Freescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, ColdFire+, C- Ware, the Energy Efficient Solutions logo, Kinetis,

Transcription

1 July 19, 2013 Freescale, the Freescale logo, AltiVec, C-5, CodeTEST, CodeWarrior, ColdFire, ColdFire+, C- Ware, the Energy Efficient Solutions logo, Kinetis, mobilegt, PEG, PowerQUICC, Processor Expert, QorIQ, Qorivva, SafeAssure, the SafeAssure logo, StarCore, Symphony and VortiQa are trademarks of Freescale Semiconductor, Inc., Reg. U.S. Pat. & Tm. Off. Airfast, BeeKit, BeeStack, CoreNet, Flexis, Layerscape, MagniV, MXC, Platform in a Package, QorIQ Qonverge, QUICC Engine, Ready Play, SMAROS, Tower, TurboLink, Vybrid and Xtrinsic are trademarks of Freescale Semiconductor, Inc. All other product or service names are the property of their respective owners Freescale Semiconductor, Inc.

2 Functional Safety Requirement Safety concept of MPC5643L and MPC5744P SafeAssure FMEDA SafeAssure Safety Manual SM : 2. General information SM : 5. System-level SW req. SM : 8. Additional information 2

3 ISO 26262: Four Automotive SILs (ASIL) Three key metrics Probability of violation of safety goal (PVSG) Single Point Fault metric (SPFM) Latent Fault Metric (LFM) General requirements for CCF analysis ASIL B ASIL C ASIL D PVSG [1/h] <10-7 (recom.) <10-7 <10-8 SPFM >90% >97% >99% LFM >60% >80% >90% Note: Table adopted for typical automotive application 3

4 Functional Safety Requirement Safety concept of MPC5643L and MPC5744P SafeAssure FMEDA SafeAssure Safety Manual SM : 2. General information SM : 5. System-level SW req. SM : 8. Additional information 4

5 Single Point Failure (SPF) Structural redundancy Core, cache, bus, DMA, INTC, watchdog, RAM-Ctrl, Flash-Controller Information redundancy ECC on system RAM and Flash, EDC on Cache input Component output wrong Latent Failure (LF) HW-Self test (BIST) input LF Component output correct Memory, logic, some peripherals Common Cause Failure (CCF) Measures according to IEC Ed.2 Annex E Supervision of clock, power and temperature Independent safety clock Independent failure signaling input Component Component Comparator OK 5

6 MC XOSC SIU WAKE ADC ADC CTU PWM PWM etimer etimer etimer CAN CAN LFLEX LFLEX DSPI DSPI DSPI FCCU BAM SSCM FLPLL FMPLL IRCOSC CMU CMU CMU TSENS TSENS CRC PIT SWG PMU SWT MCM S INTC edma e200 core FPU VLE MMU I-CACHE Debug JTAG Nexus FlexRay RC e200 core FPU VLE MMU I-CACHE PMU SWT MCM S INTC edma Dual Core Lock-Step Sphere of Replication Cross Bar Switch Memory Protection Unit RC I/O Bridge 1M FLASH (ECC) RC Cross Bar Switch Memory Protection Unit RC I/O 128K Bridge SRAM (ECC) ECC Protected Memories Replicated Peripherals BIST Fault Collection Control Unit 6

7 Flash 64bit data SRAM 64bit data ECC is done on: Flash: 64-bits + 8-bits ECC SRAM: 32-bits + 7-bits ECC ECC is checked on reads, calculated on writes 8-bit ECC 7-bit ECC Reads 64-bits containing the desired byte / halfword / word or doubleword in memory is read and ECC checked. Writes The new byte / halfword / word / doubleword is merged into the 64 bits. New ECC bits are calculated. The 64-bits and the new ECC bits are written back. 7

8 Test Point Control Signal Generatio n Stored good MISR Signature Comparator Pseudo Random Pattern Generator MISR Signature Generator Start seed LBIST Controller LBIST partition scan enable clock Done core logic scan chain 1 scan chain 2 scan chain 3 scan chain 4 Pass / Fail Automatic Isolation Test wrapper Equipment for in functional Production core IOs 8

