System Integrator needs to execute a
common cause failure analysis to consider possible dependent/common cause failures
on the sub-elements of the TMS320F280015x MCU, including pin level connections.
- Consider a relevant list of dependent failure initiators, such
as the lists found in ISO 26262-11:2018. Analysis of dependent failures should
include common cause failures among functional redundant parts and also between
functions and the respective safety mechanisms.
- Verify that the dependent failure analysis considers the impact
of the software tasks running on the TMS320F280015x MCU, including hardware and
software interactions.
- Verify that the dependent failure analysis considers the impact
of the pin or ball level interactions on the TMS320F280015x MCU package,
including aspects related to the selected I/O multiplexing.
The following should be considered for
addressing the common cause failures when using the TMS320F280015x MCU:
- Redundant functions and safety mechanism can be impacted by
common power failure. A common cause failure on power source can be detected by
PWR1-External Voltage Supervisor, PWR2-External Watchdog.
- In general, a clock source which is common to redundant
functions should be monitored and any failures on the same can be detected by
safety mechanisms such as CLK1-Missing Clock Detect (MCD), CLK17-Dual-Clock Comparator (DCC), CLK2-Clock Integrity Check Using CPU Timer, CLK5-External Clock Monitoring via XCLKOUT and CLK8-Periodic Software Read Back of Static Configuration Registers.
Specifically, to avoid common clock failure affecting Internal Watchdog (WD) and CPU, it is recommended to use either
INTOSC2 or X1/X2 as clock source to PLL.
- Failure of common reset signal to redundant functions can be
detected by RST1-External Monitoring of Warm Reset (XRSn), RST2-Reset Cause Information.
- Common cause failure on Interconnect logic could impact both
redundant functions and also functional safety mechanism in same way. In
addition to other safety mechanisms, INC1-Software Test of Function Including Error Tests can be
implemented to detect faults on interconnect logic.
- Common cause failure could impact two functions used in a
redundant way. In case the of communication peripherals, module specific Information Redundancy Techniques Including End-to-End Safing can be
implemented to detect common cause failures, for example, CAN2-Information Redundancy Techniques Including End-to-End Safing,
SPI2-Information Redundancy Techniques Including End-to-End Safing,
SCI3-Information Redundancy Techniques Including End-to-End Safing,
I2C3-Information Redundancy Techniques Including End-to-End
Safing.
- Use different voltage references and SOC trigger sources for
ADC (see Section 6.4.5.8).
- Use ePWM modules from different sync groups for implementing
Hardware Redundancy.
- Use nonadjacent GPIO pins from different groups when
implementing Hardware Redundancy for GPIO pins.