design functional safety compliant ecu
TRANSCRIPT
TM
External Use 1
Passive Safety
Active Safety
Predictive Safety
Evolution of Vehicle Safety Systems… And the Arrival of
Functional Safety
Functional Safety
Covers systems for
• Chassis & Safety
• Powertrain
• Body
Injury Free Accident FreeSemi Autonomous
Driving
2000-2010 2010-2020 2020-2030
Market trends
1. Vision zero - no fatalities
2. Safe Comfort & Asssistance
3. Green Technology
4. Automation
TM
External Use 2
Functional Safety & Standard
Automotive Industry
Adaptation of the Functional Safety standard IEC
61508 for Automotive Electric/Electronic Systems
Automotive Safety Integrity Levels
ASIL A, ASIL B, ASIL C, ASIL D
Publication date
Nov 2011
Generic Industry Functional safety of electrical
/electronic/ programmable electronic safety-related systems, applicable to all kind of industry
.
Safety Integrity Levels
SIL 1, SIL 2, SIL 3, SIL 4
Publication date
More than 10 years ago
Functional safety is the absence of unreasonable risk due to
hazards caused by malfunctioning behavior of electrical/electronic
systems.
IEC 61508 ISO 26262
TM
External Use 3
Functional safety is the absence of unreasonable risk due to
hazards caused by malfunctioning behavior of electrical/electronic
systems.
IEC 61508 ISO 26262
Generic Industry Functional safety of electrical
/electronic/ programmable electronic safety-related systems, applicable to all kind of industry
.
Safety Integrity Levels
SIL 1, SIL 2, SIL 3, SIL 4
Publication date
More than 10 years ago
Automotive Industry Adaptation of the Functional Safety
standard IEC 61508 for Automotive Electric/Electronic Systems
Automotive Safety Integrity Levels
ASIL A, ASIL B, ASIL C, ASIL D
Publication date
Nov 2011
Functional Safety & Standard
TM
External Use 4
Qualitative approach to (A)SIL computation
Class of severity Class of probability
of exposure
regarding operational
situations
Classes of controllability
C1
(simple)
C2
(normal)
C3
(difficult,
uncontrollable)
S1
(Light and moderate
injuries)
E1 (very low) QM QM QM
E2 (low) QM QM QM
E3 (medium) QM QM A
E4 (high) QM A B
S2
(Severe and life
threatening injuries
[survival probable])
E1 (very low) QM QM QM
E2 (low) QM QM A
E3 (medium) QM A B
E4 (high) A B C
S3
(Life threatening
injuries,
fatal injuries)
E1 (very low) QM QM A
E2 (low) QM A B
E3 (medium) A B C
E4 (high) B C D
(QM: “quality managed” no requirements from standard applied explicitly)
TM
External Use 5
Quantitative ASIL Requirements for HW
ASIL
B
ASIL
C
ASIL
D
PVSG
[1/h]
<10-7
recom.<10-7 <10-8
• Probability of violation of safety goals
• Values are total budget for whole system!
• uC typically receives 1% of total budget, i.e.
<10-10 for ASIL D
SPFM >90% >97% >99%
• Single Point Fault Metric
• Robustness of the item to single-point (and
residual) faults by coverage from safety
mechanisms, or by design
LFM >60% >80% >90%
• Latent Fault Metric
• Robustness of the item to latent faults by
coverage from safety mechanisms, by the
driver recognizing fault before violation of
safety goal, or by design
TM
External Use 6
AutomotiveISO 26262
IndustrialIEC 61508
Safety
Support
Safety
Process
Safety
Software
Safety
Hardware
IEC 61508
Generic Industry standard,
applicable to electrical / electronic /
programmable electronic safety-
related systems.
