TI/TÜV Rheinland Functional Safety Seminar China
Total Page:16
File Type:pdf, Size:1020Kb
TI/TÜV Rheinland Functional Safety Seminar China Texas Instruments Inc. Nov/2014 Agenda • Overview of HerculesTM MCU and SafeTITM Design package • HerculesTM MCU Functional Safety How-To Workshop – Safety Functions, Safety Goals, Safe State, SIL, Failure rate – Safety Critical Elements identification and Diagnostic Requirements – Safety Manual and Diagnostics Selection – Mission Profile and Failure Rate Estimation – SafeTITM Diagnostic Library – SafeTITM Diagnostic Library Compliance Support Package (CSP) certification support – Fault Injection with HITEX kit • Summary 2 Agenda • Overview of HerculesTM MCU and SafeTITM Design package • HerculesTM MCU Functional Safety How-To Workshop – Safety Functions, Safety Goals, Safe State, SIL, Failure rate – Safety Critical Elements identification and Diagnostic Requirements – Safety Manual and Diagnostics Selection – Mission Profile and Failure Rate Estimation – SafeTITM Diagnostic Library – SafeTITM Diagnostic Library Compliance Support Package (CSP) certification support – Fault Injection with HITEX kit • Summary 3 Functional Safety: Important for Many Industries Automotive and Industrial and Transportation EN 50155 DO-254 Medical EN 50128 DO-178B (railway) (aerospace) IEC IEC Sensor & HEV/EV Cars 60601 50156 communications (medical (furnaces) gateway equipment) Hercules TM Safety MCU Radar / Collision IEC IEC 60880 Avoidance (ADAS) (nuclear 61511 power (process Manufacturing, robotics, stations) industry) industrial automation, motor control Active suspension, ABS, IEC 62061 ISO 26262 electric power steering, ISO 13849 (automotive) airbag and more! (machinery) IEC 61508 (safety) Wind Power Railway Systems . Safety critical systems are everywhere . Systems need to manage hazardous failures Anesthesia machines, respirators, ventilators, . Many systems need to be safety-certified oxygen concentrators Anti-skid control 4 Hercules™ MCU: End Equipment Aerospace & Railway Industrial Flight Control Communications Gateway Industrial Motor Control Manufacturing / Avionics / Autopilot Elevator Robotics Escalator Anti-Skid Control Wind Power Motor Control Automotive Industrial Automation / PLC Sensor & Communications Airbag Gateway Braking / Stability Control Solar Power Radar / Collision Avoidance Hybrid & Electric Vehicles (ADAS) Infusion Pumps Oxygen Anesthesia Concentrators Chassis / Domain Control Active Suspension Electric Power Steering Respirators Medical 5 TI HerculesTM MCU Platform ARM® Cortex® Based Microcontrollers RM • Industrial and Medical 80MHz to 330MHz Safety MCUs • 128KB to 4MB Flash • -40 to 105°C Operation • ENET, USB, CAN & UART • Developed to Safety Standards • IEC 61508 SIL-3 • Cortex-R – up to 550 DMIPs Hercules™ TMS570 MCU • 80MHz to 300MHz • 128KB to 4MB Flash Transportation and Platform • Automotive Q100 Qualification Automotive Safety MCUs • -40 to 125°C Operation • FlexRay, ENET, CAN, LIN/UART Lockstep • Developed to Safety Standards MCUs for • ISO 26262 ASIL-D functional Safety • IEC 61508 SIL-3 • Cortex-R – up to 500 DMIPs 6 HerculesTM RM MCUs Supporting Industrial & Medical safety RMx Temperatures -40C 105C Benefits ARM