Microcontroller Safety Concept

ISO 26262 does not require a safety concept even inside a component. But in order to assure a consistent development along the v-model it would be recommended. The microcontroller safety concept provides clear limitations for the implementation of different applications. Depending on the application, different safety concepts will be considered. The following aspects should therefore be already analyzed related to the characteristics of the microcontroller. 

In this context we often find a lot of indications and requirements from the definition of the vehicle system and the partial networks descriptions, which need to be realized that can exclude certain microcontroller safety concepts or at least make them appear ineffective. 

The IPO principle could be also used for the software architecture in the microcontroller. IPO stands for input, processing and output. Based on this concept we now look at some basic principles for computer based safety concepts and the following fundamental questions for the microcontroller  

The interaction as well as the functions of each element can of course be very different. However, we already have two essential groups for the safety applications. Those are functional groups, which are essential in order to put the computer into operation or initialize it. These functional groups often contribute only indirectly to the implementation of the main function. This is why they will often only be able to harm the safety function indirectly. 

Based on a simplified functional model for the computer, with consideration to the two different functions, which need to be safeguarded, we will now illustrate a safety concept applicable until ASIL C. Since for an ASIL C function we already have to corroborate in the software, before we control an ASIL C action, a certain redundancy of the sensors needs to be present. Generally, it is possible to say that a single analog signal cannot be safeguarded more than up to ASIL B. For the actuator control often a current read back path ensures that we can verily the information for the control through the microcontroller. 

---

The basic requirement says that the system design should be drived from the functional safety concept, whereby the architecture should still play a central role. In effect, this causes the various functions of the functional safety concept and then-requirements to be again allocated to common elements. This is often the case for microcontroller. 

NOTE The software architectural design is not necessarily limited to one microcontroller or ECU, and is related to the technical safety concept and system design. The software architecture for each microcontroller is also addressed by this chapter. 

---