Hardware module integrity during
run-time is a critical functional safety requirement. Hardware Redundancy
implemented by the lockstep CPU architecture (two CPUs executing the same function
and the output of the CPUs are continuously compared) is a proven method for
achieving high diagnostic coverage for both permanent and transient faults. The
Lockstep Comparator Module (LCM) is implemented to compare output from the C28x CPU
to detect permanent and transient faults.
The LCM implements the following features:
- Pipelined architecture
- Redundant comparison
- Self-test capability
- Match and mismatch test
- Error forcing capability
- Temporal redundancy: The
operation of the two modules is skewed by two cycles to address the issue of
common cause failures like failure of clock, power, and so on. This makes
sure of temporal redundancy.
- Spatial redundancy: Each
module is physically separate and their outputs are compared. The physical
separation provides spatial redundancy.
- Non-delayed functional output path to provide non-delayed CPU execution for
the system (while still having temporal redundancy).
- Register protection of critical memory mapped registers of the module, using
a parity scheme.
Figure 7-3 shows the LCM block diagram.
Note: The Module described in this
block diagram can be either a CPU (for example, CPU1) or a peripheral (for example,
DMA) depending on availability for the device.