DocID024464

Rev 2

19/27

AN4287

Functions of external devices for safety applications

4

Functions of external devices for safety applications

This section gives an overview of the external components suggested to use with the

SPC564A7x/SPC564A80 device.

Suggested: at system level some countermeasures have to be placed in order to bring the

safety-critical outputs to their safe state (e.g., by pull-up or pull-down resistors).

It should be noted that the failure rates of external services are not included in FMEDA of

the SPC564A7x/SPC564A80 device and have to be included in the system FMEDA by the

user himself.

4.1

External Watchdog function (EXWD)

Suggested: an external low-cost device, acting as system supervisor, shall provide also a

watchdog to cover CCFs of the SPC564A7x/SPC564A80 device. It shall be triggered

periodically by the SPC564A7x/SPC564A80 device.

Rationale: to detect CCF as a complete failure of the power supply.

Some common causes of failure (e.g., failure on power supply) are detected because the

software no longer triggers the watchdog.

If a failure is detected, the EXWD moves, and maintains, the system (ECU level) to a Safe

state condition within the FTTI (e.g., the EXWD disconnects from the power supply the

SPC564A7x/SPC564A80 device).

The user can choose how to implement the watchdog communication between the

SPC564A7x/SPC564A80 device and the external device (for example, communication via

serial link or via toggling pin).

4.2

Power Supply Monitor function (PSM)

The SPC564A7x/SPC564A80 device embeds LVI for all internal supplies. Latent failures

impacting these LVIs can’t be detected.

Suggested: an external low-cost device, acting as system supervisor, shall provide also

over-/under-voltage monitor for the SPC564A7x/SPC564A80 on all supplies available

externally.

Rationale: to ensure voltage power supply is within the defined operating range.

If the voltage power supply is out of the defined operating range, the PSM moves, and

maintains, the system (ECU level) to a Safe state condition within the FTTI (e.g., the PSM

disconnects from the power supply the SPC564A7x/SPC564A80 device).

For the voltage power supply operating range, please refer to the SPC564A7x/SPC564A80

device data sheet.

It should be noted that an over voltage outside the specified range may cause permanent

damage to the SPC564A7x/SPC564A80 device even if kept in reset.