View AN4266_8986219.PDF datasheet online --- IC-ON-LINE

Datasheet File OCR Text:

september 2013 doc id 024283 rev 2 1/76 AN4266 application note safety application guide for spc56xl70xx family introduction this document is the safety application guide for the spc56xl70xx. it provides the conditions of use for the spc56xl70xx in asil d applications. www.st.com
contents AN4266 2/82 doc id 024283 rev 2 contents 1 preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2 general information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.1 mission profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 safe state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.3 failure indication time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.4 error handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 2.5 sphere of replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11 3 functional safety requirements for application software . . . . . . . . . . 12 3.1 application software requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.1.1 mandatory software requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.1.2 recommended software requirements . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.1.3 implementation details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.2 system status and configuration module (sscm) . . . . . . . . . . . . . . . . . 13 3.2.1 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.2.2 checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.3 self-test control unit (stcu) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.3.1 configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.3.2 checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.4 reset generation module (mc_rgm) . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 3.5 clock configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.6 sram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.7 flash memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3.8 interrupt controller (intc) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 3.9 semaphore unit (sema4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.10 enhanced direct memory access (edma) requests . . . . . . . . . . . . . . . . 17 3.11 periodic interrupt timer (pit) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.12 communication peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.13 i/o peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.13.1 read digital inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.13.2 read pwm input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
AN4266 contents doc id 024283 rev 2 3/82 3.13.3 read encoder inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3.13.4 write digital outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 3.13.5 write pwm outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 3.13.6 other requirements for i/o peripherals . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.14 cross triggering unit (ctu) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.14.1 synchronize sequential read input . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3.15 adc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.15.1 read analog inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.15.2 other requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 3.16 temperature sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 3.17 software watchdog timer (swt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.18 redundancy control checking unit (rccu) . . . . . . . . . . . . . . . . . . . . . . 48 3.19 cyclic redundancy checker unit (crc) . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.20 clock monitor unit (cmu) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 3.21 frequency-modulated phase-locked loop (fmpll) . . . . . . . . . . . . . . . 50 3.22 internal rc oscillator (ircosc) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 3.23 power management unit (pmu) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 3.24 memory protection unit (mpu) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.25 register protection module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 3.26 error correction status module (ecsm) . . . . . . . . . . . . . . . . . . . . . . . . . 55 3.27 fault collection and control unit (fccu) . . . . . . . . . . . . . . . . . . . . . . . . 55 4 functions of external devices for asil d applications . . . . . . . . . . . . 57 4.1 external watchdog function (exwd) . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 4.2 power supply and monitor function (psm) . . . . . . . . . . . . . . . . . . . . . . . 57 4.3 error out monitor function (errm) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 4.3.1 both fccu pins connected to external device . . . . . . . . . . . . . . . . . . . 58 4.3.2 single fccu pin connected to external device . . . . . . . . . . . . . . . . . . . 59 4.4 pwm output monitored by external asic (pwma) . . . . . . . . . . . . . . . . . 59 5 scenarios for automotive applications: motor control . . . . . . . . . . . . 61 5.1 application example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 5.1.1 functional safety related inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 5.1.2 functional safety related outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 5.2 application example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
contents AN4266 4/82 doc id 024283 rev 2 5.2.1 functional safety related inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 5.2.2 functional safety related outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 5.3 application example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 5.3.1 functional safety related inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 5.3.2 functional safety related outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 6 ecc logic test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 6.1 overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 6.2 data pattern - walking 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 6.3 utest mode ecc logic check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 6.4 fault coverage and execution time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 7 i/o pin/ball configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 8 further information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 8.1 conventions and terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 8.2 acronyms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 8.3 document references . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 9 revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
AN4266 list of tables doc id 024283 rev 2 5/82 list of tables table 1. temperature profile for packaged device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 table 2. temperature profile for bare die device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 table 3. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 table 4. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 table 5. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 table 6. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 table 7. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 table 8. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 table 9. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 table 10. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 table 11. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 table 12. software bist and/or test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 table 13. pmu monitored supplies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 table 14. functional safety inputs for application example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 table 15. functional safety outputs for application example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 table 16. functional safety inputs for application example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 table 17. functional safety outputs for application example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 table 18. functional safety inputs for application example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 table 19. functional safety outputs for application example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 table 20. data pattern used by the ecc logic test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 0 table 21. list of conventions and terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 table 22. acronyms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
list of figures AN4266 6/82 doc id 024283 rev 2 list of figures figure 1. double read digital input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 figure 2. double read pwm input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 figure 3. double encoder read input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 figure 4. write digital output with read back . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 figure 5. double write digital output . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 figure 6. double write pwm output configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 figure 7. single write pwm output with read back configuration. . . . . . . . . . . . . . . . . . . . . . . . . . 32 figure 8. single read analog input configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 figure 9. software bists to test the multiplexing circuitry (adc_swtest_test1) . . . . . . . . . . . . 41 figure 10. implementation of adc_sw_test1 through the adc presample feature . . . . . . . . . . . . 42 figure 11. software bists to test the multiplexing circuitry (adc_swtest_test2) . . . . . . . . . . . . 42 figure 12. implementation of adc_sw_test2 through the adc presample feature . . . . . . . . . . . . 43 figure 13. series of acquired analog values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 figure 14. double read analog inputs configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 figure 15. logic scheme of the lvd_dig and hvd_dig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 figure 16. logic scheme of the lvd_flash, lvd_gpio and lvd_vreg . . . . . . . . . . . . . . . . . . . . 53 figure 17. example of qfp144 pin/pad adjacency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 figure 18. bga balls non-adjacent, die pads adjacent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 figure 19. bga balls adjacent, die pads non-adjacent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
AN4266 preface doc id 024283 rev 2 7/76 1 preface this document discusses requirements and assumptions for the use of the spc56xl70xx microcontroller unit (mcu) in asil d applications. it prescribes several measures as mandatory (or mandatory under certain preconditions, for example, if a certain module is used) whereby the measure described was assumed to be in place when analyzing the safety of the mcu. this document considers: the system assembly that contains the spc56xl70xx mcu the ?safety element out of context? section in the ?road vehicles - functional safety - part 10: guideline [iso/dis 26262-10]? standard certain assumptions about the assembly's functional safety needs based on that standard and determines whether a measure is mandatory or not based on these factors. what this means for designers using the spc56xl70xx mcu is that if they don?t fulfill a specific safety application guide (sag) prescription they either have to show to their iso 26262 assessor that the alternative solution is similarly efficient concerning the safety requirement in question (for example, provides the same coverage, avoids common cause failure (ccf) as effectively, and so on), or they have to specify the increased failure rate/reduced safe failure fraction (sff) they estimate to incur due to the deviation. otherwise, the assessor will not recognize the mcu certificate that the customer received with the mcu. this document also contains guidelines on how to configure and operate the spc56xl70xx for asil d applications. these guidelines are preceded by one of the following bold text statements: implementation hint recommended example these guidelines are considered to be useful approaches for the specific topics under discussion, but are not mandatory. the user will need to use discretion in deciding whether these measures are appropriate for their applications. this document is valid only under the assumption that the mcu is used in automotive applications for use cases requiring a fail-silent or a fail-indicate mcu. mandatory: this document is only valid if the environmental conditions given in the spc56xl70xx data sheet are maintained. the cores in the spc56xl70xx can be configured to operate in either lock-step mode (lsm) or decoupled parallel mode (dpm). in lsm, the outputs of a set of replicated modules, identified as the sphere of replication (sor, see section 2.5, sphere of replication for details), are compared to ensure that the operations or transactions that are executed are identical on a clock per clock basis. mandatory: this document is based on the assumption that the spc56xl70xx is configured to operate in lsm.
preface AN4266 8/76 doc id 024283 rev 2 as for all devices, device errata must be taken into account during system design and implementation. for a safety-related device such as the spc56xl70xx, this also concerns safety-related activities such as system safety concept development. mandatory: the device shall be handled according to jedec standards j-std-020 and j- std-033. mandatory: to cover the iso-07-6.5.4 and iso-07-6.4.2.1, customers shall report all field failures of the devices to silicon supplier. mandatory: this document is only valid if the conditions given in the addendum are met (see section 8.3: document references ).
AN4266 general information doc id 024283 rev 2 9/76 2 general information 2.1 mission profile the assumed mission profile is: lifetime: 20 years total operating hours: 12000 hours trip time: 10 hours (trip time is defined as the maximum time of operation of the mcu without power-on reset) fault tolerant time interval (ftti, also named process safety time (pst)): 10 ms (maximum time between the first faulty output and a failure indication or reset) temperature profiles for packaged devices ( ta ble 1 ) and bare die ( ta ble 2 ) are shown below. note: the temperature profile is an assumption of the spc56xl70xx safety analysis and shall be fulfilled during integration into an asil d compliant system. 2.2 safe state by definition, the safe states of the spc56xl70xx are as follows: completely unpowered reset ? all pins except possibly the error output pins (fccu_f[0:1]) are tristated. operating correctly ? outputs depend on application. explicitly indicating an internal error ? error output pins fccu_f[0:1] are in a state indicating an error, and the state of other i/o pins will not be reliable. table 1. temperature profile for packaged device temperature range (c) operation time (h) 125?135 120 110?120 960 90?100 7680 30?40 3240 table 2. temperature profile for bare die device temperature range (c) operation time (h) 120?125 120 100?110 960 80?90 7680 20?30 3240
general information AN4266 10/76 doc id 024283 rev 2 defining these states as safe for the mcu means that the overall system must react safely to the spc56xl70xx being in, and entering, any of these states. for the ?completely unpowered? and ?reset? states the addition of a pullup or pulldown resistor on relevant signals may be necessary. if an ?explicit indication of internal error? occurs on fccu_f[0:1], the application must not depend on the mcu for continued operation. this also means that the system must be able to remain in a safe state without any additional actions from the mcu. mandatory: the system must transition to a safe state when there is an indication of an error. depending on the configuration the system may disable, or reset, the spc56xl70xx as a reaction to the error signal. if a system continuously switches between a standard operating state and the reset state, without any device shutdown, the system is not considered to be in a safe state. mandatory : the application must identify and signal such switching as a failure condition. 2.3 failure indication time the spc56xl70xx failure indication time must be taken into consideration when determining application safety strategies, because it must be less than the ftti. failure indication time has three components, two of which are influenced by configuration settings: recognition time + internal processing time + indication time . each component of failure indication time is described as follows: recognition time is the maximum of the recognition time of all involved safety mechanisms. the three mechanisms with the longest time are: ?adc (a) recognition time is the most demanding hw test in terms of timing. the self-test requires the adc conversion to complete a full test. a single full test takes at least 70 s (b) . ? recognition time related to the fmpll loss of clock: it depends on how the fmpll is configured, but is approximately 20 s. ? diagnostic cycle time of software self-tests. this time depends closely on the software implementation. internal processing time lasts maximum 10 rc clock cycles (rc is the internal safe clock with nominal frequency of 16 mhz). indication time , the time to notify an observer about the failure, depends on indication protocol configured in the fault collection and control unit (fccu): ? dual rail protocol and time switching protocol: fccu configured as ?fast switching mode?: indication delay is maximum 64 s. as soon as fccu receives a fault signal, fccu reports the failure to the outside world via output pin (if properly configured). 0 = fccu configured as ?slow switching mode ?: an indication delay could occur. the maximum delay is equal to period of the error out signal. this parameter shall be configured equal to its minimum which is 128 s. a. adc recognition time shall be used only if adc is used by the safety function. b. this value takes into account the steps needed to run the three adc hardware self-tests.
AN4266 general information doc id 024283 rev 2 11/76 0 = bi-stable protocol: indication delay is maximum 64 s. as soon as the fccu receives a fault signal, it reports the failure to the outside world via output pin (fccu_f[0:1], if properly configured). if the configured reaction to a fault is an interrupt, an additional delay (interrupt latency) can occur until the interrupt handler is able to start executing (for example, higher priority irqs, xbar contention, register saving, and so on). general failure rate, or the failure modes, effects and diagnostic analysis (fmeda) report, is available upon request when covered by an nda (contact your representative). 2.4 error handling error handling can be split into two categories: handling of errors during runtime handling of errors during boot time (for example, logic built-in self-test (lbist), memory built-in self-test (mbist)) mandatory: runtime errors shall be handled in a time shorter than the ftti. mandatory: boot time failures shall be handled before the safety function starts. note: implementation hint: to satisfy this requirement regarding the lbist/mibst, self-test control unit (stcu) status condition shall be checked by application software before safety application starts (see ?integrity sw operations? section of the ?self-test control unit (stcu)? chapter in the spc56xl70xxreference manual for details). 2.5 sphere of replication sphere of replication (sor) is used for duplicating of critical components on the spc56xl70xx. the following modules are included in the sor: e200z4 cores enhanced direct memory access (edma) interrupt controller (intc) crossbar switch (xbar) memory protection unit (mpu) flash memory controller static ram controller (sramc) system timer module (stm) software watchdog timer (wdt) peripheral bridge (pbridge)
functional safety requirements for application software AN4266 12/76 doc id 024283 rev 2 3 functional safety requirements for application software this section gives an overview of necessary, or recommended, measures when using the individual modules of the spc56xl70xx. if a module is implemented without following the text of this section, the safety certificate for the module, or the entire mcu, may not be validated. it is possible to ignore aspects of the text if equivalent measures that are taken can be shown to manage the same failures. modules not explicitly covered by this document do not require any software measures. the modules covered by the sor reach very high diagnostic coverage (dc) without dedicated measures at application or system levels. 3.1 application software requirements application software shall be developed according to asil d requirements. 3.1.1 mandatory software requirements the following sections contain mandatory design constraints for using the spc56xl70xx devices in an asil d system: section 3.2, system status and configuration module (sscm) section 3.3, self-test control unit (stcu) section 3.4, reset generation module (mc_rgm) section 3.5, clock configuration section 3.7, flash memory section 3.8, interrupt controller (intc) section 3.10, enhanced direct memory access (edma) requests section 3.11, periodic interrupt timer (pit) section 3.13, i/o peripherals section 3.14, cross triggering unit (ctu) section 3.15, adc section 3.16, temperature sensors section 3.17, software watchdog timer (swt) section 3.19, cyclic redundancy checker unit (crc) section 3.20, clock monitor unit (cmu) section 3.21, frequency-modulated phase-locked loop (fmpll) section 3.22, internal rc oscillator (ircosc) section 3.23, power management unit (pmu) section 3.25, register protection module section 3.27, fault collection and control unit (fccu)
AN4266 functional safety requirements for application software doc id 024283 rev 2 13/76 3.1.2 recommended software requirements the following sections contain recommended design constraints for using the spc56xl70xx devices in an asil d system: section 3.6, sram section 3.12, communication peripherals section 3.13, i/o peripherals section 3.16, temperature sensors section 3.18, redundancy control checking unit (rccu) section 3.19, cyclic redundancy checker unit (crc) section 3.24, memory protection unit (mpu) section 3.25, register protection module section 3.26, error correction status module (ecsm) 3.1.3 implementation details the following sections contain implementation details for using the spc56xl70xx devices in an asil d system: section 3.2, system status and configuration module (sscm) section 3.5, clock configuration section 3.7, flash memory section 3.8, interrupt controller (intc) section 3.10, enhanced direct memory access (edma) requests section 3.13, i/o peripherals section 3.14, cross triggering unit (ctu) section 3.16, temperature sensors section 3.17, software watchdog timer (swt) section 3.19, cyclic redundancy checker unit (crc) section 3.20, clock monitor unit (cmu) section 3.21, frequency-modulated phase-locked loop (fmpll) section 3.23, power management unit (pmu) section 3.25, register protection module section 3.27, fault collection and control unit (fccu) note: a section may contain mandatory constraints, recommended constraints, implementation hints or any combination of the three. 3.2 system status and configuration module (sscm) 3.2.1 configuration mandatory: before executing the safety functions, the sscm shall be configured to inhibit unintentional execution of the bam code. note: rationale: since bam code is not intended to be executed by asil d applications, any execution of the bam, or part of it, must be inhibited.
