The routines of "automotive grade" are everywhere: comply with, achieve, satisfy, and comply with

What is Automotive Grade? It means consistent reliability.

From the moment the car engine starts, it must work in hot summers and cold winter nights. The service life of a mobile phone is 2 to 4 years, but your car needs to be used for more than ten years.

Additionally, automotive components must withstand large temperature fluctuations. When consumer electronic devices, such as smartphones, are subjected to temperatures that exceed their limited tolerance range, they may send erroneous messages or simply shut down.

This is intolerable in automotive-grade systems. Therefore, automotive engineers must ensure that all components, from instrument clusters and navigation screens to advanced driver assistance systems and autonomous driving sensors and chips, meet stringent requirements.

That’s why our automotive solutions (hardware) are rated to operate from -40°C to 105°C, or even 125°C.

Temperature resistance is just one of the most critical factors in our automotive system specifications and testing, which are more demanding than those of similar consumer products.

For example, safety functional parts must have dedicated production lines that are ISO 26262 ASIL certified (of course, they must also have an IATF16949 foundation) to eliminate the possibility of human error in the manufacturing process. Using any product that does not meet the highest requirements will amplify the dangers posed by driving safety.

Car regulations, some people take advantage of the situation

In recent years, more and more new automotive electronic products such as sensors and chips have been introduced into the automotive industry, and the automotive grade has also begun to become chaotic.

Meet, comply with, achieve... Startups all over the street add dazzling adjectives before the word "automotive grade". Of course, there are also those that add the word "mass production" after the word "automotive grade", which is another "naked" PR that is difficult to explain.

In the Chinese dictionary, the definition of "conform" is: consistent with the style, form or standard of existence. "Satisfy" means "feeling" that something is enough. Note that this is a subjective judgment. "Achieve" means: mostly refers to abstract things or degrees, such as "reach" or "not reach", which is also a subjective judgment.

In other words, only those that meet the requirements are "authentic", and those words that claim to satisfy and achieve are all "imagination". There are also some subtle names: for example, compliance with automotive-grade design. In fact, there are many tricks in this.

Of course, no matter how you PR, the products will eventually be sent to the "battlefield" for testing (for example, you will often encounter many suppliers who pat their chests and say that "their products will have no problem passing automotive regulations").

At present, the most relevant quality standard for automotive-grade automotive electronics is the AEQ quality standard.

AEC-Q100 is a failure mechanism based stress test of packaged integrated circuits. The Automotive Electronics Council (AEC) is based in the United States and was originally established by the three major automobile manufacturers (Chrysler, Ford and General Motors) to establish common component qualification and quality system standards.

The idea of ​​establishing the AEC was born at a JEDEC meeting in the summer of 1992. The idea of ​​a common qualification specification was proposed as a possible way to improve the situation. At a subsequent JEDEC meeting, it was determined that the idea of ​​a common qualification specification was feasible, and work on Q100 (Stress Test Qualification for Integrated Circuits) began shortly thereafter.

The current application of AEC-Q100 in integrated circuits is mainly discrete components AEC-Q101 and passive components AEC-Q200.

AEC-Q100 is divided into five levels based on the temperature range. Among them, level 0 is the highest (-40°C to +150°C), level 1 is -40°C to +125°C, level 2 is -40°C to +105°C (which is more common), and the lowest level is level 4 (0°C to +70°C). Level 0 is mainly used for the worst environmental conditions under the hood, and levels 1 and 2 are used in other parts of the car.

In addition to AEQ, another specification that needs to be followed is ISO 26262, developed by the International Organization for Standardization (ISO) in 2011, which is mainly used for functional safety parts such as ADAS-related sensors and systems.

Automotive Safety Integrity Level (ASIL) is a risk classification scheme defined by ISO 26262 - the functional safety standard for road vehicles. It is an adaptation of the Safety Integrity Levels in IEC 61508 for the automotive industry.

This classification helps define the safety requirements necessary to comply with ISO 26262. The ASIL is established by performing a risk analysis of the potential hazard by looking at the severity, exposure, and controllability of the vehicle operating scenario. The safety goal for that hazard also meets the requirements of the ASIL.

