SWRS273D November 2021 – September 2024 AWR2944
PRODUCTION DATA
Table 8-1 is a list of the main monitoring and diagnostic mechanisms available in the device.
NO | FEATURE | DESCRIPTION |
---|---|---|
MAIN SUBSYSTEM | ||
1 | Lockstep operation of MSS R5F Core | Device architecture supports lockstep operation of the MSS R5F core that is the operating core in the Main subsystem that is provisioned as the safety island in the device. |
2 | Boot time LBIST For MSS R5F Core and associated VIM | Device architecture supports hardware logic BIST (LBIST) engine
self-test Controller (STC). This logic is used to provide a very
high diagnostic coverage (>90%) on the MSS R5F CPU core and
Vectored Interrupt Module (VIM) at a transistor level. LBIST for the CPU and VIM need to be triggered by application code before starting the functional safety application. A reset of the CPU is initiated at the end of the STC operation and the reset cause register captures the status of reset. The STC registers can then be read out to identify the status of the STC execution to determine if there were any errors. CPU stays there in while loop and does not proceed further if a fault is identified. There can be a fault injection test also performed which leads to a reset of the CPU with the error status signaled in the STC registers. |
3 | Boot time PBIST for MSS R5F Memories | MSS R5F has tightly coupled memories (TCM) Level 1 (L1) memories TCMA, TCMB0 and TCMB1 as
well as the level 2 (L2) memories. Device architecture supports a hardware programmable memory
BIST (PBIST) engine. This logic is used to provide a very high diagnostic coverage (March-13n)
on the implemented MSS R5F TCMs at a transistor level. PBIST for L1 and L2 memories is triggered by the bootloader at the boot time before starting download of application from flash or a peripheral interface. The CPU is in a while loop and does not proceed further if a fault is identified. |
4 | End to End ECC for MSS R5F Memories |
The TCMs and L2 memory diagnostic support a single error correction, double error detection (SECDED) ECC diagnostic. For L2 memory, an 8-bit code word is used to store the ECC data as calculated over the 64-bit data bus. For TCMs, a 7-bit code word is used to store the ECC data for a 32-bit data bus. ECC evaluation for TCMs is done by the ECC control logic inside the CPU. This scheme provides end-to-end diagnostics on the transmissions between CPU and TCM. CPU can be configured to have predetermined response (ignore or abort generation) to single and double bit error conditions. |
5 | MSS R5F bit multiplexing | Logical TCM and L2 memory word and the associated ECC code is
split and stored in two physical SRAM banks. This scheme provides an
inherent diagnostic mechanism for address decode failures in the
physical SRAM banks. Faults in the bank addressing are detected by
the CPU as an ECC fault. Further, bit multiplexing scheme is implemented such that the bits accessed to generate a logical (CPU) word are not physically adjacent. This scheme helps to reduce the probability of physical multi-bit faults resulting in logical multi-bit faults; rather the faults manifest as multiple single bit faults. As the SECDED TCM ECC can correct a single bit fault in a logical word, this scheme improves the usefulness of the TCM ECC diagnostic. Both these features are hardware features and cannot be enabled or disabled by application software. |
6 | Clock Monitor | Device architecture supports four digital clock comparators
(EDCCs) and an internal RCOSC. Dual functionality is provided by
these modules – clock detection and clock monitoring. EDCCA is dedicated for ADPLL/APLL lock detection monitoring, comparing the ADPLL/APLL output divided version with the Reference input clock of the device. Failure detection for EDCCA can be programmed to cause the device to go into limp mode. Additionally, there is a provision to feed an external reference clock to monitor the internal clock using the EDCCA. EDCCB, EDCCC, EDCCD module is one which is available for user software. Any two clocks can be compared. One example is to compare the CPU clock with the reference or internal RCOSC clock source. Failure detection is indicated to the MSS R5F CPU through the Error Signaling Module (ESM). |
7 | RTI/WDT for MSS R5F | Device architecture supports the use of an internal watchdog that
is implemented in the real-time interrupt (RTI) module. The internal
