Toshiba announces implementation of functional safety concept on MCU for SIL3 and ASILD level applications

TEE worked closely with Yogitech SpA, a company specialized in functional safety, and utilized Yogitech’s fRMethodology based assessment flow and library of Intellectual Properties (fRIPs) in its solution. Approved by TÜV SÜD, the fRMethodology is a “white box” approach and it was used to do functional safety analysis and safety-oriented exploration of the Toshiba Target microcontroller unit (MCU) in compliance with IEC 61508 or ISO 26262. The MCU was split into sensitive zones, failure rates were computed and used to calculate safety metrics (for example, to compute the diagnostic coverage) and to decide chip architecture. A detailed validation was done by using fault injection. The fRIPs, certified by TÜV SÜD, are small hardware supervisors designed with architectural and functional diversity with respect to the MCU sub-block (e.g. CPU, memory) that they supervise. Further peripheral functions on the chip are monitored by Toshiba’s own hardware diagnostic circuits.

Functional safety related system components generally employ duplicated CPU cores (homogenous redundancy): a “mission” core to run the application software and an identical “monitor” core to guard the system against dangerous faults in the mission core. A conventional dual-core lock-step SIL3/ASILD approach has to add further protective features, such as a guard ring, separate supply voltage, synthesis and timing diversity, which increase the chip and program size significantly and impact the system performance. Moreover, homogenous redundancy is very much prone to systematic faults.

The fRMethodology enabled Yogitech to identify critical zones in the mission core, allowing the specification of a monitor core that executes the same instructions as the mission core while excluding unnecessary operations. This process led to the implementation of a diverse and optimized monitor core (the fRCPU), eliminating unnecessary hardware overheads, avoiding systematic faults and also significantly reducing the possibility of common cause failures. The fRCPU version implemented by Toshiba in the MCU is for the ARM Cortex-M3 and it has a gate count up to 58% smaller than is used for the mission core.

The run-time supervision guaranteed by fRCPU hardware leads to high diagnostic coverage for transient faults while the short detection latency (achieved thanks to a dedicated interface between the ARM Cortex-M3 and fRCPU) allows fail operational reactions. There are also special measures on chip to avoid latent faults; for example through built-in self test of supervisor circuits or “scrub and repair” function against bit-flips in memories.

The Toshiba TSB-TC SIL3/ASILD test chip is available now for evaluation by selected partners. It has received Technical Report I from TÜV SÜD for SIL3 functional safety operation. In addition to typical automotive peripheral functions like FlexRayTM and CAN, it offers an operating temperature range of minus 40 to plus 125 degrees Celsius.