After the TSRs have been established, the next phase is to turn them into HSRs and FSRs. Each HSR/SSR inherits the ASIL‑B of its parent TSR and respects the FTTI that is imposed by the most restrictive FSR in the group. The HSR defines the hardware characteristics that must be built into the current‑sense front‑end; the SSR defines the software actions that must be performed on the measured signal to satisfy the timing and detection criteria.

According to Table 2-12, the current sensor must be able to indicate a short‑circuit condition with sufficient bandwidth or response time, and also includes a self‑diagnosis function. For these reasons, the TMCS1133‑Q1 was selected as the current sensor in OBC application, and it is placed at the input side of PFC stage and the output side of DCDC stage. The pin diagram is shown in Figure 2-10. Alternate shunt-based current sensing method may also be used, but in this case, HSRs and FSRs are different and this is not covered in this document.

In Table 2-12, TSR‑CS‑1, TSR-CS-2 and TSR-CS-3 are allocated to current sensor, and TSR-CS-4 and TSR-CS-5 are allocated to MCU. Table 2-13 and Table 2-14 are an example of HSR and SSR that realizes these TSRs traced to FSR 2.1.

These are only a handful of illustrative cases. In a real OBC project, the system integrator must perform a thorough analysis for every TSR and then move on to the subsequent steps.

• Design allocation. Assign each HSR and SSR to the respective team.
• Traceability matrix. Consolidate FTA or FMEA block diagrams to link FuSa goal to FSR, TSR and then HSR and SSR. Each HSR and SSR should be linked to their verification evidence.
• Verification planning. Verification and validation of HSRs and SSRs. Provide the test report that shows the requirement is satisfied and demonstrates the compliance of the ASIL‑B safety goal.

In the OBC system, the ASIL level of some analog components is QM. Using QM components in an ASIL-B system is possible but requires hardware element evaluation. Hardware element evaluation demonstrates either the QM component cannot interfere with safety goals or additional safety mechanisms provide sufficient diagnostic coverage to achieve the required ASIL.

For example, TMCS1133-Q1 is FuSa capable component, and it is selected to achieve ASIL-B requirement. Suppose it is used in DC output side for current sensing and overcurrent protection. TI can provide the following content to facilitate customers in hardware element evaluation.

• All failure modes.
• Probability of each failure mode.
• Effect on system safety.

All the above information can be found in the FuSa document of TMCS1133-Q1. Customers shall perform design verification, including analysis and testing. All failures modes include die failure modes and pin failure modes. The total component FIT rate is 62, including die FIT rate 26 and pin FIT rate 36. All die failure modes and distribution are listed in Table 2-15.

The pin failure modes basically include the typical pin-by-pin failure scenarios:

• Pin short-circuited to ground.
• Pin open-circuited.
• Pin short-circuited to an adjacent pin.
• Pin short-circuit to supply.

Take pin short-circuited to ground as an example, the description of potential failure effects is shown in Table 2-16. Failure effect class indicates how these pins conditions can affect the device:

• Class A: Potential device damage that affects functionality.
• Class B: No device damage, but loss of functionality.
• Class C: No device damage, but performance degradation.
• Class D: No device damage, no impact to functionality or performance.

Based on the safety mechanisms, diagnostic coverage calculation should be implemented to show >90% detection. This evaluation determines that this hardware element can adequately support the safety requirements assigned to it.

Finally, the development team has a complete, traceable, and verifiable set of concrete safety requirements that can be implemented in the single‑stage OBC and reviewed during ISO 26262: 2018 audits.