AN4124

Redundancy and functions

Doc ID 023294 Rev 2

19/32

Appendix A

Redundancy and functions

A.1

Path redundancy on critical error reaction

All faults detected are reported to the central Fault Collection and Control Unit (FCCU) and

RGM. Depending on the particular fault, the FCCU puts the device into the appropriate

configured Fail-Safe state. This prevents propagation of faults to system level.

Critical errors detected normally are forwarded independently by each channel to RGM and

FCCU. The state of the RGM is forwarded to the FCCU. The FCCU forwards an additional

reset request to the RGM. This strategy is used as it drastically decreases the common

mode failure on the Reset path.

Figure 3.

Dual path faults

For some faults:

●

The fault is triggered to the FCCU.

●

FCCU reacts independently of the RGM.

●

Fault reaction depends on the FCCU settings.

Figure 4.

RGM/FCCU – no dual path faults