0
\$\begingroup\$

I am analyzing a board with safety considerations. In one part of the circuit, PB0 and PB1 of MCU have been logical anded using an IC (PB0 && PB1). Does anyone have faced with such configuration? It is weired, because we can make a logical and (&&) inside the MCU and place the output one just one pin not two pins. Thanks.

\$\endgroup\$
  • \$\begingroup\$ To meaningfully analyze this, you'll have to consider the software as well - not the least of reasons being that it configures the pins. Failing that, you'll have to re-assign that part of the task by asking them for a written description of how the pins are used, and make your analysis explicitly depend on that description. \$\endgroup\$ – Chris Stratton May 5 '18 at 22:51
3
\$\begingroup\$

Not everything can be easily AND'ed within MCU. For example two PWM outputs can be used for carrier frequency and modulation and the easiest way to apply modulation would be with external AND.

| improve this answer | |
\$\endgroup\$
2
\$\begingroup\$

Safety rated electronics is rather specialised and would require a lot more than relying on a logical AND even with two redundant outputs. For redundant safety you typically need:

  1. Dual channel safety. If one channel fails to switch off then the other one renders the system safe.
  2. A monitoring system that prevents reset of the system in the event of one channel failing.

What you have described fails both criteria. (1) The AND gate could fail 'on'. Now all the rest of the protection is lost. (2) If the AND gate was working but one of the safety outputs got stuck on there is no means of detecting this (as far as we know).

Typically for a safety rated electronic system the outputs would need to be strobed periodically and failure of the strobe monitor to detect the strobe at the right time would result in a system shutdown. (Note that for a line normally held high the strobe would be a brief 'low' output on the line.)

Another good method is to output a square-wave from the MCU when safe. This can be transformer coupled to the next stage and followed by a rectifier and capacitor. Failure of the MCU in either ON or OFF would result in a DC signal and no output from the AC coupling stage.

I would probe further and see if you can figure out their strategy.

| improve this answer | |
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.