FPGA Safety

An FPGA is hardware whose circuit is data: the logic function is defined by millions of configuration memory bits loaded at power-up. A radiation-induced upset in that memory does not just corrupt a value - it can rewire the design, changing routing or logic until the next repair. That creates a fault class microcontroller-centric methods never model, alongside the usual permanent and transient hardware faults. ISO 26262-11 provides the semiconductor-specific guidance, and this course turns it into a concrete workflow: fault model, upset budgeting, scrubbing and TMR, HDL discipline, tool confidence, verification and the FPGA FMEDA.

Only a fraction of the configuration bits of an FPGA actually affect the implemented design; vendors call these essential bits, and a smaller subset is functionally critical for the safety application. The essential-bit funnel narrows the raw upset rate down to the failures that matter, which is what makes the FIT budget realistic instead of hopeless. The course includes an interactive estimator showing why, at high ASIL, mitigation of configuration upsets is not optional.

Usually both, because they solve different problems. Scrubbing detects and repairs configuration upsets, but its detection latency must be argued against the FTTI and it cannot fix what it has not yet reached. TMR masks faults instantly through majority voting, but the copies share one die, one clock tree and one configuration mechanism, so common cause limits the credit. The course covers readback vs blind scrubbing, internal vs external scrubbers, TMR variants and voter subtleties, and how the combination appears in the FMEDA.

The FPGA flow concentrates the Part 8 tool confidence problem: synthesis and place and route silently transform your verified HDL into the bitstream that actually runs, and errors there are hard to detect downstream. The course walks a tool-by-tool impact and detection analysis, the realistic qualification routes, and the operational discipline - frozen versions, controlled settings, reproducible builds - that keeps the argument alive across releases.

The course has 14 chapters covering the device anatomy, the ISO 26262 fit, the programmable-logic fault model, configuration upsets and scrubbing, TMR and redundancy, fault detection and safe states, HDL guidelines, tool confidence, partial reconfiguration and SoC FPGAs, verification with fault injection, a DO-254 crossover for avionics engineers, and the closing FMEDA, safety case and ten program pitfalls. It is part of the concept library; a free account starts you off, and the Pro and Expert plans unlock more of the library.