Module Operation
360
SPNU503C – March 2018
Copyright © 2018, Texas Instruments Incorporated
CPU Compare Module for Cortex-R4F (CCM-R4F)
9.3
Module Operation
The CCM-R4F compares the core compare bus outputs of the master and checker Cortex-R4F CPUs on
the microcontroller and signals an error on any mismatch. This comparison is started 6 CPU clock cycles
after the CPU comes out of reset to ensure that CPU output signals have propagated to a known value
after reset. Once comparison is started, the CCM module continues to monitor the outputs of two CPUs
without any software intervention. Upon an error software needs to handle it.
The CCM-R4F can run in one of the following four operating modes:
1. 1oo1D lock step
2. self-test
3. error forcing
4. self-test error forcing
The operating mode can be selected by writing a dedicated key to the key register (MKEY).
9.3.1 1oo1D Lock Step Mode
This is the default mode on start-up.
In lock step mode, the compare bus output signals of both CPUs are compared. A difference in the CPU
compare bus outputs is indicated by signaling an error to the ESM which sets the error flag “CCM-R4F -
compare”.
NOTE:
The CPU compare error asserts “CCM-R4F self-test error” flag as well. By doing this, the
CPU compare error has two paths (“CCM-R4F - compare” and “CCM-R4F self-test error”
flag) to the ESM, so that even if one of the paths fails, the error is still propagated to the
ESM.
Not all internal registers of the Cortex-R4F CPU have fixed values upon reset. To avoid an erroneous
CCMR4F compare error, the application software needs to ensure that the CPU registers of both CPUs
are initialized with the same values before the registers are used, including function calls where the
register values are pushed onto the stack.
9.3.2 Self-Test Mode
In self-test mode, the CCM-R4F checks itself for faults. During self-test, the compare error module output
signal is deactivated. Any fault detected inside the CCM-R4F will be flagged by ESM error “CCM-R4F -
self-test”.
In self-test mode, the CCM-R4F automatically generates test patterns to look for any hardware faults. If a
fault is detected, then a self-test error flag is set, a self-test error signal is asserted and sent to the ESM,
and the self-test is terminated immediately. If no fault is found during self-test, the self-test complete flag is
set. In both cases, the CCM-R4F remains in self-test mode after the test has been terminated or
completed, and the application needs to switch the CCM-R4F mode by writing another key to the mode
key register (MKEY). During the self-test operation, the compare error signal output to the ESM is inactive
irrespective of the compare result.
There are two types of patterns generated by CCM-R4F during self-test mode:
i.
Compare Match Test
ii. Compare Mismatch Test
CCM-R4F first generates Compare Match Test patterns, followed by Compare Mismatch Test patterns.
Each test pattern is applied on both CPU signal inputs of the CCM-R4F’s compare block and clocked for
one cycle. The duration of self-test is 3615 CPU clock cycles (GCLK).
NOTE:
During self-test, both CPUs can execute normally, but the compare logic will not be checking
any CPU signals. Also during self-test, only the compare unit logic is tested and not the
memory mapped register controls for the CCM-R4F. The self-test is not interruptible.
