I am analyzing a board with safety considerations. In one part of the circuit, PB0 and PB1 of MCU have been logical anded using an IC (PB0 && PB1). Does anyone have faced with such configuration? It is weired, because we can make a logical and (&&) inside the MCU and place the output one just one pin not two pins. Thanks.
Safety rated electronics is rather specialised and would require a lot more than relying on a logical AND even with two redundant outputs. For redundant safety you typically need:
- Dual channel safety. If one channel fails to switch off then the other one renders the system safe.
- A monitoring system that prevents reset of the system in the event of one channel failing.
What you have described fails both criteria. (1) The AND gate could fail 'on'. Now all the rest of the protection is lost. (2) If the AND gate was working but one of the safety outputs got stuck on there is no means of detecting this (as far as we know).
Typically for a safety rated electronic system the outputs would need to be strobed periodically and failure of the strobe monitor to detect the strobe at the right time would result in a system shutdown. (Note that for a line normally held high the strobe would be a brief 'low' output on the line.)
Another good method is to output a square-wave from the MCU when safe. This can be transformer coupled to the next stage and followed by a rectifier and capacitor. Failure of the MCU in either ON or OFF would result in a DC signal and no output from the AC coupling stage.
I would probe further and see if you can figure out their strategy.