Title: Soft Errors & Transient Faults | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/soft-errors Description: A cosmic ray hits a memory cell and your ASIL D function computes with a wrong value. --- Concept guide · ISO 26262-11 + -5 · 12 chapters # Soft Errors & Transient Faults A single cosmic-ray neutron or a package alpha particle can flip a bit in your ASIL D microcontroller and leave the silicon undamaged. This concept takes you from the physics of radiation-induced bit flips through the full single event effect zoo, ECC and hardened design, to a reproducible ISO 26262 Part 11 transient FMEDA. 12 Chapters 10 Single-Event Effects 6 Hardening Layers 1 Worked Transient FMEDA Included in Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsoft-errors&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **When a Bit Flips** 2. 02 **Where the Particles Come From** 3. 03 **The Single Event Zoo** 4. 04 **Silicon Sensitivity & Measuring SER** 5. 05 **From Raw SER to Effective Failure Rate** The short version ## Quick answers What is a soft error in ISO 26262? A soft error is a transient fault in which an ionizing particle - typically an atmospheric neutron from cosmic-ray cascades or an alpha particle from package materials - deposits enough charge to flip a storage node's state while leaving the transistor physically undamaged. The corrupted bit clears on rewrite or power cycle, unlike a permanent stuck-at fault. ISO 26262 treats soft errors as transient faults to be analyzed separately from permanent faults: Part 5 anchors the quantitative treatment in the hardware metrics, and Part 11 (the semiconductor guidance added in the 2018 edition) details how single event effects are classified, measured, and carried into the FMEDA. What causes soft errors in automotive chips? Three terrestrial sources. Atmospheric neutrons from cosmic-ray cascades dominate at ground level and are effectively unshieldable - packaging or enclosures do not stop them. Alpha particles from trace uranium, thorium, and lead-210 in package materials strike from micrometres away, making low-alpha materials the countermeasure. Thermal neutrons are captured by boron-10 in the die (a capture cross-section of roughly 3800 barns), producing secondary ionizing particles. Sensitivity trends worsen with scaling: shrinking geometries and lower voltages reduce the critical charge per node while multi-bit upsets rise. JESD89 accelerated beam testing converts measured cross-sections into the FIT rates your analysis starts from. Keep going, free - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262, Part 11 ## Why it pays for itself ### A reproducible transient FMEDA Follow every multiplication of the three-factor pipeline - raw FIT, non-safe fraction, escape probability - through a complete worked FMEDA, so your own transient analysis has a template an assessor can audit. ### Size ECC and scrubbing correctly Choose SEC-DED versus stronger codes, set interleaving so multi-bit upsets become correctable single-bit errors, and pick scrub intervals that actually deliver the diagnostic coverage your FMEDA claims. ### Derating without cheating Apply masking and safe-fraction arguments while keeping base failure rates raw and every derating factor disclosed - the discipline that separates a defensible SER claim from an assessor finding. After the course ## What you’ll be able to do ### Tell transient from permanent faults Explain why a soft error clears on power cycle while a stuck bit does not, and book each on the right FMEDA side. ### Name and place every single event effect Distinguish SET, SEU, MCU, MBU and SEFI from destructive SEL, SEB, SEGR and SHE and classify them per Part 11. ### Size ECC, interleaving and scrubbing Choose SEC-DED versus stronger codes and set interleaving and scrub intervals to hit a transient coverage target. ### Derate raw SER without cheating Apply masking and safe-fraction arguments while keeping the base failure rate raw and every derating factor disclosed. ### Apply the ISO 26262 transient rules Pick a transient SPFM target or qualitative rationale and analyze transients separately from permanent faults. ### Run a full transient FMEDA Carry each element from raw FIT to residual rate, transient SPFM and a PMHF contribution you can defend to an assessor. The curriculum · 10 chapters ## Chapter by chapter 1. 