Functional Safety and ISO 26262

Any influential technology emanates a set of risks, which can be especially serious in automotive safety-related systems. The purpose of the International Organization for Standardization (ISO) 26262 series of standards, Road vehicles – Functional safety, is to mitigate risks in road vehicles by providing guidelines and requirements for the functional safety of automotive electrical and electronic systems. Published in 12 parts, ISO 26262 was updated in 2018 to acknowledge evolving automotive technologies, and the standard now includes specific requirements for semiconductors. ISO 26262 details an automotive-specific, risk-based approach for determining risk classes – known as Automotive Safety Integrity Levels (ASILs) – established by performing a risk analysis of potential hazards based on three variables: severity, probability of exposure, and controllability by the driver.

Automotive manufacturers require various classifications of ASIL system-level ratings when developing functional safety-compliant platforms. As examples, surround view, driver monitoring, and radar and LiDAR for advanced driver assistance systems (ADAS) require a system-level rating of ASIL D. Meanwhile, end equipment such as digital cockpit and infotainment systems only need an ASIL B rating. An overarching theme in such safety-critical systems is the need to reliably power high-current system-on-a-chip (SoC) and multicore processor loads from an automotive battery source.

Functional safety-compliant designs with external voltage monitoring

Synchronous buck controller integrated circuits (ICs) enable DC/DC conversion in automotive designs with 12V, 24V and 48V battery inputs to meet the demands of high-current processor loads, with current specifications often exceeding 100A. Figure 1 shows a dual-output configuration, which incorporates a voltage-monitor IC on each output for the system to achieve ASIL D functional safety compliance.

Q₃ and Q₆ in Figure 1 designate the output disconnect switches that open during an output fault condition. A legacy dual-output buck controller as shown in Figure 1 provides rudimentary diagnostic information back to the system microcontroller (MCU) using the power-good (PG1/2) pins.

Functional safety-compliant designs with a synchronous buck controller

The 80V LM5137F-Q1 dual-channel DC/DC buck controller includes all of the functions necessary to implement a high-efficiency synchronous buck regulator for high-power SoC core and I/O rails. The device is offered from a controller family with three categories for functional safety: TI Functional Safety-Capable, ASIL B or ASIL D, with the latter two options designated by an “F” suffix in the device part number.

The family also offers voltage scalability to support 12V, 24V and 48V battery inputs with a switching frequency range from 100kHz to 2.2MHz. An integrated charge pump gate driver offers 100% duty-cycle capability and true pass-through mode operation. The LM5137F-Q1 also features ultra-low quiescent current for extended battery life and high light-load efficiency, along with dual random spread spectrum (DRSS) to successfully address electromagnetic interference (EMI) across a wide range of frequencies.

Figure 2 shows the full circuit schematic of a pregulator design in an ASIL D system using the LM5137F-Q1 buck controller. This design has essentially the same operating specifications and power-stage components as Figure 1 but does not require external voltage-monitoring ICs. For added flexibility, you can configure the buck controller as a single-output implementation with two interleaved phases (or stack to four phases for especially demanding high-current loads).

The LM5137F-Q1 incorporates safety mechanisms to help achieve ISO 26262 systematic capability and hardware integrity functional safety requirements up to ASIL D. Such safety mechanisms include analog built-in self-test (ABIST) to verify the health status of the LM5137F-Q1 controller and surrounding components before allowing the outputs to start up. The device also has redundant output voltage monitoring that eliminates external circuitry and saves on hardware cost, size and complexity. Additional safety mechanisms include advanced fault reporting, overcurrent monitoring and reporting, output undervoltage and overvoltage protection, and redundant thermal shutdown.

As implied by Figure 2, the system- and circuit-level advantages of the functional safety buck controller are:

• Integrated diagnostics, including ABIST before startup and per-channel current monitoring during normal operation.
• Integrated redundancy, including advanced fault identification and tolerance for reduced failure-in-time (FIT)-based failure rates.
• Reduced component count and space savings, achieved by obviating the need for supplemental voltage- and current-monitor ICs.

Functional safety compliant designs with synchronous buck converters

Offering voltage and current scalability, buck converters with integrated switches represent another option for the preregulation stage. For example, the 65V, 8A LM68680-Q1 and 65V, 4.5A LM68645-Q1 buck converter families can sustain input transients to 70V while meeting requirements in systems that must reach at least ASIL C. Scalable to 12V, 24V and 48V inputs, these converters provide functional safety features similar to the LM5137F-Q1 controller described above.

Figure 3 is a system block diagram using the LM68680-Q1 and LM68645-Q1 as preregulators that feed the 30A TPS62883-Q1 and 20A TPS62881-Q1 stackable two-phase point-of-load (PoL) buck converters. With differential remote sensing of the output voltage and ultra-fast load transient response, these PoLs provide tight voltage regulation to a Jacinto™ TDA4VH-Q1 automotive SoC used in an ADAS domain controller application.

Irrespective of the chosen architecture with controller or converter options to power the various SoC voltage rails, TI provides industry-standard reports and additional resources – including IC-level documentation such as functional safety FIT rate and failure-mode effects and diagnostic analysis (FMEDA) – to help streamline your functional safety system-level certification.

Conclusion

As automotive power electronics moves toward functional safety-compliant designs with higher densities, smaller packaging, improved performance and lower cost, rethinking controller and converter selection for the buck preregulator power stage becomes mandatory. Within this context, achieving functional safety compliance up to ASIL D is one of the primary challenges when designing systems that require high-density buck preregulators.

A buck controller such as the LM5137F-Q1 offers several inherent benefits when benchmarked against legacy controller designs that require supplementary supervisory and monitoring components to accomplish functional safety compliance. Furthermore, TI Functional Safety-Compliant 65V-rated buck converters provide an alternative for lower-power designs.

Additional resources

• Peruse TI’s functional safety landing page.
• Download the data sheets for the LM5137F-Q1 buck controller as well as the LM68645-Q1 and TPS62883-Q1 buck converters.
• Review the LM25137F-Q1-EVM5D3 evaluation module user’s guide.
• Read the technical article, “Powering next-generation ADAS processors with TI Functional Safety-Compliant buck regulators.”
• See the white paper, “Streamlining functional safety certification in automotive and industrial.”

Trademarks

All trademarks are the property of their respective owners.