Common cause failures impacting the
functions and their safety mechanisms ("diagnostic" or "functional redundancy") have
been analyzed at the internal level (sub-elements of the MCU) by Texas Instruments from
a generic SEooC point of view. The system integrator shall supplement this analysis by
analyzing relevant sub-elements of the MCU based on the intended use case, including
pin-level connections, impact of the pin or ball level interactions on the MCU package,
and aspects related to the selected I/O multiplexing. Appropriate to the safety concept,
the applicable safety measures from the list below shall be implemented for addressing
the common cause failures when using the MCU. When diagnostic or functional redundancy,
it requires further analysis of the common cause failures.
- Redundant functions and safety mechanism can be impacted by
common power failure. A common cause failure on power source can be detected by
PWR1 -
External Voltage Supervisor, PWR2 - External
Watchdog.
- In general, a clock source which is common to redundant
functions should be monitored and any failures on the same can be detected by
safety mechanisms such as CLK1 - Missing Clock
Detect, CLK2 - Clock Integrity
Check using CPU Timer, CLK5 - External Monitoring
of Clock via XCLKOUT, and CLK8 - Periodic Software
Read Back of Static Configuration Registers. Specifically, to avoid
common clock failure affecting Internal Watchdog(WD) and CPU, it is recommended
to use either INTOSC2 or X1/X2 as clock source to PLL.
- Failure of common reset signal to redundant functions can be
detected by RST1 - External Monitoring of Warm Reset (XRSn) and RST2 - Reset
Cause Information.
- Common cause failure on Interconnect logic could impact both
redundant functions and also safety mechanism in same way. In addition to other
safety mechanisms, INC1 - Software Test of
Function Including Error Tests can be implemented to detect faults on
interconnect logic.
- Common cause failure could impact two functions used in
redundant way. In case of communication peripherals module specific Information
Redundancy Techniques Including End to End Safing can be implemented
to detect common cause failures, for example, CAN2, SPI2, SCI3, I2C3, and so
on.
- Using different voltage references and SOC trigger sources for
ADC (see Hardware Redundancy).
- Using nonadjacent GPIO pins from different groups when
implementing Hardware Redundancy for GPIO pins.