Pick the region you are protecting and see which mechanisms suit it, what each one is blind to, and whether the combination actually reaches the SPFM, LFM and PMHF targets for your ASIL — with the coverage arithmetic done conservatively rather than optimistically.
Runs entirely in your browser. Nothing is uploaded, stored, or sent anywhere.
Every safety mechanism is defined as much by its blind spot as by its coverage. Parity catches an odd number of flipped bits and is completely blind to the address path, so a perfectly parity-correct word returned from the wrong location sails through. A watchdog catches a hang and is blind to a wrong answer delivered on time. A plausibility check catches the impossible and misses the plausible-but-wrong, which is most of the dangerous set.
That is why the table above lists what each mechanism does not catch alongside what it does. When an FMEDA gets challenged, the argument is almost never about the coverage number in isolation — it is about whether the mechanism plausibly covers the fault modes that region actually has.
The defaults are our own, from our own FMEDA work, and they are editable for exactly that reason. Three conventional bands are in general use — roughly 60 % for low, 90 % for medium and 99 % for high — and a mechanism's real figure depends on the implementation, not on its name. Two designs that both say "parity" can differ by twenty points depending on what the parity actually spans.
This is the arithmetic mistake that inflates an FMEDA most often. Given two mechanisms with
coverage a and b on the same region, the tempting combination is:
DC = 1 − (1 − a)(1 − b)That formula is only valid if the two fault sets are close to independent. On the same region they usually are not: parity and ECC over the same word detect largely the same failures, so combining a 60 % and a 99 % claim this way credits you for detections you already counted. The default here is the conservative one — take the best single mechanism and let the others be defence in depth — and the optimistic combination is available only behind an explicit independence claim, with the warning attached. If you want to claim it in a real safety case, fault injection across both mechanisms is the evidence that supports it.
A safety mechanism that has silently failed provides no protection, and nothing in the functional path will tell you. That is what the latent-fault metric charges you for, and it is why the catalogue marks each mechanism as addressing single-point faults, latent faults, or both. A design with excellent detection and no periodic self-test, BIST or scrub will meet its SPFM target comfortably and then fail LFM, which tends to be discovered late because the detection story looks so healthy.
The uncomfortable case is a mechanism that checks itself only through the thing it is checking. A comparator that has merged into a single net still compares, and still reports agreement, forever. Walking known-different vectors through it periodically is the cheapest way to find that out, and it is a small amount of logic against a fault that no functional test can see.
Once the mechanisms are chosen, the numbers follow. The FIT and PMHF calculator takes one element's failure rate and diagnostic coverage through to SPFM, LFM and PMHF against the ASIL gates; the FMEDA rollup aggregates every element into a system figure and ranks them by contribution, which is usually how you find that one uncovered region is spending the whole budget. If the coverage you need is out of reach on a single element, ASIL decomposition is the other lever — with the independence obligation that comes with it. And if the mechanism you are reaching for is a timeout or a watchdog, its interval has to fit inside the fault tolerant time interval, or the coverage is real but arrives too late to matter.
Each of these runs entirely in your browser. Nothing is uploaded, stored or sent anywhere, and none of them needs an email address.
See all 49 engineering tools →
We add tools here fairly often and write up the things worth writing up — a stackup that behaved oddly, a standard that turned out to be obsolete, a calculator that was quietly wrong. Join and you get told when something new lands.
One email a month at the very most, and usually less. No drip sequence, no sales cadence, no sharing your address with anyone. Unsubscribe whenever you like.