General information
Safety Manual for MPC5777M, Rev. 1.1
NXP Semiconductors 7
2.6 Failure indication time
Failure indication time is the time it takes from the occurrence of a failure to when the indication of that
failure is visible by driving the error out pins or by assertion of reset.
The failure indication time of the MPC5777M is finite. It must be taken into account when determining
application safety strategies since failure indication time plus reaction time on this indication by the system
must be less than the FTTI.
[SCG18.128]Failure indication time has three components, two of which are influenced by certain
configuration choices:
Failure indication time = recognition time + internal processing time + indication time.
Each component of failure indication time is briefly described as follows:
• Recognition time is the maximum of the recognition time of all involved safety mechanisms. The
two mechanisms with the longest times are:
— Recognition time related to the FMPLL loss of clock: This time depends on the FMPLL
configuration. This time is approximately 20 µs.
— Diagnostic cycle time of software self-tests. This time depends closely on the software
implemented.
• Internal processing time lasts a maximum 10 IRCOSC clock cycles (nominal frequency of
IRCOSC is 16 MHz).
• Indication time is the time to notify an observer about the failure. This time depends on the
indication protocol in the FCCU:
— Dual Rail protocol and time switching protocol –
— FCCU configured as “fast switching mode”: indication delay is
maximum 64 µs. As soon as the FCCU receives a fault signal, it
reports the failure to the outside world via an output pin (if properly
configured).
— FCCU configured as “slow switching mode”: an indication delay
could occur. The maximum delay is equal to the period of the error
out signal, which toggles at a frequency of 61 Hz.
— Bi-stable protocol: indication delay is maximum 64 µs. As soon as the FCCU receives a fault
signal, the FCCU reports the failure via an output pin (if properly configured).
If the configured reaction to a fault is an interrupt, an additional delay (interrupt latency) can occur until
the interrupt handler is able to start executing (for example, higher priority IRQs, XBAR contention,
register saving, and so on). [end]
Assumption: [SCG18.022]The overall failure indication time shall be less than the FTTI of the
application (assumed FTTI shown in Section 2.1, Mission profile). [end]
2.6.1 Minimum failure indication time
When a failure event occurs, one or both error output signals (Fn) are set to show an error condition for a
minimum time (T_min), even if software attempts to reset the state of the error out signals. The external
To Next Page
Loading...
Need help?
General