watchdog has two modes of operation: digital watchdog (DWD) and
digital windowed watchdog (DWWD). The modes of operation are
mutually exclusive; the designer can elect to use one mode or the
other but not both at the same time. Watchdog can issue either an internal (warm) system reset or a CPU non-mask able interrupt upon detection of a failure. The Watchdog is enabled by the bootloader in DWD mode at boot time to track the boot process. When the application code takes control, the watchdog can be configured again for the mode and timings based on the application requirements. |
8 | MPU for MSS R5F | The Cortex-R5F CPU includes an MPU. The MPU logic can be used to provide spatial separation of software tasks in the device memory. The Cortex-R5F MPU supports 16 regions. The operating system controls the MPU and changes the MPU settings based on the needs of each task. A violation of a configured memory protection policy results in a CPU abort. |
9 | PBIST for Peripheral interface SRAMs - SPIs,CANs, Ethernet, EDMA, Mailbox | Device architecture supports a hardware programmable memory BIST (PBIST) engine for
Peripheral SRAMs as well. PBIST for peripheral SRAM memories can be triggered by the application. User can elect to run the PBIST on one SRAM or on groups of SRAMs based on the execution time, which can be allocated to the PBIST diagnostic. The PBIST tests are destructive to memory contents, and as such are typically run only at boot time. However, the user has the freedom to initiate the tests at any time if peripheral communication can be hindered. Any fault detected by the PBIST results in an error indicated in PBIST status registers. |
10 | ECC for Peripheral interface SRAMs – SPIs, CANs, Ethernet, EDMA, Mailbox | Peripheral interface SRAMs diagnostic is supported by Single error correction double error
detection (SECDED) ECC diagnostic. When a single or double bit error is detected, the MSS R5F is
notified via ESM (Error Signaling Module). This feature is disabled after reset. Software must configure and enable this feature in the peripheral and ESM module. ECC failure (both single bit corrected and double bit uncorrectable error conditions) is reported to the MSS R5F as an interrupt via ESM module. |
11 | Configuration registers protection for Main SS peripherals | All the Main SS peripherals (SPIs, CANs, Ethernet, I2C, DMAs,
RTI/WD, DCCs, EDMA, IOMUX etc.) are connected to interconnect via
Peripheral Central resource (PCR). This provides two diagnostic
mechanisms that can limit access to peripherals. Peripherals can be
clock gated per peripheral chip select in the PCR. This can be
utilized to disable unused features such that the features cannot
interfere. In addition, each peripheral chip select can be
programmed to limit access based on privilege level of transaction.
This feature can be used to limit access to entire peripherals to
privileged operating system code only. These diagnostic mechanisms are disabled after reset. Software must configure and enable these mechanisms. Protection violation also generates an error that result in abort to MSS R5F or error response to other hosts such as DMAs. |
12 | Cyclic Redundancy Check–Main SS | Device architecture supports hardware CRC engine on Main SS implementing the below polynomials.
|
13 | MPU | Device architecture supports MPUs on certain peripheral ports in
the Main SS that include L2 Memory, PCR peripheral access, QSPI
access, R5F AXI-peripheral access. This allows configuring access
permissions to these key regions in the Main SS. By default, this control resides with the HSM. |
14 | MPU for DMAs | Device architecture supports MPUs on Main SS EDMAs. EDMAs also includes MPUs on both read and writes host ports. EDMA MPUs supports 8 regions. Failure detection by MPU is reported to the core as an interrupt via local ESM. |
15 | Interconnect ECC | Device architecture supports hardware based ECC protection mechanisms for transfers over the system interconnect. Since code execution includes instruction fetches from memories hosted on the interconnect, the transfers over the interconnect are designed to be safe by a combination of ECC and redundancy based mechanisms. Any failures detected in the transfers are reported over the ESM interface. This mechanism is enabled by default in HW. |
16 | Error Signaling Module | When a diagnostic detects a fault, the error must be indicated.
