Automotive Functional Safety for
C2000™ Real-Time Microcontrollers
Streamline and speed up the ISO 26262 certification processes with our Functional Safety-Compliant products, documentation,
software and support from our knowledgeable experts. Our C2000™ real-time MCUs are independently assessed and certifiedby TÜV SÜD to meet a systematic capability up to ASIL D and help you build automotive applications requiring functionalsafety. C2000 real-time MCUs also address Industrial Functional Safety.
Highlights of the C2000 functional safety offering are• Device architecture tuned for functional safety• Documentation to support to ease customer’s safety assessment at system level• Software library to implement the safety mechanisms

Safety mechanisms play a key role in the overall safety of a system by detecting potentially dangerous failures andconsequently helping place the system in a safe state. With over 300 built-in safety mechanisms defined and independently
assessed by TÜV SÜD for its effectiveness, C2000 MCUs provide the required diagnostic coverage to meet a random hardware
capability of ASIL B at a component level. Functional safety manuals provide detailed information on the safety mechanisms,
techniques for achieving non-interference between elements and avoiding dependent failures, to aid customers in thedevelopment of compliant systems up to ASIL D. The tunable FMEDA provides increased flexibility to customize and calculate
HW metrics with features such as package FIT estimation, product function tailoring, safety mechanism tailoring and custom
diagnostics allowing customers to tune the FMEDA to their own application specific needs.
Learn More about C2000 real-time MCU Key Safety Features

Key safety features

F2838x

F2837x
F2807x

F28004xF28003xASIL D Compliant Development Process✓✓✓

Random Hardware Capability

ASIL B

ASIL B

Systematic Capability

ASIL DF28002x

F280015xF28P65x✓✓✓✓

ASIL B

ASIL B

QM

ASIL B

ASIL B

ASIL D

ASIL D

ASIL D

ASIL D

ASIL D

ASIL D

Reciprocalcomparison

Reciprocalcomparison

Reciprocalcomparison

Reciprocalcomparison

N/A

Lockstep C28x

Reciprocal comparison (CPU1 + CLA)

Memory parity

✓✓

✓

XX

✓✓

Memory ECC

✓✓

✓

✓

✓✓

Flash ECC only

Memory BIST (MPOST)

✓X

✓✓✓

✓

✓

Dual Core Security Module (DCSM) to achieve
non-interference between software elements✓✓✓✓

✓

✓

✓

Windowed watch-dog timer with independent clock✓✓

✓

✓✓

✓

✓

Hardware CRC acceleration
Hardware BIST (HWBIST): Permanent fault coverageof 90%+ for C28x CPU
Redundant and independent ADC / PWM Modules
Automatic comparison of ADC conversion results in HW
Redundant Configurable Logic Block (CLB) option
STL (Software Test Library): Permanent fault coverageof 60%+ for C28x CPU✓✓

✓

✓

✓
✓
X✓X✓✓
✓
X✓X✓N/ADoc

SoftwareHardwareSingle Point Fault Coverage of CPU (SPFM)

STL (Software Test Library): Permanent fault coverage of
60% for CLA
Functional Safety Quality (FSQ) Flash APIs

Lockstep C28x (CPU2)✓✓X✓✓X

✓
N/A✓
X✓✓

✓
N/A

✓

✓

✓

XX

X

Safety Manual: detailed product overview, capabilities
and constraints, TI development process, safetyelements, and safety diagnostics.

SFFS022

Device Certification

SSZQQM2SPRUI78SPRUID8

SWAQ009

SPRQ004

✓
N/A

✓
X
N/A
✓✓✓
✓
✓
Coming soon

✓N/A

N/A

Coming soon

✓N/A

✓

Coming soonSPRUIT5

SFFS222

Beta available – contact TI

N/ASFFS748Coming soon

SFFS277

SFFS610

Safety collateralDevelopment Process Certificate
Hardware | Software

TUV-SUD certificate for QRAS-AP00210. Functional safety development process for IEC 61508-2 and ISO 26262-5 Compliant
Hardware Components

C2000 Safety package*

By request and NDA required. Package includes below elements:• Technical Report on Random HW Capability• Technical Report on Systematic Capability• FMEDA: A failure mode, effects and diagnostic analysis (FMEDA) is used in the development stage to provide a detailed analysis
of different failure modes, the associated effects of failure modes, diagnostics and the impact of any implemented diagnostics/
safety mechanisms in terms of diagnostic coverage. 5 part FMEDA training video series.
• Device Concept Assessment• SAR (Safety Analysis Report): Contains results of safety analysis according to the targeted functional safety standards.