Integrity levels
SIL 1, SIL 2, SIL 3, SIL 4
Pub date: More than 10 years ago
Continuous Improvement
Process evaluation, assessments /
audits and gap-analysis exist to
ensure processes are continually
optimized
Safety Analysis
Selected products defined &
designed from the ground up with
safety analysis being done at each
step of the process
Assessments / Audits
Safety Confirmation Measures
Automotive Software
AUTOSAR OS & MCAL
Core Self Test
Device Self Test; Complex Drivers
Software Partnerships
Partnering with leading third-party
software providers for automotive
and industrial
People
Regional functional safety experts
Documentation
Safety Application Notes / Safety
Manual / FMEDA
ISO 26262
Automotive Industry standard,
adaptation of IEC 61508 for
electrical/electronic systems within
road vehicles
Integrity levels
ASIL A, ASILB, ASIL C, ASILD
Pub date: Target end 2011
Quality Management
ISO TS 16949 Certified Quality
Management System
Hardware - Zero Defects
Software – SPICE Level 3
Organization
Safety is an integral part of the
Freescale world wide organization
Project Management
Configuration & Change
Management, Quality Management,
Requirements Management,
Architecture & Design, Verification
& Validation
Microcontrollers
Lockstep Cores, ECC on Memories
Redundant Functions, Internal
Monitors, Built In Self Test, Fault
Collection & Control
Analog and Power Management
Voltage Monitors, External Error
Monitor, Advanced Watchdog,
Built In Self Test
Sensors
Timing Checker, Digital Scan of
Signal Chains, DSI3 or PSI5 Safety
Data links
Functional Safety Standards
Freescale Quality Foundation
SafeAssure Approach: The Four Key Elements
TM
External Use 7
Safety Process – What does the product adhere to?
Freescale QM
• Development process addresses quality at
component level
• Deliverables created available to the customer
• Safety Analysis of Architecture: Safety FMEA or
FTA
• User Guide: Safety Application Note
• Development Process evidence: PPAP, Quality
Plan (Mapping to ISO 26262 / IEC 61508
checklists)
ISO 26262 or IEC 61508
• Development process addresses quality &
functional safety at component level
• Deliverables created available to the customer
− Safety Analysis of Architecture: FMEDA or FTA
− User Guide: Safety Manual
− Development Process evidence: PPAP, Safety Plan, Certificates
TM
External Use 8
Safety Hardware – Quickly understand main
Safety features?
Main MCU Safety Measure
• Dual Core
− Lockstep
− Decoupled Parallel Mode
• Sphere of Replication
• Clock & Power monitoring
• ECC
• FCCU
• STCU (LBIST, MBIST)
Main Analog Safety Features
• Voltage & timing monitoring
• Independent Fail Safe Sate Machine
• STCU (ABIST, LBIST)
• FCCU Monitoring
• Advanced Watchdog (challenger)
Main Sensor Safety Features
• Frame counters, cyclic redundancy checkers, error-corrected NVMs, & clock monitors
TM
External Use 9
Safety Software – AutoSAR based software
Safety-Related Functional Components
• safety MCAL (sMCAL)
• safety Motor Control Lib (sMCLib)y Service Components
Safety Service Components
• Safety Library (SafeLib)
• Microcontroller Error Management
• Software support for FCCU, MEMU, LBIST, MBIST
• Hardware error collection
• Safety Error Reporting and Reaction
• safety Operating System (sOS)
HW Safety ComponentsSoftwarrtnrships
• safety Core Self Test (sCST)
• safety Peripheral Test Library (sPTLib)Partnering with leading third-party software providers for automotive and industrial
microcontroller
Safe
ty lib
rary
Operating system
sMCAL
sC
ST
/sD
ST
RTE
MCAL
Customer
Applicatio
ns
BSW
Com
p
lexsBSW
TM
External Use 10
Safety Support – FMEDA, Documentation & More
Freescale QM Products - Typical Deliverables
• Safety Analysis of Architecture: Safety FMEA or FTA
• User Guide: Safety Application Note
• Development Process evidence: PPAP, Quality Plan
(Mapping to ISO 26262 / IEC 61508 checklists)
ISO 26262 or IEC 61508 Products – Typical
Deliverables
• Safety Analysis of Architecture: FMEDA, CCA or FTA