functional safety requirements for application software AN4266 14/76 doc id 024283 rev 2 note: implementation hint: this requirement is satisfied by writing sscm_error[pae] = 1. each access to the bam memory area produces a prefetch or data abort exception. 3.2.2 checking mandatory: after boot, but before executing any safety function, the application software needs to read sscm_status[lsm] to verify that the device runs in the selected mode of operation: decoupled parallel mode (dpm) ? sscm_status[lsm] = 0 lock step mode (lsm) ? sscm_status[lsm] = 1 note: rationale: to check if the mcu started in lsm 3.3 self-test control unit (stcu) 3.3.1 configuration the stcu does not require any configuration written by application software. the default stcu configuration is to execute lbist/mbist and to react to detected faults by triggering a non-critical fault (ncf) that signals the fccu (see ?self-test control unit (stcu)? chapter in the spc56xl70xx reference manual for details). mandatory: lbists and mbists shall be configured to be executed once per trip time (trip time defined in section 2.1, mission profile ). 3.3.2 checking mandatory: once after boot, before the safety application starts, application software shall carry out some stcu checking steps for ensuring stcu reliability. note: implementation hint: see ?integrity sw operations? section of the ?self-test control unit (stcu)? chapter in the spc56xl70xxreference manual for details. note: rationale: stcu manages the execution, and checks the result, of the lbists and mbists. the stcu?s correct behavior must be verified by checking the expected results with software. the integrity sw should confirm that all mbists and lbists finished successfully with no additional errors flagged. this software confirmation prevents a fault within the stcu itself from incorrectly indicating that the self-test passed. this is an additional safety layer since the stcu propagates the lbist/mbist and internal faults using the ncf signals of the fccu. so, reading stcu_lbs, stcu_lbe, stcu_mbsl, stcu_mbsh, stcu_mbel, stcu_mbeh and stcu_err registers helps increase the stcu auto-test coverage. 3.4 reset generation module (mc_rgm) a redundant fault notification path is achieved through the use of the mc_rgm and the fccu. mc_rgm configuration is application dependent. mandatory: however, to have the redundant notification path, both mc_rgm and fccu shall be configured to react to critical application faults.
AN4266 functional safety requirements for application software doc id 024283 rev 2 15/76 note: rationale: to have two notification paths in case of an error 3.5 clock configuration the system starts by using the internal rc oscillator clock (ircosc) as its source (see ?oscillators? chapter in the spc56xl70xx reference manual and section 3.22, internal rc oscillator (ircosc) below for details on ircosc configuration). mandatory: before safety functions are executed, the fmplls must be configured to use the external oscillator (xosc) as their source clock. note: rationale: since the ircosc is used by the cmus as reference to monitor the output of the two plls, it can not be used as input of these plls. note: implementation hint: mc_cgm_ac3_sc[selctl] and mc_cgm_ac4_sc[selctl] must be set to 1 to select the xosc. mandatory: all safety relevant modules shall be clocked with an fmpll generated clock signal. note: rationale: to reduce the impact of glitches stemming from the external quartz crystal and its hardware connection to the mcu note: implementation hint: this requirement is fulfilled by appropriately programming the clock generation module (mc_cgm) clock divider configuration and clock select control registers and mode entry module (mc_me) mc_me__mc registers (see ?clock generation module (mc_cgm)? and ?mode entry module (mc_me)? chapters in the spc56xl70xx reference manual for details). 3.6 sram the system sram is protected against hardware dormant faults by hardware bists (see ?mbist partitioning? section in the ?self-test control unit (stcu)? of the spc56xl70xx reference manual). this test runs at boot, but some software actions are requested (see section 3.3, self-test control unit (stcu) ). moreover, the system sram is also protected by a single error correction/dual error detection (sec/ded) ecc scheme. the sram sec/ded concerns data and addresses and thus provides diagnostic coverage to logic addresses. 3.7 flash memory non-volatile memory (nvm) flash memory is protected with an sec/ded ecc scheme. caution: the single-bit correction reporting functionality is not available as described for flash memory ecc (see errata e3320). in case single-bit corrections need to be tracked, the workaround in the errata shall be used. be aware that the workaround has a higher probability than the original mechanism to miss corrections if several occur within a short time.
functional safety requirements for application software AN4266 16/76 doc id 024283 rev 2 to support the detection of dormant faults in the entire memory array and addressing logic, and to check the integrity of the logic used for flash memory programming, the following bists must be enabled by software: mandatory: array integrity self check ? this bist is based on functionality built into the flash memory control logic. it calculates a misr signature over the array content and thus validates the content of the array as well as the decoder logic. the calculated misr value is dependent on the array content and must be validated by software. frequency: this check must be performed at boot time. note: rationale: to check the integrity of the flash memory array content note: implementation hint: this bist must be started by application software; its result must be validated by reading the corresponding registers in the flash memory controller after it has been finished (see ?array integrity self check? section in the ?flash memory? chapter of the spc56xl70xx reference manual for detailed information about this bist). mandatory: write operation ? when writing flash memory, the corresponding sw driver must validate the correctness of the programming of flash memory by checking the value of c90fl_mcr[peg]. furthermore, the data that was written must be read back, then verified by sw that it compares with the intended data value. frequency: after every write operation or after a series of write operations note: rationale: to verify that the written data is coherent with the expected data mandatory: flash memory ecc logic test ? this bist tests the (digital) logic within the flash memory that is responsible for detecting and correcting faults (ecc logic) in the read data. note: rationale: the intention of this test is to assure that correct data is not accidently modified, and single-bit errors are correctly updated. reading a set of data words from flash memory and comparing it with expected values is a software initiated function that is controlled by the application. frequency: once per ftti note: implementation hint: section 6, ecc logic test explains how to perform flash memory data compares with sw. 3.8 interrupt controller (intc) no specific hardware protection is provided against spurious or missing interrupt requests caused by electromagnetic interface (emi) on the interrupt lines, or bit flips in the interrupt registers of the peripherals (c) . mandatory: applications that are not resilient against such errors must include detection or protection measures. note: rationale: to manage spurious or missing interrupt requests note: implementation hint: a possible way to detect spurious interrupts is to check corresponding interrupt status in the interrupt status register of the related peripheral before executing the interrupt service routine (isr) service code. c. intc is a replicated module. no software acti on is needed to detect faults inside this module.
AN4266 functional safety requirements for application software doc id 024283 rev 2 17/76 3.9 semaphore unit (sema4) semaphore modules are only used in dpm. failures of the sema4 module may cause unwanted interrupts in lsm. each sema4 unit is connected to both replicated intc modules. this means that even in lsm when sema4 units are not used, a corrupted sema4 could trigger continuous interrupts to both intcs. to avoid this possible failure the intc shall have the sema4 interrupt masked (for example, sema4 units have the lowest priority in the intcs). mandatory : application software shall keep these interrupt sources masked by programming the interrupt controller appropriately. 3.10 enhanced direct memory access (edma) requests mandatory: for asil d applications, protection against spurious or missing safety relevant edma requests must be implemented (d) . the methodology used to satisfy this requirement is application dependent. note: rationale: to manage spurious or missing edma transfer requests note: implementation hint: some implementations which can satisfy these requirements are: counting the number of edma transfers triggered inside a control period and compare this with what is the expected value. if the edma is used to manage the analog acquisition with the cross-triggering unit (ctu) and adc, the number of the converted adc channels is saved in the ctu fifo together with the acquired value. the edma transfers this value from the ctu fifo to a respective sram location. spurious or missing transfer requests can be detected by comparing the converted channel with what is expected. mandatory : designers must not use the periodic interrupt timer (pit) module to trigger an edma transfer request for asil d applications. note: rationale: to avoid a faulty pit (which is not redundant) from triggering an unexpected edma transfer 3.11 periodic interrupt timer (pit) mandatory : for asil d applications the pit module must be used in such a way that a possible failure is detected by the software watchdog timer (swt). note: rationale: to catch possible pit failures mandatory : if the pit is used by asil d applications, a checksum of its configuration registers must be calculated and compared with the expected value to verify that the pit configuration is correct. frequency: once per ftti note: rationale: to verify that the pit remains at its expected configuration d. edma is a replicated module. no software ac tion is needed to detect faults inside this module.
functional safety requirements for application software AN4266 18/76 doc id 024283 rev 2 3.12 communication peripherals the spc56xl70xx includes the following communication peripherals: flexcan dspi flexray linflexd recommended: an appropriate safety software protocol should be utilized (for example, fault tolerant communication layer, ftcom) for any communication peripheral employed to meet asil d application requirements. 3.13 i/o peripherals the following sections cover the use of the following peripherals: system integration unit lite (siul) etimer flexpwm these modules shall be used to implement the following functions if they are part of the application safety function: read inputs ? read digital inputs ? read pwm inputs ? read encoder inputs write outputs ? write digital outputs ? write pwm outputs these are the safety functions assumed during analysis of the spc56xl70xx. 3.13.1 read digital inputs for asil d applications, digital inputs used for safety purposes are assumed to be acquired redundantly as described in the following section. note: implementation hint: if sufficient diagnostic coverage can be obtained by a plausibility check on a single acquisition for a specific application, a plausibility check can replace a redundant acquisition. this hint is a special case of deviating from mandatory requirements as described in the preface. double read digital inputs hardware elements double read operation of a digital input is implemented by two general purpose inputs (gpi) of the siul unit. siul must be configured to allow an input signal to be read from it?s assigned pad. to minimize ccfs, the two input pads must not be physically adjacent (see section 7, i/o pin/ball configuration for details).
