dsPIC33CH: dual-core with master and slave, no cache and safety hardware out of the box

The dsPIC33CH® from Microchip® is a dual-core part for safety-relevant control and signal tasks. Two DSC cores on one chip, hard-wired as master and slave, coupled via mailbox registers in hardware, no data cache, with safety mechanisms for IEC 60730 Class B and ISO 26262 ASIL-B to C out of the box. A few of these properties we have not found in the ARM® world at this price point, which is why the dsPIC33CH is our first pick in certain niches.

Master and slave

On the dsPIC33CH the role is fixed in silicon: the master is the classic 16-bit DSC core that runs the application, the communication and the boot. The slave is a second DSC core that runs the time-critical control code and is flashed and started from the master. There is no dynamic role negotiation, the split of duties is set by the part.

Both cores have their own DSP unit with MAC instructions, barrel shifter and saturation arithmetic. The slave runs up to 200 MHz and is tailored to control tasks, with its own access to the fast peripherals (high-resolution PWM, ADC trigger, analog comparators) without having to go through the master.

The slave does not start as an independent system but as a control engine managed by the master. The slave code exists as its own binary image but runs on the same chip in a separate program-RAM region. At boot the master loads the slave image from flash into that program-RAM and starts the core. One flash operation, one reset, both cores running.

No cache coherence, because no cache

The master and the slave have no data cache. A write on one core and a read on the other are immediately consistent, without an MPU region marked non-cacheable, without manual clean/invalidate calls, without bugs at the edge of a buffer because someone forgot the cache line boundary.

For a safety-relevant design this is a blessing. Cache bugs are hard to find, only show up under load with the right timing, and can happily ride along for years until they bite in the field. No cache means no cross-core cache bug.

Coupling: mailbox registers in hardware

The dsPIC33CH couples the cores via mailbox registers that both cores address directly. Concretely there are eight master-to-slave registers (MSI) and eight slave-to-master registers (SMI), plus two FIFO channels for longer messages.

The flow is mechanical:

• Core A writes its message into the mailbox register.
• The hardware sets a status bit and optionally raises an interrupt on core B.
• Core B reads the register, acknowledges and processes it.

No RTOS construct needed, no memory area to manage. For small messages (setpoints, status flags, commands) the registers themselves are enough. For longer streams there are the FIFO channels. Both are cleanly described in the datasheet and available as functions in the Microchip peripheral library.

This is not a general shared-memory architecture. You cannot share large data structures across the cores unless you allocate them explicitly on both cores and synchronise via mailbox. For control tasks this is exactly what you want: clear interface, no grey zone.

Safety hardware out of the box

The real reason the dsPIC33CH is often the first choice in safety-relevant projects is the built-in safety hardware. Microchip does not ship this as an optional add-on or a companion chip, but in the base specification of the processor.

What comes with it:

• Redundant clock sources with backup oscillator (BFRC). If the primary oscillator fails, the hardware switches automatically to the backup oscillator, no reset needed.
• Fail-safe clock monitor (FSCM). Detects failure or drift of the primary oscillator and triggers the switch-over.
• Flash ECC with error correction. Single-bit errors are corrected, double-bit errors are detected and reported. The program flash is self-checking.
• RAM self-test. Hardware-assisted March test of the RAM, runnable at boot and periodically during operation, without the core having to loop through in software.
• CRC unit for program and configuration checks.
• Windowed watchdog (WWDT), prevents both too-early and too-late refreshes.
• Deadman timer, when a reset must be enforced deliberately.
• IO read-back paths (IOPU): every driven output pin can be read back to its actual electrical state, so stuck levels are detected.

That covers the requirements of IEC 60730 Class B (household appliances) and IEC 60335 (electrical safety) largely in hardware. Microchip ships a certified Class-B/Y library that orchestrates these mechanisms with documented coverage of the required diagnostics. For ISO 26262 ASIL-B and ASIL-C (automotive) the dsPIC33C is separately documented with a safety manual and FMEDA. At the part level the relevant variants are qualified to AEC-Q100 (grade 1 down to grade 0 depending on the type), so reliability and temperature requirements of automotive customers are met out of the box. The part therefore saves a significant amount of software diagnostics and the associated certification work, because the required mechanisms are present and documented from the start.

