SLLA535 December 2022 TLIN1431-Q1
Table A-2 summarizes the functional safety mechanisms present in hardware or recommend for implementation in software or at the system level as described in Section 5. Table A-1 describes each column in Table A-2 and gives examples of what content could appear in each cell.
| Functional Safety Mechanism | Description |
|---|---|
| TI Safety Mechanism Unique Identifier | A unique identifier assigned to this safety mechanism for easier tracking. |
| Safety Mechanism Name | The full name of this safety mechanism. |
| Safety Mechanism Category | Safety Mechanism - This test provides coverage for faults on the primary function. It may also provide coverage on another safety mechanism. Test for Safety Mechanism - This test provides coverage for faults of a safety mechanism only. It does not provide coverage on the primary function. Fault Avoidance - This is typically a feature used to improve the effectiveness of a related safety mechanism. |
| Safety Mechanism Type | Can be either hardware, software, a combination of both hardware and software, or system. See Section 6.2 for more details. |
| Safety Mechanism Operation Interval | The timing behavior of the safety mechanism with respect to the test interval defined for a functional safety requirement / functional safety goal. Can be either continuous, or on-demand. Continuous - the safety mechanism constantly monitors the hardware-under-test for a failure condition. Periodic or On-Demand - the safety mechanism is executed periodically, when demanded by the application. This includes Built-In Self-Tests that are executed one time per drive cycle or once every few hours. |
| Test Execution Time | Time period required for the safety mechanism to complete, not including error reporting time. Note: Certain parameters are not set until there is a concrete implementation in a specific component. When component specific information is required, the component data sheet should be referenced. Note: For software-driven tests, the majority contribution of the Test Execution Time is often software implementation-dependent. |
| Action on Detected Fault | The response that this safety mechanism takes when an error is detected. Note: For software-driven tests, the Action on Detected Fault may depend on software implementation. |
| Time to Report | Typical time required for safety mechanism to indicate a detected fault to the system. Note: For software-driven tests, the majority contribution of the Time to Report is often software implementation-dependent. |
| TI Safety Mechanism Unique Identifier | Safety Mechanism Name | Safety Mechanism Category | Safety Mechanism Type | Safety Mechanism Operation Interval | Test Execution Time | Action on Detected Fault | Time to Report |
|---|---|---|---|---|---|---|---|
| SM-1 | LIN TXD pin dominant state timeout; tTXD_DTO | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - In normal and fast mode | 80 ms | The device monitors the TXD pin for a stuck dominant for tTXD_DTO then the device turns off the LIN transceiver and indicate the fault at register h'5A[6]. | 3 μs |
| SM-2 | LIN bus stuck dominant | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - In normal and fast mode | 3 μs | Upon entering sleep mode, the device detects the state of the LIN bus. If the bus is dominant, the wake-up logic is locked out until a valid recessive on the bus “clears” the bus stuck dominant, preventing excessive current use. | 3 μs |
| SM-3 | LIN bus short circuit limiter, IBUS_LIM | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Periodic | NA | Limits the current through the LIN pin. | NA |
| SM-4 | VCC and Transceiver thermal shutdown; TSD | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - All modes except for sleep mode | 10 μs | Turn off the CAN transceiver and set the interrupt bit registers h'50[7], h'50[5] and h'52[1] indicating junction temperature exceeded and indicate an interrupt back to the MCU using the nINT pin and enter fail-safe mode or TSD protected mode. | 3 μs |
| SM-5 | VCC under voltage; UVCC | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - All modes except for sleep mode | 4 ms | Device enters programmed mode, restart or fail-safe, sets interrupt bits and indicates UVCC condition back to MCU with nINT pin, 8'h52[2] UVCC interrupt. | 3 μs |
