System Integrator needs to execute a dependent failure/common cause failure analysis to consider possible dependent/common cause failures on the sub-elements of the TMS320F2838x Real-Time MCU, including pin level connections.

• Consider a relevant list of dependent failure initiators, such as the lists found in ISO 26262-11:2018. Analysis of dependent failures should include common cause failures among functional redundant parts and also between functions and the respective safety mechanisms.
• Verify that the dependent failure analysis considers the impact of the software tasks running on the TMS320F2838x MCU, including hardware and software interactions.
• Verify that the dependent failure analysis considers the impact of pin/ball level interactions on the TMS320F2838x MCU package, including aspects related to the selected I/O multiplexing.

The following may be useful for addressing the common cause failures when using the C2000 MCU:

• Redundant functions and safety mechanism can be impacted by common power failure. A common cause failure on power source can be detected by PWR1-"External voltage supervisor",PWR2-"External Watchdog".
• In general, a clock source which is common to redundant functions should be monitored and any failures on the same can be detected by safety mechanisms such as CLK1-Missing Clock Detect, CLK2-Clock Integrity Check using CPU Timer, CLK5-External monitoring of clock via XCLKOUTand CLK8-Periodic Software Read Back of Static Configuration Registers. Specifically, to avoid common clock failure affecting Internal Watchdog(WD) and CPU, it is recommended to use either INTOSC2 or X1/X2 as clock source to PLL.
• Failure of common reset signal to redundant functions can be detected by RST1-"External monitoring of warm reset (XRSn)", RST2-"Reset Cause Information".
• Common cause failure on Interconnect logic could impact both redundant functions and also safety mechanism in same way. In addition to other safety mechanisms, INC1-"Software Test of Function Including Error Tests" can be implemented to detect faults on interconnect logic.
• Common cause failure could impact two functions used in redundant way. In case of communication peripherals module specific “Information Redundancy Techniques Including End to End Safing” can be implemented to detect common cause failures, for example, CAN2, SPI2, SCI3, I2C3, MCBSP2.
• Using different voltage references and SOC trigger sources for ADC (see Section 6.6.8)
• Using PWM modules from different sync groups for implementing Hardware Redundancy
• Using GPIO pins from different groups when implementing Hardware Redundancy for GPIO pins