• State
  • Replies 1 reply
  • Subscribers 82 subscribers
  • Views 39 views
  • Users 0 members are here
Support feedback
Options
Options
Related

TMS320F28P559SJ-Q1: question about safety manual E-GAS architecture

minghao Li
Prodigy 10 points

Part Number: TMS320F28P559SJ-Q1

Regarding your E-GAS architecture, I have some questions I’d like to clarify:

If we need to run ASIL B software, I understand that at minimum ASIL B software shall be executed on the L2 level. To support this ASIL B requirement, we need to achieve a lockstep effect. As you mentioned earlier, lockstep is implemented via mutual checking between the CLA and CPU. Does this mean diagnostic functions need to run simultaneously on both CLA and CPU with synchronization?

My understanding is that CPU_STL and CLA_STL run on the CPU and CLA respectively. However, if the CPU suffers a fault, peripheral faults that occur before the STL diagnostics are activated (which configured to be handled by CPU or CLA) may not get a response from the CPU. Meanwhile, the CPU executes self-diagnostic code by itself. How can we verify that the self-test code is being executed correctly?  image(09-29-17-50-25).png

  • 0
    TI__Guru 55145 points

    The C28x STL and CLA STL don't need to run simultaneously. They're intended to be run early on at start up for detecting latent faults. Both STLs use a hardware feature that generates a signature as the STL tests execute and then checks that the signature matches a "golden" value to establish the pass/fail status of the STL. We also note in the safety manual that the STLs should also be run with the watchdog, Flash and RAM ECC/parity, etc...enabled to be able to detect faults that could cause issues with the execution of the STLs.

    Whitney