• User Guide: Safety Manual
• Development Process evidence: PPAP, Safety Plan,
Certificates
Local Support
• Functional Safety Field Experts
Learning
• Field Training / workshops – delivered by Local
Functional Safety FAE Experts
TM
External Use 11
Safety Support – Safety Manual
Objective
• Enables customers to extract the full value of
Freescale’s functional safety offering
• Simplify integration of Freescale’s safety products
into applications
• A comprehensible description of all information
relating to FS in a single entity to ensure integrity of
information and links with datasheet
Content
• SoC Safety Concept description
• System level assumptions of use (Safety specific
usage considerations)
• Pseudo-code or C-Code to simplify adoption of safety
application requirements
• FMEDA results
− Latent Fault Matrix (LFM)
− Single Point Fault Matrix (SPFM)
− Probabilistic Metric for random Hardware Failures (PMHF)
• Provisions against Dependent Failures
Safety Manual for Analog Solution
Safety Manual for MCU Solution
Safety Manual for MPC574xP
TM
External Use 12
Safety Support – System Level Application Notes
Design Guidelines for
• Integration of Microcontroller and Analog &
Power Management device
• Explains main individual product Safety
features
• Uses a typical Electrical Power steering
application to explain product alignment
• Covers the ASIL D safety requirements that
are satisfied by using both products:
− MPC5643L requires external measures to
support a system level ASIL D safety level
− MC33907/08 provides those external measures:
External power supply and monitor
External watchdog timer
Error output monitor
TM
External Use 13
Target Market Product Type Product Target ApplicationsSafety
ProcessSafety Hardware Safety Software Safety Support
Automotive
Processors S32V230
Front View
Reverse View
Surround View
Data Fusion
ISO 26262
Targets ASIL B
Integrated Safety
Architecture:
ECC, LBIST & MBIST,
replicated peripherals,
clock and voltage
monitoring, Memory
protection, FCCU
Core Self Test
AUTOSAR
MCAL
FMEDA
DFA
Safety Manual
Microcontroller
s
MPC577xK
77 GHz RADAR System
Adaptive Cruise Control
Surround View Park Assist
System
Blind Spot Detection
Cross Traffic Alert
Autonomous Emergency Braking
Systems
Side Impact Assistance
Sensor Fusion
ISO 26262
Targets ASIL D
Integrated Safety
Architecture:
Multicore delayed
lockstep, e2e ECC,
replicated peripherals,
LBIST & MBIST, FCCU
AUTOSAR
MCAL
Structural Core
Self Test
FMEDA
Safety Manual
MPC5748G
Battery Management
High End Body Control Module
Infotainment Gateway
Central Gateway / In-Vehicle
Networking
ISO 26262
Targets ASIL B
Integrated Safety
Architecture e.g.:
Multicore, e2eECC,
LBIST & MBIST, clock
and under voltage
monitoring, FCCU
FMEDA
Safety Manual
MPC5777M
Direct Injection Engines
Common Rail Diesel Injection
Systems
Electronically Controlled
Transmissions
Diesel Engine Management
Gasoline Engine Management
ISO 26262
Targets ASIL D
Integrated Safety
Architecture e.g.;
Dual core, delayed
lockstep, e2eECC,
replicated peripherals,
LBIST & MBIST, FCCU
FMEDA
Safety Manual
SafeAssure Products
To view the latest SafeAssure product table visit www.freescale.com/SafeAssure
TM
External Use 14
HW Example:
MPC5643L Safety Mechanisms
14
Fault Collection Unit
• detects when errors
have occurred
• indicates error to
external
• independent of
software operation
Flash
• ECC
RAM
• ECC
Temp Sensor
• redundant
CRC Unit
• Application Signature
Flexray
PMU
• internal Vreg
• redundant Vmonitor
Sphere of Replication:
• Replicated e200Core
• replicated eDMA
• redundant INTC, SWT, etc
• redundant MMU
• RC Units at Gates to non
redundant sphere
Clock Monitoring
• Detects and mitigates
clock disturbances
• PLL
Timer
• eTimer0 channels
“isolated”
ADC
• On Line Assisted
Hardware BIST
XBAR + MPU:
• redundant
• RC Units at Gates to non
redundant sphere
Cross Bar Switch
I/OBridge
BA
M
Memory Protection Unit
Cross Bar Switch
Memory Protection Unit
FlexRay
