The system integrator must execute an independent
failure or common cause failure analysis to consider possible dependent or common cause
failures on the sub-elements of the TMS320F28P55x
real-time MCU, including pin-level connections.
- Consider a relevant list of dependent failure initiators, such as the lists
found in ISO 26262-11:2018. Analysis of dependent failures must include common cause
failures among functionally redundant parts and also between functions and the respective
safety mechanisms.
- Verify that the dependent failure analysis considers the impact of the software
tasks running on the TMS320F28P55x
MCU, including hardware and software interactions.
- Verify that the dependent failure analysis considers the impact of pin and ball
level interactions on the TMS320F28P55x
MCU package, including aspects related to the selected I/O multiplexing.
The following can be useful for addressing the
common cause failures when using the C2000 MCU:
- Redundant functions and safety mechanism can be impacted by common power
failure. A common cause failure on power source can be detected by PWR1-External voltage
supervisor and PWR2-External Watchdog.
- In general, a clock source that is common to redundant functions is monitored
and any failures on the same clock source can be detected by safety mechanisms such as
CLK1-Missing
Clock Detect, CLK2-Clock Integrity Check using CPU
Timer, CLK5-External monitoring of clock via
XCLKOUT, and CLK8-Periodic Software Read Back of Static
Configuration Registers. Specifically, to avoid common-clock failures
affecting internal watchdog (WD) and CPU, TI recommends using either INTOSC2 or X1/X2 as
clock source to PLL.
- Failure of common reset signals to redundant functions can be detected by
RST1-External
monitoring of warm reset (XRSn) and RST2-Reset Cause
Information.
- Common cause failures on interconnect logic can impact both redundant
functions and safety mechanisms in the same way. In addition to other safety mechanisms,
INC1-Software
Test of Function Including Error Tests can be implemented to detect faults
on interconnect logic.
- Common cause failures can impact two functions used in a redundant way. In
cases of communication peripherals that are module specific, Information Redundancy Techniques
Including End to End Safing can be implemented to detect common cause
failures, for example, CAN2, SPI2, SCI3, I2C3, and MCBSP2.
- Using different voltage references and SOC trigger sources for ADC (refer to
Section 6.4.4.9)
- Using PWM modules from different sync groups for implementing hardware
redundancy
- Using GPIO pins from different groups when implementing hardware redundancy
for GPIO pins