The MCU error signal monitor (ESM) monitors the system MCU-error events signaled over the MCU_ERR input pin. The ESM is configurable for two different operating modes. The first mode is TMS570 mode, in which the ESM detects a low-pulse signal with a programmable low-pulse width duration threshold. The second mode is PWM mode, in which the ESM detects a PWM signal with a programmable minimum and maximum pulse-width threshold for the low pulse and high pulse.

The operating mode of the ESM is controlled through the MCU_ESM_CFG bit in the SAFETY_CFG3 SPI register. The ESM is disabled by default, and can be activated by setting the MCU_ESM_EN bit to 1b in the SAFETY_CHECK_CTRL SPI register.

In TMS570 mode, the SAFETY_ERR_PWM_LMAX register sets the threshold of the low-signal duration. When TMS570 mode is enabled and monitoring signal is high, monitoring starts after the first high to low signal transition. If monitoring signal is low when TMS570 mode is enabled and monitoring signal does not transition high for the duration of the t_{TMS570_START_TO} start-up time-out window, an error is detected, the ESM failure counter (MCU_ESM_FC[3:0]) is incremented, and the t_{TMS570_START_TO} start-up time-out window is restarted again. The duration of the start-up time-out window t_{TMS570_START_TO} is set by the SAFETY_ERR_PWM_LMAX register and SAFETY_ERR_PWM_HMAX register setting (t_{PWM_LOWMAX} + t_{PWM_HIGHMAX}).

In PWM mode, the SAFETY_ERR_PWM_LMIN and SAFETY_ERR_PWM_LMAX registers set the thresholds for the minimum and maximum low-pulse durations. The SAFETY_ERR_PWM_HMIN and SAFETY_ERR_PWM_HMAX registers set the thresholds for the minimum and maximum high-pulse durations.

When the PWM mode is enabled, monitoring starts after the rising or falling edge of the signal. If no edge is detected within the time-out window (t_{PWM_LOWMAX} + t_{PWM_HIGHMAX}), then an error is detected and the ESM failure counter (MCU_ESM_FC[3:0]) increments. If the monitored signal duration is shorter than the t_{PWM_HIGHMIN} or t_{PWM_LOWMIN} time or if the monitored signal duration is longer than the t_{PWM_HIGHMAX} or t_{PWM_LOWMAX} time, the following occurs:

• An error is detected.
• The MCU_ESM_FC[3:0] failure counter increments.
• A new monitoring cycle starts.

Correct signaling is detected for the low signal when the low-signal duration is from the t_{PWM_LOWMIN} time interval to the t_{PWM_LOWMAX} time interval and is followed by a high-signal width duration from the t_{PWM_HIGHMIN} time interval to the t_{PWM_HIGHMAX} time interval. Correct signaling is detected for the high signal when the high-signal duration is from the t_{PWM_HIGHMIN} time interval to the t_{PWM_HIGHMAX} time interval and is followed by a low signal with a duration from the SAFETY_ERR_PWM_LMIN interval to the SAFETY_ERR_PWM_LMAX interval.

The MCU_ESM_FC[3:0] counter decrements when a correct signal is detected. When monitoring starts, a new monitoring event starts any time after an error is detected or when correct signaling is detected.

The MCU_ESM_FC[3:0] counter increments after an MCU signaling error is detected. If the device is in the ACTIVE state, the MCU_ESM_FC[3:0] counter is greater than the programmed threshold (MCU_ESM_FC_ENDRV_TH) and MCU_ESM_RST_EN configuration bit is set to 0b, the following occurs:

• The device goes into the SAFE state.
• The ENDRV/nIRQ pin is disabled (driven low).
• The MCU_ESM_FAIL and MCU_ESM_RST_FAIL status bits are set in the SAFETY_ERR_STAT3 register.

If the device is in the DIAGNOSTIC or ACTIVE state, the MCU_ESM_FC[3:0] counter is greater than the MCU_ESM_FC_RST_TH[3:0] threshold, and the MCU_ESM_RST_EN configuration bit is set to 1b, the device goes into the RESET state. The MCU_ESM_FAIL and MCU_ESM_RST_FAIL status bits are also set in the SAFETY_ERR_STAT3 register.

If the device is in the DIAGNOSTIC or ACTIVE state, the MCU_ESM_FC[3:0] counter is greater than the MCU_ESM_FC_RST_TH[3:0] threshold, and the MCU_ESM_RST_EN configuration bit is set to 0b, the device goes into the SAFE state. The MCU_ESM_FAIL and MCU_ESM_RST_FAIL status bits are also set in the SAFETY_ERR_STAT3 register. If the device is already in the SAFE state and if the MCU_ESM_FC_RST_TH[3:0] threshold is equal to or less than the MCU_ESM_FC_ENDRV_TH[3:0] threshold, no action occurs.

Regardless of the configuration mode of the MCU ESM, a new MCU ESM cycle starts and the MCU_ESM_FC[3:0] and MCU_ESM_FAIL status bits are initialized each time one of the following occurs:

• When a NPOR event occurs.
• When the device goes to the RESET state.
• After the LBIST run is complete.
• After the MCU_ESM_CFG bit toggles when changing the ESM configuration mode.
• After the MCU_ESM_EN bit is set to 0b.

Regardless of the configuration mode of the MCU ESM, the MCU_ESM_FC[3:0] bit is initialized to its default value each time one of the following occurs:

• When the device goes into the DIAGNOSTIC state from the SAFE state.
• When the device goes into the RESET state.
• After the LBIST run is complete.
• After the MCU_ESM_EN bit toggles from 0b to 1b.
• After the MCU_ESM_CFG bit toggles from 0b to 1b or from 1b to 0b.

Figure 11-20 MCU Error Signaling Monitor (ESM) With MCU ESM Failure Counter and WD Failure Counter

Figure 11-21 MCU ESM TMS570 Mode

Figure 11-22 MCU ESM TMS570 Mode (Time-Out)

Figure 11-23 MCU ESM PWM Mode (Case Scenarios 1, 2, and 3)

Figure 11-24 MCU ESM PWM Mode (Case Scenarios 1, 4, and 5)

Figure 11-25 MCU ESM PWM Mode (Case Scenarios 1, 6, and 7)

Figure 11-26 MCU ESM PWM Mode (Case Scenarios 1, 8, and 9)

Figure 11-27 MCU ESM PWM Mode (Case Scenarios 1, 10, and 11)

Figure 11-28 MCU ESM PWM Mode Time-Out Events After PWM Mode is Enabled
(Case Scenarios 12 and 13)