When a Bit Flips: Soft Errors and Automotive Safety

An airbag control unit decides within milliseconds whether the deceleration it measures is a crash. One of the numbers behind that decision is a threshold. Like many calibration values, it is stored in flash and copied into RAM at start-up, because the algorithm reads it continuously. In our invented unit the word holds 3200.

On a motorway, a neutron passes through the car and through the microcontroller. It hits a silicon nucleus next to the memory cell that holds bit 11 of that word, the recoil leaves a trail of charge, and the cell flips. The threshold now reads 1152, about a third of what it should be. Until the next start-up copies the table again, a hard pothole looks far more like a crash to the algorithm than it should. Real airbag systems add an independent safing path for reasons like this one; we leave it out to keep the example small.

Nothing in the chip is damaged. If the unit came off the car an hour later and went through every test its supplier owns, it would pass every one. That single property is what makes soft errors a topic of their own in functional safety.

A fault without a defect

ISO 26262-1:2018, Clause 3 defines a transient fault as one that happens a single time and is then gone, and it counts soft errors such as single event upsets among them. The cause is a particle. Neutrons come from cosmic rays breaking apart in the upper atmosphere, and the flux grows with altitude. Alpha particles come from traces of radioactive elements in the chip's own package and solder. Either can deposit enough charge on a small node to change its state. Afterwards the circuit works exactly as designed. It just holds the wrong value.

Most of what the industry does to make hardware dependable is aimed at defects. Wafer probing, final test, burn-in, the ECU end-of-line test and the self-test at every start-up all look for structures that do not work: an open via, a shorted gate, a cell that cannot hold its state. Each stage screens out part of the defective population, so fewer and fewer broken parts reach the road.

Soft errors take no part in that screening. They are not in the part when it is tested. They arrive later, at a rate set by the particle flux, the altitude, the silicon technology and the package, and no amount of testing moves that rate. A test that runs after the strike meets a healthy cell. That is also why an airbag unit affected by a soft error goes back to the workshop and comes out with no fault found.

Where ISO 26262 puts them

Because the cause is random and the rate can be measured, the standard treats radiation-induced soft errors as random hardware faults. ISO 26262-11:2018, Clause 4.6 explains how to quantify them: a base failure rate from measured data, stated together with the conditions it was measured under, with the JEDEC JESD89 test standard as the main reference. The same clause draws a line that surprises people. Transients caused by electromagnetic interference or crosstalk are treated as systematic, because careful design avoids them, and they get no failure rate at all.

On the hardware side, ISO 26262-5:2018 makes transient faults part of the work wherever the technology makes them relevant, which for automotive microcontrollers with large on-chip RAM is the normal situation. The hardware safety requirements have to cover the internal safety mechanisms for them (Clause 6), and the architectural metrics have to account for them, either through a dedicated target for the single-point fault metric or through a reasoned argument that the mechanisms work (Clause 8).

What this means for the design

If testing cannot remove a fault, the design has to live with it. For the airbag unit, the crash threshold cannot be trusted just because it was loaded correctly at start-up. The check has to sit close to the moment the value is used, in a mechanism that sees the corruption, such as error-correcting code on the RAM or a second copy of the table compared before each decision. Whatever the mechanism, it is its coverage against this kind of fault that the hardware metrics credit.

That is why soft errors belong to the people who write safety requirements, not only to chip designers. An engineer who reads a passed start-up memory test as proof that the memory is good has quietly assumed that every fault waits around to be found.

The Soft Errors & Transient Faults concept page goes much deeper: the particle physics and the circuit structures most at risk, how soft error rates get measured, the masking effects that keep most upsets harmless, the countermeasures and where each one stops working, the ISO 26262 rules for transients, a transient FMEDA calculated step by step, and the mistakes and assessor questions that sink these analyses in review.