Safety Critical PCB: Safety Critical System PCB: Standards, Materials and Testing

A safety critical system is one where a failure can cause injury, and the boards inside such systems are designed so that a failure either does not occur or occurs in a way that is detectable and safe. That requirement shapes the design more than any electrical specification, and it produces a set of practices that look excessive until something goes wrong.

What Safety Critical Means in Practice

The formal approach begins with a hazard analysis, which identifies what could go wrong and how likely it is. From that comes a safety integrity requirement, expressed as a probability of failure on demand, which then determines how the system must be built. A single channel may be adequate for a low requirement, while a high requirement may demand redundancy, diagnostics and an independent shutdown path.

That analysis propagates into the board. A channel that must not fail silently is monitored. A path that must not energise unintentionally is arranged so that a failure of the driver leaves it de-energised. A measurement that a decision depends on is either verified or duplicated. Each of those decisions is made before the layout begins, because they determine what has to be routed.

Redundancy and Independence

Redundancy is only useful if the redundant paths are independent, and independence is a layout property as much as a schematic one. Two channels that share a power rail are not independent. Two channels that share a connector pin are not independent. Two channels that run side by side along the same route can be damaged by the same event, which is exactly what the redundancy was meant to survive.

Designing for independence therefore means placing the two channels in different areas of the board, routing them by different paths, and giving each its own supply, its own protection and, where the design allows, its own connector. It also means avoiding a common clock, a common reference or a common reset unless the design accounts for the consequence of its failure. Our component tolerance and reliability notes describe how those paths are assessed.

Diagnostics and Self-Testing

A safe system proves that it is working rather than assuming it. Built-in test that exercises the signal path, monitors the supply rails and checks the state of the interlocks is the standard approach, and the test has to be able to detect the failures it is meant to catch. That means the test must be designed rather than inherited, and the board has to provide the measurement points and the injection points it needs.

The diagnostic coverage is the fraction of possible failures the test can detect, and it is a number that appears in the safety calculation. Improving it is often cheaper than increasing the redundancy, and it is done by adding measurement rather than hardware: a reference channel, a comparison between two sensors or a simple current monitor can raise the coverage substantially for very little cost.

<img src="https://www.gopcba.com/wp-content/uploads/2026/08/word-image-24809-2.png" alt="fault injection test on a safety related control board” />

Materials, Documentation and Change Control

Safety related products are usually specified at a higher acceptance class, with documented traceability and a restriction on change. Every material used is qualified for the application, the fabrication processes are controlled and recorded, and any change to either is assessed for its effect on the safety case. That is the same regime that applies to medical and aerospace hardware, and it exists because a failure in service has to be diagnosable years later.

The documentation extends to the design itself. The reasoning behind the redundancy, the basis of the diagnostic coverage claim and the assumptions behind the component derating all have to be recorded, because a later revision that changes a component has to be checked against those assumptions. A design that is not documented in that way cannot be maintained safely.

Testing and Validation

Validation demonstrates that the safety functions work, not merely that the system functions. Fault injection, in which a component or a connection is deliberately broken or shorted while the system is running, is the standard technique, and it is performed on production representative hardware rather than on a prototype. The system is expected to detect the fault, respond in the designed way and report it.

The environmental testing is correspondingly thorough. Temperature extremes, humidity, vibration, supply transients and electromagnetic immunity are all applied, and the safety functions are verified before, during and after each of them. The result is a product whose behaviour is known under conditions that will rarely occur, which is the definition of a safety critical design.

Practical Engineering Consequences

The consequence for the board is usually more area, more connectors and more test points than a functionally equivalent commercial design. Traces are routed for separation rather than for density, parts are derated more heavily, and the bill of materials includes components that exist only to monitor or to protect. The cost is real, and it is the price of the property the design is claiming.

What a designer can do is make those requirements explicit early. A safety case that is assembled after the layout is finished will find compromises in the geometry that are expensive to correct, while the same requirements considered before the placement will usually be satisfied by arrangement rather than by additional hardware.

Process Control and Verification

Reviewing Process Control and Verification before the data is released is far cheaper than correcting it after the panel is in the tank, because every step downstream inherits the decision that was made at the front end. Where a value sits close to a process limit, the drawing should say so, since the shop can then adjust the process window rather than working to a nominal figure that has no tolerance attached to it.

Reviewing Process Control and Verification before the data is released is far cheaper than correcting it after the panel is in the tank, because every step downstream inherits the decision that was made at the front end. Where a value sits close to a process limit, the drawing should say so, since the shop can then adjust the process window rather than working to a nominal figure that has no tolerance attached to it.

Reviewing Process Control and Verification before the data is released is far cheaper than correcting it after the panel is in the tank, because every step downstream inherits the decision that was made at the front end. Where a value sits close to a process limit, the drawing should say so, since the shop can then adjust the process window rather than working to a nominal figure that has no tolerance attached to it.

Related reading: our fabrication notes, board quality and design release notes cover the same ground.

FAQ

Is redundancy enough on its own? No. Redundancy without independence does not reduce the failure probability, and redundancy without diagnostics can leave a failed channel unnoticed until the second one fails.

What is diagnostic coverage? The proportion of possible failures that the built-in test can detect. It appears directly in the safety calculation, and raising it is often cheaper than adding redundant hardware.

Why does a safety critical board cost so much more? Because of the additional monitoring and protection hardware, the higher acceptance class, the testing and the documentation. Much of the cost is in the evidence rather than in the components.