Title: FPGA Safety | ISO 26262 Academy
URL: https://iso26262.academy/features/concepts/fpga-safety
Description: Hardware whose circuit is data: configuration upsets and essential bits, scrubbing against the FTTI, TMR in the fabric, HDL discipline, tool confidence, and the FPGA FMEDA that closes the safety case.

---
Concept guide · ISO 26262-11 · 14 chapters

# FPGA Safety

Bring programmable logic into an ISO 26262 safety case: master the configuration-fault model, scrubbing and TMR, HDL discipline, tool confidence, and the FPGA FMEDA.

14

Chapters

3

Fault Classes

10

Program Pitfalls

2

Safety Case Pillars

Included in Expert

[Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Ffpga-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters

Inside the course

1. 01 **Why FPGAs End Up in Safety Systems**
2. 02 **What Is Actually Inside an FPGA**
3. 03 **Where FPGAs Fit in ISO 26262**
4. 04 **The Programmable Logic Fault Model**
5. 05 **Configuration Memory Upsets**

The short version

## Quick answers

Why do FPGAs need a dedicated safety approach under ISO 26262?

An FPGA is hardware whose circuit is data: the logic function is defined by millions of configuration memory bits loaded at power-up. A radiation-induced upset in that memory does not just corrupt a value - it can rewire the design, changing routing or logic until the next repair. That creates a fault class microcontroller-centric methods never model, alongside the usual permanent and transient hardware faults. ISO 26262-11 provides the semiconductor-specific guidance, and this course turns it into a concrete workflow: fault model, upset budgeting, scrubbing and TMR, HDL discipline, tool confidence, verification and the FPGA FMEDA.

What are essential bits and why do they matter?

Only a fraction of the configuration bits of an FPGA actually affect the implemented design; vendors call these essential bits, and a smaller subset is functionally critical for the safety application. The essential-bit funnel narrows the raw upset rate down to the failures that matter, which is what makes the FIT budget realistic instead of hopeless. The course includes an interactive estimator showing why, at high ASIL, mitigation of configuration upsets is not optional.

Keep going, free

- [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam)

Why this course · ISO 26262, Part 11

## Why it pays for itself

### A fault model MCU habits miss

On an FPGA the circuit itself is stored in configuration memory, so a single bit flip can rewire your design. Learn the fault model, the essential-bit funnel and the FIT arithmetic that make this tractable.

### Mitigations with honest limits

Scrubbing repairs, TMR masks - and each has failure modes of its own. The course teaches readback vs blind scrubbing, detection latency against the FTTI, voter subtleties and the common-cause limits of a single die.

### Evidence for the whole flow

From HDL coding guidelines that become checkable evidence, through Part 8 tool confidence for synthesis and place and route, to the resource-based FMEDA and the vendor deliverables an assessor will ask for.

After the course

## What you’ll be able to do

### Model Programmable-Logic Faults

Classify permanent, transient and configuration faults resource by resource, including SEFI and multi-bit upsets, and place each class correctly in the safety analysis.

### Budget and Mitigate Configuration Upsets

Walk the essential-bit funnel, estimate the FIT contribution of configuration memory, and justify why scrubbing or masking is mandatory at high ASIL.

### Design Scrubbing and TMR That Hold Up

Choose readback vs blind scrubbing, do the detection-latency arithmetic against the FTTI, and respect voter subtleties and the common-cause limits of single-die redundancy.

### Run a Disciplined HDL and Tool Flow

Apply CDC, reset and FSM coding guidelines as checkable evidence, and build a Part 8 tool confidence argument for synthesis and place and route.

### Verify with Fault Injection

Climb the verification ladder from module simulation to on-device validation, and use fault injection to prove mechanisms and measure diagnostic coverage.

### Assemble the FPGA Safety Case

Build the resource-based FMEDA, collect the vendor deliverables, argue the two pillars of random and systematic integrity, and avoid the ten classic program pitfalls.