The Device architecture provides aggregation of fault indication
from internal monitoring/diagnostic mechanisms using a peripheral
logic known as the Error Signaling Module (ESM). The ESM provides
mechanisms to classify errors by severity and to provide
programmable error response. ESM module is configured by customer application code and specific error signals can be enabled or masked to generate an interrupt (Low/High priority) for the MSS R5F CPU. Device supports Nerror output signal (IO) which can be monitored externally to identify any kind of high severity faults in the design which are not be handled by the R5F. |
17 | Temperature Sensor | Device architecture supports various temperature sensors at temperature hotspots in digital across the device that can be monitored by the application using an internal GPADC channel. |
18 | Voltage Monitors | Device architecture supports monitoring the supply rails connected to the chip, in conjunction with external voltage monitors. |
DSP SUB-SYSTEM | ||
1 | Boot time LBIST for DSP core | Device supports boot time LBIST for the DSP Core. LBIST can be triggered by the MSS R5F secondary bootloader/application code before starting the functional safety application. |
2 | Boot time PBIST for L1P, L1D, L2 and L3 Memories, HWA memories, RSS Memories (ADCBUF, CQ Memory), Mailbox | Device architecture supports a hardware programmable memory BIST (PBIST) engine for DSPSS and
RSS memories which provide a very high diagnostic coverage (March-13n). PBIST is triggered by MSS R5F secondary bootloader/application code before starting the functional safety application. |
3 | Parity on L1P, ECC on L1D | Device architecture supports Parity diagnostic on DSP’s L1P memory. Parity error is reported
to the CPU as an interrupt. L1D memory is covered by SECDED ECC. |
4 | ECC on DSP’s L2 Memory | Device architecture supports both Parity Single error correction double error detection (SECDED) ECC diagnostic on DSP’s L1D and L2 memory. L2 Memory is a unified 384KB of memory used to store program and Data sections for the DSP. A 12-bit code word is used to store the ECC data as calculated over the 256-bit data bus (logical instruction fetch size). The ECC logic for the L2 access is located in the DSP and evaluation is done by the ECC control logic inside the DSP. This scheme provides end-to-end diagnostics on the transmissions between DSP and L2. Byte aligned Parity mechanism is also available on L2 to take care of data section. |
5 | ECC on Radar Data Cube (L3) Memory, HWA Memories, RSS Memory (ADCBUF), Mailbox | L3 memory is used as Radar data section in the device. The architecture supports Single error
correction double error detection (SECDED) ECC diagnostic on L3 memory. A 12-bit code word is
used to store the ECC data as calculated over the 256-bit data bus. The RSS memory (ADCBUF) too supports the SECDED ECC diagnostics. Failure detection by ECC logic is reported to the DSP core as an interrupt via ESM. |
6 | RTI/WDT for DSP Core | Device architecture supports the use of an internal watchdog for
DSP C66x that is implemented in the real-time interrupt (RTI) module
– replication of same module as used in Main SS. This module
supports same features as that of RTI/WD for MSS. This watchdog is enabled by customer application code and Timeout condition is reported via an interrupt to DSP and/or MSS R5F and rest is left to application code in MSS R5F to take the device to a safe state. |
7 | CRC for DSP Sub-System | Device architecture supports hardware CRC engine on DSPSS implementing the below polynomials.
|
8 | MPU for DSP | Device architecture supports MPUs for DSP memory accesses (L1D, L1P, and L2). L2 memory supports 64 regions and 16 regions for L1P and L1D each. Failure detection by MPU is reported to the DSP core as an abort. |
9 | MPU | Device architecture supports MPUs on certain peripheral ports in
the DSP SS that include L3 Memory banks. This allows configuring
access permissions to these key regions in the DSP SS. By default, this control resides with the HSM. |
BIST (Within RADAR SUB-SYSTEM) | ||
NOTE: BIST is handled by the TI firmware. Refer to the mmWave Interface Control Document (as a part of mmWave-MCUPLUS-SDK package) and safety manual for information on safety mechanisms. |