• State Resolved
  • Locked Locked
  • Replies 10 replies
  • Subscribers 31 subscribers
  • Views 4181 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Microcontroller for SIL2 specification

Vitaly Stepin
Intellectual 640 points
Other Parts Discussed in Thread: TMS570LS20216

Hello,

My name is Vitalij. I represent a small group of electronics engineers from Riga.

At the moment we are redesigning / upgrading data acquisition and control system for fire alarm applications. The problem is so that the system must meet requirements of the SIL2 standard (SIL2 - Safety Integrity Level 2). What are main requirements regarding hardware and firmware design? The system consists of different I/O modules that are interconnected via RS485. In general optocouplers are used for inputs and relays - for outputs. What are additional requirements for I/O? Perhaps self-test or something else…?

All modules feature isolated power supply and isolated RS485 interface. At the moment data integrity is ensured by CRC16.

We took a look on several SIL2 compliant devices. They use 2 MCUs to increase system reliability. Is this option required for SIL2? If yes, how can this be implemented?

Texas Instruments provides dedicated TMS570LS Family. "The Hercules TMS570LS Safety MCU family enables customers to easily develop safety-critical products for transportation applications. Developed to meet the requirements of the ISO 26262 ASIL-D and IEC 61508 SIL-3 safety standards and qualified to the AEC-Q100 automotive specification this ARM® Cortex™-R4F based family offers several options of performance, memory and connectivity. Dual core lockstep CPU architecture, hardware BIST, MPU, ECC and on-chip clock and voltage monitoring are some of the key functional safety features available to meet the needs of automotive, railway and aerospace applications"

Can we rely on this family of microcontrollers to meet all SIL2 requirements? Or is single MCU also acceptable?

Additional peripheral modules of the MCU are onboard memories: FRAM or optionally microSD card. FRAM is more preferable for us because ease of use.

I will be waiting for your response.

Best regards,

Vitalij

  • 0
    TI__Mastermind 23000 points

    Hello Vitalij,

    The first question I must ask is what standard do you target to comply with?  SIL is a level of safety integrity found in many standards, but it is not a standard by itself.  IEC 61508 (functional safety of electrical/electronic/programmable electronic systems) and several of the derived application specific standards which follow IEC 61508 all use the terminology of SIL for safety integrity.  We need to clarify which standard you target to provide a more precise answer.

    Assuming that you target the IEC 61508 standard, you may find the requirements for safety management in part 1, system/hardware development in part 2, and software development in part 3.  Unfortunately we cannot share the standard due to licensing issues but you can purchase a copy via www.iec.ch and many other online locations.

    With respect to development process, IEC 61508 has a number of fixed requirements which must be addressed by your development.  

    With respect to specific needed hardware and software architectural features, you will not find these in the IEC 61508.  IEC 61508 is performance based - this means that it is your responsibility to analyze the target system for potential hazards and risks, apply an appropriate combination of risk reduction measures and diagnostics, and then demonstrate that your applied target architecture achieves the target measures of effectiveness found in the IEC 61508 standard.  For any given application, there are many possible solutions which could be applied in order to demonstrate that the end product achieves IEC 61508 SIL 2 for the implemented safety function.

    With respect to hardware components such as our Hercules MCUs, what we can claim is that we have developed the product in a process which is compliant to standard and that we can demonstrate for an example application that target safety metrics can be met.  This does not mean that every possible implementation with the MCU will be compliant - this must be confirmed by the system developer for each system implementation.  While using a compliant component is not explicitly required by IEC 61508 standard, it can greatly reduce the complexity of your system safety analysis, help you get to market faster, and increase the chance that your system will be assessed compliant to the standard.

    I hope that this helps.  Please feel free to ask further questions as needed.

    Regards,
    Karl 

  • 0 in reply to KGreb
    Intellectual 640 points

    Hello Karl,

    Thank you very much for detailed information. I will clarify what standard my customer targets to comply with.

    I will answer as soon as possible.

    Regards,

    Vitalij

  • 0 in reply to KGreb
    Intellectual 640 points

    Hi Karl,

    My client does not really know, whether it is IEC 61508.

    At the moment the following standards must be met:

    1) EN 54 part 2 Fire detection and fire alarm systems. Control and indicating equipment (Fire alarm control panel)

    2) EN 12101-9:2005 Smoke And Heat Control Systems - Part 9: Control Panels 

    But it is very desirable to meet IEC 61 508 requirements for future applications. In any case it will be much easier for us to develop the system based on Hercules microcontrollers. I will have also further questions regarding suitable microcontrollers and development kits. Perhaps in several days.

    Regards,

    Vitalij

  • 0 in reply to KGreb
    Intellectual 640 points

    Hello Karl,

    Can you please send me a copy of the certificate of the Hercules microcontrollers for IEC 61508 standard? Our client wishes to demonstrate it to an inspector. We will get an acceptance for system development easier and faster, if the inspector sees that main component of the device is compliant to standard. We understand that the complete system must be compliant to standard, not only separate components. The certificate of the MCU may help us very much.

    Now we are selecting MCU for our application. The peripheral modules are as follows:

    1) 2 UART modules for 2 RS485 buses

    2) At least 3 Timers. Is High-End Timer (N2HET) Module used for this purpose?