01 **When a Bit Flips** What a soft error actually is: a particle deposits charge, a storage node flips state, but the transistor is left perfectly healthy, unlike a permanent fault. - Transient vs permanent: corrupted state, intact hardware - Why a power cycle clears it and a stuck bit does not - Critical charge and the node that lost its logic value 2. 02 **Where the Particles Come From** The three terrestrial radiation sources and why you cannot shield your way out of two of them. - Atmospheric neutrons from cosmic-ray cascades, unshieldable - Alpha particles from uranium, thorium and lead-210 in the package - Thermal neutrons captured by boron-10 at ~3800 barns 3. 03 **The Single Event Zoo** The full taxonomy of single event effects, from soft upsets to destructive latch-up, mapped onto how ISO 26262 books each one. - Soft side: SET, SEU, SBU, MCU, MBU, SEFI - Destructive side: SEL, SEB, SEGR, SHE - Why only the soft branch counts as a transient fault 4. 04 **Silicon Sensitivity & Measuring SER** How shrinking geometries and lower voltages change soft error behaviour, and how JESD89 accelerated beam testing turns cross-sections into FIT rates. - Critical charge falling while multi-bit upsets rise with scaling - Accelerated neutron and alpha testing per JESD89 - From measured cross-section to a raw FIT/Mbit number 5. 05 **From Raw SER to Effective Failure Rate** The masking and derating chain that separates raw upsets from failures that actually reach a safety goal, kept honest for the FMEDA. - Logical, electrical and latching-window masking - Architectural vulnerability factor and the safe fault fraction - Why the base rate must stay raw, with derating disclosed 6. 06 **Detecting & Correcting: Codes and Scrubbing** The error-code ladder from parity to symbol codes, plus interleaving, scrubbing and the gaps ECC silently leaves open. - SEC-DED at +8 bits per 64 as the safety-relevant default - Bit interleaving that turns MBUs into correctable SBUs - Scrubbing, address folding and CRC on configuration space 7. 07 **Hardening the Design** The six-layer defence-in-depth stack, from low-alpha packaging and DICE cells up to lockstep, TMR and system-level E2E. - Hardened DICE cells for 1-2 orders of magnitude lower upset rate - Lockstep CPU pairs and triple modular redundancy for the datapath - Software and system layers that encode application knowledge 8. 08 **What ISO 26262 Says About Transients** The normative anchor points in Part 5 and Part 11, and the eight distilled rules for treating transient faults correctly. - Dedicated transient SPFM target or a justified qualitative rationale - Transients analyzed separately from permanent faults - Radiation soft errors quantified; EMI transients stay systematic 9. 09 **Worked Example: A Transient FMEDA** A complete, reproducible transient FMEDA for a lockstep ASIL D microcontroller, every multiplication visible from raw rate to PMHF contribution. - Three-factor pipeline: raw x non-safe fraction x escape probability - 16 Mbit SRAM at 300 FIT/Mbit tamed by SEC-DED and scrubbing - Transient SPFM split across RAM, logic and configuration 10. 10 **System View, Pitfalls & Checklist** How transients propagate beyond the chip, plus the most dangerous FMEDA mistakes and the assessor questions you must be ready for. - Emerging trends: advanced nodes, safety islands, central compute - Forgetting configuration registers and error accumulation - Assessor checklist for safe-fraction and coverage claims Diagrams & Visuals ## Not just text: the visual toolkit ### Bit-Flip Charge Deposition Traces a single particle from strike to deposited charge to a flipped storage node while the transistor stays intact. ### Single Event Effect Family Tree Splits every single event effect into the soft transient branch and the destructive permanent branch as ISO 26262 books them. ### Masking & Derating Cascade Shows how logical, electrical and latching-window masking plus the safe fraction reduce raw upsets to residual failures. ### ECC, Interleaving & Scrubbing Map Illustrates how bit interleaving and periodic scrubbing