Various functional safety mechanisms in the devices are either always-on (see CPU Handling of Illegal Operation, Illegal Results and Instruction Trapping, and so forth) or executed periodically (see VCU CRC Check of Static Memory Contents, and so forth) by the application software. The maximum time that a safety mechanism will take to detect a fault is termed as Fault Diagnostic Test Time Interval (FDTI). Once the fault is detected, depending on the fault reaction of the associated fault (for example, external system reaction to ERRORSTS pin assertion), the system will enter in the safe-state. The time-span in which a fault or faults can be present in a system before a hazardous event occurs is called Fault Tolerant Time Interval (FTTI) as defined in ISO 26262. This is similar to Process Safety Time (PST) defined in IEC 61508. Figure 4-6 illustrates the relationship between FDTI, Fault Reaction Time and FTTI.

Figure 4-6 Relationship Between FDTI, Fault Reaction Time and FTTI

Figure 4-7 Illustration of FTTI

The frequency and extent of each of the Level 2 and Level 3 checks in E-GAS monitoring concept should be consistent with the Fault Tolerant Time Interval (FTTI). Figure 4-7 illustrates the frequency of the required checks. The checks should be such that single point faults of the microcontroller should be detected and responded to, such that the TMS320F280015x MCU enters a safe state within the FTTI budget. The microcontroller on detection of a fault enters into one of the safe states as illustrated in Figure 4-8. An example of a diagnostic for single point faults is ECC/Parity for memories.

The proposed functional safety concept, subsequent functional safety features and configurations explained in this document are for reference purpose only. The system and equipment designer or manufacturer is responsible to ensure that the end systems (and any Texas Instruments hardware or software components incorporated in the systems) meet all applicable safety, regulatory and system-level performance requirements.