Motor control peripherals

The slave core is explicitly designed for high-quality control tasks. What comes with it:

• High-resolution PWM with 250 ps resolution, for resonant converters and soft switching.
• Multiple ADCs with dedicated sample-and-hold stages per channel, for simultaneous measurement of current and voltage.
• Analog comparators with DAC reference, for over-current shutdown without CPU involvement.
• CAN-FD and SENT directly on the master, for vehicle and sensor communication.
• DMA for sensor streams and PWM updates without CPU load.

Microchip ships the motorBench environment and the motor control application framework (MCAF), ready for field-oriented control (FOC) on BLDC and PMSM machines. The heavy control math is largely done, the slave core executes it deterministically in the 20 kHz PWM cycle.

Concrete part: dsPIC33CH512MP508

For reference, the concrete numbers of a mid-range member of the family:

• Master: 100 MHz DSC, 512 KB flash, 48 KB RAM
• Slave: 100 MHz DSC (up to 200 MHz depending on variant), 24 KB program RAM, 4 KB data RAM
• CAN-FD, SENT, multiple UART, SPI, I²C
• Two ADCs with up to 3.5 MSPS each, multiple sample-and-hold stages
• Operating temperature up to 150 °C (H variants)
• Unit price in typical volumes in the single-digit franc (or USD) range

For tasks where safety and cost dominate, this is a hard combination to beat.

Toolchain and boot

Development happens in MPLAB X with the XC-DSC compiler. A solution project contains two sub-projects: one for the master, one for the slave. The build produces a master hex that carries the slave image as an embedded section.

At boot the master programs the slave program-RAM, releases the slave reset, and the slave runs. That is a single flash operation for the whole system, no separate slave flashing needed. Debugging both cores runs in parallel with a single ICD programmer.

Honest pitfalls

• Memory. The slave has only 24 KB of program RAM. A larger control programme does not fit. Anyone who wants FOC plus communication plus diagnostics on the slave has to measure.
• 16-bit limits. DSC is 16-bit with 32-bit extensions for DSP. Data structures and address arithmetic should be adapted to that, otherwise effective register resources shrink.
• Mailbox count. Eight registers per direction are enough for control messages. Anyone wanting many parallel channels needs multiplexing in software.
• Slave image in the master binary. Forgetting to rebuild the slave hex leads to a version mismatch that is discreetly wrong in the field. The build should always translate both cores together.
• No data cache also means: no cache benefit. The code path is always the one from flash. Time-critical code can live in RAM (RAMFUNC) to save wait states. Standard practice for DSCs, but a detail worth knowing.

Where it fits

The dsPIC33CH plays its strengths in a concrete segment:

• Safety-relevant control with a certification obligation. Household appliance under IEC 60730 Class B, automotive supplier under ISO 26262 ASIL-B or ASIL-C. The combination of Class-B/Y library, safety manual, FMEDA and the built-in hardware diagnostics visibly shortens the certification path.
• Motor control with high PWM resolution. BLDC and PMSM control with FOC in the 20 kHz control cycle, resonant converters with soft switching, anything that benefits from 250 ps HR-PWM and dedicated sample-and-hold stages.
• Sensor-close control system with a clear master/slave cut. When the split of duties naturally has one core running the control loop and the other doing communication, the hardware maps directly onto the problem.
• Cost pressure matters. The part sits well below a 32-bit dual-core heavyweight with comparable safety features in typical volumes.

Where it does not fit: pure compute in the three-digit MHz range with FPU, large data buffers, graphics HMI, or several complex communication stacks in parallel. For that a 32-bit architecture with enough RAM is the answer.

Takeaway

The dsPIC33CH is the quieter dual-core. No cache means fewer pitfalls. Fixed roles mean fewer degrees of freedom and fewer bugs. Mailbox registers instead of shared RAM mean less middleware. Safety hardware out of the box means less effort in certification.

What it is not: a compute monster. For heavy compute with FPU and large data buffers there are better fitting parts. Anyone who wants to bring a safety-relevant control loop through cleanly and affordably has, in the dsPIC33CH, a part that handles the hard parts of the task in silicon.

Keywords: dsPIC33CH, Microchip dual-core, master slave DSC, IEC 60730 Class B, IEC 60335, ISO 26262 ASIL-B, ISO 26262 ASIL-C, AEC-Q100 automotive, functional safety embedded, motor control MCAF, motorBench FOC, CAN-FD, high resolution PWM, MPLAB X XC-DSC, embedded consulting Switzerland, swissEmbedded firmware engineering Aargau