Safety Manual for MPC5777M, Rev. 1.1
Functional safety requirements for application software
NXP Semiconductors54
NOTE
This safety mechanism doesn't cover the analog watchdog only, but it
verifies the integrity of the interrupt and DMA generation by the ADC
module. This procedure is required to run even if the analog watchdog is not
used by the safety application.
Assumption: [SM_FMEDA_161] Every trigger (either hardware or software), which starts a conversion
sequence, also initiates a timer or watchdog to monitor the conversion sequence duration. [end]
NOTE
In case conversion time exceeds the expected value, this timer or watchdog
shall abort the corresponding ADC conversion.
In case of scan mode, the conversion time is monitored for duration deviation more than the conversion
time of a single channel.
Assumption: [SM_FMEDA_162] At the end of the conversion of all enabled channels (or after a
CONV_TIME_MON time-out), software shall check the status of the conversion to detect any missed or
spurious request. The status of the last conversion shall be cleared before starting a new one. [end]
NOTE
In case of SAR ADC some registers which give information about the status
of the conversion are showed below:
— VALID and OVERW flags of the CDR registers
—EOC/ECH flags
— ECAWORRx (or ICAWOOR) and WTISR to verify any violation
triggered by the analog watchdog.
In case of SDADC the register showing status information is the SFR.
Please check the SDADC section in the MPC5777M Reference Manual to
have all details.
Assumption: [SM_FMEDA_163]In case the DMA is used to transfer the converted data from ADC
modules to the memory, at the end of the conversion of all enabled channel VALID and OVERW flags of
the CDR register and EOC status flags are verified against programmed configuration of DMA to detect
any missing or spurious request. [end]
Functional and supervisor ADCs share the same reference bias. Since a failure affecting the bias can cause
the violation of the safety goal, its integrity shall be verified at least per FTTI. This check can be done via
software by acquiring some known analog values via the supervisor ADC.
Assumption: [SM_FMEDA_164] At least once per FTTI, the supervisor ADC shall acquire some known
internal analog voltage signals and compare them with the expected values before being used to monitor
the functional ADCs. [end]
NOTE
The implementation of this software mechanism is the same than the
SELFTEST_SARB one. The only difference is the execution frequency.
To Next Page
Loading...
