TMS570LS3137: About Software Voting Using Secondary Free Running Counter

Hello Arriy,

Please review the RTI chapter within the technical reference manual. There are two free running counters in this module. You can start them both at the same time and check the value of one versus the other to make sure there haven't been any transient or permanent errors impacting the counter content of the primary counter.

Thank you for your reply.

But I'm sorry,I not understood well..

Describes is "While one up-counter is used as the operating system timebase" in technical referenece manual.

What is mean "the operating system timebase" ?

In case of I don't use operating system,don't needs this safety mechanism ?

Best Regards.

Arriy,

The RTI module is often used for the time base for the RTOS within an embedded system. i.e., the RTI is set to provide an interrupt periodically and the interrupt is used to define the loop time within the operating system. In more complex systems, it is used to provide timing for the scheduler. However, the RTI can be used for any time based or cyclical execution of code or tasks. The RTI has more than one counter so one could be the primary counter and the second as a diagnostic check.

As an example, say you setup the counter to interrupt every time the counter reaches a value of 0xFF. If, bit8 is stuck as a one due to a permanent or transient fault, your would reach the value 0xFF too soon and the task associated with the timed interrupt would happen too soon. As a diagnostic, you could check the second counter to insure the count was in synch and the time is, in fact, valid.

The operating system use case is just an example. If your system is using the RTI counters for any task or function within your system that is related to your safety function, this diagnostic could be beneficial/necessary. TI will not be able to definitively answer if it is needed in your application or not since it is application/system dependent so it needs to be evaluated by you if it is needed. The FMEDA allows you to include or exclude safety measures and gauge the impact on the overall device level safety metrics based on your specific use case. It doesn't however, measure the impact on the targeted safety function your system is trying to protect.

Hello Chuck.

I understood as below.
Using two synchronous increment counters, when interrupt occurs I have to check that the two counters value is match.

Best Regards

Hello Chuck.

I implemented "RTI1:Software Voting Using Secondary Free Running Counter" below.

What do you think about this implemented?

1.Free running counter0 and counter1 are enable.( counter0 is default enable )

2.Holds the value of counter 0.

3.Count 20 by for(0>x>20).

4.Add the value of counter 0 held and the value of counter 1.

5.If the difference between the value of the held counter 0 and the value of the counter 1 and the difference between the current counter 0 and the present value is 10 or more,

   an error occurs.

 (moving at 100 Hz)

How should we decide the difference ?  I now setting 10.
I am glad if you give me something.

Best Regards

Hello Arriy,

The exact procedure and method of test is dependent on how you are using the counters so it is very difficult to judge. Can you provide more details on how you plan to use counter 1 and counter 0 within your application?

As a general comment, you are capturing counter0 then adding it to counter1 and calling this a difference. Since you have added and not subtracted the values, this would not be a difference in counter values. Also, since I don't see that you are setting the counters to 0 or a known starting point, you should probably have some logic to account for the counter registers possibly rolling over or overflowing.

For normal use cases, the RTI counters are used to timer an event or to provide a system tick. Although we don't want to limit your creativity or flexibility to meet your requirements, below are a couple high level summaries of how it could be done.

If used randomly to time events or measure time of tasks, simply read both at the start of the task as time 1; perform the task; after task completion, read both again as time 2; compare time total from counter0 vs counter1; if outside of a prescribed tolerance based on your application need and SW capability, then notify an error.

if RTI is used for system tick, it can be as simple as reading the free running counters at each system tick/periodic interrupt to make sure they are both within a specified tolerance of each other.

Note that if both counters are initialized at the same time and then read at nearly the same times, I would expect the tolerance to be very small (on the order of 2-3 VCLK cycles, but you may need to determine your final values through characterization/experimentation and may vary dependent on interrupt structures and application needs.