AN4266 functional safety requirements for application software doc id 024283 rev 2 19/76 safety integrity functions mandatory: safety integrity is achieved by replicated reading and software comparison by the processing function. the application shall implement the following tests: siul_swtest_regcrc note: rationale: to verify that the configuration of the two pads used corresponds with the expected configuration, and to avoid a ccf caused by incorrectly configured pads gpi_swtest_cmp note: rationale: to verify that the two input values compare figure 1. double read digital input software test implementation siul_swtest_regcrc the siul configuration registers are read, then a crc is calculated. the crc calculation is compared to the expected crc value. note: implementation hint: the edma and crc modules may be used to implement this safety integrity function (sif) to avoid overloading the cpu. gpi_swtest_cmp this software test is used to execute the comparison between the double reads performed by the independent channels. implementation details the only hardware element that can be used for the safety function is the general purpose input/output (gpio). siul i digital in double read configuration i gpi[y] gpi[x] i = input pad
functional safety requirements for application software AN4266 20/76 doc id 024283 rev 2 note: implementation hint: every i/o pad that is not dedicated to a single function can be configured as gpio (adc pads are an exception to this rule, as they can only be configured as inputs). caution: redundant gpio shall be selected in a non-contiguous way from the pin perspective to minimize ccf (see section 7, i/o pin/ball configuration for details). mandatory: the pads shall be configured via the appropriate pad configuration registers (pcr n ) in the siul module. note: rationale: to configure pads used by this safety function, and avoid ccf caused by improper configuration of the pads. 3.13.2 read pwm input for asil d applications, digital inputs used for safety purposes are always assumed to be acquired redundantly as described in the following section. read pwm input means any input read related to signal transitions (rise or fall). this may also include the time that the signal was high, low or both. double read pwm inputs hardware elements a double read pwm input is implemented by two channels, one channel provided by etimer_0 and the other by etimer_1. the siul module must be configured (via the appropriate siul_pcr n ) to provide configuration and input direction of the input pads. to minimize ccfs, these input pads must not be physically adjacent (see section 7, i/o pin/ball configuration for details). safety integrity functions safety integrity is achieved by reading each input then comparing the values in the processing function (see figure 2 ). mandatory: the software tests that the application must implement are: etimer0_swtest_regcrc etimer1_swtest_regcrc siul_swtest_regcrc note: rationale: to verify that the configuration of the modules used by this safety function compare to the expected configuration mandatory: in addition, the double reads must be compared by the application with the implementation of the following test: etimeri_swtest_cmp. note: rationale: to verify that the two sets of data compare table 3. software bist and/or test software bist or test frequency siul_swtest_regcrc once after programming gpi_swtest_cmp once for every acquisition
AN4266 functional safety requirements for application software doc id 024283 rev 2 21/76 figure 2. double read pwm input software test implementation etimer0_swtest_regcrc the etimer_0 configuration registers are r ead and a crc checksum is computed. the checksum is compared with the expected value. etimer1_swtest_regcrc the etimer_1 configuration registers are r ead and a crc checksum is computed. the checksum is compared with the expected value. siul_swtest_regcrc the configuration registers of the siul are read and a crc checksum is computed. the checksum is compared with the expected value. note: implementation hint: the edma and crc modules should be used to implement these sifs to avoid overloading the cpu. etimeri_swtest_cmp this software bist is used to execute the comparison between the double reads performed by a channel on etimer_0 and another channel on etimer_1. the comparison must take into account possible approximation because of different capturing of the input asynchronous signals. implementation details the following hardware elements shall be used for the safety function: etimer_0 channels etimer_1 channels pwm in double read configuration etc[x] etc[y] etimer_0 etimer_1 i i i = input pad
functional safety requirements for application software AN4266 22/76 doc id 024283 rev 2 mandatory : the user must select one channel from the etimer_0 module and another from the etimer_1. note: rationale: to avoid ccf (etimer_0 and etimer_1 belonging to different lakes) mandatory: the pads shall be configured via the appropriate pad configuration registers (siul_pcr n ). note: rationale: to configure pads used by this safety function 3.13.3 read encoder inputs for asil d applications, encoder inputs used for safety purposes are assumed to be acquired redundantly as described in the following section. read encoder input means any input read related to signal transitions (rise or fall). this may also include signals coming from an encoder. double read encoder inputs hardware elements a double read encoder input is implemented using two channels that can be provided by: etimer_0 etimer_1 siul when both channels are provided by the timer units, the signals of one encoder must be addressed to etimer_0 and the signals of the other encoder must be addressed to etimer_1. alternatively, one or both channels can be provided by the siul, which supports interrupt based reading of encoder signals. this means the siul must use general purpose inputs which have edge detection interrupts (see figure 3 for details). mandatory: one channel must be addressed by etimer_0, and the other by etimer_1. note: rationale: two different etimers must be used to avoid ccf (etimer_0 and etimer_1 belonging to different lakes). for each signal, the siul can provide additional channels to support interrupt-based reading. mandatory: in this configuration, the siul must be correctly configured to forward one or two interrupt-based event readings. note: rationale: to configure pads used by this safety function mandatory: the input pads must not be physically adjacent (see section 7, i/o pin/ball configuration for details). table 4. software bist and/or test software bist or test frequency etimer0_swtest_regcrc once after programming etimer1_swtest_regcrc once after programming siul_swtest_regcrc once after programming etimeri_swtest_cmp once for every acquisition
AN4266 functional safety requirements for application software doc id 024283 rev 2 23/76 note: rationale: to minimize ccf safety integrity functions the safety integrity is achieved by duplicate reads and software comparison by the processing function (see figure 3 ). mandatory: the application software must implement the following tests: etimer0_swtest_regcrc etimer1_swtest_regcrc siul_swtest_regcrc note: rationale: to verify that the configuration of the modules used by this safety function compare with what is expected rationale: to avoid ccf caused by improper configuration of the pads mandatory : the application software must implement the test enci_swtest_cmp, which compares signals acquired from each channel. note: rationale: to verify that the two sets of data compare figure 3. double encoder read input etimer_0 i etc[x] etimer_1 i etc[y] encoder input double read configuration siul i i eirq[x] eirq[y] i = input pad
functional safety requirements for application software AN4266 24/76 doc id 024283 rev 2 software test implementation etimer0_swtest_regcrc the etimer_0 configuration registers are read, then a crc checksum is computed. this computed checksum is compared to the expected value. etimer1_swtest_regcrc the etimer_1 configuration registers are read, then a crc checksum is computed. this computed checksum is compared to the expected value. siul_swtest_regcrc the configuration registers of the siul ar e read, then a crc checksum is computed. this computed checksum is compared to the expected value. note: implementation hint: the edma and crc modules should be used to implement this sif to avoid overloading the cpu. enci_swtest_cmp this software test is used to execute the comparison between the double reads performed by one of the following: ? one channel on etimer_0 and one channel on etimer_1 ? one channel on etimer_1 and one channel on the siul ? one channel on etimer_0 and one channel on the siul ? two channels on the siul the comparison must take into account possible approximation because of different captured values of the input asynchronous signals and the execution of interrupt based event reads. approximation required by different behavior of the encoded inputs must be handled at the application level. implementation details the following hardware elements shall be used for the safety function: etimer_0 channels etimer_1 channels external interrupt via gpio pins (configured via the siul) the user must select one channel from etimer_0 and one from etimer_1. the external interrupt pins are optional. mandatory: the pads shall be configured via the appropriate pad configuration registers (siul_pcr n ). note: rationale: to configure pads used by this safety function table 5. software bist and/or test software bist or test frequency etimer0_swtest_regcrc once after programming etimer1_swtest_regcrc once after programming siul_swtest_regcrc once after programming enci_swtest_cmp once for every acquisition
AN4266 functional safety requirements for application software doc id 024283 rev 2 25/76 3.13.4 write digital outputs for asil d applications, digital outputs used for safety purposes are assumed to be written either redundantly or with read back as described in the following section. note: application-dependent option: if a sufficient diagnostic coverage can be reached by a plausibility check on a single output channel for a specific application, a plausibility check can replace a redundant write or a direct read back. the element safety function write digital out is implemented as either: single write digital out with read back double write digital out single write digital outputs with read back the siul hardware element is used to perform a single write digital output with read back. mandatory: the read back must be implemented in one of the two modes shown in figure 4 . note: rationale: to verify if written data compares with the expected data mandatory: the siul element must be correctly configured to provide the output write and the pad directions as follows: external read back ? siul is configured to read back the signal from an additional pad, and the loopback is performed outside the device. in this configuration, only half of the available digital outputs are available as safety outputs. internal read back (e) ? siul is configured to read back the pad value via an internal read path. all pads dedicated to digital input/output are capable of reading the pad digital status using the input logic. note: rationale: to verify if written data is coherent with the expected data mandatory: the application software must implement the software test to check the correct configuration of the pads, siul_swtest_regcrc, and to compare the read back with the digital output write. gpoerb_swtest_cmp is used for external read back and gpoirb_swtest_cmp is used for internal read back. e. internal read back does not cover package faults (e.g., wire bond, etc.).
functional safety requirements for application software AN4266 26/76 doc id 024283 rev 2 figure 4. write digital output with read back software test implementation siul_swtest_regcrc the siul configuration registers are re ad and a crc checksum is computed. this crc checksum is compared what is expected. note: rationale: to avoid ccf caused by incorrect configuration of the pads note: implementation hint: the edma and crc modules should be used to implement this sif to avoid overloading the cpu. gpoerb_swtest_cmp this software test is used to execute the comparison between the desired output values and the value read back via external read back configuration. after writing the output value, the test must read the value of the digital input. note: rationale: to verify if the read data compares with the written data gpoirb_swtest_cmp this software test is used to execute the comparison between the desired output values and the value read back via internal read back configuration. after writing the output value, the test must read the status of the digital input. note: rationale: to verify if the read data compares with the written data siul o digital out external readback configuration i gpo pin pin siul o digital out internal readback configuration gpo pin i = input pad o = output pad gpi
AN4266 functional safety requirements for application software doc id 024283 rev 2 27/76 implementation details the siul hardware element shall be used for the safety function. every pad that is not dedicated to a single function can be configured as gpio. pads dedicated to adc are an exception to this rule, as they can be configured as inputs only. the pads shall be configured via the appropriate pad configuration registers (pcr n ) in the siul module. double write digital outputs the siul is used to perform a double write digital output. mandatory: the siul must be configured to correctly define the configuration of the output pads used. the software must perform a double write. note: rationale: to configure pads used by this safety function mandatory: to guarantee the integrity of the two output channels, the application shall test the siul configuration implementing the siul_swtest_regcrc. note: rationale: to avoid a ccf caused by incorrect configuration of the pads mandatory: the application must implement the double output write as defined by the gpodw_swapp_write. note: rationale: to write a digital output by exploiting redundancy table 6. software bist and/or test software bist or test frequency siul_swtest_regcrc once after programming gpoerb_swtest_cmp once every write gpoirb_swtest_cmp once every write
functional safety requirements for application software AN4266 28/76 doc id 024283 rev 2 figure 5. double write digital output software test implementation siul_swtest_regcrc the configuration registers of the siul are read and a crc is computed. this crc value is compared with what is expected. note: implementation hint: the edma and crc modules should be used to implement this sif to avoid overloading the cpu. gpodw_swapp_write mandatory: the output write of a redundant channel must be implemented following this guideline: the two outputs are written with a single instruction to the appropriate register. the output register is read back. note: rationale: to minimize ccf of the siul note: implementation hint: to write two or more gpios with a single instruction, the masked parallel gpio pad data out register (mpgpdox) register can be used. application software shall verify that the two gpios used are in the same mpgpdox register. to protect the value of the other gpios that belong to the same mpgpdox, the mask field of the mpgpdox register needs to be properly configured. implementation details the only hardware element that can be used for the safety function is the gpio. siul o digital out double configuration o gpo[y] gpo[x] o = output pad
AN4266 functional safety requirements for application software doc id 024283 rev 2 29/76 note: every pad that is not dedicated to a single function can be configured as gpio. adcs are an exception to this rule, as they can be configured as inputs only. the pads shall be configured via the appropriate pad configuration registers (pcr n ) in the siul module. 3.13.5 write pwm outputs for asil d applications, pwm outputs used for safety purposes are assumed to be written either redundantly or with read back as described in the following section. the element safety function write pwm output is implemented as double write pwm outputs or single write pwm outputs with read back. double write pwm outputs the hardware elements etimer_0 and etimer_1 or flexpwm_0 and flexpwm_1 are used to perform a double write pwm output. mandatory: these units must be configured to implement two pwm channels. the siul must be configured to define the configuration of the output pads used. the software must perform a double write. mandatory: redundant pads must not be adjacent and pad configuration/data registers must be separate siul registers (see section 7, i/o pin/ball configuration for details). note: rationale: to avoid ccf mandatory: to guarantee the integrity of the two output channels, the application should test the siul configuration implementing the siul_swtest_regcrc. note: rationale: to avoid ccf caused by incorrect configuration of the pads mandatory: the application software must implement a test for the etimer_0 and etimer_1 configuration (etimer0_swtest_regcrc, etimer1_swtest_regcrc) or for the flexpwm_0 and flexpwm_1 configuration (flexpwm0_swtest_regcrc, flexpwm1_swtest_regcrc) and a software write (pwmdw_swapp_write). note: rationale: to verify that the configuration of the modules used by this safety function adhere to the expected configuration table 7. software bist and/or test software bist or test frequency siul_swtest_regcrc once after programming gpodw_swapp_write once every write
functional safety requirements for application software AN4266 30/76 doc id 024283 rev 2 figure 6. double write pwm output configuration software test implementation siul_swtest_regcrc the siul configuration registers are read and a crc checksum is computed. the crc checksum is compared to the expected value. etimer0_swtest_regcrc the etimer_0 configuration registers are r ead and a crc checksum is computed. the checksum is compared to the expected value. etimer1_swtest_regcrc the etimer_1 configuration registers are r ead and a crc checksum is computed. the checksum is compared to the expected value. flexpwm0_swtest_regcrc the flexpwm_0 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. flexpwm1_swtest_regcrc the flexpwm_01 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. note: implementation hint: the edma and crc modules should be used to implement this sif to avoid overloading the cpu. pwmdw_swapp_write etimer_0 pwm out double write configuration (etimer) o etimer_1 o flex pwm out double write configuration (flexpwm) o flex o pwm_0 pwm_1 etc[x]* o = output pad etc[y]* n[z]* n[z]* note: n[z] represents any flexpwm output (for example, a[z], b[z] or x[z]), but each output must be driven by different flexpwm modules. the same consideration is valid for the etimer; any etimer output may be used, but each output must be driven by different etimer module.
