The products supported by this document have been assessed to be meet a systematic capability compliance of ASIL-D (according to ISO 26262) and SIL-3 (according to IEC 61508). For more information, see the Texas Instrument's functional safety hardware development process.

This Functional Safety Manual is part of the safety design package to aid customers who are designing systems in compliance with ISO 26262 or IEC 61508 functional safety standards.

Table 1-1 shows a complete list of the products supported by this functional safety manual (including silicon revision C) and the part numbers.

This Functional Safety Manual provides information needed by system developers to assist in the creation of a functional safety system using a C2000 microcontroller (MCU). This document contains:

• Overview of Delfino TMS320F2837xD/S and Piccolo TMS320F2807x MCU product architectures
• Overview of the development process utilized to reduce systematic failures
• Overview of the safety architecture for management of random failures
• Details of architecture partitions and implemented safety mechanisms

It is expected that the user of this document should have a general familiarity with the Delfino TMS320F2837xD/S and Piccolo TMS320F2807x MCU product family. More information can be found at http://www.ti.com/C2000. This document is intended to be used in conjunction with the device-specific data sheets, technical reference manuals, and other documentation for the products being supplied.

Table terms and definitions ready for reference are listed in Table 1-2.

The TMS320F2837xD/S and TMS320F2807x are powerful 32-bit floating-point microcontroller unit (MCU) designed for advanced closed-loop control in automotive and industrial applications.

TMS320F2837xD supports two instances of the C28x + CLA architecture (four processing elements) that significantly boosts system performance. The integrated analog and control peripherals also let designers consolidate control architectures and reduce multiprocessor use in some of the high-end systems.

The C28x CPUs are further boosted by the Trigonometric Math Unit (TMU) accelerator that enables fast execution of algorithms with trigonometric operations common in transforms and torque loop calculations. The Viterbi, Complex Math and CRC Unit (VCU) accelerator reduces the time for complex math operations common in encoded applications. Users may refer to Accelerators: Enhancing the Capabilities of the C2000™ MCU Family to see how the accelerators can be employed to increase the performance of the MCU in many real-time applications.

The CLA is an independent 32-bit floating-point accelerator that runs at the same speed as the main C28x CPU, responding to peripheral triggers with minimum event latency and executing code concurrently with the main CPU.

The TMS320F2837xD supports up to 1MB (512KW) of onboard Flash memory with error correction code (ECC) and up to 204KB (102KW) of SRAM. Two 128-bit secure zones are also available on each CPU for code protection.

Figure 1-1 Functional Block Diagram of TMS320F2837xD MCU

Performance analog and control peripherals are also integrated to further enable system consolidation. Four independent 12/16-bit ADCs provide precise and efficient management of multiple analog signals, which ultimately boosts system throughput. The new sigma-delta filter module (SDFM) works in conjunction with the sigma-delta modulator to enable isolated current shunt measurements. The Comparator Subsystem (CMPSS) with windowed comparators allows for protection of power stages when current limit conditions are exceeded or not met. Other analog and control peripherals include the Digital-to-Analog Converter (DAC), Pulse Width Modulation (PWM), Enhanced Capture (eCAP), Enhanced Quadrature Encoder Pulse (eQEP) and other peripherals. Peripherals such as External Memory Interface (EMIF) and Controller Area Network (CAN) modules (ISO11898-1/CAN 2.0B-compliant) extend the connectivity of the C2000 MCUs.

The device configurations supported by this functional safety manual for TMS320F2837xD MCUs is outlined in the TMS320F2837xD Dual-Core Delfino™ Microcontrollers Data Sheet. Not all variants are available in all packages or all temperature grades. To confirm availability, contact your local Texas Instruments sales and marketing.

TMS320F2837xS supports a single-instance of the C28x + CLA architecture (two processing elements). The integrated analog and control peripherals also let designers consolidate control architectures and bring down multiprocessor use in some of the high-end systems.

The TMS320F2837xS supports up to 1MB (512KW) of onboard Flash memory with error correction code (ECC) and up to 164KB (82KW) of SRAM. Two 128-bit secure zones are also available on the CPU for code protection.

Performance analog and control peripherals are also integrated on this C2000 MCU to further enable system consolidation, similar to the TMS320F2837xD.

Figure 1-2 Functional Block Diagram of TMS320F2837xS MCU

The device configurations supported by this functional safety manual for TMS320F2837xS MCUs is outlined in the TMS320F2837xS Delfino™ Microcontrollers Data Sheet. Not all variants are available in all packages or all temperature grades. To confirm availability, contact your local Texas Instruments sales and marketing.

The F2807x supports a single-instance of the C28x + CLA architecture (two processing elements). The integrated analog and control peripherals also let designers consolidate control architectures and reduce multiprocessor use in some of the high-end systems.

The F2807x device supports up to 512KB (256KW) of ECC-protected onboard Flash memory and up to 100KB (50KW) of SRAM with parity. Two independent security zones are also available for 128-bit code protection of the main C28x.

Figure 1-3 Functional Block Diagram of TMS320F2807x MCU

The performance analog subsystem of the TMS320F2807x MCUs consist of up to three 12-bit ADCs, which enable simultaneous management of three independent power phases, and up to eight windowed comparator subsystems (CMPSSs), allowing very fast, direct trip of the PWMs in overvoltage or overcurrent conditions. In addition, the device has three 12-bit DACs, and precision control peripherals such as enhanced pulse width modulators (ePWMs) with fault protection, eQEP peripherals, and eCAP units. Connectivity peripherals such as dual CAN modules (ISO11898-1/CAN 2.0B compliant) add connectivity to your application.

