PD ISO PAS 19451 — Application of ISO 26262 to Semiconductors (ISO/PAS 19451)

🔌 PD ISO/PAS 19451 is a BSI Published Document implementing ISO/PAS 19451 in the UK, developed by Technical Committee AUE/16 (Data Communication — Road Vehicles) for Part 1 and AUE/32 (Electrical and electronic components and general system aspects — Road vehicles) for Part 2. The series addresses “the application of ISO 26262:2011-2012 to semiconductors“, focusing on the specific challenges of semiconductor devices (especially analogue and mixed-signal devices) in road-vehicle functional safety development. ISO 26262 (Road vehicles — Functional safety) provides a systematic framework for the functional safety of vehicle electrical/electronic systems, but its clauses are dominated by system- and software-level concerns and say little about semiconductor failure modes, random hardware failure metrics, and qualification methods at the device level. ISO/PAS 19451 closes that gap. This batch covers two parts: Part 1 (Application of concepts) and Part 2 (Application of hardware qualification).

1. Series Background and Significance 📌

With vehicle electrification and intelligence, the number and complexity of semiconductor devices in a vehicle have grown dramatically — from powertrain and chassis control to advanced driver assistance systems (ADAS), all depend on high-performance chips. ISO 26262 requires systematic hazard analysis and risk assessment of safety-related systems, with residual risk from random hardware failures kept at an acceptable level through appropriate safety mechanisms. However, the default object of ISO 26262 is “already purchased or developed components”, and its description of semiconductor internal structure, failure modes, and test methods is limited.

ISO/PAS 19451 was developed to guide semiconductor manufacturers working within the ISO 26262 framework: how to decompose ASIL (Automotive Safety Integrity Level) requirements to the device level, how to analyse device failure modes, how to perform hardware qualification, and how to choose appropriately between “standard qualification” and “ISO 26262 hardware qualification”. As a Publicly Available Specification, it both provides a consistent reference for early adoption and accumulates experience for eventually incorporating these topics into later editions of ISO 26262.

2. Series File List 📋

The PD ISO/PAS 19451 series files covered in this batch are listed below.

3. Application of Concepts (Part 1) 🔧

Part 1 answers the core question of “how ISO 26262 clauses map to semiconductor development”, covering mainly:

• Analogue/mixed-signal devices and ISO 26262: the role of ADCs/DACs, power management, and sensor interfaces in safety systems, and how their failure behaviour differs from pure digital devices.
• Failure mode analysis: typical failure modes of analogue and mixed-signal devices (drift, stuck-at, nonlinearity, noise, etc.) and their treatment in safety analysis, showing how device-level failures map to system-level hazards.
• Safety mechanisms and diagnostic coverage: on-chip self-test, redundancy, monitoring circuits, and how they provide diagnostic coverage for random hardware failure metrics.
• Development process alignment: the correspondence between the semiconductor design flow (specification, design, verification, tape-out, test) and ISO 26262 phases (concept, system level, hardware level).

The central idea is that foundries and chip design houses should establish a common “functional safety language” at the device level, so OEMs can perform system-level evaluation based on a unified description of failure modes and safety mechanisms.

4. Application of Hardware Qualification (Part 2) 🧪

Part 2 focuses on the engineering activity of hardware qualification, the key point being the distinction between “standard qualification” and “ISO 26262 hardware qualification”:

• Standard Qualification: reliability tests commonly used in the semiconductor industry (e.g. JEDEC standards) — burn-in, temperature cycling, ESD, etc. — to demonstrate that a device meets basic reliability requirements over its expected life.
• ISO 26262 Hardware Qualification: on top of standard qualification, additional qualification for functional safety requirements, including specific tests for safety-related failure modes and supporting evidence for random hardware failure metrics (PMHF, SPFM, LFM).
• Differences and choice: Part 2 clarifies the relationship — standard qualification is the foundation, ISO 26262 hardware qualification is a supplement; for higher ASIL parts, both are usually required, with adequate qualification reports as evidence for the safety case.

The standard also recommends implementation steps: from defining qualification objectives and scope, preparing a qualification plan, selecting and executing test items, to evaluating results, writing the report, and making the release decision — a complete closed loop.

5. Engineering Practice Applications 🛠️

• Chip functional safety development: semiconductor design companies build device-level failure mode libraries and safety mechanism sets per Part 1, embedding BIST, watchdog, and redundant-channel structures in design.
• Safety manual preparation: provide OEMs a Safety Manual describing device failure modes, safety mechanisms, diagnostic coverage, and usage limits, supporting ASIL decomposition and FMEA/FTA analysis.
• Qualification plan and report: prepare a hardware qualification plan per Part 2, coordinating JEDEC standard qualification with ISO 26262 supplementary qualification, producing an auditable qualification report.
• Supply chain collaboration: a common basis for information exchange (safety requirements, failure data, qualification results) among OEMs, Tier 1s, and chip makers shortens audit cycles.

A typical implementation path: OEM defines system-level safety requirements → decompose to device-level requirements and communicate to the chip maker → chip maker implements safety mechanisms in design and verification → perform standard and functional-safety supplementary qualification → issue Safety Manual and qualification report → OEM performs system-level evaluation and includes it in the Safety Case.

6. Frequently Asked Questions ❓