AN4266 functional safety requirements for application software doc id 024283 rev 2 31/76 mandatory: the output write of a redundant pwm channel must be implemented by writing the new output values to both the pwm channels. the customer can decide whether to use both etimers (etimer_0, etimer_1) or both flexpwms (flexpwm_0, flexpwm_1), see figure 6 . note: rationale: to write a digital output by exploiting redundancy, and modules must belong to different lakes to decrease the probability of ccf implementation details the following hardware elements shall be used for the safety function: etimer_0 channels etimer_1 channels flexpwm_0 channels flexpwm_1 channels mandatory: the pads shall be configured via the appropriate pad configuration registers (pcr n ) in the siul module. note: rationale: to configure pads used by this safety function single write pwm outputs with read back the hardware elements etimer_0 and flexpwm_1 or etimer_1 and flexpwm_0 are used to perform a write pwm output with read back (f) . these units must be configured to implement one pwm output channel and (via internal read back) the etimer_0 input pwm channel. the siul must be configured to define the configuration of the output pads used. the software must perform a write operation followed by a read operation. to guarantee the integrity of the two output channels, the application should test the siul configuration implementing the siul_swtest_regcrc (to avoid a common fa ilure caused by misconfiguration of the pads). table 8. software bist and/or test software bist or test frequency siul_swtest_regcrc once after programming (1) 1. if a change in a single siul configuration register is capable of affecting both the output and the read-back paths, then siul_swtest_regcrc must be executed ev ery ftti. in all other cases configuration errors are covered by the software comparison. etimer0_swtest_regcrc (2) 2. this software bist is needed only if the flexpwm channels are used for the safety function once after programming etimer1_swtest_regcrc (2) once after programming flexpwm0_swtest_regcrc (3) 3. this software bist is needed only if the et imer channels are used for the safety function once after programming flexpwm1_swtest_regcrc (3) once after programming pwmdw_swapp_write once every write f. etimer_0 and flexpwm_0 (etimer_1 and flexpwm_1) cannot be used in combination due to the same lbist partition assignment.
functional safety requirements for application software AN4266 32/76 doc id 024283 rev 2 note: implementation hint : a single channel of the etimer is used with a multiplexing of the internal read back of the different output of the flexpwm. the read back paths are limited to six signals, two for each sub-module of the flexpwm. mandatory: the application software must implement software tests for etimer_0 and etimer_1 configurations: flexpwm0_swtest_regcrc flexpwm1_swtest_regcrc etimer0_swtest_regcrc etimer1_swtest_regcrc note: rationale: to verify that the configuration of the modules used by this safety function adheres to the expected configuration mandatory: the application software must write to the output port and then compare the written value via the read back (see item pwmrb_swtest_cmp below). note: rationale: to verify that written data is what is expected figure 7. single write pwm output with read back configuration etimer i pwm out single write external readback configuration flex pwm etimer i pwm out single write internal readback configuration flex pwm o o etc[x] n[z]* n[z]* * note: n[z] represents any flexpwm output. i = input pad o = output pad
AN4266 functional safety requirements for application software doc id 024283 rev 2 33/76 software test implementation siul_swtest_regcrc the siul configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. etimer0_swtest_regcrc the etimer_0 configuration registers are r ead and a crc checksum is computed. the checksum is compared to the expected value. etimer1_swtest_regcrc the etimer_1 configuration registers are r ead and a crc checksum is computed. the checksum is compared to the expected value. flexpwm0_swtest_regcrc the flexpwm_0 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. flexpwm1_swtest_regcrc the flexpwm_1 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. note: implementation hint: the edma and crc modules should be used to implement this sif to avoid overloading the cpu. pwmrb_swtest_cmp this procedure output compares the pwm read back provided by a single channel of the etimer_0 (etimer_1) with the expected values that have been written to the flexpwm_1 (flexpwm_0) output channel. implementation details the following hardware elements shall be used for the safety function: etimer_0 channels etimer_1 channels flexpwm_0 channels flexpwm_1 channels mandatory: the pads shall be configured via the appropriate pad configuration registers (pcr n ) in the siul module. note: rationale: to configure pads used by this safety function
functional safety requirements for application software AN4266 34/76 doc id 024283 rev 2 3.13.6 other requirements for i/o peripherals mandatory: other requirements related to i/o peripherals include the following: in the etimer module, the capture flag (etimer_ n _sts[icf n ]) must be used. note: rationale: to detect missing etimer_n acquisition if the etimer counter is used to decode a primary and secondary external input as quadrature encoded signals, the etimer watchdog must be used (see ?counting modes? section of the spc56xl70xx reference manual). note: rationale: to detect stalled quadrature counting 3.14 cross triggering unit (ctu) the ctu generates some triggers based on input events (flexpwms, etimers, and/or external pins). the trigger can be caused by: a pulse an interrupt an adc command (or a stream of consecutive commands) all of these mandatory: the ctu shall be appropriately configured so that the output triggers are generated within the desired time schedule with respect to the input event(s). note: rationale: to avoid erratic output trigger generation for each trigger, a set of adc commands and pulses to be generated can be defined. if the application safety function includes the read of some inputs synchronized with some events (flexpwms, etimers, and/or external pins), the customer can use the ctu module for this purpose. the software needed for targeting the asil d is listed in section 3.14.1, synchronize sequential read input . for a detailed description on how the ctu works (triggered and sequential mode), its configuration and use, refer to the spc56xl70xx reference manual. table 9. software bist and/or test software bist or test frequency siul_swtest_regcrc once after programming etimer0_swtest_regcrc (1) 1. this software bist is needed only if the et imer channels are used for the safety function. once after programming etimer1_swtest_regcrc (1) once after programming flexpwm0_swtest_regcrc (2) 2. this software bist is needed only if the flexpwm channels are used for the safety function. once after programming flexpwm1_swtest_regcrc (2) once after programming pwmrb_swtest_cmp once every write
AN4266 functional safety requirements for application software doc id 024283 rev 2 35/76 3.14.1 synchronize sequential read input the ctu can be used if the customer needs to synchronize the reading of some inputs with some events (flexpwms, etimers, and/or external pins). mandatory: if this function is part of the application safety function, the safety integrity is achieved by a mix of hardware mechanisms and software safety integrity functions implemented at the application level: ctu_hwswtest_triggernum ctu_swtest_triggertime ctu_hwswtest_triggeroverrun ctu_hwswtest_adccommand (only if the input is an analog signal) ctu_swtest_etimercommand ctu_hw_cfgintegrity note: these functions are mandatory only if the ctu is used. software test implementation ctu_hwswtest_triggernum if the reload signal occurs before all the triggers are generated, an overrun indication is flagged and the application software must handle the error indication. note: rationale: tests if all the triggers configured within a control period have been generated and serviced. note: implementation hint: the cross triggering unit error flag register (ctuefr) shows information about the overrun status. ctu_swtest_triggertime application software must configure one etimer channel to capture the time at which each trigger event occurs. in triggered mode, the time instant of each trigger within one control period is captured and stored in a fifo. application software has to check the fifo values against the expected ones according to ctu configuration. in sequential mode, one etimer channel is needed to check the correct time of a single trigger with respect to the corresponding event. note: rationale: to verify if triggers are generated at the correct time note: implementation hint: some etimer inputs are internally connected to the ctu output. etimer_2 input/outputs are not connected to pins on lqfp144 package. use etimer_2 channels for implementing this safety function to keep the channels from etimer_0 or etimer_1 units for functions using port pins (see ?enhanced motor control timer (etimer)? in the spc56xl70xx reference manual for details). note: implementation hint: etimer capture register implements a two entry fifo, but in ctu triggered mode up to 8 time values need to be stored. to avoid fifo overflow condition,
functional safety requirements for application software AN4266 36/76 doc id 024283 rev 2 etimer can be configured to trigger a edma transfer to move the captured value to specific ram location. ctu_hwswtest_triggeroverrun this hardware mechanism checks if a new trigger occurs that requires an action by a subunit that is currently busy. in this case, an overrun interrupt is generated and the application software must handle the error condition. over-run detection mechanism shall be enabled by software during ctu configuration. note: rationale: checks if a new trigger occurs that requires an action by a subunit (such as adc command generator) which is currently busy. note: implementation hint: to enable the over-run detection the iee flag in the cross triggering unit interrupt/edma register (ctuir) register shall be asserted. this interrupt is shared between several sources of error. the user can discriminate among them by reading the ctuefr register. ctu_hwswtest_adccommand the ctu stores in its internal fifos both the value provided by each adc conversion and the channel number. application software must check the adc channel number sequence against what is expected for each fifo. moreover, invalid commands issued by the ctu are flagged and the corresponding error must be handled by the application software. note: rationale: to detect if the incorrect channel has been acquired, or if the incorrect adc result fifo is selected note: implementation hint: to enable invalid command detection, the iee flag in the ctuir register must be asserted. this interrupt is shared between several sources of error. the user can discriminate among them by reading the ctuefr register. this safety integrity function needs to be implemented only when reading analog signals. ctu_swtest_etimercommand application software must configure one channel of etimer_0 or etimer_1 to count the number of etimer commands generated within a ctu control period and must check the number against the expected one. note: rationale: to verify the correctness of the number of generated commands note: implementation hint: some etimer inputs are internally connected to the ctu output (see the spc56xl70xx reference manual for details). ctu_hw_cfgintegrity this hardware mechanism ensures the consistency of the ctu configuration at the beginning of each ctu control period. the configuration registers are all double-buffered. if the configuration is only partial when the control period starts, the previous configuration is used and an error condition is flagged, which must be handled by the application software. note: rationale: ensures the consistency of the ctu configuration note: implementation hint: the ctu uses a safe reload mechanism. the general reload enable (gre) bit in the cross triggering unit control register (ctucr) shall be used to detect partial or incomplete ctu update.
AN4266 functional safety requirements for application software doc id 024283 rev 2 37/76 to enable the interrupt in case of error during reload, the iee flag in the ctuir register shall be asserted. this interrupt is shared between several sources of error. the user can discriminate among them by reading the ctuefr register. implementation details the following hardware elements shall be used for the safety function: ctu one etimer channel other requirements for ctu module usage mandatory: the only other requirement related to the ctu is that if the ctu is used to read an analog signal through the adc, the software shall verify the invalid command error flag (ctu_ctuefr[icr]) after programming the adc command lists. note: rationale: to check the presence of invalid commands 3.15 adc if the adc is used in a safety function, the following sections must be observed if an adc bist is to be performed. it is important to note that the adc is part of the temperature measuring safety integrity function, and it is therefore required that the hwbist functions be executed once after the boot even if the adc is not in application use. 3.15.1 read analog inputs the customer has two options for reading analog inputs: single read analog inputs double read analog inputs table 10. software bist and/or test software bist or test frequency ctu_hwswtest_triggernum once for every control period (< ftti) ctu_swtest_triggertime once for every ctu control period (triggered mode) or every trigger (sequential mode) ctu_hwswtest_triggeroverrun once for every trigger ctu_hwswtest_adccommand once for every adc command ctu_swtest_etimercommand once for every control period (< ftti) ctu_hw_cfgintegrity once for every control period (< ftti)
functional safety requirements for application software AN4266 38/76 doc id 024283 rev 2 single read analog inputs hardware elements the single-read analog input uses a single-analog-input channel either of adc_0 or adc_1 to acquire an analog voltage signal (see figure 8 ). to support a high diagnostic coverage two known reference supply voltages are utilized by two software tests which are described in the following sections (adc_swtest_test1 and adc_swtest_test2). the reference supply voltages are the following: v dd_hv_adr0 (adc_0 high reference voltage) v dd_hv_adr1 (adc_1 high reference voltage) v ss_hv_adr0 (adc_0 low reference voltage) v ss_hv_adr1 (adc_1 low reference voltage) the siul unit must be configured properly to correctly enable the input pads. the pads used for analog inputs are only of type inputs. safety integrity functions mandatory: the safety integrity is achieved by dedicated hardware bist (g) : note: rationale: hardware bist to check the integrity of the adc, both analog and digital parts: supply self-testresistive-capacitive self-testcapacitive self-test mandatory: by dedicated software test implemented at the application level: adc_swtest_test1 adc_swtest_test2 adc_swtest_valchk adc0_swtest_regcrc adc1_swtest_regcrc siul_swtest_regcrc adc_swtest_adcoversampling g. these hardware bists need some software to activa te them. this software shall be developed by the customer.
AN4266 functional safety requirements for application software doc id 024283 rev 2 39/76 figure 8. single read analog input configuration hardware bist three types of self-test algorithms have been implemented in the adc hardware: supply self-test resistive-capacitive self-test capacitive self-test hardware bist implementationthe hardware bists shall be activated by the application in one of the following modes: cpu mode ctu mode in cpu mode, the application software takes care of the hardware self-test activation and checks the test flow and the timing. in ctu mode, the ctu module takes care of the hardware self-test activation, flow monitoring, and timing. it is important to note that in this operating mode, the cpu does not take part in running the hardware self-test. hw self-tests use analog watchdogs to verify the outcome of self-test conversions. the reference thresholds of these watchdogs are saved in test sector (see ?test flash memory? section and ?test flash information? table in the spc56xl70xx reference manual). mandatory : before running the hw self-test, the customer must copy these thresholds from the test sector into the watchdog registers (see ?self test analog watchdog? section of the spc56xl70xx reference manual). adc_x analog single read/write internal readback configuration an[x] reference voltages (v dd _hv_adrx and v ss _hv_adr) i i = input pad
functional safety requirements for application software AN4266 40/76 doc id 024283 rev 2 note: rationale: to set the correct threshold for the self-tests note: implementation hint: since user can not directly read the test sector an sscm feature, called test flash enable, shall be exploited. this action is performed through the following steps: 1. if code is executing in flash memory, it jumps to execute from ram. 2. write sscm_sctr[tfe] = 1. 3. test sector is readable at the offset 0x0 of the flash memory address space (see ?system status and configuration module (sscm)? of the reference manual). 4. thresholds are copied from the test sector to the respective register. 5. write sscm_sctr[tfe] = 0. 6. code can continue execution from the flash memory. bam implements an access method to read the test sector. mandatory: since the bam is not developed according to the safety standard, a safety application is not allowed to read the test sector through the bam access method. additionally, a watchdog timer is implemented to check the sequence of the self-test algorithms. mandatory: the customer must enable the watchdog timer for cpu mode and ctu mode. the programmable watchdog timeout is the ftti (h) . note: rationale: to check the sequence of the self-test algorithms every hardware bist is activated via a dedicated command sent to the adc. refer to the ?self-testing? section in the ?adc? chapter of the spc56xl70xx reference manual to have all detailed instructions for implementing one of these modes. the supply self-test must be executed without interleaved user conversion. software tests adc_swtest_test1 this software bist exploits the presampling feature of the adc. presampling allows to precharge or discharge the adc internal capacitor before it starts the sampling and conversion phases of the analog input coming from pads. during presampling phase, the adc samples the internally generated voltage while in the sampling phase the adc samples analog input coming from pads (see figure ). reference voltage which can be used during presampling phase is either v dd_hv_adr0/1 or v ss_hv_adr0/1 . if there is an open failure in the analog multiplexing circuitry, the signal converted by the adc is not the analog input coming from the pad, but the presampling reference voltage (v dd_hv_adr0/1 or v ss_hv_adr0/1 ). this bist must be run for each analog input used by the safety function. since the pads dedicated to analog inputs are of type input, a missing enable from the siul results in an open failure. note: rationale: to detect open failures of the channel multiplexing circuitry (see figure 9 ) h. this action is not mandatory in case of double read analog inputs.
