Technology
›
Semiconductor & Chip Design
›
Automotive Chip Design
Functional Safety (ISO 26262)
Long-cycle design programs where IP, foundry, and ecosystem partnerships execute against tapeout and market windows.
Example organizations in this space:
Infineon
Renesas
NXP
STMicroelectronics
This interactive experience is the shipped product itself — the same application code customers run in production, mounted read-only in your browser over a real sample journey. Not a video, not a mockup: because the demo and the product are one codebase, it can never drift from the real thing.
Inside this journey
-
Pre-Sales
Qualify and diagnose technical and program requirements before committing to evaluation.
-
Stakeholder Qualification
Confirm program timelines, ASIL targets, sample needs, budget window, and decision-makers before investing in full technical discovery.
Qualification Questions
Program fit: ASIL target, sample needs, and scope
- What ASIL target are you aiming for for this ECU or safety function?
- Do you require hardware samples for evaluation, and if so which bracket fits your needs?
- Are there any hard integration, diagnostic, or FMEDA constraints we should be aware of before discovery?
Budget
- Is there an allocated budget range for component evaluation and qualification?
Authority
- Who signs off on selecting a semiconductor supplier for this ECU — choose the role that best represents the final approver?
- Can you confirm whether there is a single point of contact for scheduling discovery or if committee alignment is required?
Timeline and next step readiness
- What target milestone or OEM submission window is driving your qualification timeline?
- If we confirm alignment on ASIL, sample needs, budget range, and decision access, are you open to a one-hour technical discovery call in the next two weeks?
-
Technical Discovery
Map the buyer's ECU architecture, safety requirements, diagnostic expectations, and stakeholder constraints that drive qualification effort.
Discovery Questions
Quick project snapshot
- Which vehicle program timeline window best matches your current project?
- Who in your organization holds functional safety sign-off authority for ECU components?
- How many ECU variants, board revisions, or silicon SKUs are in the qualification scope today?
- Which ASIL target or targets must the ECU meet, and for which functions?
- If the program needed to compress qualification by about 6 months, what single element would you reduce or compress first to try to make that window?
Where the electronics architecture really matters
- If a single-point hardware fault in one ECU produced a system-level ASIL degradation, how would that change your integration priorities?
- Walk me through your current ECU partitioning for safety functions, including which domains, cores, and isolation boundaries you use.
- How many distinct communication buses carry your safety-critical messages, for example CAN, CAN FD, FlexRay, Ethernet TSN, or LIN?
- Indicate the team or role that manages bus arbitration and failover logic for those messages.
- What architecture limitation or constraint would force you to redesign ECU partitioning or select a different silicon path?
The hidden safety assumptions shaping your FMEDA
- Imagine a diagnostic assumption in your FMEDA failed during validation, which assumption would be most damaging to your ASIL claim?
- Describe the single-point fault metric and latent fault metric targets you use as pass criteria, including units (FITs, failures per hour, or rates you expect).
- How do you currently incorporate vendor FMEDA inputs into your system-level FMEDA, and who is responsible for adjusting supplier assumptions?
- Point to the FMEDA sections or failure modes you most often customize when integrating third-party silicon.
- What single missing piece of vendor evidence would cause you to pause a qualification decision for a device?
Diagnostics, trip behavior, and real failure handling
- When a hardware fault is detected at system level, how quickly must diagnostics remove the function or declare a safe state to keep your program on schedule?
- List the on-chip diagnostic modes you expect a supplier to expose, for example BIST, continuous monitoring, watchdog escalation, or power-on self-test.
- How often do you run fault injection in integration to validate diagnostic coverage, and what maximum failure escape rate do you accept?
- Indicate the role in your organization that owns the mapping from diagnostics to system reaction, and whether that responsibility is internal or handed to the OEM.
- Given a device that delivered 10 percent less diagnostic coverage than your target, would you continue integration, require compensating design measures, or stop?
Practical gates and hard stops before we begin
- Identify one integration dependency you do not currently have that would prevent a vendor-led evaluation from starting.
- List the third-party systems the device must connect to, and indicate whether public APIs, bus message specifications, or ODX/DBC files are available.
- Quantify your available integration capacity in engineer full-time equivalents, test bench hours per week, and available toolchain licenses.
- Indicate which role or team controls access to silicon samples, hardware test benches, and OEM submission queues within your organization.
- Can your team complete a compliance or legal review required before exchanging FMEDA inputs within four weeks?
The other options on your table
- Rank the alternatives you are evaluating, for example incumbent supplier, internal development, or other external vendors, in order of lowest risk to your launch date.
