A safety-critical chip is not judged only on working — it is judged on what it does when something breaks. To an ISO 26262 ASIL target, the design has to detect a dangerous fault and reach a safe state inside a defined fault-tolerant time, and prove it with diagnostic coverage, not assert it.
An automotive SoC that steers, brakes or senses cannot be certified on correct operation alone. ISO 26262 asks a harder question: when a transistor fails, a bit flips or a block latches up, does the chip notice, and does it reach a safe state before the fault can cause harm — within the fault-tolerant time interval the system allows?
Answering that means designing safety mechanisms into the silicon: redundancy, error detection and correction, lockstep, built-in self-test, monitors that watch the monitors. And it means quantifying them — an FMEDA that shows what fraction of dangerous faults each mechanism actually catches, mapped to the ASIL target.
So the programme runs safety as a first-class requirement alongside function: a safety architecture derived from the goals, diagnostic coverage engineered to the ASIL, and an FMEDA that signs the numbers rather than assuming them.
Stated before any of them had an answer.
A chip that works perfectly can still be unsafe if it cannot detect its own failures; safety is about the fault case, which normal testing never exercises.
The ASIL demands a measured fraction of dangerous faults detected; a safety mechanism whose coverage is asserted rather than computed does not meet the standard.
Detecting a fault is only useful if the reaction reaches a safe state within the fault-tolerant time; the diagnostics have a deadline, not just a job.
Redundancy, lockstep and BIST add area, power and complexity; meeting the ASIL without over-building is a genuine optimisation.
Safety is measured on the fault case, not the working one. The FMEDA proves that dangerous faults are detected and handled in time — to the ASIL, with evidence.
The scope of the work, rather than a capability list.
Rarely the subsystem that sounds difficult.
Normal design and test exercise the working chip; safety requires deliberately reasoning about every way it can break and proving each is handled, which is a different mindset.
An honest FMEDA is detailed and unforgiving; getting the diagnostic coverage numbers to genuinely meet the ASIL, not just on paper, is the core of the work.
A diagnostic that eventually detects a fault is useless if the reaction misses the fault-tolerant time; the timing has to be designed and proven, not assumed.
Every safety mechanism costs area and power; reaching the ASIL efficiently, rather than by piling on redundancy, is a real optimisation.
Dangerous faults caught and a safe state reached within the fault-tolerant time interval.
Diagnostic coverage computed by FMEDA and mapped to the target, with evidence.
Safety mechanisms themselves monitored, so a fault in the monitor does not go unseen.
A safety case assembled in the form the certification requires, not asserted after the fact.
Customer projects are presented at property, capability, outcome and integration level. Customer names, internal architecture, confidential deliverables and commercial terms are not disclosed. Where a detail would identify a customer it is omitted rather than approximated. More is available under a non-disclosure agreement, within the limits the customer has agreed.
Every item links to its own page.
ISO 26262, diagnostics.
SERVICEArchitecture to physical.
PLATFORMThe silicon platform.
SERVICEScan, BIST, ATPG.
TECHNOLOGYThe system around the SoC.
SERVICECoverage and formal.
It adds the requirement to handle failure. A conventional design is judged on operating correctly; ISO 26262 judges the chip on what happens when a component fails — whether a dangerous fault is detected and the system reaches a safe state before harm can occur, within a defined fault-tolerant time. That means designing and proving safety mechanisms for a fault case that ordinary testing never exercises.
Diagnostic coverage is the fraction of dangerous faults that a safety mechanism can actually detect. The ASIL target sets a required level, and the standard demands it be quantified rather than claimed — through an FMEDA that examines fault classes and computes what each mechanism catches. A mechanism that sounds thorough but has not been computed against real fault modes does not satisfy the requirement.
Because detecting a fault is only useful if the reaction is fast enough to prevent harm. The system defines a fault-tolerant time interval — the window between a fault occurring and it causing a hazard — and the chip's diagnostics and safe-state reaction must complete inside it. A diagnostic that eventually finds the fault but misses that deadline provides no safety, so the timing is designed and verified, not assumed.
Written for engineers. Share it with one.
Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.