convert clustered multi-bit upsets into correctable single-bit errors. ### Defence-in-Depth Hardening Stack Layers process and package, hardened cells, ECC, lockstep, software and system measures into one protection story. ### Transient FMEDA Pipeline Walks each element from raw FIT through non-safe fraction and coverage to a transient SPFM and PMHF contribution. Worked Example ## Transient FMEDA for a Lockstep ASIL D Microcontroller A fictional but realistic lockstep MCU subsystem implements an ASIL D torque-limitation function, sized so you can follow every multiplication. Each element is carried through the three-factor pipeline, from a 16 Mbit SRAM at 300 FIT/Mbit down to a residual transient failure rate, then rolled up into a transient SPFM and a PMHF contribution. - System SRAM: 4800 raw FIT, 50% safe fraction, SEC-DED plus 4-way interleaving and 1 h scrubbing at 99.9% DC - CPU lockstep flip-flops: 200 raw FIT, 60% safe by AVF fault injection, delayed lockstep with a layout-diverse shadow core at 99% DC - Configuration registers: 15 raw FIT, only 20% safe, register parity plus a 100 ms golden-image CRC at 90% DC - Flash controller buffers: 20 raw FIT, protected end-to-end by buffer and line ECC into the bus at 99% DC - Bus fabric, DMA and misc logic: 100 raw FIT, bus parity and DMA descriptor CRC with E2E on safety payloads at 95% DC - Residuals rolled up into a transient SPFM, split across RAM and logic, then folded into the PMHF budget Transient FMEDA Roll-Up (fictional lockstep MCU) System SRAM: 16 Mbit @ 300 FIT/Mbit -> 4800 raw FIT, 50% safe, SEC-DED + interleaving + scrubbing at 99.9% DC Unlock the full 5-element FMEDA table with residuals, transient SPFM split and the PMHF contribution Built for ## Who this guide is for - Hardware safety engineers who must add a transient column to their FMEDA - SoC and memory designers choosing between ECC schemes, interleaving, and scrubbing - FMEDA reviewers asked to judge a supplier's soft error rate derating - Engineers hearing "cosmic rays" in a design review and wanting the real physics ## Frequently Asked Questions Common questions about Soft Errors & Transient Faults Part 11 guidance requires transients to be analyzed separately from permanent faults, with either a dedicated transient SPFM target or a justified qualitative rationale. Only the soft branch of the single event zoo counts as transient - SET, SEU, SBU, MCU, MBU, and SEFI - while destructive effects like SEL, SEB, and SEGR are booked as permanent. Radiation-induced soft errors are quantified from measured rates; EMI-induced transients stay in the systematic fault domain. The course distills this into eight rules and applies them in a complete transient FMEDA where each element runs from raw FIT to its PMHF contribution. As diagnostic coverage claims with conditions attached. SEC-DED ECC (8 extra bits per 64) corrects single-bit and detects double-bit errors - but adjacent multi-bit upsets defeat it unless bit interleaving spreads physically neighboring cells across different code words. Scrubbing then bounds error accumulation: without periodic correction, two correctable single-bit errors can meet in one word and become uncorrectable, so the scrub interval directly affects the achievable coverage. The worked example carries a 16 Mbit SRAM at 300 FIT/Mbit through SEC-DED plus 4-way interleaving and hourly scrubbing to a 99.9% DC claim - with configuration registers and controller buffers handled separately, a classic gap the course flags. It runs 12 chapters from particle physics to sign-off: radiation sources, the 10 single-event effects and their ISO classification, silicon sensitivity and JESD89 measurement, masking and derating, ECC and scrubbing, the 6 hardening layers from low-alpha packaging up to lockstep and TMR, the ISO 26262 transient rules, and a system-level pitfalls chapter. The centerpiece is a fully worked transient FMEDA for a lockstep ASIL D microcontroller - five elements carried from raw FIT to transient SPFM and a PMHF contribution. A free account starts you off, and the Pro and Expert plans unlock more of the library. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsoft-errors&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)