AN4266 functional safety requirements for application software doc id 024283 rev 2 41/76 figure 9. software bists to test the mu ltiplexing circuitry (adc_swtest_test1) note: implementation hint : presampling can be enabled on a per channel basis through the adc_x_psr0 register. adc_x_pscr[preval0] selects which reference voltage is used to precharge/discharge the adc internal capacitor. adc_x_pscr[preconv] register shall be 0 (see ?analog-to-digital converter (adc)? chapter in the spc56xl70xx reference manual for details on the presampling feature). adc reference value 1 pins adc reference value 1 pins adc adc presampling phase open detection: conversion phase
functional safety requirements for application software AN4266 42/76 doc id 024283 rev 2 i figure 10. implementation of adc_sw_test1 through the adc presample feature adc_swtest_test2 to detect short failures two different voltages are acquired by the adc. if these values are different from the expected ones, a short failure on the multiplexed circuitry has been detected. to implement this test a presampling feature of the adc can be exploited. the presampling must be configured in such a way that the sampling of the channel is bypassed and the presampling reference supply voltages are converted. during the first step the v dd_hv_adr0/1 is converted and compared with the its expected value, then the v ss_hv_adr0/1 is converted and compared with its expected value (see figure 12 ). figure 12 includes the conversion of the 2 different presampling reference voltages (v dd_hv_adr0/1 and v ss_vh_adr0/1 ). note: rationale: to detect short failures of the channel multiplexing circuitry (see figure 11 ) figure 11. software bists to test the mu ltiplexing circuitry (adc_swtest_test2) note: implementation hint : the implementation hints of the adc_swtest_test1 applies also to the adc_swtest_test2 to bypass the conversion of the input channel and convert the presampled values, adc_x_pscr[preconv] register shall be set to 1. convert ch a presample ch b sample ch b convert ch b presample ch a sample ch a t vdd_hv_adrx or vss_hv_adrx note: either v dd_hv_adr0/1 or v ss_hv_adr0/1 can be used as presampling voltage. adc reference value 2 pins adc reference value 1 pins adc adc adc reference value 1 first reference conversion short detection: second reference conversion pins
AN4266 functional safety requirements for application software doc id 024283 rev 2 43/76 figure 12. implementation of adc_sw_test2 through the adc presample feature adc_swtest_valchk the goal of this software test is to verify correct operation of the control and queue logic of the adc, and also the ctu, if used. this software measures implementation is dependant on the adc configuration (for example, ctu or cpu mode): when the adc is used in cpu mode, the acquired value is read by the adc_cdr n . this register includes adc_cdr n [valid] and adc_cdr n [result] fields as well as channel n converted data (adc_cdr n [cdata]). these fields provide status information about the data acquisition. application software shall read and verify these fields after every acquisition. when the adc conversion is triggered by the ctu, the acquired digital sample data are stored in a dual queue along with information about the channel that performed the acquisition. checking the channel information of the acquisition provides sufficient coverage of the control logic and, in part, the queue logic. note: implementation hint: if adc is configured to work in ctu mode, the conversion results are stored in ctu fifos (see ?cross-triggering unit (ctu)? chapter in spc56xl70xx reference manual). along with the converted data, the converted channel number and adc module are stored. ctu includes two sets of registers to read this information (fifo right aligned data, ctu_frx, and fifo left aligned data, ctu_flx). user must read these registers to verify if the sequence of the acquired channel is what is expected. adc_swtest_oversampling in case of single read analog inputs the adc_swtest_adcoversampling_cmp must be implemented as counter measure against random fault. adc_swtest_oversampling is an acquisition redundant in time. it refers to sampling the signal at rate significantly higher than the nyquist frequency related to the input signal. in case of fault the acquired values are not correlated with themselves. this sif compares the acquired value to verify the correlation. against random fault, three consecutive analog values are converted for each acquisition to implement the adc_swtest_oversampling the second presample ch x convert ch x presample ch x convert ch x t vdd_hv_adrx vss_hv_adrx note: either v dd_hv_adr0/1 or v ss_hv_adr0/1 can be used as presampling voltage.
functional safety requirements for application software AN4266 44/76 doc id 024283 rev 2 acquisition, a 2 , is faulty because the first converted value is quite different respect the other two (see figure 13 ). figure 13. series of acquired analog values adc0_swtest_regcrc if adc_0 is used, the adc_0 configuration registers are read and crc checksum is computed. the checksum is compared to the expected value. adc1_swtest_regcrc if adc_1 is used, the adc_1 configuration registers are read and crc checksum is computed. the checksum is compared to the expected value. siul_swtest_regcrc the siul configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. implementation details the following hardware elements shall be used for the safety function: analog input channels an[0:8] of adc_0 analog input channels an[11:14] of adc_0 and adc_1 (shared channels) analog input channels an[0:8] of adc_1 the user must select one channel from adc_0 or from adc_1. shared channels can be used. mandatory: the input pads are configured via the appropriate pad configuration registers (pcr n ) in the siul module. faulty acquisition a 1 a 2 a 3 t table 11. software bist and/or test software bist and/or test frequency supply self-test once in the ftti resistive-capacitive self-test once in the ftti capacitive self-test once in the ftti adc_swtest_test1 once in the ftti adc_swtest_test2 once in the ftti adc_swtest_valchk once for every acquisition adc_swtest_oversampling once for every acquisition
AN4266 functional safety requirements for application software doc id 024283 rev 2 45/76 double read analog inputs hardware elements the double read analog input uses two analog input channels to acquire a replicated analog input signal. both adc units acquire and digitize the two copies of a redundant analog signal connected to the inputs. in this configuration (if applied to all possible analog inputs), only half of the analog inputs are available to the applications (an[0:8] of adc_0 for signals, and an[0:8] of adc_1 for signal copies). mandatory: the shared channels (an[11:14]) suffer from ccf because they share pads between each adc module. therefore, they are omitted (considered not safe) for double reads. the comparison of the results is performed by application software (see figure 14 ). note: rationale: adc_0 and adc_1 share a pad for the channels (an[11:14]). omitting them from double read eliminates a possible source of ccf. mandatory: after boot but before executing the safety function the following tests shall be executed to detect latent faults (see section , hardware bist and section , hardware bist implementation ): supply self-test resistive-capacitive self-test capacitive self-test note: rationale: to check the integrity of the adc modules mandatory : before running the hw self-test, the customer must copy the threshold values of the analog watchdogs from test sector into the watchdog registers (see ?self test analog watchdog? section of the ?analog-to-digital converter (adc)? chapter in spc56xl70xx reference manual). note: rationale: to set the correct threshold for the self-test safety integrity functions safety integrity is achieved by replicated acquisition with separate analog input channels and software comparison by the processing function (see figure 14 ). mandatory: the following software test must be implemented by the application software: adc0_swtest_regcrc, adc1_swtest_regcrc, siul_swtest_regcrc note: rationale: to verify that the configuration of the module used by this safety function corresponds with what is expected note: rationale: to avoid ccf caused by improper configuration of the pads mandatory: in addition, the software test adc_swtest_cmp must be implemented to compare the channel reads. adc0_swtest_regcrc once in the ftti adc1_swtest_regcrc once in the ftti siul_swtest_regcrc once in the ftti table 11. software bist and/or test (continued) software bist and/or test frequency
functional safety requirements for application software AN4266 46/76 doc id 024283 rev 2 note: rationale: to verify that the two sets of read data compare it is important to note that this safety integrity function might be applied in addition to single analog read inputs, which increases diagnostic coverage. figure 14. double read analog inputs configuration software test implementation adc0_swtest_regcrc the adc_0 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. adc1_swtest_regcrc the adc_1 configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. siul_swtest_regcrc the siul configuration registers are read and a crc checksum is computed. the checksum is compared to the expected value. adc_swtest_cmp this software test is used to execute a comparison between the double acquisition performed by one channel of adc_0 and one channel of adc_1. the comparison must be approximated because of conversion differences. adc_0 analog double read configuration an[0:8] adc_1 an[0:8] i i i = input pad
AN4266 functional safety requirements for application software doc id 024283 rev 2 47/76 implementation details the following hardware elements shall be used for the safety function: analog input channels an[0:8] of adc_0 analog input channels an[0:8] of adc_1 the user must select one channel from adc_0 and one from adc_1. the input pads are configured via the appropriate pad configuration registers, siul_pcr n . 3.15.2 other requirements other requirements related to the adc modules are: when an application needs to access the adc result fifo, a 32-bit read access shall be performed to verify the channel number on which the conversion has been executed. if the adc analog watchdog function is used for function-safety relevant signal, two analog watchdog channels must monitor the same signal. if the sine wave generator (swg) is used, the adc (in conjunction with ctu) must be used to check the output signal. 3.16 temperature sensors there are two temperature sensors: temperature sensor 0 (tsens_0) mapped to adc_0 and temperature sensor 1 (tsens_1) mapped to adc_1. mandatory: during power up, the two temperature sensors need to be read by software (tsens_0 from adc_0 channel 15, tsens_1 from adc_1 channel 15), which must verify that the read values are similar as a means of assessing the functionality of the sensors. however, nothing prohibits reading the temperature sensors during run time if needed. note: rationale: a means of assessing functionality of the temperature sensors mandatory: in addition, the temperature must be acquired from at least one of the temperature sensors by software every ftti during run time. in case of a fault, software must move the system to a safe state. note: rationale: to detect over-temperature faults table 12. software bist and/or test software bist or test frequency supply self-test once after boot resistive-capacitive self-test once after boot capacitive self-test once after boot adc0_swtest_regcrc once after programming adc1_swtest_regcrc once after progamming siul_swtest_regcrc once after progamming adc_swtest_cmp once for every acquisition
functional safety requirements for application software AN4266 48/76 doc id 024283 rev 2 to set a proper threshold the customer must consider that the maximum operating junction temperature is 150 c (see the spc56xl70xx data sheet) and the temperature sensor accuracy is 10 c. note: implementation hint: see the spc56xl70xx reference manual for details on tsens_x implementation in relation to the adc. it is important to note that the adc is part of the temperature measuring safety integrity function. therefore, it is required that the bist of the adc be executed once after boot even if the adc is not used by the application. 3.17 software watchdog timer (swt) mandatory: these requirements apply to the swt for asil d applications: both of the following must be true: ? the swt is enabled ? configuration registers hard locked to avoid unwanted modification the swt time window settings must be set to a value less than the ftti. detection latency shall be smaller than ftti. before the safety function is executed, software must verify that the swt is enabled by reading the swt control register (swt_cr[wen] = 1). note: rationale: to detect a defective program sequence mandatory: control flow monitoring can be implemented by swt. however, other control flow monitoring approaches that do not used the swt may also be used. spc56xl70xx provides the hardware support (swt) to implement both control flow and temporal monitoring methods. refer to the spc56xl70xx reference manual for the swt functional description. note: implementation hint: to enable the swt, and to hard lock the configuration register, swt_cr[wen] and swt_cr[hlk] must be asserted (= 1). the timeout register (swt_to) must contain a 32-bit value that represents a timeout less than the ftti. if windowed mode and keyed service mode (two pseudorandom key values used to service the watchdog) are enabled, it is possible to reach a high effective temporal flow monitoring. 3.18 redundancy control checking unit (rccu) the task of the rccu unit is to perform a cycle-by-cycle comparison of the outputs of the modules included in the sor. the sor is the logical part of the device that contains all the modules that are replicated for functional safety reasons. the rccu is able to detect any mismatch between the outputs of two replicated modules. the error information is forwarded to the mc_rgm and fccu. for asil d applications, use of the rccu is indispensable. the use of rccu?s is automatically managed by the spc56xl70xx device, users cannot disable the rccu. note: rationale: to catch faults in the processing channel
AN4266 functional safety requirements for application software doc id 024283 rev 2 49/76 the rccus are only enabled when the spc56xl70xx is in lsm. application software must determine whether lsm mode is activate. please refer to section 3.2.2, checking for further details. 3.19 cyclic redundancy checker unit (crc) the crc module computes crc checksums, wh ich offloads the cpu. the crc has the capability of processing two crc calculations simultaneously. recommended: the crc module should be used to detect accidental alteration of data during transmission or storage. the crc takes as its input a data stream of any length and produces a 32-bit output value. mandatory: the crc calculation shall be executed to ve rify the content of the registers. note: rationale: the contents of the configuration registers of the safety-related modules must be checked within the ftti. note: theoretically, the cpu could be used instead of the crc to verify that the value of the configuration registers have not changed. however, using the crc is more effective. note: implementation hint: the crc of the configuration registers of the modules involved with the safety function shall be calculated offline. at run time, the same crc value shall be calculated by the crc module within the safety process time. to avoid overloading the cpu, the edma module can be used to support the data transfer from the registers under check to the crc module. the result of the runtime computation is then compared to the value of the offline crc. the application must include detection, or protection measures, against possible faults of the crc module only if the crc module is used by any sef. 3.20 clock monitor unit (cmu) the main task of the clock monitor unit (cmu) is to supervise the integrity of various clock sources. mandatory: the following supervisor functions shall be used: loss of external crystal oscillator clock fmpll frequency higher than a (programmable) value set as high reference fmpll frequency lower than a (programmable) value set as low reference note: rationale: to monitor the integrity of the clock signals this error information is forwarded to the fccu and to the mc_rgm. spc56xl70xx includes three cmus: cmu_0 monitors the clock signal of the sor modules and the clock from the xosc (xosc_clk). cmu_1 monitors the clock signal used by the motor control related peripherals (such as etimer, flexpwm, ctu and adc). cmu_2 monitors the clock signal for the protocol engine of the flexray module.
functional safety requirements for application software AN4266 50/76 doc id 024283 rev 2 mandatory: for asil d applications, use of the cmu is mandatory. if the related modules are used by the application safety function, the user shall verify that the cmus are enabled and their faults managed by the fccu. note: rationale: to monitor the integrity of the various clock signals note: implementation hint: in general, the following two application-dependent configurations must be executed before cmu monitoring will be enabled: the first configuration is related to the xosc_clk monitor of cmu_0. the software shall configure cmu_0_csr[rcdiv] to select a divider for the ircosc. the divided rcosc frequency will be compared with the xosc_clk. the second configuration relates to the other clock signals being monitored. the high frequency reference (cmu_ n _hfrefr_a[hfref_a]) and low frequency reference (cmu_ n _lfrefr_a[lfref_a]) shall be configured depending on the sor (cmu_0), motor control related peripherals (cmu_1) and flexray (cmu_2) clock frequencies. once the cmus are configured, the clock monitoring must be enabled by asserting cmu_ n _csr[cme_a] (= 1). 3.21 frequency-modulated phase-locked loop (fmpll) mandatory: application software has the responsibility of checking that the system uses the system fmpll clock as system clock before running any safety element function (pll_swcheck). note: rationale: to decrease the risk of a glitch from the crystal or ircosc note: implementation hint: application software can verify the current system clock by checking mc_me_gs[s_sysclk] status. mc_me_gs[s_sysclk] = 0x4 indicates system fmpll clock is used as system clock. mandatory: each fmpll provides a loss of lock error indication which is routed to the mc_rgm and fccu. the application software must enable the respective fault and configure the fccu to manage the fault. note: rationale: to check the integrity of the fmpll clock since the system can be driven by the ircosc, if there is a system clock fault, an fmpll fault is considered a non-critical fault (ncf). if the fmpll successfully relocks after a clock fault it will typically stay relocked since the locking process includes built in hysteresis between loosing and regaining the lock. note: implementation hint: software must clear fmpll_n_cr[pll_fail_mask] so the pll_fail output is not masked. to enable the rgm input related to fmpll loss of clock, rgm_ferd[d_plln] and rgm_fear[ar_plln] must be configured. to enable fccu fault paths, registers in the fccu must be configured (ncf_cfg0, ncfs_cfg0, ncf_toe0, etc.). loss of lock signals from fmpll_0 and fmpll_1 provide the fccu ncf[2] and ncf[3] inputs, respectively. the mc_rgm and fccu configuration includes the reaction in case of fmpll loss of lock. this reaction is application-dependent.