    3) 2 SPI modules for external FRAM memory and RTC

    4) GIO. At the moment we are not sure about total I/O quantity. Perhaps up to 30 GIO will be enough.

    The smallest package is preferable. BGA is not acceptable because 2-layer PCB will be developed. Very high speed is not required too.

    At first approach TMS570LS10106-PGE is selected on TI website. Its status is ACTIVE. The status of several other suitable microcontrollers is denoted as PREVIEW? What does this mean? Are other microcontrollers with similar functionality available too, but in 100LQFP package?

    We will also need development kit to get started faster? What does it include? At the moment we use Code Composer Studio for MSP430 microcontrollers. This is free version and it is limited to 16kB. We suppose that code size for ARM microcontroller will exceed this limit.

    Best regards,

    Vitalij

     

  • 0 in reply to Vitaly Stepin
    TI__Mastermind 23000 points

    Hello Vitalij,

    At present only the TMS570LS20x/10x family is certified suitable for use in IEC 61508 applications up to SIL 3.  Additional product certifications are under way for products which are being qualified for production but I cannot publicly commit to schedules for this activity.

    We used an external independent assessor for the certification of the TMS570LS20x/10x, exida.  The certificate can be viewed via exida's web site:  http://www.exida.com/index.php/Resources/SAEL_Detail/texas_instruments/.  Additional information regarding the certificate and assessment report can be made available under NDA if desired.  You can request this data by filling out the form online at http://www.ti.com/safetyreport.

    With respect to peripheral function on the LS20x/10x products:

    • SCI/LIN peripherals are specialized UARTS which may also be usable for RS485 communications
    • N2HET can provide many channels of input capture, PWM generation, and general timer functionality.  In addition the RTI (OS Timer) can provide two free running counters, though most will use to support operating system time ticks.
    • SPI and MibSPI modules are available 
    • A dedicated GIO module is available.  In addition, most peripheral I/O can be repurposed to GIO (but without pin level interrupt capability).

    With respect to product status on the TI website, an ACTIVE product is qualified for production, actively shipping to production, and recommended for use in new designs.  A product in PREVIEW state is announced to market but has not yet completed production qualification but is sampling for prototype use.  We have several TMS570LS and RM4 products which will transition from PREVIEW status to ACTIVE status this year.  

    Regarding package, the Hercules MCU selection tool can help you identify products available in 100 LQFP package:  http://www.ti.com/paramsearch/docs/parametricsearch.tsp?sectionId=95&tabId=2834&familyId=1931&family=mcu.  The smallest package available for the TMS570LS20x/10x parts is a 144 QFP package.  The LS04x/03x products are available in 100 LQFP but have lesser capability and are not yet qualified for production nor yet certified suitable for use in IEC 61508 systems.  The LS04x/03x are compatible to the LS20x/10x.

    Development kits are described here:  http://www.ti.com/mcu/docs/mcuprodtoolsw.tsp?sectionId=95&tabId=2836&familyId=1931&toolTypeId=1#kits.  

    Best Regards,

    Karl

  • 0 in reply to KGreb
    TI__Mastermind 49120 points

    A minor correction: the  LS04x/03x are not compatible to the LS20x/10x.

    Regards, Sunil

  • 0 in reply to KGreb
    Intellectual 640 points

    Hello Karl,

    In my opinion, the certificate from exida's web site is enough. A microcontroller from TMS570LS20x/10x family will be selected for our application.

    Thank you very much for detailed information and assistance.

    Regards,

    Vitalij

  • 0 in reply to Sunil Oak
    Genius 3950 points

    Sunil Oak said:

    A minor correction: the  LS04x/03x are not compatible to the LS20x/10x.

    Regards, Sunil

     
    Hi Sunil,
     
    Can you please elaborate on how those MCU are not compatible? We're also looking for a TMS570LS20216 compatible MCU for some new projects, in the 100-pin or smaller footprint.
     
    I'm asking this question because I have been told by one of your support staff the following:
     
    The newer LS31x/21x share the same peripheral architectures with LS20216.  The programmer model should be identical.  We also just announced new parts with sample available now: TMS570LS04xx/03xx with 100-pin package that supports R4 (without floating point) and identical programmer model & peripheral architecture to LS31x/21x and LS20216.  The TMS570LS04xx/03xx has all the latest enhancement (e.g. N2HET, etc). 
     
    Regards.
     
     
     
  • 0 in reply to Chuck Wong
    TI__Mastermind 49120 points

    Chuck,

    Yes, the peripheral modules on these devices are functionally compatible. The module versions on the LS04x/03x may be different from those on LS20x/10x, and this could be due to feature enhancements or bug fixes. You need to refer to the TRM and the errata documents to identify the actual changes.

    Also, "compatibility" in general means different things to different people. This could imply software or hardware compatibility, which would not be accurate. For example, the LS04x/03x MCUs are not pinout-compatible to the LS20x/10x MCUs. Also, the number of cycles it takes to complete an access may not be the same.

    Regards, Sunil

  • 0 in reply to Sunil Oak
    Genius 3950 points

    Thanks Sunil,

    I'm referring to reuse of low-level drivers written for MCU peripherals such as, SPI, A/DC, CAN, GIO and NHET etc., knowing that ESM and VIM are device-dependent ...

    Any thought?

    Regards.