TMS570 safe state and VCCAD supply

Richard

Sorry for the delay on this. I will get back to you shortly. I have forwarded the question to our expert.

Hello Richard,

Please note the recommended device level safe state noted in the safety manual.  Our recommended safe state is to keep all supplies active but to hold the device in reset by driving the nPORRST signal low.  This results in all outputs tri-stating and all I/Os are placed in input state, such that errant signals should not propagate from the MCU.

If you intend to power down the MCU as your system level safe state, we would recommend a complete power down of the MCU.  I will defer to the other experts on the forum as to whether damage might occur in your use case.

Regards,

Karl

Hi Richard

Could you pls clarify What does "removing" the supply mean? Does it mean floating, undriven or shorted to ground?

Hi Karl/Abhishek,

In an earlier revision of the safety manual for the TMS570LS1x family, it recommended that in the event of the 3.3V or 1.5V supplies being out of range, the safety monitor should remove the supplies from the processor.

We are now using the TMS570LS3x family so the 1.5V supply is now reduced to 1.2V. Our current implementation has a voltage monitor on the 1.2V, 3.3V and 5V  ADC reference rails. Our safety monitor shuts down the 1.2V and 3.3V supplies to the processor if it detects that they are out of range (obviously allowing sufficient time for them to come up in the first place). The safety monitor also places the processor in reset if the voltage monitor indicates that the rails are out of spec. The current circuit design disables the output of the voltage regulator (a TI TPS62410QDRCRQ1) so I guess this means effectively shorting the rails to ground.

However at the moment we do nothing with the 5V ADC reference voltage. The question related to whether this was advisable or not.

Regards,
Richard 

Hi Richard,

If I remember correctly, the ADC reference on the previous device is also the ADC power supply.  Our intent was that all rails including ADC power supply would be removed, though this may not have been worded as clearly as it could have been.

We have an internal discussion ongoing with the ADC experts regarding potential damage but there is not a conclusion yet.  This is an atypical use case and requires a fair bit of analysis to resolve.

Regards,

Karl

Hi Karl,

By the sound of it we have two options; either to not remove power from 1.2V and 3.3V and just hold the processor in reset or to remove power from 1.2V, 3.3V and 5V ADC reference voltage.

Do you have any feel for when your ADC experts may have an opinion?

Regards,
Richard

I don't think you can remove the power from all the power domain and call this as a safe state. In this case, the MCU power could come from the IO structure (through the protecting diodles), resulting in: 1) the IO is crampped down 2) the MCU is powered (with a lower voltage) in a unknown state.

Haixiao

Hi Haixiao,

So what is the safe state? Is holding the processor in reset sufficient?

In the original TMS570LS20106 safety manual (V1.0.2) it states "Upon detection of overvoltage the power supply shall power down as quickly as possible." This is what we were trying to achieve by removing the 1.2V and 3.3V power supplies.

Regards,
Richard

Richard,

Are you still looking for additional information on this topic?

Thanks and regards,

Zhaohong