Functional Safety Compliance Throughout the Vehicle with Safeassure Solutions FTF-AUT-F0009 Richard Soja | Automotive MCU Systems Engineer
Total Page:16
File Type:pdf, Size:1020Kb
Functional Safety Compliance Throughout the Vehicle with SafeAssure Solutions FTF-AUT-F0009 Richard Soja | Automotive MCU Systems Engineer A P R . 2 0 1 4 TM External Use Agenda • Functional Safety at Freescale • Functional Safety and Microcontrollers • MCU Safety Context and Safety Concepts • Dynamic FMEDA • Safety Manual TM External Use 1 Microcontrollers and Digital Networking Processors Five Core Product Four Primary Groups Markets Microcontrollers Automotive Digital Networking Networking Automotive MCU >50 Year Legacy Industrial >5,500 Engineers Analog >6,100 Patent Families RF Consumer TM External Use 2 Several Platforms Key to Making the World a Healthier, Safer Place • Active Safety Systems • Connected Home • Advanced Driver • Portable Medical Assistance • Factory Automation • Radar, Vision Systems Systems • Functional Safety We See a Healthier, Safer Population TM External Use 3 Functional Safety. Simplified. • Simplifies the process of system compliance, with solutions designed to address the requirements of automotive and industrial functional safety standards • Reduces the time and complexity required to develop safety systems that comply with ISO 26262 and IEC 61508 standards • Supports the most stringent Safety Integrity Levels (SILs),enabling designers to build with confidence • Zero defect methodology from design to manufacturing to help ensure our products meet the stringent demands of safety applications TM External Use 4 The Right Technology Partner TM External Use 5 SafeAssure - Simplification • SafeAssure products are conceived to simplify system level functional safety design and cut down time to compliance • Component safety measures augment system level safety measures • Key functional safety activities addressed − Safety analysis (FMEA, FTA, FMEDA) − Hardware integration (Safety Manual) − Software integration (Safety Manual) − Support interface (Roles & Responsibilities) TM External Use 6 History of Auto MCU Functional Safety Solutions • Gen 1 Safety More than 10 years experience of safety development in the area of MCU & SBC • Gen 2 Safety First general market MCU, MPC5643L Certified ISO 26262! • Gen 3 Safety From 2012, multiple MCUs in Body, Chassis and Powertrain are being designed and developed according to ISO 26262 2012 MPC5744P/MPC5777K/etc 55 nm PowerSBC • 32-bit Dual/Quad-Core MCU • Voltage Supervision • Developed according to ISO 26262 • Fail-Safe State Machine • Target Applications Chassis & P/T for – ASILD • Fail-Safe IO •Safe methodology, Architecture, SW and tools • Advanced Watchdog 2008 Safety 3 Gen MPC5643L – 90 nm PowerSBC • 32-bit Dual-Core MCU • Voltage Supervision • Developed according to ISO 26262 • Fail-Safe State Machine Functional SafetySolutions Functional • Target Applications for Chassis – ASILD • Fail-Safe IO • Advanced Watchdog 2000 Safety2Gen Custom Safety Platform for Braking Custom IC • Started to ship in 2000 first safe MCU for braking applications • IEC 61508 / ISO 26262 compliance achieved at system level (top down approach) Gen 1 Safety 1 Gen • MCU features are a key enabler for SIL3 / ASILD TM External Use 7 First ISO 26262 Certified MCU – Qorivva MPC5643L • Certified by exida – an independent accredited assessor • Certificate issued based on a successful assessment of the product design, applied development & production processes against requirements and work products of ISO 26262 applicable to a MCU • MPC5643L MCU certified for use for all Automotive Safety Integrity Levels (ASIL), up to and including the most stringent level, ASIL D TM External Use 8 Agenda • Functional Safety at Freescale • Functional Safety and Microcontrollers • MCU Safety Context and Safety Concepts • Dynamic FMEDA • Safety Manual TM External Use 9 The World of Functional Safety Standards 1980 1985 1990 1995 2000 2005 2010 2015 DO 178B DO 178C DO 178 ARP 4761 DO 254 DO 178A Aeronautic ARP 4754 ARP 4754A IEC 61508 EN 50155 EN 5012X Rail Transport EN 50159 Generic IEC 61508 IEC 61508 Standard Ed. 2.0 IEC61508 IEC 61508 IEC 61508 IEC 61511 Industrial ISO 13849 Ed. 2.0 Automation IEC 62061 (IEC 61508) ISO 26262 Automotive IEC 60601 Ed. 3.0 Medical Select Freescale products are being defined and designed from the ground up to comply with ISO 26262 and enabled for IEC 61508 Ed. 2.0 & ISO 13849 TM External Use 10 Comparison of Functional Safety Standards Functional Safety is the absence of unreasonable risk due to hazards caused by malfunctioning behavior of electrical / electronic systems ISO 26262 IEC 61508 ISO 13849 Automotive Industry Generic Industry standard, One of two European standard, adaptation of IEC applicable to electrical / Standards to achieve 61508 for electrical / electronic / programmable compliance with the electronic systems within electronic safety-related Machinery Directive road vehicles systems. 