SLLA475 December 2020 TCAN1144-Q1 , TCAN1146-Q1
Table A-2 summarizes the functional safety mechanisms present in hardware or recommend for implementation in software or at the system level as described in Section 7. Table A-1 describes each column in Table A-2 and gives examples of what content could appear in each cell.
| Functional Safety Mechanism | Description |
|---|---|
| TI Safety Mechanism Unique Identifier | A unique identifier assigned to this safety mechanism for easier tracking. |
| Safety Mechanism Name | The full name of this safety mechanism. |
| Safety Mechanism Category | Safety Mechanism - This test provides coverage for faults on the primary function. It may also provide coverage on another safety mechanism. Test for Safety Mechanism - This test provides coverage for faults of a safety mechanism only. It does not provide coverage on the primary function. Fault Avoidance - This is typically a feature used to improve the effectiveness of a related safety mechanism. |
| Safety Mechanism Type | Can be either hardware, software, a combination of both hardware and software, or system. See Section 8.2 for more details. |
| Safety Mechanism Operation Interval | The timing behavior of the safety mechanism with respect to the test interval defined for a functional safety requirement / functional safety goal. Can be either continuous, or on-demand. Continuous - the safety mechanism constantly monitors the hardware-under-test for a failure condition. Periodic or On-Demand - the safety mechanism is executed periodically, when demanded by the application. This includes Built-In Self-Tests that are executed one time per drive cycle or once every few hours. |
| Test Execution Time | Time period required for the safety mechanism to complete, not including error reporting time. Note: Certain parameters are not set until there is a concrete implementation in a specific component. When component specific information is required, the component data sheet should be referenced. Note: For software-driven tests, the majority contribution of the Test Execution Time is often software implementation-dependent. |
| Action on Detected Fault | The response that this safety mechanism takes when an error is detected. Note: For software-driven tests, the Action on Detected Fault may depend on software implementation. |
| Time to Report | Typical time required for safety mechanism to indicate a detected fault to the system Note: For software-driven tests, the majority contribution of the Time to Report is often software implementation-dependent |
| TI Safety Mechanism Unique Identifier | Safety Mechanism Name | Safety Mechanism Category | Safety Mechanism Type | Safety Mechanism Operation Interval | Test Execution Time | Action on Detected Fault | Time to Report |
|---|---|---|---|---|---|---|---|
| SM-1 | CAN bus fault | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - In normal mode | 150 ns | interrupt bits in registers 8'h50[7], 8'h50[3] and register 8'h54[6:0] and indicates an CAN Bus fault | 50 ns |
| SM-2 | Thermal shutdown; TSD | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - all modes except for sleep | 4.4 μs | [turn off the CAN transceiver and set the interrupt bit registers 8'h50[7], 8'h50[5] and 8'h52[1] indicating junction temperature exceeded and enters fail-safe mode or TSD protected mode | 1.1 μs |
| SM-3 | CAN bus short circuit limiter, IOS | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - all modes except for sleep | NA | Limits the current throught the CANH and CANL pins. | NA |
| SM-4 | CAN TXD pin dominant state timeout; tTXD_DTO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - In normal mode | 3.5 ms | the device will turn off the CAN transceiver and indicate the the fault at 8'h50[7], 8'h50[6] and 8'h51[0] | 1.1 μs |
| SM-5 | VCC undervoltage; UVCC | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - all modes except for sleep | 330 ms | Device enters programmed mode, sleep or fail-safe mode, sets interrupt registers 8'h50[7], 8'h50[5] and 8'h52[2] and indicates UVCC condition | 1.1 μs |
| SM-6 | VSUP supply undervoltage; UVSUP | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - all modes except for sleep | 2.2 μs | Device enters programmed mode, sleep or fail-safe mode, sets interrupt registers 8'h50[7], 8'h50[5] and 8'h52[4] and indicates UVSUP condition | 1.1 μs |
| SM-7 | VIO supply undervoltage; UVIO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - all modes except for sleep | 330 ms | Device enters programmed mode, UVIO protected or fail-safe mode, sets interrupt registers 8'h50[7], 8'h50[5] and 8'h52[3] and indicates UVIO condition back to MCU with nINT pin | 1.1 μs |
| SM-8 | Timout, Window or Q&A watchdog error - Normal mode | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | Programmable | Increments WD error counter and if exceeded programmed value will enter programmed mode, restart or fail-safe mode, set WD interrupt and indicate back to MCU with nINT pin | 1.1 μs |
| SM-9 | SPI communication error; SPIERR | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | 50 ns after rising edge of nCS | The device shall monitor MCU SPI communication utilizing clock count check and if there are too many or not enough clock signals the MCU write to the device will be blocked and 8'h50[7], 8'h50[4] and 8'h53[7] | 1.1 μs |
| SM-10 | Scratchpad write/read | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous when VIO is present and is MCU initiated | SPI clock rate dependent as a write plus data followed by a read and data required | Using the TCAN114x scratchpad, 8'h0F[7:0], by the processor makes it possible to write and read back data to determine SPI communication is valid | NA |
| SM-11 | Sleep Wake Error Timer; tINACTIVE | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | 5 min | If tINACTIVE times out and fail-safe mode (FSM) is enabled, the device will enter FSM and will indicate the fault at 8'h50[7], 8'h50[4] and 8'h53[5]. If not enabled, the device will enter sleep mode. | 1.1 μs |
| SM-12 | Internal memory CRC; CRC_EEPROM | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Periodic - Exiting fail-safe and sleep modes | 425 μs | The device will attempt to load and CRC check the EEPROM up to eight times and if fail it will indicate the the fault at 8'h50[7], 8'h50[4] and 8'h53[0] | 1.1 μs |
| SM-13 | SCLK internal pull-up to VIO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin | NA |
| SM-14 | SDI internal pull-up to VIO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin | NA |
| SM-15 | nCS internal pull-up to VIO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin | NA |
| SM-16 | TXD internal pull-up to VIO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin | NA |
| SM-17 | CAN protocol | Safety Mechanism | System Functional Safety Mechanism | Periodic | NA | CAN protocol has several mechanism that will make sure the data provided is correct, like CRC. If incorrect the processor will disregard the CAN packets | NA |