ISO 26262 and Semiconductors

ISO 26262-11, added in the 2018 edition, is the guideline part on applying ISO 26262 to semiconductors. It exists because silicon breaks the assumptions of Parts 1 to 10: failure rates are not constant across the bathtub curve, transient soft errors dominate at advanced nodes, and an IC is almost always developed as a Safety Element out of Context, before any specific vehicle item exists. Part 11 covers digital, analog, programmable logic, multi-core SoC and sensor elements, with informative annexes providing worked examples - including the Annex C die-plus-package FMEDA, Annex D analog examples and Annex E programmable logic examples this guide walks end to end.

The Part 11 approach decomposes the IC into die and package contributions. Base rates come from handbooks such as SN 29500, IEC 61709 or FIDES, corrected for the mission profile, and the die rate is then allocated across functional blocks - CPU, SRAM, peripherals - with refinements beyond pure area proportionality. The Annex C worked example computes roughly 0.26 FIT for the die and 12.41 FIT for the package of a CMOS digital MCU, around 13 FIT total, with soft-error rates from the JEDEC JESD89 framework added separately because transient upsets scale differently with technology node than permanent faults do.

A chip is designed years before it lands in any specific vehicle item, so the IC vendor cannot know the actual safety goals - they develop it as a Safety Element out of Context (SEooC) against assumed requirements. Those assumptions are captured as Assumptions of Use (AoU) in the safety manual: testable, owned, dated statements about how the integrator must configure and use the device for the safety claims to hold. The integrator must verify every AoU in the real item context - typically through the Development Interface Agreement - and an unclosed AoU is one of the most common findings in a semiconductor safety assessment.

The workhorse mechanisms are memory protection (parity, SECDED ECC, scrubbing against accumulating soft errors), core-level redundancy (pure, delayed or asymmetric lockstep), structural self-test (LBIST for logic, ABIST for analog), and analog supervision such as window comparators on supplies. Each mechanism has a different diagnostic coverage profile for permanent versus transient faults - lockstep catches both, ECC handles transient bit flips, LBIST finds permanent faults only at test time - and shared clock, power, reset and substrate make dependent failures the default assumption, so a DFA against the Annex A coupling mechanisms accompanies any independence claim.

The guide has 12 chapters spanning failure physics in silicon, the Part 11 clause map, the five hardware element families, SEooC development, FIT quantification, on-chip safety mechanisms, dependent failure analysis, multi-core patterns, fault injection and EDA tool qualification, and the Part 11 work products - supported by more than 60 diagrams and tables. The Annex C, D and E worked examples are carried through end to end so the numbers stay reproducible. A free account starts you off, and the Pro and Expert plans unlock more of the library.