The curriculum · 14 chapters

## Chapter by chapter

1. 01
   **Why FPGAs End Up in Safety Systems**
   What an FPGA is, where programmable logic actually sits in vehicles, the MCU vs FPGA vs ASIC decision, and why safety engineers need a dedicated treatment for this device class.
   - MCU vs FPGA vs ASIC
   - Automotive use sites
   - Why a dedicated treatment
2. 02
   **What Is Actually Inside an FPGA**
   The fabric under the abstraction: logic and routing resources, embedded memory and the configuration memory whose bits define the circuit itself - the anatomy every later chapter builds on.
   - Fabric resources
   - Configuration memory
   - Circuit as data
3. 03
   **Where FPGAs Fit in ISO 26262**
   Programmable logic through the lens of Part 11 and Part 5: which clauses apply, how the hardware and systematic tracks divide the work, and what assessors expect to see.
   - Part 11 guidance
   - Part 5 metrics
   - Two development tracks
4. 04
   **The Programmable Logic Fault Model**
   Permanent, transient and configuration faults, resource-by-resource failure modes, SEFI and multi-bit upsets, and the persistence spectrum that decides how each fault class enters the safety analysis.
   - Three fault classes
   - SEFI & multi-bit upsets
   - Persistence spectrum
5. 05
   **Configuration Memory Upsets**
   Where the upsets come from, the essential-bit funnel from raw bits to functionally critical ones, and a FIT budget estimator showing why mitigation is not optional at high ASIL.
   - Essential-bit funnel
   - FIT budgeting
   - Mitigation is mandatory
6. 06
   **Scrubbing: Repairing the Fabric in Flight**
   Readback vs blind scrubbing, internal vs external scrubbers, the detection-latency arithmetic against the FTTI, and the honest list of what scrubbing does not do.
   - Readback vs blind
   - Latency vs FTTI
   - Scrubbing limits
7. 07
   **TMR and Redundancy in the Fabric**
   Why masking complements repair: the TMR variants, voter subtleties, duplication with comparison, and the common-cause limits of redundancy living on a single die.
   - TMR variants
   - Voter subtleties
   - Single-die common cause
8. 08
   **Detecting Faults and Reaching the Safe State**
   The detection and reaction chain for programmable logic: turning raw fault indications into a coordinated response that reaches the safe state within the FTTI.
   - Detection chain
   - Safe-state reaction
   - FTTI discipline
9. 09
   **HDL Development and Coding Guidelines**
   The systematic-fault side: the V-model for programmable logic, the guideline categories that matter - CDC, resets, FSMs, style, pragmas - and how guidelines become checkable evidence.
   - V-model for HDL
   - CDC & reset rules
   - Checkable evidence
10. 10
    **Tool Confidence for Synthesis and Place & Route**
    Why the FPGA flow concentrates the Part 8 tool confidence problem: a tool-by-tool impact and detection analysis, qualification routes, and operational discipline around tool versions.
    - TI/TD per tool
    - Qualification routes
    - Version discipline
11. 11
    **Partial Reconfiguration and SoC FPGAs**
    Rewriting part of the fabric while the rest runs: uses, risks and mitigations, isolation between regions, and the safety anatomy of devices pairing hard processor systems with programmable logic.
    - Partial reconfiguration
    - Region isolation
    - SoC FPGA anatomy
12. 12
    **Verifying an FPGA Safety Design**
    The verification levels from module simulation to on-device validation, coverage discipline, and fault injection as the special weapon of the FPGA for proving mechanisms and measuring diagnostic coverage.
    - Verification ladder
    - Coverage discipline
    - Fault injection
13. 13
    **The DO-254 Crossover**
    For engineers arriving from avionics hardware assurance: what maps between DO-254 and ISO 26262, what does not, and the culture shocks in both directions.
    - DO-254 vs ISO 26262
    - What maps
    - Culture shocks
14. 14
    **FMEDA, Safety Case and Pitfalls**
    Assembling everything: the resource-based FPGA FMEDA, the vendor deliverables checklist, the two-pillar safety case, and the ten mistakes that define failed FPGA safety programs.
    - Resource-based FMEDA
    - Vendor deliverables
    - Ten pitfalls

Interactive Diagrams

## Not just text: the visual toolkit

### Essential-Bit Funnel

From total configuration bits down to the essential and functionally critical bits that actually matter for the FIT budget.

### FIT Budget Estimator

Interactive estimate of configuration-upset contributions, showing why mitigation is not optional at high ASIL.

### Tool-by-Tool TI/TD Analysis

Impact and detection analysis across the synthesis and place-and-route flow, feeding the Part 8 tool confidence argument.

Built for

## Who this guide is for

- FPGA designers whose device just landed in an ASIL-rated item
- Safety engineers who know microcontrollers but not programmable logic
- Hardware leads choosing between MCU, FPGA and ASIC for a safety element
- Engineers arriving from DO-254 avionics work who need the ISO 26262 mapping

## Frequently Asked Questions

Common questions about FPGA Safety

Usually both, because they solve different problems. Scrubbing detects and repairs configuration upsets, but its detection latency must be argued against the FTTI and it cannot fix what it has not yet reached. TMR masks faults instantly through majority voting, but the copies share one die, one clock tree and one configuration mechanism, so common cause limits the credit. The course covers readback vs blind scrubbing, internal vs external scrubbers, TMR variants and voter subtleties, and how the combination appears in the FMEDA.

The FPGA flow concentrates the Part 8 tool confidence problem: synthesis and place and route silently transform your verified HDL into the bitstream that actually runs, and errors there are hard to detect downstream. The course walks a tool-by-tool impact and detection analysis, the realistic qualification routes, and the operational discipline - frozen versions, controlled settings, reproducible builds - that keeps the argument alive across releases.

The course has 14 chapters covering the device anatomy, the ISO 26262 fit, the programmable-logic fault model, configuration upsets and scrubbing, TMR and redundancy, fault detection and safe states, HDL guidelines, tool confidence, partial reconfiguration and SoC FPGAs, verification with fault injection, a DO-254 crossover for avionics engineers, and the closing FMEDA, safety case and ten program pitfalls. It is part of the concept library; a free account starts you off, and the Pro and Expert plans unlock more of the library.

## Start the course today

A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required.

[Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Ffpga-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)