.
Implementing the design for the automotive mission profile and temperature grade: physical design with reliability sign-off for electromigration and ageing, test insertion for production and in-system test, separation of redundant logic in the layout, then tape-out.
Bringing up first silicon and characterising it across the automotive temperature range and supply corners, and testing the safety mechanisms on real silicon by injecting faults through test access and checking that each is detected and reported as specified.
Engineering samples gate, owned by the Product lifecycle (Engineering samples)Silicon validated gate
Qualifying the packaged chip to AEC-Q100 for its temperature grade: accelerated environmental and life stress tests, electrical verification, ESD and latch-up, and package tests, on parts built on the production flow, with failures analysed to root cause.
Qualification start gateAEC-Q100 qualified gateTR3, technical readiness review
Completing the independent confirmation measures: confirmation reviews of the main work products, a functional safety audit of how the safety plan was carried out and a functional safety assessment of the result, then assembling the safety case and releasing the safety manual for integrators.
Proving that the production process makes parts that meet every customer requirement consistently, under IATF 16949: process flow, process FMEA, control plan, measurement system analysis and capability studies, assembled into a production part approval submission the customer approves before shipping production parts.
Production release gate, owned by the Product lifecycle (Production release)
Building the chip in volume under its control plan, with statistical process control and outlier screening, handling every product or process change through formal change notification and requalification, and monitoring field returns and safety-relevant incidents for the life of the vehicles.
Start of production gate, owned by the Product lifecycle (Volume ramp)
Honouring the long-term supply commitment made to automotive customers, planning for obsolescence of the process, package and test equipment, and when the part is discontinued, giving the agreed notice, a last-time buy and the record retention the standards require.
Last-time buy gate, owned by the Product lifecycle (Last-time buy)Last-time ship gate, owned by the Product lifecycle (Last-time ship)
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.