MCU Recommendations for Safety-Critical Drone Flight Control

A Few Questions That Would Sharpen This Recommendation

Before diving in, a few details would help refine the guidance:

• What DO-178 DAL level are you targeting (A, B, C, or D)? This significantly affects MCU resource requirements and certification effort.
• Which EASA certification basis — CS-LURS (light UAS), CS-23, or another standard?
• Will your dual/triple redundancy be at the board level (separate MCU per channel) or do you also need chip-level lockstep within each channel?
• Communication protocol preferences between redundant computers (CAN-FD, FlexRay, Ethernet)?
• RTOS preference — do you already have a safety-certified RTOS selected?

That said, the analyses provide strong direction even without these answers.

The TMS570LC4357 Is a Solid Baseline — But Consider Newer Alternatives

The TMS570LC4357 you're already looking at is a proven choice for safety-critical systems. It features dual Cortex-R5F cores in lockstep at 300 MHz, 4 MB Flash and 512 KB SRAM with ECC protection, and a CPU Compare Module (CCM-R5F) for cycle-by-cycle fault detection [1][2]. It's designed for IEC 61508 SIL 3 and ISO 26262 ASIL-D compliance [3], includes built-in self-test (BIST) for CPUs, memories, and N2HET coprocessors [4], and has an Error Signaling Module (ESM) for centralized fault monitoring [2]. It also supports SafeRTOS with pre-certified safety documentation to help streamline DO-178 compliance [5].

However, for a new design targeting certification, TI's newer AM26x family offers meaningful advantages:

Recommended: AM263P4-Q1 (Top Pick)

The AM263P4-Q1 stands out for your application because [6]:

• 8 CAN-FD channels — critical for robust inter-computer communication in a triple-redundant architecture
• 6× more RAM and 2× more Flash — provides headroom for complex flight control algorithms and DO-178 artifacts
• Trigonometric math accelerator — directly accelerates attitude and navigation calculations
• Modern security features (secure boot, cryptographic acceleration) — increasingly important for DO-178C and EASA compliance

Alternative: AM2634-Q1

The AM2634-Q1 is a slightly lower-resource option (2 MB RAM, 4× CAN-FD) but notably includes SafeRTOS support alongside FreeRTOS and Zephyr, which can accelerate DO-178 certification [7].

Key Consideration

The TMS570LC4357 has proven aviation heritage and a mature ecosystem [5], which can reduce certification risk. The AM26x parts are newer-generation with superior specs but may have less mature safety documentation for aerospace specifically. Your certification timeline should factor into this decision — if you need the most established safety artifacts today, the TMS570LC4357 is lower-risk; if you're early in development with time to work with TI on certification support, the AM263P4-Q1 is the stronger long-term choice.

I'd recommend engaging TI's safety MCU team directly to discuss availability of DO-178 certification artifacts and safety manuals for whichever part you select.

1. TMS570LC4357 Datasheet
2. TMS570LC4357 Datasheet - Safety Features
3. Hercules Safety MCU Application Note
4. TMS570LC4357 Technical Reference Manual
5. TMS570LC4357 Product Page
6. AM263P4-Q1 Product Page
7. AM2634-Q1 Product Page