DocID026216 Rev 1

19/27

AN4475

Functions of external devices for safety applications

26

3

Functions of external devices for safety applications

This section gives an overview of the external components suggested to use with the

SPC563MXX device.

Suggested: at system level some countermeasures have to be placed in order to bring the

safety-critical outputs to their safe state (e.g., by pull-up or pull-down resistors).

It should be noted that the failure rates of external components are not included in FMEDA

of the SPC563Mxx device and have to be included in the system FMEDA by the user

himself.

3.1

External Watchdog function (EXWD)

Suggested: [covers: SW_EXT_SWT] an external low-cost device, acting as system

supervisor, provides also a watchdog to cover complete failures of the SPC563Mxx device

for safety applications. It is triggered periodically by the SPC563Mxx device. [end]

Rationale: to detect CCF as a complete failure of the device.

Some common causes of failure (e.g., failure on power supply) are detected because the

software no longer triggers the watchdog.

If a failure is detected, the EXWD moves, and maintains, the system (ECU level) to a Safe

state condition within the FTTI (e.g., the EXWD disconnects from the power supply the

SPC563Mxx device).

The user can choose how to implement the watchdog communication between the

SPC563Mxx device and the external device (for example, communication via serial link or

via toggling pin).

3.2

Power Supply Monitor function (PSM)

The SPC563Mxx device embeds LVI for all internal supplies. Latent failures impacting these

LVIs can’t be detected.

Suggested: [covers: SW_EXT_SUPPLY_MON] an external low-cost device, acting as

system supervisor, is provided also over-/under-voltage monitor for the SPC563Mxx on all

supplies available externally. [end]

Rationale: to ensure voltage power supply is within the defined operating range.

If the voltage power supply is out of the defined operating range, the PSM moves, and

maintains, the system (ECU level) to a Safe state condition within the FTTI (e.g., the PSM

disconnects from the power supply the SPC563Mxx device).

For the voltage power supply operating range, please refer to the SPC563MXX device data

sheet.

It should be noted that an over voltage outside the specified range may cause permanent

damage to the SPC563Mxx device even if kept in reset.