Memory Power & Clocking • Lockstep ARM Cortex-R based MCU –with up to 550 peak Cortex™ARM-R5F Up to 4MB Flash OSC PLL DMIPS and 384KB to 4MB Flash Memory (w/ ECC) Cortex-R CLKMON 80 to 330 MHz Up to 512KB SRAM • Safety Integrated in HW – provides a high level of (w/ ECC) VMON Cache diagnostic coverage to reduce safety software overhead FPU MPU (w/ECC) Up to 128KB Data Flash Debug • SafeTI™ system design packages – makes it easier to (w/ECC) Real-time JTAG achieve safety certification and get to market quickly Lockstep Fault Detection ExternalMemory Memory 32-bit Trace (ETM) • Developed to safety standards – developed for use in IEC ControlControl Peripherals 16-bit Parallel Interface 61508 SIL-3 safety applications Calibration ePWM Communication Safety & System • Flexible Communication and Control – Ethernet, USB, eCAP CAN. Up to 84 timer and 41 12-bit ADC channels. 10/100 Ethernet CPU BIST eQEP USB SRAM BIST N2HET Timer CAN DMA CRC Analog UART Tools Analog OS Timers Multi-Buffer SPI 12-bit 1 MSPS ADC Windowed Watchdog Temperature Sensor I2C External INT / GPIO Software Packages Launchpad • Drivers & Libraries – HALCoGen Development Kit peripheral driver generation tool, SafeTITM Diagnostic Library, CMSIS DSP Library • RTOS: SAFERTOS, Codesys • IDEs: Code Composer Studio, IAR 144p QFP • SafeTI Compiler Qualification Kit (20x20mm) • SafeTI 3rd Party Ecosystem 100p QFP 337p BGA Motor Control (14x14mm) (16x16mm) XDS560 Pro Trace SafeTI Kit 7 Hercules™ RM Cortex™-R Roadmap 2012 2013 2014 ! Features: RM48L9x – 220MHz R4F 3MB Flash, 256kB RAM Lock Step QEP/PWM Ethernet Architecture RM57Lx – 330MHz R5F SafeTI ISO & IEC 4MB Flash, 512kB RAM High CAN RM48L5x – 200MHz R4F CAN CAN USB 2MB Flash, 192kB RAM ! SafeTI ISO & IEC CAN ISO ISO 13849 IEC IEC 61508 ! SafeTI RM46L8x – 220MHz R4F ! 1.25MB Flash, 192kB RAM SafeTI ISO & IEC Next Gen Mid SafeTI ISO & IEC Mid RM46L4x – 200MHz R4F 1MB Flash, 128kB RAM SafeTI ISO & IEC CAN Next Gen Low Production RM42x – 100MHz R4 ! SafeTI ISO & IEC 384kB Flash, 32kB RAM SafeTI ISO & IEC CAN Low Sampling Development 8 HerculesTM TMS570 MCUs Supporting Automotive & Transportation safety TMS570x Temperatures -40C 125C Q100 Benefits ARM Memory Power & Clocking • Lockstep ARM Cortex-R based MCU –with up to 480 peak Cortex™ARM-R5F Up to 4MB Flash OSC PLL DMIPS and 256KB to 4MB Flash Memory (w/ ECC) Cortex-R CLKMON 80 to 300 MHz Up to512KB SRAM • Safety Integrated in HW – provides a high level of (w/ ECC) VMON Cache diagnostic coverage to reduce safety software overhead FPU MPU 128KB Data Flash (w/ECC) (w/ECC) Debug • SafeTI™ system design packages – makes it easier to Real-time JTAG achieve safety certification and get to market quickly Lockstep Fault Detection ExternalMemory Memory 32-bit Trace (ETM) • Developed to safety standards – developed for use in IEC ControlControl Peripherals 16-bit Parallel Interface 61508 SIL-3 and ISO 26262 ASIL-D safety applications Calibration ePWM CommsCommunication Peripherals Safety & System • Flexible Communication and Control – Ethernet, Flexray, eCAP CAN. Up to 84 timer and 41 12-bit ADC channels. 