1. Purpose of the gate
This gate answers one question for the chip as a safety element: has the organisation shown, with evidence that an independent party has examined, that the chip achieves the safety goals and ASIL targets it claims, and that integrators have what they need to use it safely? The answer is given in three forms. The confirmation reviews and the functional safety audit must be complete with findings closed. The functional safety assessment must be positive, or positive with conditions that are tracked. The safety case and the safety manual must be released.
ISO 26262 treats confirmation measures as distinct from ordinary verification. Verification asks whether a work product is correct against its inputs. Confirmation asks whether the work products, the process that produced them and the overall argument are adequate, and it is carried out by people with the independence the ASIL requires. For the highest integrity levels that independence extends to a different department or organisation, separate from the people who wrote and verified the work. The gate review checks that this independence was real, not only declared.
Most automotive chips are developed as a safety element out of context, so the safety case rests on assumptions of use about the vehicle system: the fault tolerant time interval, the safe state the system can reach, the external measures expected from the integrator and the mission profile. The gate must confirm that every assumption is written in the safety manual in words an integrator can check, because an assumption that only lives in an internal analysis cannot be honoured by anyone outside.
10 more sections for registered members.