Functions of external devices for safety applications

AN4287

20/27

DocID024464

Rev 2

4.3

PWM Output Monitor function (PWMM)

The eMIOS200 module and the eTPU2 module integrated in the SPC564A7x/SPC564A80

device can generate PWM output signals.

In general, if the safety application uses these PWM output signals to control an actuator

with short safety time against wrong control (such as the inverter of a three-phase motor

control application with a dead-time requirements to avoid short circuits destroying the

inverter and the motor), those requirements shall be supervised externally if the failure

reaction delay within the SPC564A7x/SPC564A80 device can exceed the safety time of the

actuator.

The distinctive features that should be managed by the external device are the correctness

of inserted dead-time and the occurrence of an open-circuit and/or short-circuit to supply or

ground.

Suggested: an external low-cost device, acting as system supervisor, shall provide also a

PWM monitor to check the generated PWM output signals.

Rationale: to check the accuracy of the PWM output signals.

If a failure is detected, the PWMM moves, and maintains, the system (ECU level) to a Safe

state condition within the FTTI (e.g., the PWMM disconnects from the power supply the

SPC564A7x/SPC564A80 device).

Implementation hint: in case PWM signals drive the switches of a power stage, eMIOS200

channels or eTPU2 channels cannot be used to detect a dead-time fault because its failure

indication time is normally greater than the time enough to produce a physical permanent

failure of the power stage.