AN4266 functional safety requirements for application software doc id 024283 rev 2 51/76 3.22 internal rc oscillator (ircosc) the frequency meter of cmu_0 must be exploited to verify the availability and frequency of the ircosc. this feature allows measuring the ircosc frequency using the external oscillator as the clock source. mandatory: users must measure the ircosc frequency and compare it with what is expected (16mhz (i) ). this test must be performed at least once every ftti (irc_sw_check_sif). note: rationale: to check the integrity of the ircosc note: if the ircosc is not operating due to a fault, the measurement of the ircosc frequency will never complete and the cmu_csr[sfm] flag will remain set. the application shall manage detecting this condition. for example, implementing a software watchdog which monitors the cmu_csr[sfm] flag status. safety analysis assumes that this measurement executes at least once every ftti. testing frequency can be reduced to once after boot if the customer accepts that most safety mechanisms will be non-functional for the remainder of the operation if the ircosc fails. safety related modules which work with the rc clock are: fccu, cmu and swt. these modules stop working if the ircosc fails. 3.23 power management unit (pmu) the power management units (pmu) manage the supply voltage of modules on the spc56xl70xx. the supplies monitored by the pmu and naming conventions are found in ta ble 13 . if one of the monitored voltages falls below or rises above a fixed threshold, a destructive reset is initiated. the low voltage detection (lvd) and high voltage detection (hvd) fault indications are forwarded to the mc_rgm. i. nominal frequency of the ircosc is 16 mhz, but a post trim accuracy of 6% over voltage and temperature must be taken into account. table 13. pmu monitored supplies detector type detector name voltage monitored alternate name comments flash memory lvd lvd_main_3 vddflash lvd_flash a redundant lvd is embedded i/o lvd lvd_main_1 vddio lvd_gpio a redundant lvd is embedded vreg lvd lvd_main_2 vddreg lvd_vreg a redundant lvd is embedded core main lvd lvd_dig_main 1.2 v digital ? ? core main hvd hvd_dig_main 1.2 v digital ? ? core backup lvd lvd_dig_bkup 1.2 v digital ? assists in the self-test of lvd_dig_main core backup hvd hvd_dig_bkup 1.2 v digital ? assists in the self-test of hvd_dig_main
functional safety requirements for application software AN4266 52/76 doc id 024283 rev 2 since power is critical to the operation of the spc56xl70xx there is built-in redundancy to the pmu core lvds and hvds. lvd_dig_main and hvd_dig_main monitor the digital core voltage and have backups for additional safety protection (lvd_dig_bkup and hvd_dig_bkup). internal architecture allows for testing of the functionality of the main and back up lvd_dig and hvd_dig, as well as trimming circuitries (see figure 15 ). the pmuctrl module provides software initialized bists which test the digital core supply hvd and lvd (both main and backup). figure 15. logic scheme of the lvd_dig and hvd_dig if the self-test circuitry detects a fault in the main or backup detectors the reaction will be one of the following (see ?built in self-test (bist)? subsection of the ?power management unit (pmu)? section in the spc56xl70xx reference manual): critical fault (cf[21]) triggered and one or more of the following: ? main low voltage detector pending ? pmuctrl_irqs[mlvdp] = 1 ? backup low voltage detector pending ? pmuctrl_irqs[blvdp] = 1 ? main high voltage detector pending ? pmuctrl_irqs[mhvdp] = 1 ? backup high voltage detector pending ? pmuctrl_irqs[bhvdp] = 1 destructive reset triggered if the self-test circuitry detects a fault in th e main or backup detectors the fccu will read a cf. there are dedicated lvd?s in the flash memory, i/o and vreg providing additional redundancy. this solution is different from the 1.2 v digital core supply monitoring, but still provides the same level of safety coverage. the outputs of the first and the second lvd are logically and?d in such a way that a single lvd can trigger a fault, even if the other lvd is not functioning properly (see figure 16 ). note: this scheme represents only the logical configuration and not the actual silicon implementation structure. hvd_dig_main/ self-test circuitry reference voltage 2 to fccu to mc_rgm (destructive reset) to mc_rgm digital supply (1.2v) reference voltage 1 lvd_dig_main hvd_dig_bkup/ lvd_dig_bkup
AN4266 functional safety requirements for application software doc id 024283 rev 2 53/76 figure 16. logic scheme of the lvd_flash, lvd_gpio and lvd_vreg operation of the lvd_flash, lvd_gpio and lvd_vreg is as follows (software intervention is not needed): a single lvd (pmu lvd or module lvf) can trigger a fault even if the other lvd is faulty (this event signals the mc_rgm) during each power on cycle self-test circuitry is able to detect failures on one of the two lvd?s (this event signals the fccu). mandatory: core voltage lvd and hvd implement a hardware assisted self-test that needs to be initiated by software once after the boot. note: rationale: to check the integrity of the lvd and hvd note: implementation hint: the hardware assisted self-tests are initiated by configuring pmuctrl_ctrl[silht[1:0]]. if the self-test passes, an ncf is triggered. if the self-test fails, a pmuctrl_irqs flag and cf are asserted. apart from the self-test, the use of the power management unit for asil d applications is transparent to the user, because the operation of the pmu is automatic. the spc56xl70xx embeds three lvds which can detect a failure in the 3.3v power supply. considering the failure mode ?wrong power regulation?, a diagnostic coverage of 90% is estimated against both a soft error and dc fault. 3.24 memory protection unit (mpu) the memory protection unit (mpu) provides hardware access control for all memory references generated in a device. using pre-programmed region descriptors that define memory spaces and their associated access rights, the mpu concurrently monitors all system bus transactions (including those initiated by the edma or flexray controller) and evaluates the appropriateness of each transfer. note: this scheme represents only the logical configuration and not the actual silicon implementation structure. pmu lvd module lvd self-test circuitry reference voltage 2 3.3 v supply to mc_rgm (destructive reset) to fccu
functional safety requirements for application software AN4266 54/76 doc id 024283 rev 2 memory references that have sufficient access control rights are allowed to complete, while references that are not mapped to any region descriptor or have insufficient rights are terminated with a protection error response. the mpu implements a set of program-visible region descriptors that monitor all system bus addresses. the result is a hardware structure with a two-dimensional connection matrix, where the region descriptors represent one dimension and the individual system bus addresses and attributes represent the second dimension. recommended: for asil d applications, the mpu should be used to ensure that only authorized software routines can configure modules and all other bus masters (edma, core, flexray) can access only their allocated resources according to their access rights. for the non-replicated master flexray, a correct mpu setup is highly recommended. 3.25 register protection module the register protection module offers a mechanism to protect defined memory mapped address locations in a module that has been write protected. the address locations that can be protected are module specific. the register protection module includes these distinctive features: the register protection module restricts write accesses for the module under protection to supervisor mode only. this access restriction is in addition to any access restrictions imposed by the protected module. a register cannot be written once soft lock protection is set. soft lock protection can be cleared by software or system reset. a register cannot be written once hard lock protection is set. hard lock protection can only be cleared by system reset. mandatory: for asil d applications, all configuration registers that aren?t modified during application execution, must be protected with a hard lock. note: rationale: hard lock is the last access protection against unwanted writes to some predefined memory mapped address locations. mandatory: access restrictions must be handled at mpu level. note: rationale: access restriction at the mpu level is protection against unwanted read/write accesses to some predefined memory mapped address locations. recommended: it is recommended that only hardware related software (os, drivers) run in supervisor mode. note: implementation hint : most of the off-platform peripherals have their own register protection module. register protection address space is inside the memory space reserved for the peripherals (please, refer to the ?spc56xl70xx registers under protection? section of the spc56xl70xx reference manual). each peripheral register that can be protected through the register protection module has a set soft lock bit reserved in the register protection address space. this bit shall be asserted to enable the protection of the related peripheral registers. moreover, the hard lock bit (reg_prot_gcr[hlb] = 1) should be set for best write protection.
AN4266 functional safety requirements for application software doc id 024283 rev 2 55/76 3.26 error correction status module (ecsm) there is no dedicated ecc module on the spc56xl70xx. ecc functionality is located in, or near, the different storage modules and may vary slightly depending on the needs (and size) of the storage. the ecsm is used to detect failures of data stored in memory (sram only) and addressing failures (see ?error correction status module (ecsm)? in the spc56xl70xx reference manual). the ecsm can detect and correct single-bit errors, detect two bit faults and detect faults affecting more than two bits. for sram, addressing information is included in the calculation and evaluation of the ecc to also detect addressing failure of the sram arrays. single-bit addressing failures that are detected are not corrected. instead, they are treated as a detected multi-bit error. ecc is automatically calculated on memory write accesses and is checked while read accesses are executed on memory. the ecsm corrects read data when a single-bit error is detected. optionally, the user can raise an interrupt or check the address of last corrected data. in the case of a multi-bit fault, both the fccu and mc_rgm modules take appropriate actions: activate error out pins reset nmi is triggered. the reporting functionality of the ecsm is disabled by default. mandatory: before the safety application starts executing, the error reporting shall be enabled. note: implementation hint: error reporting is enabled by configuring the ecc configuration register (ecr) of the ecsm module (for example, ecsm_ecr[epr1br] = 1b, see section ?ecc configuration register (ecr)? in the spc56xl70xx reference manual for details). 3.27 fault collection and control unit (fccu) the fault collection and control unit (fccu) offers a hardware channel to collect faults and to bring the device into a safe state when a failure has occurred. besides the possible initial configuration, no cpu intervention is necessary for collection and control operation.
functional safety requirements for application software AN4266 56/76 doc id 024283 rev 2 the fccu offers a systematic approach to fault detection and control. the distinctive features of the module are: collection of redundant hardware checker results (e.g., the rccu. see section 3.18, redundancy control checking unit (rccu) ) collection of error information from modules whose behavior is essential with respect to the safety goal configurable and graded fault control: ? internal reactions no reset reaction irq functional reset spc56xl70xx safe mode entered ? external reaction (failure is reported to the outside world via output pin) mandatory: only functional resets, or a switch to a safe state, is appropriate as internal reaction for asil d applications. note: rationale: maintain the device in the safe state in case of failure the only exception to this rule is when the cmu monitors a fmpll that is not used or is used for non-safety critical modules only. in this case, error masking and limited internal reaction can be tolerated. external reaction of the fccu is alwa ys enabled and can not be disabled. note: implementation hint: the application shall configure the fccu to enable all reactions related to faults of peripherals used by the application safety function. software shall be implemented to avoid cycling between a functional and a fault state. for example, in case of periodic ncfs, the software could clean the respective status and periodically move the device from fault state to normal state. this looping shall be avoided. mandatory: to prevent permanent cycling between a functional and a fault-state, software needs to keep track of cleaned faults, stop cleaning and stay in safe mode instead in case of inacceptable high frequency of necessary fault cleaning. the limit for the number and frequency of clearances is application dependent.
