IC-SUM24-PG14-16_Layout 1 05/06/2024 11:02 Page 15


WORKPLACE SAFETY TABLE 1. HARDWARE FAULT TOLERANCE


FRACTION OF AN ELEMENT


SAFE FAILURE 0 <60% 60% to <90% 90% to <99% ≥99%


TABLE 2. VARIOUS SIL LEVELS IEC 61508 SIL 1


SIL 2 SIL 3 SIL 4 Not allowed SIL 1 SIL 2 SIL 3


HARDWARE FAULT TOLERANCE 1


SIL 1 SIL 2 SIL 3 SIL 4 2 SIL 2 SIL 3 SIL 4 SIL 4


Table 3 shows the link between safe failure fraction (SFF) and SIL for a hardware fault tolerance of zero (HFT = 0).


PROBLEM/EXISTING SOLUTION


ISO 26262 ASIL A


ASIL B ASIL C/D


AVIONICS D


C B A


faults that could cause a loss of the safety function. It is worth pointing out that no account shall be taken of other measures that may control the effects of faults such as diagnostics. HFT is effectively a means to ensure the hardware is robust against failures while allowing you to trade off HFT vs. SFF. See Table 1.


SAFETY INTEGRITY LEVEL Figure 3. Systematic and random failures.


Redundancy is effectively having a spare or redundant path that is able to carry out the intended safety function in case a fault occurs within the safety system. It is worth noting that if a system has a level of redundancy, it does not automatically mean it has high availability. It only has high availability if the redundant path can be turned on or activated automatically. Another term commonly used within the IEC 61508 is called hardware fault tolerance (HFT). An HFT of N means the N + 1 is the minimum number of


TABLE 3. SIL AND SFF SIL


1 2 3 SFF 60% 90% 99%


SIL describes the integrity of a safety function and the relative level of risk-reduction provided. IEC 61508 specifies four SILs, SIL 1 having the lowest level of safety integrity and SIL 4 the highest level of safety integrity. Table 2 compares industrial IEC 61508 safety levels (SIL) to the automative (ISO 26262) safety levels (ASIL) and the avionics safety levels. Note these are only approximate comparisons. As the SIL level increases in number (from SIL 1 to SIL 4), the allowed failures in time (FIT) decreases. One FIT equates to one failure per billion (1e9) hours of operation. 1e9 hours ~ 100,000 years! It is worth pointing out that no device will last one billion hours of operation, but


HIGH DEMAND RATE DANGEROUS FAILURES PER HOUR


1e–5 (10,000 FIT) 1e–6 (1,000 FIT) 1e–7 (100 FIT)


THEORETICALLY ALLOWED DANGEROUS FAILURES


1 dangerous failure every 10 years


1 dangerous failure every 100 years


1 dangerous failure every 1,000 years


The problem for many designers employing functional safety, specifically those designing with ICs, is that it can be difficult and expensive to achieve certification along with the very real risk of non-compliance. A system-level FMEDA must be created, and they must treat ASICs as black boxes as they don’t know the:


Transistor count


Internal failure mechanisms Layout block sizes Reliability for an IC


As a result, designers must be overly conservative in their FIT calculations and overly safe in other parts of their safety system in order to achieve their overall SIL target. This generally means the use of external diagnostics like an external ADC. The problems with this are:


More expensive (BOM) Larger footprint More complexity


Additional overhead in system software Longer development time


To compound these problems, there is a new version of IEC 61508 standard coming out (Revision 3).


IEC 61508 REVISION 3


Currently planned changes in IEC 61508 Revision 3 include explicit warnings about the use of on-chip diagnostics to detect failures on the same chip unless the IC was developed in compliance to IEC 61508. It is also planned to include requirements similar to automotive ISO 26262 latent fault metric. In addition to a kind of SFF for diagnostic functions, the diagnostic circuiting will also have an SC requirement.


ADFS5758: WORLD’S FIRST CERTIFIED DATA CONVERTER


The ADFS5758 is a single-channel, 16-bit current out DAC with integrated dynamic power


Continued on page 16... INDUSTRIAL COMPLIANCE | SUMMER 2024 15


if you operate 100,000 devices for one year you can expect one random hardware failure in that time. Safe failure fraction (SFF) is a calculation of the total safe plus dangerous detected faults compared to the total faults in a safety function.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48