Software diagnostic library

A library of modules and examples demonstrating safety features and mechanisms. Examples include CPU, memory, clocks/
watchdogs, HWBIST, etc.
F2837x/07x supported through this library.
All other F28x series supported by libraries released in C2000Ware.

Functional safety flash APIs

Library is available in C2000Ware. Contact local TI representative for further compliance support package offerings.

C28x CPU self-test library (C28x-STL)*

Library to perform start-up for C28x logic integrity

CLA co-processor self-test library*

Library to perform start-up and periodic tests for CLA logic integrity

Compiler qualification kit

Compare compiler coverage for customer use cases against coverage of TI compiler release validations

Safety certified RTOS (SafeRTOS)

Pre-certified safety Real Time Operating System (RTOS)

MathWorks simulation & code generation

IEC certification kit helps you qualify MathWorks code generation and verification tools to streamline certification of your embeddedsystems*Not publicly available collateral. Contact your local TI representative to request.

Figure 1. Automotive Functional Safety application example:
on-board charger (OBC) with F28P65x-Q1.
•
•

•

•

Intended Function: can be implemented on both C28x CPU1 and CLAo In example above: control functions for on-board charger (OBC) digital power control
Safety Function: Implement using C28x CPU2 and other hardware modules such as ADC, CMPSS, SDFM secondary
filter, CLB, and so forth.
o SPFM of the safety goal can be met by hardware redundancy between the modules used in implementing safetyfunction, Hardware Redundancy Using Lockstep Compare Module (LCM), Hardware Redundancy withADC Safety Checker, Periodic Software Read Back of Static Configuration Registers and so forth.
Diagnostic Function: Implement with C28x CPU and other hardware modules such as LCM, ADC, CMPSS, SDFM
secondary filter, CLB, and so fortho LFM can be met by Software Test of CPU, Self-test Logic for LCM, Software Test of Function IncludingError Tests and so forth.

See more details on the mentioned safety mechanisms in the F28P65x safety manual.

© 2022 Texas Instruments Incorporated
C2000 is a trademark of Texas Instruments.

SWAB014D

IMPORTANT NOTICE AND DISCLAIMER
TI PROVIDES TECHNICAL AND RELIABILITY DATA (INCLUDING DATA SHEETS), DESIGN RESOURCES (INCLUDING REFERENCEDESIGNS), APPLICATION OR OTHER DESIGN ADVICE, WEB TOOLS, SAFETY INFORMATION, AND OTHER RESOURCES “AS IS”
AND WITH ALL FAULTS, AND DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION ANYIMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT OF THIRDPARTY INTELLECTUAL PROPERTY RIGHTS.
These resources are intended for skilled developers designing with TI products. You are solely responsible for (1) selecting the appropriate
TI products for your application, (2) designing, validating and testing your application, and (3) ensuring your application meets applicablestandards, and any other safety, security, regulatory or other requirements.
These resources are subject to change without notice. TI grants you permission to use these resources only for development of an
application that uses the TI products described in the resource. Other reproduction and display of these resources is prohibited. No license
is granted to any other TI intellectual property right or to any third party intellectual property right. TI disclaims responsibility for, and you
will fully indemnify TI and its representatives against, any claims, damages, costs, losses, and liabilities arising out of your use of theseresources.
TI’s products are provided subject to TI’s Terms of Sale or other applicable terms available either on ti.com or provided in conjunction withsuch TI products. TI’s provision of these resources does not expand or otherwise alter TI’s applicable warranties or warranty disclaimers for
TI products.
TI objects to and rejects any additional or different terms you may have proposed. IMPORTANT NOTICE
Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265
Copyright © 2023, Texas Instruments Incorporated