- For any incumbent or external vendor you listed, what conditions about their FMEDA and safety documentation would need to be true for you to keep them?
- Have internal teams proposed solving the safety requirements without an external supplier, and if so, what estimated timeline and headcount did they provide?
- Select the dominant factor that would keep you with your current approach instead of switching suppliers.
- Would identical hardware safety metrics from an incumbent, paired with no on-site engineering support, be acceptable or a deal breaker for your program?
Acceptance criteria that actually move you to a decision
- Name the single measurable acceptance criterion, if met in a 6-week pilot, that would cause you to sign terms that week.
- Select which evidence types you require in the safety documentation package before procurement, for example FMEDA, safety manual snippets, or dependent failure analysis.
- Specify the minimum number of independent test cases or sample runs you require to accept a hardware diagnostic claim.
- Identify the roles that must be present to approve the final mutual commit, including legal, procurement, and functional safety representation.
- Given a pilot that meets diagnostic and fault metrics but misses your OEM submission timing window, would you proceed, require a negotiated schedule change, or pause?
Next practical steps and owners
- Name the person or role most likely to authorize a pilot quickly, and state the one issue that would stop them from saying yes.
- Provide the priority order for artifacts we should deliver first, for example safety manual excerpts, FMEDA spreadsheets, or sample boards.
- Estimate the earliest date your team can schedule an integration engineer for a two-week onboarding, and list the system access they will need.
- Outline the success metrics we should track weekly during a pilot so your team feels informed and able to make a decision.
- Can you provide a provisional go or no-go decision within four weeks if we commit to the pilot scope and deliver the requested artifacts within two weeks?
-
Safety Architecture Review
Translate the seller's hardware safety features into the buyer's system context and show how those features support the target ASIL and safety case.
Solution Experience
- Safety Architecture Review Session
- Confirm the current state and its cost
- You confirm whether the mapped hardware features are sufficient to support your target ASIL or identify the precise remaining gaps.
- Deliver an annotated FMEDA mapping that updates single-point and latent fault metrics for your ECU based on today's mapping, within 10 business days.
- You agree on the complete list of evidence and acceptance criteria required for OEM submission, with owners for each item.
- Map seller hardware features into your ECU context
- Provide the current ECU block diagram showing function-to-pin mappings, ASIL allocations, and any custom diagnostic modes within 5 business days.
- You commit to the next milestones and timeline needed to finalize the safety case within your program schedule.
- Quantify impact on system FMEDA metrics and diagnostic coverage
- Schedule a technical detailed review to finalize FMEDA customizations and the sample test plan within two weeks.
- List outstanding evidence and acceptance criteria
- Declare the acceptance criteria for hardware safety metrics and confirm your target OEM submission date.
- Validate conclusions and confirm next commitments
- Safety Architecture Review Session
- Safety Architecture Review Deck
- Safety Architecture Review Brief
- meeting
- slides
- document
-
-
Solution Scope
Define the hardware, certified software, documentation package, sample plan, and responsibilities required for integration and qualification.
Scope Configuration
- Ship Automotive Safety MCU/Processor Device
- Deliver Safety Manual and FMEDA Package
- Provide Dependent Failure Analysis Report
- Provide FMEDA-derived Hardware Metrics (SPFM/LFM/DC)
- Supply Certified AUTOSAR MCAL Package
- Supply Safe Runtime Libraries and Diagnostic Firmware
- Preload Built-In Self-Test (BIST) Startup Firmware
- Provide Hardware Diagnostic API and Driver Package
- Deliver Reference Evaluation Board and Kit
- Provide Production Qualification Test Vectors and Scripts
- Deliver Safety Traceability Matrix to ISO 26262
- Provide ECC Memory and Lockstep Configuration Guidelines
Scope Questions
Ship Automotive Safety MCU/Processor Device
- Do you require staggered sample deliveries (evaluation, qualification, production)?
- Which package variant do you need for evaluation (BGA, LGA, QFN, LQFP, other)?
- How many device samples do you need for initial hardware evaluation?
- Who is the primary contact on your integration team for sample acceptance and receiving shipping paperwork?
- When do you need the first shipment relative to your program milestone (e.g., architecture freeze, hardware bring-up)?
Deliver Safety Manual and FMEDA Package
- When do you require the safety manual revision used for your qualification package (e.g., before FMEDA review)?
- Where will you store or accept the FMEDA and safety manual for your safety team review?
- Provide the target ASIL(s) you are claiming at the ECU or function level that the device will support.
