Roland Einspieler from magnetic position sensor supplier ams describes the measures it has taken to support the ISO26262 compliance programmes of automotive customers
Under the provisions of ISO26262, the new functional safety standard, automotive component manufacturers have to develop a new safety process flow for every new application that they support.
This means that, for a component that is specific to a single application, the component supplier has to implement one safety process flow.
The challenge is much greater for standard parts that can be used in multiple applications.
Every new standard sensor from ams is now developed in accordance with the process defined in ISO26262.
The aim is that every part should meet the target safety grading for every application in which a customer might use it. This means carrying out a different safety analysis for each potential application.
An important element of every ISO26262 development flow is the Failure Mode, Effects and Diagnostic Analysis (FMEDA), which establishes a device's critical failure mode.
The results of the FMEDA are affected by the safety requirements set by the customer for each application. In other words, this FMEDA will be done for each position sensor and for each application in which the sensor might be used.
For each application, it is possible to calculate the single fault metric, the latent fault metric and the FIT (failure in time) rate.
The FMEDA process flow identifies the limits for the four ASIL levels defined in ISO26262.
ASIL levels C and D are very tight limits needed for the safety requirements of high-risk applications such as in a brake pedal system, in which the sensor measures the position of the pedal in its travel. For this application, the ECU must detect every potential fault in the sensor.
For instance, if the sensor sets the output to a specified static signal, this 'error flag' will be detected by the ECU, which will then implement a pre-defined work-around to maintain the safety of the vehicle and its users.
If the position sensor happens to be a custom part developed for a specific customer, this FMEDA becomes an organic part of the chip development process.
For standard devices used in various applications, it is naturally harder to implement the FMEDA process. The ams has developed a two-step approach to FMEDA.
The first step measures how well the sensor fits the customer's safety goals. This FMEDA is an analysis of operation at the level of the IC.
The second step is in fact a second FMEDA: the purpose of this is to modify the customer's implementation of the device in order to achieve the required ASIL grade. This second analysis could result in changes at the chip level, but equally could entail the use of different external components or a reworking of the PCB layout.
The process of analysing the safety performance of a sensor does not stop here.
Customers are also supplied with a FIT rate calculation for each sensor.
For some applications, the sensor FIT rate alone can be enough to allow the customer to perform the required safety calculation, aggregating the FIT rate for each element of the application to produce a complete FIT rate for the whole application.
The FIT rate measures the average number of occurrences of failure in a device over 109 hours of operation (equivalent to 114,000 years). 1 FIT = 1 error in 109h.
The FIT rate for standard devices depends on the process technology, the die area and the operating temperature. In general, temperature is the factor that has the biggest impact on the FIT rate.
When designing a magnetic position sensor to meet functional safety standards, a key decision for the customer is the choice of either a single-die device or a redundant (dual-die) package.
Here, new 3D sensor technology plays an important role, and can measure displacement in the x, y and z axes. This technology is particularly useful to achieve compliance with ISO26262.
This is because the 3D sensors can reach ASIL B or ASIL C (depending on the application and the safety requirements of the customer) with a single die.
An internal safety tree in these 3D devices checks the device for every possible internal error every time it is started up.
In the most safety-critical applications, such as the pedals, however, a dual-die solution is mandatory.
Two sensors and two power supplies work in parallel, and a microcontroller compares the two outputs. If there is a discrepancy, the microcontroller detects an error.
A stacked-die technology has been developed by ams to meet this requirement, in which the two independent sensors are stacked in a single package.This ensures that both dies occupy the same magnetic field position, and so will generate the same measurement outputs when operating correctly.
Roland Einspieler is Senior Application Engineer (Magnetic Position Sensors) with ams AG
