Product Architecture for Management of Random Faults
www.ti.com
The system integrator is responsible for the functional partition of these processing engines, depending on
the end application, as each application has different safety reactions and recovery times. The IEC60730
libraries enable easy implementation of safety software using the hardware and software functions.
Control Subsystem: Piccolo6x devices have proven control peripherals such as PWMs, enhanced
capture (ECAP), and enhanced quadrature encoder pulse (EQEP) modules as part of the MCUs control
subsystem. These hardware peripherals are instantiated in multiple instances on the same chip. This
enables redundant channel implementation, thus enabling a higher level of safety in the end equipment.
Having redundant channels enables 1oo2 (1 out of 2 architecture) level voting scheme on critical control
channels.
The high-resolution pulse width modulator (HRPWM) module enhances the resolution of the PWM control
and provides unique calibration logic to track the PWM modulation accuracy and input clock oscillator
accuracy. The oscillator accuracy library functions use the SFO libraries, which use the inherent
calibration logic, to measure the accuracy of the oscillator clock and PLL.
General-purpose input/output (GPIO) configuration registers are write-protected with special EALLOW
instructions. Most of the GPIO inputs have a programmable de-glitching filter to screen spurious noise or
debouncing. This is especially important for PWM output trip control signals, to avoid false tripping of
PWM outputs.
The Control peripherals are complemented with three 32-bit CPU timers that can support time base
checks, and as redundant channels to implement timing checks.
Piccolo MCUs use industry standard communication ports such as: controller area network (CAN), serial
communications interface (SCI), serial peripheral interface (SPI), multichannel buffered serial port
(McBSP) and inter-integrated circuit (I2C). These peripherals are often available in multiple instantiations
that allow 1oo2 voting schemes and internal loop back paths that allow periodic serial data integrity
checks.
Section 5 presents many of the functional safety diagnostics schemes that can be implemented to add
safety in each of these MCU functions during run time and power up state.
Analog Subsystem: Piccolo6x analog subsystem supports all the necessary analog sensing and
feedback channels. It has its own independent regulated power, oscillators, temperature sensor and PLL
clock. At runtime, it is synchronized and tightly coupled to the main CPU and control subsystems. Piccolo
MCU addresses the safety requirements of the operating clock redundancy with a minimum of two clocks
sources and an additional external clock source. There are two zero-pin oscillators operating in parallel,
OSC1 and OSC2, an additional on-chip crystal oscillator, and an external clock pin.
The oscillator clocks feed the on-chip watchdog module to provide time-out monitoring of time critical
loops. Device reset is offered through an external pin. This is a bidirectional pin allowing on-chip watchdog
reset to propagate to external devices. The reset input signal is always qualified with a deglitching filter
(about 200 ns) that helps to block reset line noise due to any electrical disturbance.
The dependencies of these clock domains and recovery mechanisms are presented in the Piccolo
technical reference manual (see Table 1). The on-chip regulator supports POR and BOR logic to generate
under voltage detection.
14
Safety Manual for C2000™ MCUs in IEC60730 Safety Applications SPRUHI3A–April 2013–Revised August 2013
Submit Documentation Feedback
Copyright © 2013, Texas Instruments Incorporated
To Next Page
Loading...
Need help?
General