9 3.3V 1.2V 9

10 10

11 Layout/routing/placement constraints set to maximize the independence of redundant components Allocate all components of each channel to a separate lake on die = Apply different layout constraints to each lake (=>Diversity) Route signals non-parallel and around other lake 11

12 12

13 Single Point Failure (SPF) Structural redundancy Core, cache, bus, DMA, INTC, watchdog, RAM-Ctrl, Flash- Controller input Component output wrong Information redundancy E2E ECC, EDC on Cache Latent Failure (LF) HW-Self test Memory, logic input LF Component output correct 90% stuck-at Runtime LBIST of cores Common Cause Failure (CCF) Measures according to IEC Ed.2 Delayed Checker Core Supervision of clock, power and temperature input Component Component Comparator OK Independent safety clock Independent failure signaling 13

14 Functional Safety Requirement Safety concept of MPC5643L and MPC5744P SafeAssure FMEDA SafeAssure Safety Manual SM : 2. General information SM : 5. System-level SW req. SM : 8. Additional information 14

15 Certified by exida an independent accredited assessor Certificate issued based on a successful assessment of the product design and applied development and production processes against all requirements and work product definitions of ISO identified as applicable to an MCU part MPC5643L MCU certified for use for all Automotive Safety Integrity Levels (ASIL), up to and including the most stringent level, ASIL D 15

16 Example 16

17 Example 17

18 Example 18

19 Functional Safety Requirement Safety concept of MPC5643L and MPC5744P SafeAssure FMEDA SafeAssure Safety Manual SM : 2. General information SM : 5. System-level SW req. SM : 8. Additional information 19

20 MCU Internal Safety concept MCU Connected Safety concept S. measure F. rates Dynamic FMEDA Chap 3 Chap 3/4 SM (Safety Manual) Customer Design (ASIL A~D System) 20

21 2.3 Safe State 21

22 2.4 Single-point Fault Tolerant Time Interval and Process Safety Time PST FTTI in IEC61508 in ISO

23 2.5 Latent Fault Tolerant Time Interval for latent faults L-FTTI = trip time 23

24 2.6 Failure handling Start time : LBIST, MBIST before the safety function within a L-FTTI Run time : Shall be handled shorter than FTTI 24

25 5.2 MPC5643L modules Assumption for ASIL-D : SSCM, STCU, RGM, CLK, FLASH, INTC, DMA, PIT, I/O, CTU, ADC, TSENS, SWT, CRC, CMU, FMPLL, IRC, PMU, RPM, FCCU Recommend : SRAM, COMM., I/O, TSENS, RCCU, CRC, MPU, RPM, ECSM 25

26 < MPC5643L clock sources > - IRCOSC (16Mhz) : Reference clock, Start time - clock, Safe mode clock - XOSC (4 ~ 40Mhz) : Main oscillator, FMPLL - source, CAN clock - FMPLL0 (~120Mhz) : System clock - FMPLL1 (~120Mhz) : Motor control clock 26

27 < MPC5643L CMUs > - CMU0 : SYS_CLK, XOSC monitoring - CMU1 : Motor control clock monitoring - CMU2 : FlexRay clock monitoring - Indications : Loss of XOSC, FMPLL higher/lower than ref. MC clock H/L than ref. FlexRay clock H/L than ref. - Report to : RGM, FCCU Upper/ lower bound setting 27

28 Clock Monitoring Unit (CMU) Assumption: [SM_065] It is assumed that the following clocks are supervised. Loss of external crystal oscillator clock FMPLL frequency higher than the (programmable) upper frequency reference FMPLL frequency lower than the (programmable) lower frequency reference Rationale: To monitor the integrity of the various clock signals Assumption: [SM_066] It is assumed that for each clock used by a functional safety relevant module, a CMU is used. It is assumed that the CMUs are enabled and their faults are managed by the FCCU. Rationale: To monitor the integrity of the various clock signals 28

29 Clock Monitoring Unit (CMU) 29

30 30

31