Two of the most important peripherals on a C2000 device are the PWM and the ADC. The reason why is that the C2000 devices are typically connected to some type of power converter, whether that is an inverter for a motor or whether it is a digital power supply. The typical applications involve some level of power being converted, controlled, observed, etc, so in the area of safety and using a C2000 device and using Concerto, Concerto has some very specific features to add safety and reliability to both the ADC and the PWM. On the ADC specifically, the Concerto, the F28M35x is the very first device in the C2000 family to have two ADC converters. Each of these converters have two sample and holds, but what is most important is what is shown in the red lines on this slide. There are four ADC input pins that are shared by both ADC converters, so ADC1A0, ADC1B0, which are shown in the upper left hand corner here, those two pins go to both ADC1 and ADC2. What happens is that the designer could have both ADC1 and ADC2 converting, sampling and converting both of those signals at the same exact time. By taking a closer look, users will notice that when those two signals or all four of the signals are shared between the two converters, the cross connection, for instance, the ADC1A0 is connected to ADC1A0 and also is connected to ADC2A1. ADC2A1 does not have a pin connected to it, except for ADC1A0. There is a lot of functionality on the F28M35X and this is an area where there is some functionality that is not using a pin. Both converters have DACs available to them and those DACs are another way to verify the converter is functioning correctly. The designer may want to develop a safety strategy that periodically tests the ADC over the full voltage range, the internal DACs can be used to do that. These are 10-bit DACs and they go from rail to rail, from 0 to 3.3 V and they can be tested for the full voltage range of the ADC and confirm that the ADC is not only converting, but it is converting at the expected value. Additional verification that is available is that not only does the C28 have access to both of the converters, the M3 does as well. Not only does the user want to verify that both conversions are the same every time for their control loop, but maybe at a slower rate, they may want to have the M3 reading the ADC results to make sure that they are staying within the expected range. This is a supervisory level software strategy approach where the M3 is taking a supervisory level control or a supervisory level observation of the C28 ADC results. Designer’s may even want the M3 to do some of the calculations that the C28 does and verify that it is doing its calculations correctly, as well. Because, keep in mind, that there is message RAM available and shared RAM available, so every time the C28 updates its PWM, it could actually be updating that shared memory and the M3 could be verifying that the calculations are operating within the expected range, as well. PWM verification often involves the ADC. One great way to verify that the PWMs are running as expected is to connect up a PWM output through an RC filter to the ADC input. Essentially, the designer is creating an external DAC, but the beauty of that is that even though there are internal DACs to verify the ADC is converting correctly by having the PWM actually providing that voltage level, it does a level of system verification on the PWM itself. In some instances the user may want to not only cover the PWM module but cover the part of the system, like the inverter. The designer may want to take the PWM signals from the inverter at the motor phases, bring them into some info captures and to verify that the PWM timing is correct at the inverter stage, so then the user is getting in some verification coverage of more than just the processor but of the system itself. Finally, if there is an over-current situation, over-temperature, over-voltage, whatever the fault condition that is defined, if it does occur, there is the feature that has been available on all C2000 devices since they were first introduced in 1997, is the ability to be able to trip the PWMs. On the Concerto and the 28x devices if a fault condition comes to the PWM trips zone, it will be able to put the PWM output on at high impedance in 20 nanoseconds. So obviously, this is an asynchronous path that does not require and interrupt to cause the PWM output to be disabled. It is available as part of the reliability and safety of the part. The designer also has the option to be able to disable the PWMs pull high or pull low. It adds five nanoseconds, and if the user wanted to use the onboard comparators to be able to trip the PWMs, it would add another 30 nanoseconds.