• State Resolved
  • Locked Locked
  • Replies 8 replies
  • Answers 2 answers
  • Subscribers 82 subscribers
  • Views 380 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F28P559SJ-Q1: The function safety related question

Shuqing Zhou
Expert 3525 points

Part Number: TMS320F28P559SJ-Q1

Hi team,

I ask this for my customer.

1.what's the function safety level of F28P55x Diagnostic library or STL library? for example, ASILB/D? I find this in the functional safety that STL library achieve the ASILB and system ASILD, is it correct?

image.png

And in my understanding, we don't cert the F28P55x Diagnostic library, is QM level?

2.How to choose which SM is for latent fault or which SM is for single point fault?

BRs

Shuqing

  • 0
    TI__Mastermind 18386 points

    F28P55x device is capable of achieving random fault capability upto ASIL-B and systematic fault capability upto ASIL D

    --> read this to understand what is systematic and random fault capabilities

    The software diagnostic library (SDL) comprises general example implementations of several safety mechanisms. The SDL examples are developed using a baseline quality software development flow and are not required to be compliant with any particular standard. As such, the SDL is not certified by TÜV® SÜD. Users are expected to study and adapt the provided examples into their safety-related applications and are responsible for their own product level third-party certifications.

    C28x_STL and CLA_STL provide an implementation of the CPU3 - Software Test of CPU and CLA2 - Software Test of CLA safety mechanisms, respectively. The C28x_STL and CLA_STL are independently assessed and found to be satisfactory for integration into safety-related systems up to ASIL D and SIL 3, according to ISO 26262:2018 and IEC 61508:2010, respectively.

    Shuqing Zhou said:
    ow to choose which SM is for latent fault or which SM is for single point fault?

    Appendix table in the Safety manual explains how the SM are classified into Diagnostic which are used for SPFM coverage, Test for diagnostic which is used for LFM

    Thanks

  • 0 in reply to Prarthan Bhatt
    TI__Expert 3525 points

    Hi Prarthan,

    Thanks for your reply!
    In addition to Diagnostic and Test for diagnostic, some SM shows Fault avoidance, is it used for SPFM or LFM?

    BRs

    Shuqing

  • 0 in reply to Shuqing Zhou
    TI__Expert 3525 points

    Hi Prarthan,

    I try to change the Diagnostic SM, it would influence the SPFM value; and I try to change the Test for diagnostic SM in system, it would influence the LPF value; but when I try to change the fault avoidance, it would change nothing.

    BRs

    Shuqing

  • +1 in reply to Shuqing Zhou
    TI__Mastermind 18386 points

    Fault avoidance safety mechanism have no coverage for LFM or SPFM coverage, these are used for fault avoidance as the name suggests.

    Thanks

  • 0 in reply to Prarthan Bhatt
    TI__Expert 3525 points

    Hi Prarthan,

    In your original reply, you said that Diagnostic SM is used for SPFM coverage. In customer's understanding, SPFM would cause the serious consequences. so the related SM should be executed periodically in the software.

    But some SM, like ROM8, it can be executed just once after the chip power-on, 

    How to understand this? Is ROM8 used for SPFM? Why in our function safety manual said this is used for SPFM?

    And in addition to ROM8, other diagnostic SM like ADC4 is used for SPFM coverage. But this SM would spend a long time every time it executed. If they used this for SPFM coverage and executed it periodically, it would add more CPU loading that is unacceptable, could you help to give some comment about this?

    BRs

    Shuqing

  • 0 in reply to Shuqing Zhou
    TI__Mastermind 18386 points

    Some background on the SPFM coverage, SPFM coverage depending on permanent and transient fault coverage requires safety mechanism to run periodically to provide coverage for transient faults and only at start-up or power down to provide permanent fault coverage.

    ROM8 is only meant to be run at Start-up for pre-operational checks for ROM same for ADC4 where open shorts test is only done at start-up or when system is idle.

    The final coverage for permanent and transient fault SFM coverage can be checked in FMEDA report after selecting the SM.

    Thanks

  • 0 in reply to Prarthan Bhatt
    TI__Expert 3525 points

    Hi Prarthan,

    Customer said for SPFM, it needs to be tested in FTTI, so the SM for SPFM needs to be run in period when the code is running, could you give some comment about this?

    BRs

    Shuqing

  • 0 in reply to Shuqing Zhou
    TI__Mastermind 18386 points

    It depends on the failure mode categorization, if the Failure mode SPFM coverage for transient faults needs to be achieved then it needs to be run periodically but if permanent fault coverage then its sufficient to run at start-up. For example ROM only runs at device start-up so there is no point of it running periodically, the safety mechanism needs to run at startup for those particular failure modes for ROM.

    Thanks