Safety Manual for MPC5777M, Rev. 1.1
Functions of external devices for ASIL D applications
NXP Semiconductors62
The functionality of FI[0] can be verified in two ways on a system level by testing that FI[0] can trigger
the Safe state
system
. If only FI[0] needs to be tested (without the rest of the shutdown path), this can be
accomplished with either of the following:
• FI[0] output, and FI[0] input (loop through the IO pad).
• FI[0] output connected externally to a normal GPIO.
The customer must choose which solution best fits their requirement.
Assumption: [SM_FMEDA_121] After boot, but before executing the safety function, the functionality
of FI[0] pin shall be verified
1
. [end]
As access to FI[0] is shared between the FCCU and GPIO there is a failure mode where the multiplexing
fails and FI[0] becomes controlled by GPIO. To make this detectable, the respective GPIO needs to be
configured to drive FI[0] into the fail state.
Assumption: [SCG18.094]If an error indication protocol is selected which makes use of only one error
out pin (for example, FI[0]), then SW configures any I/O MUXed to that pin to drive low before switching
the pin to FCCU control [end] (see the MPC5777M Reference Manual’s “Signal Description” chapter and
the “I/O Signal Description table” for pin MUXing specifics).
The advantage of this configuration with respect to the configuration where two error indication signals
are used, is that it can use an external device that does not compare the two signals.
Assumption: [SM_FMEDA_122] If the system is using the MPC5777M in a single error output pin mode,
the application software shall configure the pins and pads neighboring the FI[0] to use a lower drive
strength. [end]
Using a lower drive strength on the pins near FI[0] will reduce the effects of simultaneously switching
outputs on signal integrity. Software must configure the slew rate for the relevant pads in the Pad
Configuration Register.
1. Since FCCU is a monitor, it is sufficient to verify the FI[0] signal only at start-up in order to avoid latent faults.
To Next Page
Loading...