| SM-6 | VCC over-voltage; OVCC | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - All modes except for sleep mode | 150 μs | Device enters programmed mode, fail-safe or sleep mode, sets interrupt bits and indicates OVCC condition back to MCU with nINT pin, 8'h52[5] OVCC interrupt. | 3 μs |
| SM-7 | VCC short to ground; VCCSC | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - All modes except for sleep mode | 125 μs | Device enters programmed mode, fail-safe or sleep mode, sets interrupt bits and indicates VCCSC condition back to MCU with nINT pin, 8'h53[3] VCCSC interrupt. | 3 μs |
| SM-8 | VSUP supply under voltage; UVSUP | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - All modes except for sleep mode | 125 μs | Device enters UVSUP state and sets interrupt, 8'h52[4] UVSUP letting processor know that this event took place. | 3 μs |
| SM-9 | Standby long timeout WD; tINITWD | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Periodic - Upon entering standby mode. | 200 ms | Missing window cause an interrupt flag to be set and indication back to MCU with nINT pin and setting interrupt 8'h51[7] WD. | 5 μs |
| SM-10 | Timeout or window watchdog error - Normal mode | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | Programmable 4 ms to 20 s | Increments WD error counter and if exceeded programmed value enters programmed mode, restart or fail-safe mode, set WD interrupt and indicate back to MCU with nINT pin and setting interrupt 8'h51[7] WD. | 5 μs |
| SM-11 | SPI CRC Error | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | 8 μs | The device shall monitor MCU SPI communication utilizing 8-bit CRC and if the CRC is invalid the MCU write to the device is blocked. Interrupt 8'h53[4] CRCERR is set. | 2 μs |
| SM-12 | SPI communication error; SPIERR | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | 8 μs | The device shall monitor MCU SPI communication utilizing clock count check and if too many or not enough clock signals the MCU write to the device is blocked and interrupt bit set and indicated fault back to MCU with the nINT pin and interrupt 8'h53[7] SPIERR is set. | 2 μs |
| SM-13 | Scratchpad write/read | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | 16 μs | Using the scratchpad, h'F[7:0], by the processor makes it possible to write and read back data for the purpose of verifying SPI communication. | 16 μs |
| SM-14 | Sleep Wake Error Timer; tINACT_FS | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | Programmable 30 seconds to 10 min Default 5 min | The Sleep Wake Error timer is used to determine if inactivity indicated loss of communication with MCU and causes the device to transition to either fail-safe mode or sleep mode. Interrupt 8'h51[4] WKERR is set along with 8'h52[7] SMS and/or 8'h53[5] FSM as applicable. | 5 μs |
| SM-15 | CLK internal pull-up to VINT | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin. | NA |
| SM-16 | SDI internal pull-up to VINT | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin. | NA |
| SM-17 | nCS internal pull-up to VINT | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin. | NA |
| SM-18 | DIV_ON internal pull-down | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin. | NA |
| SM-19 | TXD internal pull-up to VINT | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin causing LIN bus being stuck dominant. | NA |
| SM-20 | LIN internal pull-up to VSUP | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin causing LIN bus being stuck dominant. | NA |
| SM-21 | nRST internal pull-up to VINT | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous | NA | Avoids floating pin, indicates to processor a UVCC event, watchdog failure event and device in restart mode. Also utilized as a device power on reset input. | NA |
| SM-22 | LIN protocol | Safety Mechanism | System Functional Safety Mechanism | Periodic | NA | LIN protocol has several mechanisms that makes sure the data provided is correct, like checksum. If incorrect the processor disregards the LIN data. | NA |
| SM-23 | HSS Current Limit | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - when on | 20 μs | Turns off the HSS to avoid damage and interrupt 8'h5A[3] HSSOC is set. | 3 μs |
| SM-24 | HSS Open Load Detect | Safety Mechanism | Component Hardware Functional Safety Mechanisms | Continuous - when on | 80 μs | Indicates to processor that there is an open load on HSS and interrupt 8'h5A[2] HSSOL is set. | 3 μs |