Industrial Functional Safety for
C2000™ Real-Time Microcontrollers
Streamline and speed-up IEC 61508 (SIL) and ISO13849 (PL) certification process with our Functional Safety-Compliantproducts, documentation, software and support from our knowledgeable experts. Our C2000™ real-time MCUs are
independently assessed and certified by TUV SUD to meet a systematic capability up to SIL 3 and help you create industrial
applications requiring functional safety. C2000 real-time MCUs also address Automotive Functional Safety.
Highlights of the C2000 functional safety offering are• Device architecture for functional safety• Documentation to support to ease customer’s safety assessment at system level• Software library to implement the safety mechanisms

Safety mechanisms play a key role in the overall safety of a system by detecting potentially dangerous failures andconsequently helping place the system in a safe state. With over 300 safety mechanisms defined and independently
assessed by TUV SUD for its effectiveness, C2000 MCUs provide the required diagnostic coverage to meet a random
hardware capability of SIL 2 at a component level. Functional safety manuals provide detailed information on the safetymechanisms, techniques for achieving non-interference between elements and avoiding dependent failures, to aidcustomers in the development of compliant systems up to SIL 3. The tunable FMEDA provides increased flexibility tocustomize and calculate HW metrics with features such as package FIT estimation, product function tailoring, safetymechanism tailoring and custom diagnostics allowing customers to tune the FMEDA to their own application specific needs.
Learn More about C2000 real-time MCU Safety Mechanisms

Key safety features

F2838xF28P65x

F2837x
F2807xF28P55xF28003x

SIL 3 Compliant Development Process✓✓✓✓Random Hardware Capability

SIL 2

SIL 2

SIL 2

Systematic Capability

SIL 3

SIL 3

SIL 3

Single Point Fault Coverage of CPU (SPFM)

Reciprocalcomparison

Reciprocal comparison Reciprocal comparison(CPU1 + CLA)

F28002xF280015x

✓

✓

✓

SIL 2

SIL 2

QM

SIL 2

SIL 3

SIL 3

SIL 3

SIL 3

Reciprocalcomparison

Reciprocalcomparison

N/A

Lockstep C28xDocSoftwareHardware

Lockstep C28x (CPU2)
Memory parity✓✓✓✓XX✓

Memory ECC✓

Flash only✓✓✓✓✓Memory BIST (MPOST)✓✓X✓✓✓✓

Dual Core Security Module (DCSM) to achieve
non-interference between software elements✓✓✓✓✓✓✓

Windowed watch-dog timer with independent clock✓

✓✓✓

✓

✓

✓

Hardware CRC acceleration✓✓✓✓✓✓

✓✓
✓
X

✓
✓X

✓
✓
X

✓
N/AX
✓
✓
✓

✓
✓
X

✓
N/A

✓
✓
✓
✓
✓

Coming soon

✓
N/A

✓
N/AX
✓
X
N/A
✓

STL (Software Test Library): Permanent fault coverage of
60% for CLA✓✓✓

Coming soon✓

N/AN/A

Functional Safety Quality (FSQ) Flash APIsX✓X✓✓

N/A✓

Safety Manual: detailed product overview, capabilities SFFS022
and constraints, TI development process, safetyelements, and safety diagnostics.

SFFS700SPRUI78

Beta

SFFS277SPRUIT5

SFFS222SSZQQM2SFFS901

SWAQ009

Comingsoon

SFFS610

N/A

SFFS748

Hardware BIST (HWBIST): Permanent fault coverageof 90%+ for C28x CPU
Redundant and independent ADC / PWM Modules
Automatic comparison of ADC conversion results in HW
Redundant Configurable Logic Block (CLB) option
STL (Software Test Library): Permanent fault coverageof 60%+ for C28x CPU

Device Certification

Safety collateralDevelopment Process Certificate
Hardware | Software

TUV-SUD certificate for QRAS-AP00210. Functional safety development process for IEC 61508-2 and ISO 26262-5 Compliant Components

C2000 Safety package*

By request and NDA required. Packages include below elements:*Not publicly available collateral.
Contact your local TI representative to request.

C2000 Safety Package for Automotive and Industrial MCUs
• Technical Report on Random HW Capability• Technical Report on Systematic Capability• FMEDA: A failure mode, effects and diagnostic analysis (FMEDA) is used in the development stage toprovide a detailed analysis of different failure modes, the associated effects of failure modes,
diagnostics and the impact of any implemented diagnostics/ safety mechanisms in terms of diagnostic
coverage. 5-part FMEDA training video series.
• Device Concept Assessment• SAR (Safety Analysis Report): Contains results of safety analysis according to the targeted functionalsafety standards.
Device-specific self-test library package• C28x_STL (C28x Self-Test Library): Library for software test of C28x CPU• CLA_STL (CLA Self-Test Library): Library for software test of CLA

Software diagnostic library

A library of modules and examples demonstrating safety features and mechanisms. CPU, memory, clocks/ watchdogs, HWBIST, etc.
F2837x/07x supported through this library. All other F28x series supported by libraries released in C2000Ware.