RC
FlexRay
RC
RC RC
FLASH(ECC)
SRAM(ECC)
RC
I/OBridge
SS
CM
FLP
LL
FM
PLL
IRC
OS
C
CM
U
CM
U
CR
C
PIT
MC
XO
SC
SIU
WA
KE
TS
EN
S
TS
EN
S
AD
C
AD
C
CT
U
Fle
xP
WM
eT
IME
R
eT
IME
R
eT
IME
R
Fle
xC
AN
Fle
xC
AN
LF
LE
X
LF
LE
X
DS
PI
DS
PI
DS
PI
FC
CU
SWT
MCM
STM
INTC
eDMACACHE
PowerPC™e200
MMU
VLE
CACHE
FPUNexus
JTAG
Debug
Nexus
JTAG
Debug PMU
SWT
MCM
STM
INTC
eDMACACHE
PowerPC™e200
MMU
VLE
CACHE
FPU
TM
External Use 15
MPC5643L and the Failure Classes
• Single Point Failure (SPF)− Structural redundancy
Core, cache, bus, DMA, INTC, watchdog, RAM-Ctrl, Flash-Controller
− Information redundancy
ECC on system RAM and Flash
• Latent Failure (LF)− HW-Self test
Memory, logic, some peripherals
90% coverage
• Common Cause Failure (CCF)− Measures according to IEC61508-2 Ed.2 Annex E
− Supervision of clock, power and temperature
− Independent safety clock
− Independent failure signaling
inp
ut
wro
ng
ou
tpu
t
Component
inp
ut
Component
Co
mp
ara
tor
Component
OK
inp
ut
co
rrec
t
ou
tpu
t
ComponentLF
TM
External Use 16
First ISO 26262 Certified MCU – Qorivva MPC5643L
• Certified by exida – an independent
accredited assessor
• Certificate issued based on a successful
assessment of the product design and
applied development and production
processes against all requirements and
work product definitions of ISO 26262
identified as applicable to an MCU part
• MPC5643L MCU certified for use for
all Automotive Safety Integrity Levels
(ASIL), up to and including the most
stringent level, ASIL D
Released on 6th September, 2012
TM
External Use 17
ISO 26262 Assessment and Audit Summary
• Assessment of the MPC5643L Safety Case
• Assessment and audit of Freescale’s
development processes used for the
MPC5643L
• Assessment of the FMEDA (Failure Modes
Effects and Diagnostic Analysis) of the
MPC5643L to confirm it satisfies the SPFM,
LFM and PMHF metrics required for ASIL D
• Assessment of the MPC5643L hardware
design, implementation and verification
activities
• Over 50 work products were provided to
exida during the assessment and on-site
audits
MPC5643L MCU
TM
External Use 19
ASIL-D System Design with Freescale
• MCU with Highly integrated Safety architecture
• Power SBC separate watchdog, fail safe check
• FMEDA-FTA-Safety manual
• AutoSar developed as per ISO26262
Safety Functions: Locked Steering or Unintended Steering
MPC5643L
Qorivva
Core
Sin-Cos Physical Layer
Ucos
Usin
q
Uref
Vd
c3-Phase
Low
Voltage
Power
Stage PWM Isa
Isc
U_Dc bus
Isb
U_D
c b
us
Motor
Dif ferential
Amplif ier + Filter
ADC
TIMER
PWM
Cross Triggering Unit
FCCU
NVMRAM
=
Qorivva
Core
IO bridge
Bus Bus
PowerSBC 2010 Failsafe Outputs
Fails
afe
Inp
uts
VCORE
VCCFCCU[0]FCCU[1]
FS[0]
RST
MOSI
SCLK
MISO
PMC/ RGM
Sphere of redundancy
SPI
FAlL SAFE Machine, Voltage
Monitor & Watchdog
TM
External Use 20
SafeAssure MCU Product – MPC5744P
ISO 26262 ASIL D
• Safety assessment of MCU architecture and
development process (ISO 26262)
• helps to reduce effort and time on ECU
functional safety assessment
Integrated Safety Architecture (ISA)
• Saves development effort and time as no
complex diagnostic SW required
• CPU processing power available for running
applications
• High diagnostic coverage in HW to detect
random faults
SW deliverables provided by Freescale and
partners
• Enable support for ASIL D applications with
minimized performance degradation
• sMCAL & sOS, Selftests, SW Safety Manual
Safety enablement provided by Freescale
• Safety Manual
• FMEDA
• System Level Appication Note
TM
External Use 21
Panther 2.5 MB
Core
• Dual up to 180 MHz PowerTM ISA e200 zen4 core ( Z420)
• 32 bit Reg File, 64 bit BIU with E2E ECC,
• 64kB RAM of D-LMEM with MPU for fast context switch + local data
• 8KB 2-way I-cache / 4KB 2-way D-Cache
• 1x Scalar FPU (compiler supported) per core
• Safety enhanced Cores – VLE only
• No Signal processing unit extension + NO MMU
• Delayed Lock Step configuration only
Memory
• 2.5 MBytes NVM with ECC (with add. Safety measure for address).
