SDAA524 October   2026 DRV3233-Q1 , DRV3263-Q1 , DRV8245-Q1 , LM74930-Q1 , TCAN1043HG-Q1 , TMAG6180-Q1

 

  1.   1
  2.   Abstract
  3.   Trademarks
  4. 1Introduction
    1. 1.1 Evolution of Braking Systems
      1. 1.1.1 Legacy Hydraulic Brake
      2. 1.1.2 Electrical Hydraulic Brake (EHB)
      3. 1.1.3 Electrical Mechanical Brake (EMB)
    2. 1.2 Why ASIL D is Required for EMB
    3. 1.3 How to Develop a Safe EMB System?
  5. 2Safety Goal and Safety Concept
    1. 2.1 EMB System Overview
      1. 2.1.1 Item Definition
      2. 2.1.2 Operational Situations
      3. 2.1.3 System Interface
    2. 2.2 EMB Safety Goal
      1. 2.2.1 Application Assumption
      2. 2.2.2 Hazard Analysis and Risk Assessment
      3. 2.2.3 Safety Goal
    3. 2.3 EMB Functional Safety Concept
      1. 2.3.1 Fail Tolerance Strategy
      2. 2.3.2 Functional Safety Concept
      3. 2.3.3 Functional Safety Requirements
  6. 3Proposed Design for ASIL D EMB
    1. 3.1 EMB System Safety Design Architecture
    2. 3.2 Hardware Component
    3. 3.3 Safety Mechanism Design
      1. 3.3.1 Power Management Safety Design
        1. 3.3.1.1 Ideal Diode Safety Analysis
        2. 3.3.1.2 DCDC safety analysis
        3. 3.3.1.3 PMIC Safety Analysis
      2. 3.3.2 Central Controller Safety Design
      3. 3.3.3 Communication Interface Safety Design
      4. 3.3.4 Actuator Safety Design
        1. 3.3.4.1 Braking Motor Driver Safety Analysis
        2. 3.3.4.2 Parking Driver Safety Analysis
      5. 3.3.5 Sensor Interface Safety Design
        1. 3.3.5.1 Position Sensor Safety Analysis
        2. 3.3.5.2 Wheel Speed Decoder Safety Analysis
        3. 3.3.5.3 Pedal Position Sensor Safety Analysis
  7. 4Summary
  8. 5References

3.3.3 Communication Interface Safety Design

TCAN1043HG-Q1 is a functional safety-capable device in TI. Figure 3-11 shows the structure of the TCAN1043HG-Q1. The safety design for communication interface follows ASIL decomposition principle. All failures on the transceiver lead to a communication error is checked by end-to-end mechanism. To achieve an ASIL D target, the check software shall develop as ASIL D and cover all failures on CAN communication. A QM CAN transceiver IC can be selected. To achieve a robust communication, the transceiver shall support fail-safe features that prevents sending data to bus when TXD timeout, RXD short, overtemperature, and so forth. Local failure diagnostics can be implemented by specifically designed output pins for status indication.

TCAN1043HG-Q1 Structure Figure 3-11 TCAN1043HG-Q1 Structure

Table 3-22 shows the safety analysis and safety mechanisms proposed for the ideal diode application.

Table 3-5 System Level FMEA for Communication Interface
Failure mode Failure effect FSR violation Safety mechanism FSR traced
Receiver fail Cannot receive ECU data, communication fails lead to cannot perform braking control SPF

SM_TCAN_E2E CHECK

SM_TCAN_switch over

FSR 3.1

FSR 3.2

FSR 3.4
Transmitter fail Cannot transmit pedal, wheel speed, and so forth, message to ECU, cannot generate correct command for braking control SPF

SM_TCAN_E2E CHECK

SM_TCAN_switch over

FSR 3.1

FSR 3.2

FSR 3.4
System stuck in sleep mode Cannot wakeup MCU for braking control SPF

SM_TCAN_E2E CHECK

SM_TCAN_switch over

FSR 3.3

FSR 3.4
CANL or CANH driver biased dominant indefinitely ECU cannot communicate with wheel side MCU, cannot receive braking control command SPF

SM_TCAN_E2E CHECK

SM_TCAN_switch over

FSR 3.1

FSR 3.2

FSR 3.4
Short-circuit of any two pins Loss of pin function SPF pin FMEA

FSR 3.4

FSR 3.5
Reports erroneous fault condition Not used for safety function NSR NA NA

SM_TCAN_E2E CHECK: F29P32 MCU embedded with an ASIL D lockstep core, support end-to-end software running. System integrator shall use ASIL D software for E2E check. The E2E check shall include but not limited to the following items:

  • Data CRC for all kinds of message corruption during transmission
  • Frame counter for communication frame losses
  • Timeout check for message lost detection
  • Periodic readback of sent message by MCU or periodic communicate with ECU for communication alive monitor

SM_TCAN_switch over: When detected first TCAN1043HG-Q1 communication failure occurs or cannot wake up the EMB system, MCU switch communication to another TCAN1043HG-Q1 path.

Safety Mechanism Design of Communication Interface Figure 3-12 Safety Mechanism Design of Communication Interface