Functional safety flash APIs

Library is available in C2000Ware. Contact local TI representative for further compliance support package offerings.

Compiler qualification kit

Compare compiler coverage for customer use cases against coverage of TI compiler release validations

Safety certified RTOS (SafeRTOS)

Pre-certified safety Real Time Operating System (RTOS)

MathWorks simulation & code generation

IEC certification kit helps you qualify MathWorks code generation and verification tools to streamline certification of your embeddedsystems

Industrial Safety Architectures common in machinery applications typically require a dual channel safety approach (hardware
fault tolerance = 1). C2000 devices offer unique capability and scalability to implement two different architectures for SIL-2(or cat 3 PL d) and SIL-3 (or cat 3 or cat 4 PL e) systems; a C2000 MCU for each of two safety channels (Figure 1) or a C2000
MCU for one safety channel and a C2000 MCU for the second safety channel and the controller combined in single device(Figure 2).
However, for several industrial applications such as mobile robots, single channel architectures can be used to fulfill the safety
requirements (hardware fault tolerance = 0). A C2000 device together with external test equipment result in an optimalarchitecture to achieve the required SIL-2 (or cat 2 PL d); a C2000 MCU can be used as the motor controller as well as fordiagnostics and as test equipment an external power supply with diagnostics is used to diagnose and ensure the proper
functionality of the C2000 MCU (Figure 3). Read more about simplifying robotics motor drive safety assessments.
Further, compared to general purpose MCUs being used for safety functions C2000 devices offer superior computeperformance and device features for implementing complex safe motion functions beyond just Safe Torque Off (STO) that
requires real-time monitoring of parameters such as SLS (Safe Limiting Speed), Safe Brake Control (SBC), Safe Direction(SDI), Safe Speed Monitor (SSM) and fast actuation of the safe state.
Further details – including a TUV report on these concepts and architectures - are available under NDA in the C2000 Safety
package.

Figure 1. Architecture 1 with dual safety MCUs (HFT=1, SIL 2 or SIL 3 ).

Figure 2. Architecture 2 with single safety MCU and safety integratedfunctions into the Drive MCU (HFT=1, SIL 2 or SIL 3 ).

Coms
MCU

Control
MCU
Test Equipment
MCU

Power
SupplyTest Equipment
Diagnostics
Power rails

Test Equipment
Diagnostics
MCU

Power supply with diagnostics

Figure 3. Architecture 3 with single safety MCU and PMIC (HFT=0, SIL 2)© 2023 Texas Instruments IncorporatedC2000 is a trademark of Texas Instruments.

SWAB013C

IMPORTANT NOTICE AND DISCLAIMERTI PROVIDES TECHNICAL AND RELIABILITY DATA (INCLUDING DATA SHEETS), DESIGN RESOURCES (INCLUDING REFERENCEDESIGNS), APPLICATION OR OTHER DESIGN ADVICE, WEB TOOLS, SAFETY INFORMATION, AND OTHER RESOURCES “AS IS”
AND WITH ALL FAULTS, AND DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING WITHOUT LIMITATION ANYIMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT OF THIRDPARTY INTELLECTUAL PROPERTY RIGHTS.
These resources are intended for skilled developers designing with TI products. You are solely responsible for (1) selecting the appropriate
TI products for your application, (2) designing, validating and testing your application, and (3) ensuring your application meets applicablestandards, and any other safety, security, regulatory or other requirements.
These resources are subject to change without notice. TI grants you permission to use these resources only for development of anapplication that uses the TI products described in the resource. Other reproduction and display of these resources is prohibited. No license
is granted to any other TI intellectual property right or to any third party intellectual property right. TI disclaims responsibility for, and you
will fully indemnify TI and its representatives against, any claims, damages, costs, losses, and liabilities arising out of your use of theseresources.
TI’s products are provided subject to TI’s Terms of Sale or other applicable terms available either on ti.com or provided in conjunction withsuch TI products. TI’s provision of these resources does not expand or otherwise alter TI’s applicable warranties or warranty disclaimers for
TI products.
TI objects to and rejects any additional or different terms you may have proposed. IMPORTANT NOTICE
Mailing Address: Texas Instruments, Post Office Box 655303, Dallas, Texas 75265
Copyright © 2024, Texas Instruments Incorporated