2206/42/EC Safety Integrity Levels Safety Integrity Levels Performance Levels ASIL A, ASILB, ASIL C, ASIL D SIL 1, SIL 2, SIL 3, SIL 4 a, b, c, d, e Publication date Publication date Categories 15 Nov 2011 Ed. 2.0 – Apr 2010 B, 1, 2, 3, 4 Ed. 1.0 - More than 10 years ago Freescale is strengthening its product development cycle, making functional safety an integral part of the process. TM External Use 11 Example Interaction Between Car OEM, Tier 1 & Tier 2 (Freescale) OEM Overall ISO 26262 compliance is achieved together, we each own a piece of the puzzle • Item definition • Hazard analysis and risk assessment • Safety Goals • Functional Safety Concept ISO26262 Safety Relevant Safety Manual & Requirements & scope of Safety Analysis ISO26262 DIA high Tier 1 Relevant • Safety Architecture scope of • Safety Concept ISO26262 • ASIL Classification of Functions medium Safety Manual & Safety Safety Analysis Requirements & DIA Tier 2 Supplier - Freescale • HW / SW offering Freescale Product Safety Measures (implemented in Functional Safety Focus offering, described in Safety Manual, Safety Element out of Context quantified/qualified by Safety Analysis) Development Process & Methods Foundation Quality & Quality Data TM External Use 12 MCU HW Component Developed as SEooC Safety Manual includes all HW & SW requirements on system level (Assumptions) as well as MCU Safety Concept description (4-6) MCU Safety Context (4-7) MCU Safety Concept MCU SEooC Safety Plan (5-6) MCU HW Safety Requirements (5-7) MCU HW Design Specification (5-7) Simulation Testing (5-8,9) MCU FMEDA (5-10) Silicon Testing Applicable to MCU HW Component developed as SEooC Reference ISO 26262-10:2012 TM External Use 13 Functional Safety Process – Definition to Test Major Mask Rev. change Product Revision Rev. 1.0 Minor Mask Rev. change Final Rev. for Production Product Definition Product Development Product Manufacturing Concept Feasibility Planning Execution Manufacture End of Life Product Life- Phase Prototype Pilot Certification Production Cycle PCG0 PCG1 PCG2 PCG3 First Build RTL Freeze Tape Out Validation PCG4 PCG5 Phase Gate TO cut 1.x M1 TO cut 2.x M2 M3 Milestone Start Lifecycle Alpha Beta Certified Start EOL EOL Define product type Functional Specification Product QM or ISO26262 ASIL Prototypes Compliant Functional Safety Assessment Report Safety Case Input Requirements Customer Documents Standard Product Product Electrical (7-5) Production Customer Requirements (PRD) Specification Data Sheet Testing Marketing Internal Reference Manual (4-6) MCU Safety (8-13) Qualification Context Safety Manual Testing Dynamic FMEDA (4-7) MCU Safety (5-10) Functional Fault Injection Testing Concept (5-8,9) Concept Validation Testing FMEDA MCU Architecture (5-6) MCU HW Safety (5-7) SoC Integration (ADD) Fault Injection Testing Requirements & Testing (5-7) MCU HW (5-7) IP Block Fault Injection Testing Design Specification Verification Testing Implement Diagram Color Schema Development Flow Input Document Safety Requirement Traceability Functional Documentation Safety Documentation Simulation Testing Silicon Testing TM External Use 14 Know Your Safety System Context How to make the system safe? • Optimal partitioning between Safety System HW & SW measures scaled to complexity of vehicle safety function − Simple Safety Functions are implemented on a high abstraction level (vehicle & ECU) − Complex* Safety Functions are implemented using a combination of low (MCU HW) and high abstraction level (vehicle & ECU) Simple Safety Complex Safety Function (e.g. EPS) Function (e.g. Airbag) ASIL D target * A Complex Safety Function (vehicle Safety System level) here refers to the combination of a ASIL C target EPS, ESP, RADAR andHW & SW high computational demand for the Engine Airbag, Vision based application combined with a short Management Body, DIS… ASIL B target ADAS… control cycle. MCUHEV… HW ASIL A target TM External Use 15 The Solution • Offering products scaled to vehicle safety function complexity from across the Freescale product portfolio − ISO 26262 developed products cover the complete range − Standard products cover systems with simple safety functions . Where we enable the customer to do the Qualification, testing and analysis to prove that our component is suitable for the purpose of his safety concept. Complex Safety Function Simple Safety Function ASIL D target Safety System HW & SW ASIL C target EPS, ESP, SafeAssure SafeAssure RADAR and Standard HW Engine SEooC HW Airbag, DevelopedVision based for Enabled for ASIL B target ManagementMCU Body, DIS… ISOADAS… 26262 ISO 26262 HEV… (10.9 Safety Element out of Context) (8.13 Qualification of HW Hardware Components) ASIL A target Covering the whole TM range efficiently … External