- List any OEM or integrator-specific FMEDA formatting or annex requirements (for example required FMEDA columns, dependent-failure tables, or hardware/software allocation templates).
- How will you verify that the delivered safety manual and FMEDA meet your team's acceptance criteria for qualification?
Provide Dependent Failure Analysis Report
- Identify which system-level common-cause or dependent-failure modes you require analysis for (for example power-rail common-mode, shared clock domains, or thermal coupling).
- Confirm the scope of dependent failure analysis you require: device-only, device-plus-board, or device-to-system including software interactions.
- Describe any dependent-failure probability thresholds or correlation assumptions you expect to appear in the report (for example target correlated-failure probability).
- Outline specific stress profiles or test conditions you want included in dependent-failure analysis (for example hot soak, cold soak, voltage margining, EMC stress).
- Indicate whether you require root-cause traceability from each dependent failure entry back to test evidence and design mitigation.
Provide FMEDA-derived Hardware Metrics (SPFM/LFM/DC)
- Select the SPFM (single point fault metric) threshold you require for your ECU safety case.
- Choose the LFM (latent fault metric) target you need the hardware to demonstrate for system-level FMEDA integration.
- State the minimum diagnostic coverage (DC) percentage you require for safety-relevant functions documented in the FMEDA.
- Attach or reference an existing FMEDA baseline or template you will use to validate reported metrics.
- Which evidence will validate the delivered SPFM, LFM, and DC figures (for example annotated FMEDA worksheets, raw failure-mode calculations, BIST logs)?
Supply Certified AUTOSAR MCAL Package
- Supply the AUTOSAR MCAL release or API version you require for your RTE and ECU integration.
- Define which AUTOSAR MCAL modules you will integrate initially (for example CAN, LIN, ETH, ADC, GPT).
- Name the RTE or OS versions that must be compatible with the MCAL package for your integration team.
- For which MCAL deliverables do you require certification artifacts or traceability (for example MISRA/standards compliance evidence, test reports, or safety-related certificates)?
- Are there memory footprint or timing constraints for MCAL that we must meet for your ECU scheduling and stack budgets?
Supply Safe Runtime Libraries and Diagnostic Firmware
- Will you require source code access, object-only binaries, or source under NDA for runtime libraries?
- Does your integration endpoint mandate a certified cryptographic module or FIPS-like artifact in diagnostic or boot firmware?
- List the debug and diagnostic interfaces the runtime and firmware must expose (for example UDS, JTAG, SWD, UART).
- Specify the diagnostic fault reporting format required by your OEM (for example UDS DTC format, OEM-specific DTC mapping).
- What acceptance evidence do you require for runtime library functional safety claims (for example safety certificate, unit test coverage report, or integration test logs)?
Preload Built-In Self-Test (BIST) Startup Firmware
- Identify which BIST modes you want preloaded at power-on (for example memory BIST, CPU core BIST, peripheral BIST).
- Confirm the desired BIST invocation behavior: automatic on every boot, on-demand via diagnostic command, or scheduled windows.
- Describe any boot-time timing constraints the BIST must meet relative to your ECU startup budget (for example maximum delay in milliseconds).
- Outline how BIST results should be surfaced to your diagnostic subsystem (for example event logs, UDS DTCs, status registers).
- Indicate whether you require BIST firmware source for local modification or binary-only delivery.
Provide Hardware Diagnostic API and Driver Package
- Specify which driver API style you expect (plain C API, AUTOSAR wrapper, or other ABI convention).
- List the diagnostic API functions required for fault injection, event logging, and correction reporting.
- Attach any expected ABI, header file conventions, or example stubs your build system requires.
- Estimate acceptable driver memory and CPU overhead limits (for example percent of CPU or RAM budget) for scheduling in your ECU.
- Select the supported toolchains and compiler versions the drivers must be built and validated against.
Deliver Reference Evaluation Board and Kit
- Choose which evaluation board configuration you need: base board only, base plus shield, or custom mezzanine layout.
- Detail required peripheral interfaces on the evaluation kit that must be populated out of box (for example CAN FD, Ethernet AVB, FlexRay, LIN).
- State whether you require thermal and vibration fixtures, tamper-proof housings, or other environmental test accessories included with the kit.
- Provide any acceptance tests you will run on the evaluation board upon receipt and the pass/fail gating you will apply.
- Name who on your team will handle board-level bring-up and verify power sequencing and JTAG access.
Provide Production Qualification Test Vectors and Scripts
- Estimate the delivery timing for production qualification test vectors relative to your PPAP or OEM submission milestone.