AN4266 functions of external devices for asil d applications doc id 024283 rev 2 57/76 4 functions of external devices for asil d applications this section describes the external components needed to use the spc56xl70xx for asil d applications. mandatory : at system level some countermeasures have to be placed in order to bring the safety-critical outputs to their safe state (e.g., by pull-up or pull-down resistors) when an output in high-impedance is not considered safe. it should be noted that the failure rates of external services are not included in fmeda of the spc56xl70xx and have to be included in the system fmeda by the user himself. 4.1 external watchdog function (exwd) mandatory: an external device, acting as the supervisor of operations, must provide a watchdog to cover ccfs of the spc56xl70xx for asil d applications. the watchdog shall be triggered periodically by safety relevant software running on the spc56xl70xx or other means demonstrating that the spc56xl70xx is still working. note: rationale: to detect critical ccf as a complete failure of the power supply some common causes of failure (e.g., failure on power supply) are detected because the software no longer triggers the watchdog. if a failure is detected, the exwd moves, and maintains, the system (ecu level) to a safe state condition within the ftti (such as the exwd disconnects the spc56xl70xx device from the power supply). the user can choose how to implement the watchdog communication between the spc56xl70xx and the external device (for example, communication via serial link, via toggling pin, or via the fccu error out signals). note: there must be a signalling path from the safety software to the external system through which the software can confirm correct initialization. this is not automatically guaranteed by the fccu_f[n] signals which communicate the status of the device independently from software. on the other hand, a different communications interface (such as a serial link) can be used to detect incorrect software initialization. 4.2 power supply and monitor function (psm) the spc56xl70xx includes some internal monitors which continuously check the various voltage supplies (see section 3.23, power management unit (pmu) ). mandatory: to prevent over voltage conditions causing malfunctions or possibly permanent damage to the spc56xl70xx, an external device must provide over voltage monitoring for the spc56xl70xx external 3.3 v supplies (such as i/o and vreg). under voltage conditions on the 3.3v supply may be detected indirectly by measurements from other functionality like the adc self-test or ecc/ecd logic. recommended: to fully monitor all voltage supplies, it is also recommended that an external device provides under voltage monitoring for the spc56xl70xx external 3.3 v supplies (such as i/o and vreg). note: rationale: to monitor the power supply voltage to ensure it is within the acceptable range
functions of external devices for asil d applications AN4266 58/76 doc id 024283 rev 2 if the power supply is out of range, the psm moves and maintains the system (ecu level) to a safe state condition within the ftti (for example, the psm disconnects the spc56xl70xx device from the power supply). note: working outside the specified voltage range may cause permanent damage to the spc56xl70xx even if the mcu is held in reset (see spc56xl70xx data sheet for correct voltage operating ranges). 4.3 error out monitor function (errm) the fccu has two external pi ns: fccu_f[0], fccu_f[1]. an external device must be connected to the fccu via fccu_f[0] and optionally fccu_f[1] to continually monitor the error output pins of the fccu. if a failure is detected, the errm moves and maintains the system (ecu level) to a safe state condition within the ftti (e.g., the errm disconnects the spc56xl70xx device from the power supply) mandatory: depending on user selection, there are two different ways to interface to the fccu: both fccu pins connected to the external device only a single fccu pin connected to the external device note: rationale: to monitor the error out signals (fccu_f[x]) for correct functionality mandatory: for asil d applications, the user can choose between these fccu configurations, depending on which best fits the hardware and software system. both fccu configurations work properly with all the supported error out protocols. refer to the spc56xl70xx reference manual for a list of supported protocols. note: the system (for example, ecu) cannot rely on any pins, other than the spc56xl70xx error output pins (fccu_f[n]), when those pins indicate an error. 4.3.1 both fccu pins connected to external device in this case, both pins fccu_f[0] and fccu_f [1] are connected to the external device. mandatory: the external device must check both signals, taking into account that fccu_f[0] = fccu_f[1] . note: rationale: to check the integrity of the fccu in this configuration the external device continuously monitors the output of the fccu. thus it can detect if the fccu does not work properly. the advantage of this configuration with respect to the other one is that it does not need any dedicated software. note: implementation hint: monitoring the error out pins through a combinatorial logic (e.g., xor port) can generate some glitches. oversampling these pins reduces the possibility that the glitches occur. 4.3.2 single fccu pin connected to external device a single pin, fccu_f[0] (or fccu_f[1]), is connected to the external device.
AN4266 functions of external devices for asil d applications doc id 024283 rev 2 59/76 if a fault occurs, the fccu communicates it to the external device through the fccu_f[0] (or fccu_f[1]) pin. the functionality of fccu_f[0] (or fccu_f[1]) can be verified in 2 ways: fccu_f[0] (or fccu_f[1]) output read back (internal connection) fccu_f[0] (or fccu_f[1]) output connected externally to a normal gpio. the customer must choose which solution better fits their requirements. mandatory: after boot, but before executing the safety function, the functionality of fccu_f[0] (or fccu_f[1]) pin shall be verified (j) . note: rationale: to check the integrity of the fccu error out signals note: implementation hint: to verify the functionality of fccu_f[0] (or fccu_f[1]) pin, a fault may be injected and the behavior of the pin could be checked by fccu_f[1] (or fccu_f[0]), or gpio. it?s possible to change the polarity of the error out pin by configuring the fccu_cfg[fccu_cfg.ps] bit. other met hods for checking the functionality of fccu_f[0] (or fccu_f[1]) may be implemented. the advantage of a single fccu_f[x] signal being used, when compared to using both fccu_f[x] signals as in the previous section, is that an external device does not need to be used for comparing the fccu_f[x] signals. 4.4 pwm output monitored by external asic (pwma) the flexpwm module integrated in the spc56xl70xx can insert dead time in the generated pwms. mandatory: an asil d compliant application shall include an external device which checks the pwm output signals. note: rationale: to check the accuracy of the pwm signals the distinctive features that must be managed by the external device are: dead-time must be always positive and greater than the maximum value between ton and toff of the inverter switches open pins and short to supply or ground shall be detected in case read back is not performed via input capture functionality on the spc56xl70xx if a failure is detected, the pwma moves and maintains the system (ecu level) to a safe state condition within the ftti (e.g., the pwma disconnects the spc56xl70xx device from the power supply). in general, if the safety application uses i/os to control actuator with short safety time against wrong control (for example, a motor control application with dead-time requirements to avoid short circuits destroying the motor), those requirements shall be supervised externally if the error reaction delay within the spc56xl70xx can exceed the safety time of the actuators. j. since fccu is a monitor, it is sufficient to verify the fccu_f[0] (or fccu_f[1]) signal only at startup in order to avoid latent faults.
functions of external devices for asil d applications AN4266 60/76 doc id 024283 rev 2 note: implementation hint: in case pwm signals drive the switches of a power stage, etimer can not be used to detect dead-time fault because its failure indication time is normally greater than the time needed to have a physical permanent failure in the power stage.
AN4266 scenarios for automotive applications: motor control doc id 024283 rev 2 61/76 5 scenarios for automotive ap plications: motor control this section shows some examples of safety-related inputs and outputs from some motor control applications. 5.1 application example 1 application: 3-phase electric motor control motor control algorithm: field oriented control (foc) position sensor(s): incremental encoder; 3 hall sensors current sensor(s): 3 shunts on motor phases or on inverter legs current sensor(s) for diagnostic: 1 shunt on direct-current (dc) link 5.1.1 functional safety related inputs table 14. functional safety inputs for application example 1 signal description input signal (alias) source destination (module on spc56xl70xx) comments fccu input fccu_f[1] (if used) fccu output pin fccu_f[0] fccu fccu output loop-back signal. phase current 1 an[0] asic or current sensor adc_0 precautions for usage are presented in section , single read analog inputs . phase current 2 an[15] asic or current sensor adc_1 precautions for usage are presented in section , single read analog inputs . phase current 3 an[11] asic or current sensor adc_0 adc_1 precautions for usage are presented in section , single read analog inputs . dc voltage for dc ripple compensation an[1] asic adc_0 precautions for usage are presented in section , single read analog inputs . dc-link current an[16] asic or current sensor adc_1 precautions for usage are presented in section , single read analog inputs . non-maskable interrupt nmi (1) external component (asic) wkpu critical interrupt routine or error/fault signal coming from external device. reset signal reset b external component (asic, companion chip) mc_rgm reset signal coming from external device.
scenarios for automotive applications: motor control AN4266 62/76 doc id 024283 rev 2 5.1.2 functional safety related outputs incremental encoder management etc[0?1] etc[0?1] incremental encoder etimer_0 etimer_1 precautions for usage are presented in section , double read encoder inputs . hall sensors management etc[2?4] etc[2?4] hall sensors siul precautions for usage are presented in section , double read pwm inputs . dspi receive signal sin external component (asic) dspi_0 if dspi_0 is used, an appropriate safety protocol must be utilized. dspi receive signal sin external component (asic) dspi_1 if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan receive signal can_rx external component (asic) flexcan_0 if flexcan_0 is used, an appropriate safety protocol must be utilized. flexcan receive signal can_rx external component (asic) flexcan_1 if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray receive signals fr_ca_rx fr_cb_rx external component (asic) flexray if flexray is used, an appropriate safety protocol must be utilized. 1. the nmi input is not intended or certified for use as the so le mechanism to react to the failure of a system component external to the spc56xl70xx. for asil d certification, additi onal measures at the system level are necessary to handle failures of non-spc56xl70xx components beyond notif ication of the spc56xl70xx device via nmi. table 14. functional safety inputs for application example 1 (continued) signal description input signal (alias) source destination (module on spc56xl70xx) comments table 15. functional safety outputs for application example 1 signal description output signal (alias) source (module on spc56xl70xx) destination comments fccu output fccu_f[0] fccu external component (asic) error out signal that indicates the presence of a failure in the device. fccu output fccu_f[0] fccu alternative 1: fccu_f[1] fccu output loop-back signal. fccu_f[1] = fccu_f[0] fccu alternative 2: external component (asic) inverted error out signal that indicates the presence of a failure in the device. pwm output signal a[0?2], b[0?2] flexpwm external component (asic) precautions for usage are presented in section , single write pwm outputs with read back .
AN4266 scenarios for automotive applications: motor control doc id 024283 rev 2 63/76 5.2 application example 2 application: 3-phase electric motor control motor control algorithm: field oriented control (foc) position sensor(s): resolver; 3 hall sensors current sensor(s): 3 shunts on motor phases or on inverter legs current sensor(s) for diagnostic: 1 shunt on dc link clockout clk_out mc_cgm external component (asic) clockout signal to be used if the external components needs the spc56xl70xx clock for internal usage or for monitoring. clockout inverted signal clk_out mc_cgm external component (asic) inverted clockout signal to be used if the external components needs the spc56xl70xx clock for internal usage or for monitoring. transceiver enable (for communication peripherals) gpo[?] siul external component (asic, transceiver) precautions for usage are presented in section , single write digital outputs with read back . reset signal gpo[0] siul external component (asic, companion chip) reset signal for the external component(s) precautions for usage are presented in section , single write digital outputs with read back . dspi transmit signal sout dspi_0 external component (asic) if dspi_0 is used, an appropriate safety protocol must be utilized. dspi transmit signal sout dspi_1 external component (asic) if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_0 external component (asic) if flexcan_0 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_1 external component (asic) if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray transmit signals fr_ca_tx fr_cb_tx flexray external component (asic) if flexray is used, an appropriate safety protocol must be utilized. table 15. functional safety outputs for application example 1 (continued) signal description output signal (alias) source (module on spc56xl70xx) destination comments
scenarios for automotive applications: motor control AN4266 64/76 doc id 024283 rev 2 5.2.1 functional safety related inputs table 16. functional safety inputs for application example 2 signal description input signal (alias) source destination (module on spc56xl70xx) comments fccu input fccu_f[1] (if used) fccu output pin fccu_f[0] fccu fccu output loop-back signal. phase current 1 an[0] asic or current sensor adc_0 precautions for usage are presented in section , single read analog inputs . phase current 2 an[15] asic or current sensor adc_1 precautions for usage are presented in section , single read analog inputs . phase current 3 an[11] asic or current sensor adc_0 adc_1 precautions for usage are presented in section , single read analog inputs . dc voltage for dc ripple compensation an[1] asic adc_0 precautions for usage are presented in section , single read analog inputs . dc-link current an[16] asic or current sensor adc_1 precautions for usage are presented in section , single read analog inputs . non-maskable interrupt nmi (1) external component (asic) wake-up unit critical interrupt routine or error/fault signal coming from external device. reset signal reset b external component (asic, companion chip) mc_rgm reset signal coming from external device. resolver management (sine/cosine) an[2?3] an[17?18] resolver adc_0 adc_1 precautions for usage are presented in section , single read analog inputs . hall sensors management etc[0?2] etc[0?2] hall sensors etimer_0 etimer_1 precautions for usage are presented in section , double read pwm inputs . dspi receive signal sin external component (asic) dspi_0 if dspi_0 is used, an appropriate safety protocol must be utilized. dspi receive signal sin external component (asic) dspi_1 if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan receive signal can_rx external component (asic) flexcan_0 if flexcan_0 is used, an appropriate safety protocol must be utilized.
AN4266 scenarios for automotive applications: motor control doc id 024283 rev 2 65/76 5.2.2 functional safety related outputs flexcan receive signal can_rx external component (asic) flexcan_1 if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray receive signals fr_ca_rx fr_cb_rx external component (asic) flexray if flexray is used, an appropriate safety protocol must be utilized. 1. the nmi input is not intended or certified for use as the so le mechanism to react to the failure of a system component external to the spc56xl70xx device. for asil d certification, additional measures at the system level are necessary to handle failures of non-spc56xl70xx components beyond notification of the spc56xl70xx device via nmi. table 16. functional safety inputs for application example 2 (continued) signal description input signal (alias) source destination (module on spc56xl70xx) comments table 17. functional safety outputs for application example 2 signal description output signal (alias) source (module on spc56xl70xx) destination comments fccu output fccu_f[0] fccu external component (asic) error out signal, that indicates the presence of a failure in the device. fccu output fccu_f[0] fccu alternative 1: fccu_f[1] fccu output loop-back signal. fccu_f[1] = fccu_f[0] fccu alternative 2: external component (asic) inverted error out signal that indicates the presence of a failure in the device. pwm output signal a[0?2], b[0?2] flexpwm external component (asic) precautions for usage are presented in section , single write pwm outputs with read back . resolver excitation da [0] swg resolver precautions for usage are presented in section , single read analog inputs . clockout clk_out mc_cgm external component (asic) clockout signal to be used if the external components need the spc56xl70xx clock for internal usage or for monitoring. clockout inverted signal clk_out mc_cgm external component (asic) inverted clockout signal to be used if the external components need the spc56xl70xx clock for internal usage or for monitoring. transceiver enable (for communication peripherals) gpo[-] siul external component (asic, transceiver) precautions for usage are presented in section , single write digital outputs with read back .
scenarios for automotive applications: motor control AN4266 66/76 doc id 024283 rev 2 5.3 application example 3 application: 3-phase electric motor control motor control algorithm: sinusoidal control (sc) or 6-step mode position sensor(s): incremental encoder; 3 hall sensors current sensor(s) for diagnostic: 1 shunt on dc link 5.3.1 functional safety related inputs reset signal gpo[0] siul external component (asic, companion chip) reset signal for the external component(s). precautions for usage are presented in section , single write digital outputs with read back . dspi transmit signal sout dspi_0 external component (asic) if dspi_0 is used, an appropriate safety protocol must be utilized. dspi transmit signal sout dspi_1 external component (asic) if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_0 external component (asic) if flexcan_0 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_1 external component (asic) if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray transmit signals fr_ca_tx fr_cb_tx flexray external component (asic) if flexray is used, an appropriate safety protocol must be utilized. table 17. functional safety outputs for application example 2 (continued) signal description output signal (alias) source (module on spc56xl70xx) destination comments table 18. functional safety inputs for application example 3 signal description input signal (alias) source destination (module on spc56xl70xx) comments fccu input fccu_f[1] (if used) fccu output pin fccu_f[0] fccu fccu output loop-back signal. dc voltage for dc ripple compensation an[0] asic adc_0 precautions for usage are presented in section , single read analog inputs . dc-link current an[15] asic or current sensor adc_1 precautions for usage are presented in section , single read analog inputs .