10/100 Ethernet CPU BIST eQEP CAN SRAM BIST N2HET Timer DMA Flexray CRC UART (LIN) Tools Analog OS Timers Multi-Buffer SPI 12-bit ADC Windowed Watchdog Temperature Sensor I2C External INT / GPIO Software Packages • Drivers & Libraries – HALCoGen Development Kit Launchpad peripheral driver generation tool, SafeTITM Diagnostic Library, CMSIS DSP Library, • RTOS – SAFERTOS, AUTOSAR • IDEs: Code Composer Studio, IAR • SafeTI Compiler Qualification Kit 144p QFP (20x20mm) • Mathworks Simulink 100p QFP 337p BGA (14x14mm) Motor Control rd (16x16mm) XDS560 Pro Trace SafeTI Kit • SafeTI 3 Party Ecosystem 9 Hercules™ TMS570 Cortex™-R Roadmap 2012 2013 2014 TMS570LS31x – 180MHz R4F ! Features: 3MB Flash, 256kB RAM Lock Step SafeTI ISO & IEC QEP/ePWM Ethernet TMS570LC – 300MHz R5F Architecture High 4MB Flash, 512kB RAM TMS570LS21x – 180MHz R4F CAN CAN CAN 2MB Flash, 192kB RAM FlexRay CAN ! SafeTI ISO & IEC ISO ISO 26262 IEC IEC 61508 ! SafeTI TMS570LS12x – 180MHz R4F ! 1.25MB Flash, 192kB RAM SafeTI ISO & IEC Next Gen Mid SafeTI ISO & IEC Mid TMS570LS11x – 180MHz R4F 1MB Flash, 128kB RAM SafeTI ISO & IEC CAN TMS570LS04x – 80MHz R4 Next Gen Low 384kB Flash, 32kB RAM SafeTI ISO & IEC Production SafeTI ISO & IEC ! Low Sampling TMS570LS03x – 80MHz R4 CAN 256kB Flash, 24kB RAM Development SafeTI ISO & IEC 10 Functional Safety Standards Hardware requirements Safety Architectural Architectural Failure Specific MCU self-test Standard System Integrity Metric Requirement Rate requirements Programmable IEC 61508 SIL – 1,2,3,4 SFF HFT>0 for SIL 4 PFD, PFH No E/E systems ASIL – A, B, ISO 26262 Automotive SPFM / LFM No PMHF No C, D Follow IEC EN 50129 Railway SIL- 1,2,3,4 N/A THR CPU, Memory 61508 Dual channels CPU, Memory, Interrupt, ISO 22201 Elevator SIL – 1,2,3 N/A N/A for SIL3 Clock, I/O, Comm SIL – 1,2,3 Dependent on PFH IEC 61800 Drive SIL4 Apply SFF No function (no PFD) IEC 61508 SIL – 1,2,3 Supports ISO IEC 62061 Machinery SIL4 Apply SFF 13849 PFHD No IEC 61508 categories SIL – 1,2,3 Process IEC 61511 SIL4 Apply SFF See IEC 61508 PFDavg No Automation IEC 61508 ISO 13849 Machinery PL a,b,c,d,e DCavg CAT B,1,2,3,4 MTTFD No Home CPU, Memory, Interrupt, IEC 60730 Class A, B, C No Yes (Class C) No Appliances Clock, I/O, Comms 11 Typical Usage of Hercules MCU per Functional Safety Standard* Specific Diagnostic Functional Safety Typical Hercules MCU Usage Requirements per Standard Standard IEC 61508 Single MCU for SIL1 - SIL 3, Dual MCU for SIL 4 No ISO 26262 Single Hercules MCU ASIL A to D No Examples provided, EN 50129 Single MCU for SIL1 - SIL 3, Dual MCU for SIL 4 not requirements ISO 22201 Single MCU for SIL1 - SIL 2, Dual MCU for SIL 3 Yes IEC 61511 Single MCU for SIL1 - SIL 3, Dual MCU for SIL 4 No IEC 61800 Single Hercules MCU for SIL1 - SIL 3 No IEC 62061 Single Hercules MCU for SIL1 -SIL 3 No Single MCU for Cat B, 1, 2 from PL a to PLe ISO 13849 Dual MCU for Cat 3, 4 from PL a to PL e No Single MCU + TPS under evaluation for PL d CAT3 IEC 60730 Single MCU for Class A – C, Dual MCU for some Class C Yes * Items shown are typical examples. Achieved safety integrity level is the responsibility of the system developer. 12 Applying Functional Safety Standards Functional Safety SafeTI™ design packages help meet functional safety requirements while Risk reduction managing both systematic and random failures. Safety