TMS470MF03107: Hercules mcu for SIL3 level and PLd level

Hello Fax,

First, let me point out that the part number referenced is a non-lockstep device with limited safety capability. It is a QM (quality managed) device and is not certified. Although system level considerations may come into play, this device is generally not intended for the level of safety that you have noted as your goals. It is an automotive grade device so there is potential for it to be used in automotive applications that do not require the rigor of higher ASIL requirements.

In light of this, I will answer your questions relative to our more standard Hercules line Safety MCUs with Lockstep Cores. This includes the TMS570LS0x32 series at the low end up to the TMS570LC4357 at the top end relative to feature content and performance.

Hercules Safety Concept:

To begin and to be clear, these devices have 2 CPUs/Cores but they are operating in lockstep and cannot be dis-conjoined. These cores are operating out of phase to allow temporal diversity (i.e., always operating 2 clocks out of synch). They are synchronized at their outputs and the outputs are compared via comparator logic such that if there are any differences in their operation, a fault can be notified. In this since, only 1 of the cores is truly active in the system and the second is acting only as a diagnostic of the first to insure consistent and accurate operation.

In addition to this, there are several other hardware based safety mechanisms such as a logic built in self test for the cores (LBIST), built in self-test (BIST) for the RAMs, ECC on flash and RAM, etc.... The end result is a safe island of HW built around the code execution in order to keep the code execution safe. This then allows the use of SW based tests to provide safety for the remaining peripherals and other IP on the device.

Now that we have the baseline understanding of the concept, I will address your specific questions:

.

Fax said:

1. If using only one Hercules MCU for each drive is sufficient for our SIL3 target (e.g. max SIL and PL, DC diagnostic coverage, redundance ...). I've read that the Hercules architecture is 1oo1D (the safety system is not redundant) so will it imply that the MCU has DC>99%?

Yes, the Hercules device is based on a 1oo1D architecture. Each of the lockstep devices in the Hercules family of Safety MCUs has been certified to IEC61608:2010 SIL3 as a SEooC. We have effectively demonstrated the ability to achieve a DC>-99% in compliance with the IEC61508 standard requirements for at the component level. This doesn't necessarily mean that a SIL3 level can be achieved at the system or integrator level. This is dependent on many application specific requirements as well as the requirements of the individual standards to which you are trying to align and comply with.

Fax said:

2. Which versions among the Hercules MCU family are totally certified and provided with user documentation?

For a complete list of devices certified to IEC61508 or both IEC61508 and ISO26262, please refer to the www.ti.com/safeti page for details. TI provides most of the documentation for our certified devices publicly without a need for an NDA. However, an NDA is required for our Safety Analysis Reports and our FMEDA tool. The NDA materials are provided within the SafeTI Private Forum which can be joined by completing the form at this link, http://www.ti.com/safetyanalysis, and submitting a SafeTI NDA. This forum can also be used to discuss any NDA related topic for our SafeTI products since all of the members of the private community are covered under their associated NDA agreement. We do ask that NDA topics remain off of the (this) public forum.

Fax said:

3. I know that TI offers tools for the validation, but which tools we need for the assessment. Have you some more detailed information or a practical example?

We offer several tools to aid in the development of a safety project and for use of our Hercules devices.

To start, there are a couple of SW packages that can are available for free to aid in device specific SW development so you can focus on your application.

This starts with our our HalCoGen tool. As the name implies, it is a HAL code generation tool. It has a GUI that allows for the graphical configuration of each peripherals/IPs on the device including the system IP such as clock settings, interrupt management, etc.Once all of the elements are configured, the tool will automatically generate the boot up code and drivers for each of the configured IPs.

A second SW package is our  SafeTI Diagnositic library which has many of the safety mechanisms coded up to allow for easier integration into your application.

Each of the above tools have associated CSPs that can be purchased. I will discuss the CSPs in more detail within the context of your next question.

Of course the key tool for development is the IDE. Our IDE is an exlipse based tool called Code Composer Studio and includes the editor, compiler, programmer and debug environment, Each of these components are not considered safety critical except for the compiler which will have a direct impact on the executable code. For this reason we offer a couple of compiler qualification options in our Compiler Qualification Kits (CQKs). More information can be read about these in a permanent post at the top of the private forum. Here is a link: https://e2e.ti.com/support/microcontrollers/hercules/f/312/t/616290. There is also a product page for the pay for use user based model where your team performs the tests on your specific setup and compiler use case. It is located here: http://www.ti.com/tool/SAFETI_CQKIT

Finally, TI offers a tool (FMEDA) that can be used to customize the safety related metrics for the device to our application based on the application specific mission profile, feature use, pin use, safety mechanism use, etc. The resulting FIT rate metrics can then be used in the overall system calculations for evidence to provide to the customer's system level assessor.

Fax said:

4. Regarding the application level (the code written by us) is it validated using the tools provided by TI or do we need some external unit test (like Polyspace, Cantata, LDRA, ecc)?

TI offers compliance support packages (CSPs), that, in most cases, include a Test Automation Unit (TAU tool) along with a set of collateral that includes both static and dynamic test reports. The TAU tool allows the customer to recreate the testing as reported in the test reports in case there is any change made to the provided safety related code or for customization of the code to the application. The TAU tool is a limited license LDRA based tool. It can only be used on the code provide by TI as part of the applicable package. I believe there are always options to negotiate an expansion of the license with LDRA so that the tool could cover the wider application level code if desired but this is at the discretion of the end customer/integrator. Our intent for the CSP is to provide all the necessary information to allow the integrator to qualify the TI provided software components for use in their safety systems. This means the code provided has not been certified or assessed outside of TI for specific compliance to any given standard. More information and downloadable demos can be found here: http://www.ti.com/tool/safeti-hercules-diag-lib-csp and here http://www.ti.com/tool/safeti-halcogen-csp

Fax said:

5. Do you have experience if someone has already succeeded to implement a IEC61508/SIL3-compliant product with only one Hercules MCU?

Yes. We have many customers that have certified SIL3 systems with only 1 Hercules device but the system level requirements and specific standards requirements need to be considered. As an example, for ISO13849, we have worked together with a third party assessor to review a concept using 1 Hercules device together with a TPS65381A-Q1 PMIC as test equipment in order to satisfy a Cat3 PLd rating and this similar concept has been used by our customers in their certified systems. More details can be discussed about this in an NDA safe environment. A word of caution for this, however, is that the suitability and ability to meet safety goals is always dependent on the safety function that is being implemented. To really understand the requirement and our ability to meet it with a single MCU +PMIC we would need to understand both the intended operation and the applicable safety state that would be enforced. Unfortunately, there is no one size fits all.

Fax said:

6. We tried the Demo Kit for Compiler Qualification, but we saw there is the Hercules SafeTI Compiler Qualification Kit (that is free of charge). Which are the differences affecting the certification process?

I believe this was addressed above under the tools question and additional information pointed to the sticky post at the top of the public E2E for Hercules. If there are still questions after reviewing the information provided, please let me know.