AN4266 scenarios for automotive applications: motor control doc id 024283 rev 2 67/76 5.3.2 functional safety related outputs non-maskable interrupt nmi (1) external component (asic) wake-up unit critical interrupt routine or error/fault signal coming from external device. reset signal reset b external component (asic, companion chip) mc_rgm reset signal coming from external device. incremental encoder management etc[0?1] etc[0?1] incremental encoder etimer_0 etimer_1 precautions for usage are presented in section , double read encoder inputs . hall sensors management etc[2?4] etc[2?4] hall sensors etimer_0 etimer_1 precautions for usage are presented in section , double read pwm inputs . dspi receive signal sin external component (asic) dspi_0 if dspi_0 is used, an appropriate safety protocol must be utilized. dspi receive signal sin external component (asic) dspi_1 if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan receive signal can_rx external component (asic) flexcan_0 if flexcan_0 is used, an appropriate safety protocol must be utilized. flexcan receive signal can_rx external component (asic) flexcan_1 if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray receive signals fr_ca_rx fr_cb_rx external component (asic) flexray if flexray is used, an appropriate safety protocol must be utilized. 1. the nmi input is not intended or certified for use as the so le mechanism to react to the failure of a system component external to the spc56xl70xx device. for asil d certification, additional measures at the system level are necessary to handle failures of non-spc56xl70xx components beyond notification of the spc56xl70xx device via nmi. table 18. functional safety inputs for application example 3 (continued) signal description input signal (alias) source destination (module on spc56xl70xx) comments table 19. functional safety outputs for application example 3 signal description output signal (alias) source (module on spc56xl70xx) destination comments fccu output fccu_f[0] fccu external component (asic) error out signal, that indicates the presence of a failure in the device.
scenarios for automotive applications: motor control AN4266 68/76 doc id 024283 rev 2 fccu output fccu_f[0] fccu alternative 1: fccu_f[1] fccu output loop-back signal. fccu_f[1] = fccu_f[0] fccu alternative 2: external component (asic) inverted error out signal, that indicates the presence of a failure in the device. pwm output signal a[0?2], b[0?2] flexpwm external component (asic) precautions for usage are presented in section , single write pwm outputs with read back . clockout clk_out mc_cgm external component (asic) clockout signal to be used if the external components need the spc56xl70xx clock for internal usage or for monitoring. clockout inverted signal clk_out mc_cgm external component (asic) inverted clockout signal to be used if the external components need the spc56xl70xx clock for internal usage or for monitoring transceiver enable (for communication peripherals) gpo[?] siul external component (asic, transceiver) precautions for usage are presented in section , single write digital outputs with read back . reset signal gpo[0] siul external component (asic, companion chip) reset signal for the external component(s). precautions for usage are presented in section , single write digital outputs with read back . dspi transmit signal sout dspi_0 external component (asic) if dspi_0 is used, an appropriate safety protocol must be utilized. dspi transmit signal sout dspi_1 external component (asic) if dspi_1 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_0 external component (asic) if flexcan_0 is used, an appropriate safety protocol must be utilized. flexcan transmit signal can_tx flexcan_1 external component (asic) if flexcan_1 is used, an appropriate safety protocol must be utilized. flexray transmit signals fr_ca_tx fr_cb_tx flexray external component (asic) if flexray is used, an appropriate safety protocol must be utilized. table 19. functional safety outputs for application example 3 (continued) signal description output signal (alias) source (module on spc56xl70xx) destination comments
AN4266 ecc logic test doc id 024283 rev 2 69/76 6 ecc logic test 6.1 overview this appendix describes the required information on how to develop the software for such ecc logic test. a flash memory ecc logic test is needed to perform a test to check flash memory ecc logic every ftti (10 ms). the goal is to ensure high coverage of the faults in ecc logic with minimum performance penalty to customer?s application. thus, the performance penalty must be less than 2% which means that the test lasts less than 200 s considering a ftti of 10 ms. the spc56xl70xx flash memory has a utest (user-test) mode ecc logic check feature which can be utilized for this ecc logic test. a data pattern with walking 0 through data and ecc parity bits can be applied during the ecc logic check procedure to achieve high fault coverage of the ecc logic and fast execution. 6.2 data pattern - walking 0 to reach the needed performances the use of the data pattern with walking 0 through data and ecc parity bits must be used. tab le 20 shows the data vectors. table 20. data pattern used by the ecc logic test (1) 1. each vector is a 72-bit ecc code-word. data vector number 8-bit ecc parity bits 64-bit data bits 0 0xff 0xffff_ffff_ffff_fffe 1 0xff 0xffff_ffff_ffff_fffd 2 0xff 0xffff_ffff_ffff_fffb 3 0xff 0xffff_ffff_ffff_fff7 4 0xff 0xffff_ffff_ffff_ffef 5 0xff 0xffff_ffff_ffff_ffdf 6 0xff 0xffff_ffff_ffff_ffbf 7 0xff 0xffff_ffff_ffff_ff7f ... ... ... 62 0xff 0xbfff_ffff_ffff_ffff 63 0xff 0x7fff_ffff_ffff_ffff 64 0xfe 0xffff_ffff_ffff_ffff 65 0xfd 0xffff_ffff_ffff_ffff ... ... ... 71 0x7f 0xffff_ffff_ffff_ffff 72 0xff 0xffff_ffff_ffff_ffff
ecc logic test AN4266 70/76 doc id 024283 rev 2 it is important to note that for double word data = 0xffff_ffff_ffff_ffff, the correct ecc check bits should be 0xff. therefore, every data vector in the data pattern in tab le 20 , except the last one, contains a single-bit ecc error and will result in a single-bit correction. 6.3 utest mode ecc logic check the procedure to use the utest mode ecc logic check is listed as below: 1. write 0xf9f9_9999 to ut0 to enable utest mode (ut0[ute] will be set). 2. write ut0[sbce] to 1 to enable single-bit error correction visibility. 3. write ut0[eie] to 1. 4. write ut0[dsi], ut1[dai] and/or ut2[dai] bits to provide the current data vector including the double-word data and check bit values to be read. the data and check bit values are from the chosen ecc test data pattern, i.e., walking 0 pattern shown above. 5. write double-word address to receive the data input in step 4 into the adr register. 6. reads the address stored in adr register via biu using a cpu instruction. the expected data, and corrections or detections should be observed based on data written into the ut0[dsi], ut1[dai] and/or ut2[dai] registers. mcr[eer] and mcr[sbc] will be checked to evaluate the status of reads done. 7. repeat steps 4 to 6 for all the data vectors in the proposed test data pattern. 8. once completed, clear the ut0[eie] bit to 0. 6.4 fault coverage and execution time the described ecc logic test reaches a 92.7% fault coverage of ecc decode logic. the execution of the test code takes 176 s at 80 mhz.
AN4266 i/o pin/ball configuration doc id 024283 rev 2 71/76 7 i/o pin/ball configuration mandatory: the user must avoid configurations that place redundant signals on neighboring pads or pins. whether two functions on two package pins/balls are adjacent to each other can easily be determined by looking at the mechanical drawings of the packages (see the spc56xl70xx data sheet ) together with the pin/spheres (balls) number information of the packages as seen in the spc56xl70xx reference manuals ?system integration unit lite (siul)? section and the ?pin muxing? table. the internal die pad sequence can be derived from the package pin sequence of the qfp144 pin package shown in the spc56xl70xx data sheet . figure 17. example of qfp144 pin/pad adjacency for example, the internal die pads supporting the functionality described in figure 17 are referred to by ?port pin? in the first column. from this figure you can see that the port pins are b[9] and b[10]. since these two port pins are in sequential order on the same port (port b) the die pads are adjacent to each other. the corresponding two qfp144 package pin numbers are directly adjacent to each other, qfp144 pins 52 and 53. in general, the internal die pads follow the same sequence as the corresponding package pins for qfp144 packages. if pins on the qfp144 pins are adjacent to each other, the corresponding internal die pads are also adjacent. likewise, if package pins are not adjacent to each other the corresponding die pads are also not adjacent. an example on the bga package as shown in figure 18 has two balls belonging to port pins b[9] and b[10], which are balls u7 and r8, respectively. they are not directly adjacent to
i/o pin/ball configuration AN4266 72/76 doc id 024283 rev 2 each other on the bga package. however, their corresponding die pads are adjacent to each other as described above since the same die is used in the qfp144 and bga packages. figure 18. bga balls non-adjacent, die pads adjacent figure 19. bga balls adjacent, die pads non-adjacent in another example looking at balls u4 and u5 in figure 18 . their functionality is implemented by port pins e[4] and c[2] (qfp144 pins 42 and 45, respectively, shown in figure 19 ). these two spheres are adjacent to each other on the bga, but not on the qfp144. therefore, the two corresponding die pads are not adjacent to each other. the above examples are valid for corresponding pins on bga (257 balls) and qfp144 packages only. for a thorough analysis of pin adjacency related to all signals see . this table can be used to determine whether two pins are adjacent in the internal die for all signals and packages. two pins, identified by the columns ?port name?, are adjacent on the internal die if the numbers in the ?physical pad sequence? column are consecutive (for example, pad number n and pad number n + 1 are adjacent).
AN4266 further information doc id 024283 rev 2 73/76 8 further information 8.1 conventions and terminology ta ble 21 shows the list of conventions for this document. 8.2 acronyms and abbreviations a short list of acronyms and abbreviations used in this document is reported below for completeness. table 21. list of conventions and terminology convention description error discrepancy between a computed, observed, or measured value or condition and the true, specified or theoretically correct value or condition. fault abnormal condition that may cause a reduction in, or loss of, the capability of a functional unit to perform a required function. failure the termination of the ability of a functional unit to perform a required function. table 22. acronyms and abbreviations terms meanings adc analog to digital converter bam boot assist module ccf common cause failure cf critical fault cmu clock monitor unit crc cyclic redundancy check ctu cross-triggering unit dc diagnostic coverage ded dual error detection ecc error correcting code ecsm error correction status module edma enhanced direct memory access errm error out monitor function exwd external watchdog function fccu fault collection and control unit fmeda failure modes, effects and diagnostic analysis fmpll frequency-modulated phase-locked loop
further information AN4266 74/76 doc id 024283 rev 2 8.3 document references safety application guide for spc56xl70xx family reference manual addendum (tn0983, doc id 024257). gpio general purpose input/output lbist logic built-in self-test lsm lock step mode mbist memory built-in self-test mc_cgm clock generation module mc_me mode entry mcu (microcontroller unit) mpu memory protection unit ncf non-critical fault nmi non-maskable interrupt nvm non-volatile memory pmu power management unit psm power supply and monitor function pwm pulse width modulation rccu redundancy control checking unit mc_rgm reset generation module sag safety application guide sec single error correction sef safety element function sff safe failure fraction sif safety integrity function sil safety integrity level sor sphere of replication swg sine wave generator swt software watchdog timer table 22. acronyms and abbreviations (continued) terms meanings
AN4266 revision history doc id 024283 rev 2 75/76 9 revision history table 23. document revision history date revision changes 18-feb-2013 1 initial release 17-sep-2013 2 updated disclaimer.
AN4266 82/82 doc id 024283 rev 2 please read carefully: information in this document is provided solely in connection with st products. stmicroelectronics nv and its subsidiaries (?st ?) reserve the right to make changes, corrections, modifications or improvements, to this document, and the products and services described he rein at any time, without notice. all st products are sold pursuant to st?s terms and conditions of sale. purchasers are solely responsible for the choice, selection and use of the st products and services described herein, and st as sumes no liability whatsoever relating to the choice, selection or use of the st products and services described herein. no license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted under this document. i f any part of this document refers to any third party products or services it shall not be deemed a license grant by st for the use of such third party products or services, or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoev er of such third party products or services or any intellectual property contained therein. unless otherwise set forth in st?s terms and conditions of sale st disclaims any express or implied warranty with respect to the use and/or sale of st products including without limitation implied warranties of merchantability, fitness for a particular purpose (and their equivalents under the laws of any jurisdiction), or infringement of any patent, copyright or other intellectual property right. st products are not designed or authorized for use in: (a) safety critical applications such as life supporting, active implanted devices or systems with product functional safety requirements; (b) aeronautic applications; (c) automotive applications or environments, and/or (d) aerospace applications or environments. where st products are not designed for such use, the purchaser shall use products at purchaser?s sole risk, even if st has been informed in writing of such usage, unless a product is expressly designated by st as being intended for ?automotive, automotive safety or medical? industry domains according to st product design specifications. products formally escc, qml or jan qualified are deemed suitable for use in aerospace by the corresponding governmental agency. resale of st products with provisions different from the statem ents and/or technical features set forth in this document shall immediately void any warranty granted by st for the st product or service described herein and shall not create or extend in any manner whatsoev er, any liability of st. st and the st logo are trademarks or register ed trademarks of st in various countries. information in this document supersedes and replaces all information previously supplied. the st logo is a registered trademark of stmicroelectronics. all other names are the property of their respective owners. ? 2013 stmicroelectronics - all rights reserved stmicroelectronics group of companies australia - belgium - brazil - canada - china - czech republic - finland - france - germany - hong kong - india - israel - ital y - japan - malaysia - malta - morocco - philippines - singapore - spain - swed en - switzerland - united kingdom - united states of america www.st.com

▲Up To Search▲

Price & Availability of AN4266

	To Download AN4266 Datasheet File
If you can't view the Datasheet, Please click here to try to view without PDF Reader .