Functions of external devices for safety applications

AN4475

20/27

DocID026216 Rev 1

3.3

PWM Output Monitor function (PWMM)

The eMIOS200 module and the eTPU2 module integrated in the SPC563Mxx device can

generate PWM output signals.

In general, if the safety application uses these PWM output signals to control an actuator

with short safety time against wrong control (such as the inverter of a three-phase motor

control application with a dead-time requirements to avoid short circuits destroying the

inverter and the motor), those requirements are supervised externally if the failure reaction

delay within the SPC563Mxx device can exceed the safety time of the actuator.

The distinctive features that should be managed by the external device are the correctness

of inserted dead-time and the occurrence of an open-circuit and/or short-circuit to supply or

ground.

Suggested: [covers: SW_EXT_PWM_MON] an external low-cost device, acting as system

supervisor, provides also a PWM monitor to check the generated PWM output signals.

Rationale: to check the accuracy of the PWM output signals.

If a failure is detected, the PWMM moves, and maintains, the system (ECU level) to a Safe

state condition within the FTTI (e.g., the PWMM disconnects from the power supply the

SPC563Mxx device).

Implementation hint: in case PWM signals drive the switches of a power stage, eMIOS200

channels or eTPU2 channels cannot be used to detect a dead-time fault because its failure

indication time is normally greater than the time enough to produce a physical permanent

failure of the power stage.