The device configurations supported by this functional safety manual for TMS320F2807x MCUs is outlined in the TMS320F2807x Piccolo™ Microcontrollers Data Sheet. Not all variants are available in all packages or all temperature grades. To confirm availability, contact your local Texas Instruments sales and marketing.

You, as a system and equipment manufacturer or designer, are responsible to ensure that your systems (and any TI hardware or software components incorporated in your systems) meet all applicable safety, regulatory, and system-level performance requirements. All application and safety related information in this document (including application descriptions, suggested safety measures, suggested TI products, and other materials) is provided for reference only. You understand and agree that your use of TI components in safety critical applications is entirely at your risk, and that you (as buyer) agree to defend, indemnify, and hold TI harmless from any and all damages, claims, suits, or expense resulting from such use.

The products supported by this functional safety manual could be implemented as unique silicon designs or may be shared silicon designs that have elements disabled or not guaranteed by specification, even if present in silicon. Only the capabilities that are enabled in the device as specified in the device-specific data sheet and technical reference manual are to be used for safety feature enhancements or safety software implementation. Capabilities that are not part of the device, even though it is supported in the superset of the device family, are not guaranteed to be present and operate.

The effectiveness of the hardware safety mechanisms is noted in the detailed functional safety analysis report. This information should be used to determine the strategy for utilizing safety mechanisms. The technical and implementation details of each safety mechanism can be found in the device-specific technical reference manual. Depending on the safety standard and end equipment targeted, it may be necessary to manage not only single point faults, but also latent faults. Many of the safety mechanisms described in this document can be used as primary diagnostics, diagnostics for latent fault, or both. When considering system design for management of latent faults, failure of execution resources for software diagnostics, such as failure of CPU and memories need to be considered.

Safety enabled design packages for functional safety applications are used in a variety of safety-related applications, including digital power, electric vehicles, industrial machinery, industrial process, medical, automotive, rail, and aviation. Safety enabled products help TI customers get to market quickly with safety critical systems targeting compliance to safety standards such as ISO 26262, IEC 61508, and IEC 60730 (in Europe)/ UL 1998 (in the United States). The C2000 MCUs TMS320F2837xD/S and TMS320F2807x are being offered with QM and 60730 (UL 1998) design packages for functional safety applications.

• QM design packages for functional safety applications include hardware, software, and tools which are developed according to a quality managed (QM) process for use in functional safety related system designs. These design packages include documentation to support easy evaluation of suitability for use in functional safety system designs with application of appropriate system level measures. The C2000 MCUs TMS320F2837xD/S and TMS320F2807x are automotive-qualified products and comply with the quality management standards of ISO 9001 and ISO/TS16949. In addition as QM offerings, additional documentation is provided (functional safety manual and safety analysis report) to assist customers in reaching compliance of their systems with the ISO 26262 and/or IEC 61508 functional safety standards.
• 60730 design packages for functional safety applications include software self-test libraries developed in accordance with IEC 60730:2008 requirements to support safety systems of Class A, Class B or Class C. These design packages help manufacturers of automatic controls for household and similar use, to quickly and easily achieve applicable system certification. The TMS320F2837xD/S and TMS320F2807x can be used by customers to achieve system level certification up to IEC 60730 Class C and/or UL 1998 Class 2 levels.

The system integrator is responsible for carrying out a number of product development activities. These activities carried out may include but are not limited to the information discussed in the following subsections.

• Verify that the implementation of the TI component in the system design is compliant to requirements in TI documentation. This includes but is not limited to the requirements found in technical reference manuals, data sheets, errata documents, safety manuals and safety analysis reports.
• Verify that the system operational lifetime (power-on hours) does not exceed lifetime specifications for the TI component, as specified in the device data sheet. If the operational lifetime (power-on hours) is not specified in the data sheet, contact a TI quality/reliability engineering representative. For more information, see [1].
• Adhere to the device handling requirements based on JEDEC handling standards J-STD-020 [2] and J-STD-033 [3].
• Define a mechanism for reporting of the field failures back to Texas Instruments.
• Define system maintenance requirements. This C2000 MCU does not require maintenance.
• Define system repair requirements. This C2000 MCU is non-repairable with respect to permanent faults. A power-on reset of the C2000 MCU may be considered a repair activity for transient faults per some definitions of system repair requirements.
• Define system decommissioning requirements. This C2000 MCU has no specific decommissioning requirements.
• Define system disposal requirements. This C2000 MCU has no specific disposal requirements.

• Define the safety functions and verify that the microcontroller behaves properly to support execution of the defined safety function. This C2000 MCU is a generic product which is capable of supporting a variety of safety functions.
• Define the system-level safe state concept considering safe-state entry, maintenance of safe state, and safe-state exit as appropriate to the application and verify correct implementation ( see Section 4.2.4).
• Define the system-level error-handling concept and verify correct implementation.
• Define appropriate overall timing requirements for safety metrics to be calculated for the application (see Section 4.1.2).
• Define appropriate safety metric targets for the application.