ASIL A, ASIL B, ASIL C, and ASIL D are four levels, among which ASIL D has the highest requirements for product integrity, and ASIL A has the lowest.

ASILs are established through hazard analysis and risk assessment. For each electronic component in a car, engineers must measure three specific variables: severity (the classification of injuries to the driver and passengers) and exposure (the number of times the car is exposed to the hazard), and controllability (what the driver can do to avoid injury), all of which are broken down into subcategories.

There are four levels of severity, ranging from "no injury" (S0) to "fatal/fatal injury" (S3). Exposure is divided into five categories, ranging from "very unlikely" (E0) to "very likely" (E4). There are four types of controllability, ranging from "generally controllable" (C0) to "uncontrollable" (C3).

All variables and sub-categories are analyzed and combined to determine the expected ASIL.

For example, systems such as airbags, anti-lock brakes, and power steering require ASIL-D—the highest level of stringency used for safety assurance—because the risk associated with their failure is also the greatest. On the other hand, parts such as taillights only require ASIL-A. Headlights and brake lights are generally ASIL-B, while cruise control is generally ASIL-C.

Given the guesswork involved in determining ASIL hazard levels, the Society of Automotive Engineers (SAE) drafted J2980, “Considerations for ISO 26262 ASIL Hazard Levels,” in 2015. These guidelines provide clearer guidance for assessing the exposure, severity, and controllability of specific hazards.

ISO 26262 has become the guiding standard for functional safety in the automotive development process. However, in recent years, with the rapid introduction of ADAS and autonomous driving technologies, bottlenecks in this standard have begun to emerge.

J2980 continues to evolve—SAE published a revision in 2018. As autonomous vehicles develop, ISO 26262 will need to redefine “controllability,” a definition that currently belongs to human drivers.

By current standards, no human piloting means controllability will always be C3, the limit of “uncontrollable.” The other variables of severity (harm) and exposure (likelihood) will undoubtedly need to be re-examined as well.

In March, the International Organization for Standardization also updated ISO26262:2018. This version adds guidance on semiconductor design and use in automotive functional safety environments.

The first time a chip (a single-chip microcomputer) was used in a car was to control the operation of the engine. It was called an ECU or engine control unit. The first ECU appeared in Volkswagen in 1968, implementing a specific function: EFI (electronic fuel injection).

As of today, there are more than 50 ECUs in cars dedicated to monitoring or controlling various aspects of the powertrain, in-car entertainment, active safety and communication systems. Next, in addition to distributed networks and centralized domain control architectures, more chips (more complex than past ECUs) will also appear in new cars.

ISO26262:2018 Part 11 provides a comprehensive overview of the development projects for semiconductor products related to functional safety. These issues include the overall description of semiconductor components and their development and possible partitioning. Related hardware faults, errors and failure modes are included. The invention also involves intellectual property (IP) and especially intellectual property related to ISO 26262 with one or more safety requirements.

Safety and reliability should be always implemented

But nowadays, new reliability issues of automotive electronic products are increasing, resulting in chaos in the overall supply chain. At the same time, a series of problems such as insufficient data, unclear definitions, and inconsistent professional levels have also been discovered.

For example, most automotive chips are not developed at advanced nodes. But technologies that require massive computing power to make safety-critical decisions in a split second, such as artificial intelligence, will require the highest available density.

The resulting reliability issues have been largely ignored at advanced nodes because most chips built using those processes were previously targeted for consumer electronics or controlled environments.

At the same time, newer manufacturing processes generally produce more defective parts than existing mature, older process technologies. This higher defect density means that higher defect coverage in post-manufacturing testing is required to achieve the same quality level.

The traditional method of using abstract logical fault models to generate test sequences for defect detection is no longer fully applicable. In order to achieve automation-grade quality levels with complex integrated circuits at advanced process nodes, test pattern generation requires understanding how and where defects are physically exposed, and the behavior of these defects must be known in an analog sense, not just a digital sense.