CPU 1
CPU 2
2 cycles delay
2 cycles delay
CCM-R4F
compare
CCM-R4F
CPU1CLK
CPU2CLK
compare
error
ESM
(Error
Signaling
Module)
Master CPU
Checker CPU
Main Features
359
SPNU503C – March 2018
Copyright © 2018, Texas Instruments Incorporated
CPU Compare Module for Cortex-R4F (CCM-R4F)
9.1
Main Features
Safety-critical applications require run-time detection of faults in the Central Processing Unit (CPU). For
this purpose, the CPU Compare Module for Cortex-R4F (CCM-R4F) compares the core compare bus
outputs of two Cortex-R4F CPUs running in a 1oo1D (one-out-of-one, with diagnostics) lockstep
configuration. Any difference in the core compare bus outputs of the CPUs is flagged as an error. For
diagnostic purposes, the CCM-R4F also incorporates a self-test capability to allow for boot time checking
of hardware faults within the CCM-R4F itself.
The main features of the CCM-R4F are:
•
run-time detection of faults
•
self-test capability
•
error forcing capability
9.2
Block Diagram
shows the interconnection diagram of the CCM-R4F with the two Cortex-R4F CPUs. The core
compare bus outputs of the CPUs are compared in the CCM-R4F. To avoid common mode impacts, the
signals of the CPUs to be compared are temporally diverse. The output signals of the master CPU are
delayed 2 cycles while the input signals of checker CPU are delayed 2 cycles. The CCM-R4F is constantly
comparing about 900 signals from each of the two CPUs. These signals include the address, data and
control signals from the flash and RAM TCMs and from the AXI peripheral bus. An internal register or ALU
error will be flagged as a mis-compare when the faulty value is stored, used as an index, or causes a
change in program execution.
Figure 9-1. Block Diagram