- Where will your qualification lab execute the vectors and scripts (in-house lab, third-party test house, OEM lab)?
- Define the pass/fail thresholds you require for production qualification scripts (for example allowable error rate, timing margin), so we can map vectors to acceptance gates.
- Name the automation frameworks or harnesses you use for executing qualification scripts (for example Python test harness, CANoe, LabVIEW, custom runner).
- How many vector or script variants do you expect per device and per package variant for production qualification?
Deliver Safety Traceability Matrix to ISO 26262
- Detail which ISO 26262 edition and clause-to-artifact mapping you require in the traceability matrix (for example ISO 26262:2018 mapping to hardware FMEDA rows).
- Map the top-level safety goals and hazards you want included so they are traced down to device requirements and FMEDA entries.
- Explain the expected linkage between FMEDA items, safety manual claims, and traceability rows that your OEM reviewer requires.
- Pick the delivery format you need for the traceability matrix (for example Excel workbook, CSV export, or DOORS artifact).
- Upload or reference any OEM traceability templates you must conform to for the submission.
Provide ECC Memory and Lockstep Configuration Guidelines
- Detail which ECC schemes you plan to use or require examples for (for example single-bit ECC, SECDED, chipkill), so we can include configuration examples.
- Tell us whether your system mandates memory scrubbing intervals or watchdog monitors and, if so, the required interval or behavior.
- Will you need example configuration files and scripts for lockstep enablement and synchronization between redundant cores?
- Does your diagnostic architecture require reporting of corrected ECC events to be surfaced as DTCs or telemetry?
- Define the maximum acceptable frequency of uncorrected memory errors for production acceptance (for example FIT or errors per 10^9 device hours).
-
Hardware Evaluation & Evidence
Execute the buyer-defined evaluation: sample testing, FMEDA customization, and evidence collection to validate hardware safety metrics and acceptance criteria.
- decision_readiness
- current_state
- desired_state
- success_criteria
- gaps
- stakeholders
- decision_readiness
- stakeholders
- current_state
- gaps
- desired_state
- success_criteria
- success_criteria
- stakeholders
- desired_state
- gaps
- current_state
- decision_readiness
- decision_readiness
- decision_readiness
- decision_readiness
- decision_readiness
-
Mutual Commit
Finalize commercial and legal terms, sampling schedules, support commitments, and the seller's obligations to provide safety evidence.
Agreement Modules
- Purchase Agreement
- Master Supply Agreement
- Sampling & Delivery Schedule
- Support & Warranty Agreement
- Functional Safety Evidence Addendum (ISO 26262)
- Statement of Work (SOW) — Engineering & FMEDA Services
-
Deployment
Operationalize rollout with readiness checks, execution, and outcome validation.
-
Pre-Deployment Readiness
Confirm owners, sample delivery dates, test benches, toolchain access, and OEM submission windows required before integration begins.
Pre-Deployment Questions
Environment and site access
- List the target integration environment(s) by short name (one per line) — e.g., 'ECU bench', 'HIL lab' (so we can reserve the right benches).
- Are the integration endpoints and test benches accessible from the buyer's network or do they require external/lab access? (so we can plan access approvals)
Samples and test benches
- Have hardware samples been allocated for integration?
- If samples are allocated, what is the committed first delivery date? (so we can schedule arrivals and bench time)
- Are the test benches required for ECU-level and system-level validation reserved and configured?
People and ownership
- Who is the buyer integration owner (name and role) responsible for receiving samples and accepting integration milestones?
- Who will own OEM submissions and safety-evidence coordination on the buyer side (name and role)?
- Is there a named approver for integration sign-offs?
Timing and constraints
- What is the target integration start date or week? (so we can align resources and toolchain access)
- Are there known OEM submission windows, program blackout dates, or regulatory audit periods we must avoid? Select all that apply.
- If you selected fixed windows or 'Other', briefly name the window(s) or the contact who manages them (so we can coordinate timing).
-
Integration Configuration
Lock the exact integration values: AUTOSAR/MCAL interfaces, software versions, diagnostic settings, and configuration parameters the integration team will use.
