ST STM32F2 Series User Manual page 88

Cat. Ref. § Summary
Enforcing category B requirements by adopting solutions based on "well
tried components" for safety critical application and "well tried" safety
principles.
1 6.2.4
A microprocessor is not classified as a "well tried" component.
No need of DC and CCF (usually single channel), MTTFd is high.
Highest achievable is PL = c.
With respect to category 1, it is expected to include in the architecture a
test equipment performing checks on the safety function and reporting
2 6.2.5
its loss. Overall DC is low, CCF must be evaluated, MTTFd can range
from low to high allowing up to PL = d.
With respect to category 1, it is expected to have fault detection
mechanisms and any single fault occurrence does not lead the loss of
3 6.2.6
the safety function.Overall DC is low, CCF must be evaluated for the
channels, MTTFd can range from low to high allowing up to PL = d
With respect to category 1, it is expected to have fault detection
mechanisms and any single fault occurrence does not lead the loss of
4 6.2.7
the safety function. Overall DC is high, CCF must be evaluated for the
channels, MTTFd is high allowing PL = e
i m
I
L
O
UM1845 - Rev 4
Figure 6. Block diagram for ISO 13849 Cat. B and Cat. 1
i m
I
interconnecting means
input device, e.g. sensor
logic
output device, e.g. main contactor
Designated architecture of Logic
Single channel architecture, one MCU in
1oo1
Refer to Section 3
Compliant item's MTTFd = high
Single channel architecture, one MCU in
1oo1d
Refer to Section 3
Compliant item's MTTFd = high
TE is in charge of end user, PL = d
Double channel architecture, two
identical MCUs in 1oo2
Refer to Section 3
Continuous testing or monitoring
Compliant item's MTTFd = high
Double channel architecture, two
identical MCUs in 1oo2
Refer to Section 3
Continuous testing or monitoring
Compliant item's MTTFd = high
PLe achievable
i m
L O
UM1845
ISO 13849-1 / ISO 13849-2
Block
diagram
Figure 6.
Figure 7.
Figure 8.
Figure 8.
page 88/108