• 64kB EEE (Data Flash) available incl. ECC
• Up to 384 Kbyte global system SRAM with ECC (Addr + Data)
I/O
• 3 x FlexCAN (64+2x32 message buffers)
• 1 x FlexRay (Dual Channel 64 msg. buffers)
• 2 x LINFlex (Uart/Lin protocol driver)
• 4 x DSPI (4 cs each)
• 2x FlexPWM (2x 12ch for 2 independent Motors Controlled)
• 3 x eTimer modules (18 channel total)
• 4 x SAR ADC – 1MS/s target 5V input capable
• 2 x Cross-triggering unit for motor control automatism
• 2x SENT
System
• Interprocessor I/F SIPI (– approx 300Mbaud)
• Safe DMA
• Fault Collection unit, WDG, T-sens, & CRC computing unit
• Nexus debug interface – Aurora
• Dual-PLL (Peripheral + System Core)
• 3.3 V Single supply: internal regulator with external power stage or External supply
• 3.3 V I/Os (ADC 5 V capable)
• 144 LQFP / 257 MAPBGA 0.8 mm pitch
• Tj = 150°C . Extended Temperature at 165”C Option (separate P/N)
Cross Bar Switch –E2E ECC (Addr+Data)
Memory Protection Unit – 32 regions
2.5 M
FLASH (I/D)
(A+D ECC)
PMU
SWT
MCM
STM
INTC
CACHE
PowerPC™
e200
VLE
S-FPU
DLMEMNexus/
Aurora
JTAG
Debug
CACHE
PowerPC™
e200
Safety
CheckerVLE
S-FPU
2 x
LIN
Fle
x
4 x
DS
PI
4 x
AD
C
3
Fle
xC
AN
3 x
eT
imer
FC
CU
2 x
Fle
xP
WM
2x C
TU
2 x
TS
EN
S
I/D-cache
384 KB
SRAM
(A+D ECC)
FlexRaySIPI
2 x
SE
NT
Safe
eDMASafety Lake
I/O
BridgeSRAM Ctrl
Multi Ported
Flash ctrlI/O
Bridge
I/O
Syste
m
Crossbar Slaves
Ethernet
TM
External Use 22
Summary
• The automotive industry are increasingly requiring functional safety solutions.
• Freescale is the right expert safety partner for our customers next-generation
safety-critical applications
• Freescale’s SafeAssure program are conceived to simplify system-level
functional safety design and cut down time to compliance
• Freescale’s SafeAssure program is built on four key elements: safety process,
safety hardware, safety software and safety support.
• The SafeAssure program is about the complete functional safety solutions, it
includes microcontrollers, sensors, analog and power management ICs.
• MPC5643L is the first ISO 26262 Certified MCU
• For more information, visit www.freescale.com.
TM
© 2015 Freescale Semiconductor, Inc. | External Use
www.Freescale.com