Multi Microcontroller Functional Safety design Consideration - Page 1
Forum section: electronics / general

author: ramesh.rajagopal
author_rank: Newbie
timestamp: February 01, 2024, 06:38:38 am
content: Hi ,While designing the System with the multiple Microcontroller. if one MCU is directed to check the heath of the systems.Other than monitoring the following things, what else we can monitor to ensure stable design1) Voltage monitoring2) power supply Current monitoring3) Communication Monitoring.4) Vital signal monitoring5) few points temperature monitoring.6) Clock monitoring is possible??7) being an watch dog monitor to another system.Is there any other things that we can monitor...'pls advice.ThanksRamesh.

author: Andy Chee
author_rank: Super Contributor
timestamp: February 01, 2024, 07:20:05 am
content: A similar principle to the watchdog, you can monitor a vital status flag being set/reset in a subroutine, or indeed a vital ASCII or BCD code.If that flag or code isn't valid, then you trigger the watchdog.Of course such a technique may be overkill for simple systems.

author: SteveyG
author_rank: Unknown
timestamp: February 03, 2024, 12:17:49 am
content: What does your risk register and failure mode analysis highlight as critical functionality or risks that need addressing? You could monitor all kinds of things, but you need to establish what and why.

author: andre.lubbock
author_rank: Contributor
timestamp: February 03, 2024, 12:33:07 am
content: 6) Clock monitoring is possible??If you mean monitoring the clock is running on other MCUs?The other MCUs would need to output their clock signal on a GPIO pin. The actual signal would be derived from the main MCU clock so it runs at a much slower speed e.g. 1Hz. The MCU that does that health monitoring could read these GPIO pins.In many MCU, if the main xtal fails, the clock will fallback to internal RC

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 03, 2024, 08:38:02 am
content: External "Clock monitoring", when at all possible, doesn't make much sense, that's what watchdogs are for (among other things).Otherwise, more generally speaking, I'm not sure there's really a benefit of designing a system with multiple processors, with one dedicated to "control" what the rest does. It's usually more effective to have several do the same job (redundancy scheme). That's just a very general consideration, the whole topic could be detailed in several books, and still not be covered.

author: JoeyG
author_rank: Regular Contributor
timestamp: February 03, 2024, 08:45:44 am
content: https://mu.microchip.com/introduction-to-functional-safety

author: ramesh.rajagopal
author_rank: Newbie
timestamp: February 23, 2024, 04:43:46 am
content: Thanks for all your suggestions.On the topic of Redundancy, Yes, we tried do add on sensing and actuation portions to avoid single point of failure.Thanks again.Ramesh.

author: Njk
author_rank: Frequent Contributor
timestamp: February 24, 2024, 08:33:22 pm
content: It depends on the requirements. I once designed a system comprising 49 MCUs of three different types. It was working fine with no centralized monitoring functionality implemented. I have doubt on its usefulness unless it's required by the customer. Detecting a failure is one thing but what to do next is the other thing. That's why high availability assumes high redundancy, otherwise self-healing is not possible.