ST STM8AF6166, User Manual, Page: 33 / 43

UM1915 Rev 3 33/43
UM1915 Safety analysis results
42
4 Safety analysis results
This section reports the results of the safety analysis of the STM8AF MCU, according to
ISO 26262 (in particular ISO 26262-10 Annex A).
ISO 26262-10 Annex A is a guideline about how to perform a safety analysis of a
microcontroller according to ISO 26262.
Shortly, the ISO 26262 has three main objectives:
•
To improve functional safety by reducing the HW random failures , i.e. failures that
can occur unpredictably during the lifetime of a hardware element and that follow a
probability distribution. They are quantified using safety “metrics”, as described in
Section 3.3.1: The target safety metrics (ASIL, SPFM, LFM and PMHF) .
• To improve functional safety by reducing or avoiding dependent failures , i.e. failures
whose probability of simultaneous or successive occurrence cannot be expressed
simply as the product of the unconditional probability of each failure. They include
common cause failures and cascading failures. They are analyzed in a qualitative
way by means of checklists, as described in
Section 4.2 .
•
To reduce or avoid the systematic failures , i.e. failures, related in a deterministic
way to a certain cause, that can only be eliminated by a change of the design or of
the manufacturing process, operational procedures, documentation or other relevant
factors.
As mentioned before, the target for the safety functions is ASILB; therefore every
consideration about absolute and relative safety metrics takes ASILB targets.
It is worth to recap here that ASILB report as target limits 90% for SPF (overall system) and
100 FIT for PMHF (100 FIT is indeed the overall budget available for the system, therefore
for STM8AF the allocated budget is be lower).
4.1 Hardware random failure analysis
The analysis for random hardware failures of STM8AF devices reported in this safety
manual is executed according to ISO 26262 and to the following steps.
The STM8AF has been divided into parts and sub-parts according to the procedure defined
in ISO 26262-10. Then, for each part and sub-part, the failure modes have been
identified starting from the ones specified by ISO 26262-5, Annex D and then significantly
extended based on detailed analyses.
Each failure mode has been analyzed in terms of its “end effect” at the STM8AF I/O level.
Detailed results of the qualitative analysis are reported in
[2] .
About safety metrics, both relative (SPFM, LFM) and absolute (PMHF) have been
computed. The results are not reported in this section but in
[2].
In summary, with the adoptions of the safety mechanism and conditions of use reported in
Section 3.7: Assumption of use (AoU) , it is possible for the STM8AF family devices to
achieve the ASILB target.