Configuration Details
Integration Snapshot — baseline values the integration build will lock
- Target integration environment label (enter the exact environment name used in your CI/CD or config registry; default: "production") — consumed by the deployment pipeline
- Selected AUTOSAR stack variant (choose the single variant the integration will target)
- MCAL modules required for this integration (select all modules the build must include; used to generate the MCAL configuration)
Software & Interface Versions — exact package versions the integrator will pin
- Exact AUTOSAR RTE / BSW version to lock (format: X.Y.Z — default: "4.4.0") — consumed by the RTE/BSW resolver
- Seller-provided MCAL package version to lock (format: major.minor.patch; default: "1.0.0") — enter the non-secret package/version identifier
- Certified software package variant for integration (select one)
Diagnostics, Safety & Ownership — safety targets, diagnostic thresholds, and where to find the integration mapping
- Target ASIL level this integration must support (select one)
- Locked diagnostic coverage target (%) for single-point faults (numeric percent; default: 90) — enter an integer between 0 and 100; consumed by FMEDA customization
- Locked diagnostic coverage target (%) for latent faults (numeric percent; default: 90) — enter an integer between 0 and 100; consumed by FMEDA customization
- Exact AUTOSAR/MCAL interface mapping file location (enter repo path or URL; format: path or https://...; default: "repo://integration/mappings/autosar_mapping.xml") — this file is read verbatim by the integration generator
- Integration configuration owner (enter the role or team name responsible for this locked config; e.g., "Buyer ECU Integration Team") — non-secret owner identifier
-
Integration & Qualification
Execute integration work, run qualification tests, and coordinate submission of evidence to the OEM with clear owners and milestones.
-
-
Safety Case Success
Track certification progress, production readiness signals, field performance, and open issues or enhancement requests during program qualification and ramp.
Success Reviews
- Go-live Health Check (weeks 1-4)
- First Measurement Review (weeks 4-10)
- Acceptance Gate Decision (around day 90)
- Monthly Operational Review (ramp)
- Quarterly Safety & Certification Review
Issues & Enhancements
- Open focused reliability investigations for any out-of-spec field fault trends and capture required evidence for the safety case.
- If any criteria fail, agree on a remediation and retest plan with firm dates and verification steps.
- Publish the acceptance decision document with evidence links and, if applicable, the remediation plan and retest schedule.
- Initiate the highest-priority remediation tasks and schedule verification test windows.
- Update the project milestone tracker to reflect acceptance outcomes and any shifted dates.
- Production readiness and sample yield review
- Confirm production sample yield and field spurious fault rate are within acceptable tolerance of Solution Scope targets or identify corrective actions to close gaps.
- Drive down the count of open safety-critical CARs with committed resolution dates to support volume ramp.
- Implement agreed production test threshold changes and document the verification steps and acceptance criteria.
- Re-confirm agreed success criteria and owners
- Update the enhancement request log with prioritization decisions and expected delivery windows.
- Certification progress and OEM feedback
- Achieve alignment on the remaining certification artifacts required and the plan to deliver them so that certification progress meets program milestones.
- Reduce the backlog of open safety corrective actions with committed closure timelines that support production ramp.
- Submit the agreed list of remaining certification artifacts to the OEM and record receipt/acknowledgement.
- Prioritize and resource the top 3 safety CARs that pose the highest risk to qualification and set target close dates.
- Produce the quarterly safety summary package for the program steering group with evidence links and status.
- Confirm that deployment components (samples, benches, toolchain) are operational and able to run the qualification test suite.
- Document all critical blockers with owners and committed remediation dates for resolution before the first measurement meeting.
- Publish a one-page deployment status summary listing open blockers, owners, and resolution dates.
- Enable access to the shared evidence repository for all named owners and confirm read/write access is working.
- Schedule a bench validation window to re-run smoke tests after remediation actions complete.
- Present first measured FMEDA and diagnostic results
- Determine whether FMEDA single-point fault metric and diagnostic coverage are trending toward their targets and document gap owners.
- Agree a timeboxed corrective action plan with dates that will be validated prior to the acceptance gate meeting.
- Update the FMEDA file with measured test results and circulate the delta summary for review.
- Execute targeted diagnostic re-tests and document results in the evidence repository.
- Close or scope any non-safety-critical CARs and move remaining items into the acceptance remediation tracker.
- Restate acceptance criteria and numeric targets
- Produce a documented acceptance decision for the program qualification window and record it in the shared project artifacts.
- Field performance and reliability trends
- Deployment and lab validation
- Present outcome data against each criterion
- Root-cause analysis for any gaps
- Open safety corrective actions and closure plan
- Document pass/fail per criterion
- Early adoption signals and usage
- Field performance and production readiness summary
- Open safety evidence and CARs review
- Open defects, CARs, and enhancement requests
- Operational adjustments and configuration locks
- Agree corrective action plan and timeline to acceptance gate
- Open issues and immediate blockers
- Schedule and next-quarter commitments
- Formal acceptance decision and remediation commitments
- Agree immediate remediation actions