LMR33620-Q1: Safety capabilities and additional requirements for safety applicaton

Hello

Thank you for your patience.  Below is our response from our safety expert:

My first question is in general about the TI categorization and how to use this inside a safety project. There is the split into different levels of functional safety capabilities and I am not really sure about how to use this categorization inside a project. The additional documentation on your homepage answers this question not completely .

TI:  Devices labeled  under the “Functional Safety Capable” category are devices where TI can provide FIT rates, Failure Mode Distributions and Pin FMA.  Any other piece of documentation will need to be requested and evaluated separately by TI to see if it can be provided.  Any devices under the “Functional Safety Compliant” category are devices developed under ISO26262 standards and have been certified.

The window wdg TPS3850G33QDRCRQ1 is rated as functional safety capable. So my understanding is that this component can be used as wdg in a safety related systems. The question here is if there are special requirements which needs to be fulfilled?

TI: Any of our devices labeled “Functional Safety Capable” can be used in safety related systems since the safety rating and analysis is at the system level and not at the component level.  For example: an “FS Capable” device can be pared up with an ASIL-B component to achieve ASIL-B or ASIL-C level system safety and that’s how many of our customers use our “FS Capable” devices.

Regarding LMR33620-Q1. This is a DC/DC converter with an internal power good mechanism and here is the question if this can be used as monitoring function of the output voltage equal to a voltage monitor or are there restrictions which are not fulfilled by this component. From my point of view is an component with an integrated safety mechanism a class II component according to the norm

Class III:

“the element has internal safety mechanisms which are relevant for the safety concept to control

or detect internal failures.” ISO26262-8:2018 13.4.1.1

This means in my opinion that the DC/DC Converter with an internal power good monitoring must be considered as a class III element as long as the power good is used as a safety mechanism. Is this correct or is there a different interpretation on TI side? This means that it is really unlikely for a company to use this power good in a safety application.

Or what is the recommendation from TI side?

TI: In the case of the Power Good mechanism, yes this can be used as a monitoring function of the output voltage, but the user has to keep in mind that there will be other failures that will cause the Power Good mechanism to not catch the output voltage from going to high.  Depending on the safety requirement for a system, an external window monitor is used to independently monitor the output voltage of a DC-DC converter.  The fact that the external monitor is independent (i.e. separate bandgap, covers issues with FB pin floating, resistor divider issues, damage to high-side FET) the monitor lowers the total FIT of the system and allows the user to qualify it to a higher ASIL rating.  Example: LMR33620 by itself will get a system to an ASIL-A rating vs. LMR33620 with external monitor will get the system to an ASIL-B/C rating.  Therefore it depends on the customer use-case and safety-rating that’s needed to be achieved.

Thanks