AM2612: AM2612/AM2632 lockstep architecture for SIL2 safety outputs

Your Understanding is Correct

You are right that in lockstep mode, the second R5F core operates with a two-clock-cycle delay purely for comparison purposes and does not independently control peripherals 1. Any mismatch between the cores is routed to the Error Signal Module (ESM), which can trigger an interrupt or assert an external pin for monitoring. This means lockstep provides fault detection through redundant computation, not redundant actuation.

Key Concern: Single Point of Output Control

With both OSSD pairs connected to a single MCU, you lose the physical independence of your current dual-STM32 architecture. Lockstep detects CPU-level faults (computation errors, memory corruption via ECC), but:

• Both OSSD pairs share the same peripheral subsystem, power supply, and clock domain
• A failure in the output peripheral, pad driver, or power rail would affect all outputs simultaneously
• Your current architecture inherently provides hardware diversity that a single MCU cannot replicate

Whether this is acceptable for SIL2 depends on your specific safety standard (IEC 61508, ISO 13849, IEC 62061) and your certification body's interpretation of independence requirements for OSSD channels.

Software Development and Certification Effort

A single lockstep MCU does simplify software development by eliminating inter-MCU communication, synchronization protocols, and cross-checking logic. However, certification effort may not be significantly reduced because:

• You must demonstrate that single-MCU failure modes (common-cause failures) are adequately covered
• The AM26x is provided as a Safety Element out of Context (SEooC) 2, meaning system-level certification responsibility falls on you
• You'll need TI's FMEDA and safety manual (available under NDA through your local TI sales team) to validate diagnostic coverage for your architecture 2
• Proper isolation between safety and non-safety software is required, potentially necessitating SafeRTOS or MPU-based partitioning 3

Recommendation

Before committing to this architecture, you should:

1. Consult your certification body on whether lockstep fault detection (without redundant actuation paths) satisfies SIL2 requirements for your OSSD application
2. Request TI's functional safety collateral (FMEDA, safety manual) through your local TI sales representative under NDA to assess diagnostic coverage
3. Consider whether external monitoring (e.g., ESM pin driving an external safety relay, or output feedback monitoring) could compensate for the loss of dual-MCU independence

The AM2632 with lockstep is a strong candidate for SIL2 computation integrity, but consolidating both OSSD pairs onto a single device requires additional justification for common-cause failure coverage that your dual-STM32 architecture inherently provides.

Follow up: Have you considered whether the AM2632's quad-core variant (using both R5F subsystems independently rather than in lockstep) could provide a middle ground—maintaining some output independence while still consolidating to a single MCU?

1. AM263x Technical Reference Manual
2. AM26x Functional Safety SIL3 Discussion (E2E)
3. AM2612 Safety/Non-Safety Area Isolation (E2E)