AN3077 datasheet(14/82 Pages) STMICROELECTRONICS

14 / 82 page

Functional safety requirements for application software

AN3077

14/82

DocID16384 Rev 10

Note:

Implementation hint: This requirement is satisfied by writing SSCM_ERROR[RAE] = 1.

Each access to the BAM memory area produces a Machine Check exception.

3.2.2

Checking

Mandatory: After boot, but before executing any safety function, the application software

needs to read SSCM_STATUS[LSM] to verify that the device runs in the selected mode of

operation:

●

Decoupled Parallel Mode (DPM) – SSCM_STATUS[LSM] = 0

●

Lock Step Mode (LSM) – SSCM_STATUS[LSM] = 1

Note:

Rationale: To check if the MCU started in LSM

3.3

Self-Test Control Unit (STCU)

3.3.1

Configuration

The STCU does not require any configuration written by application software. The default

STCU configuration is to execute LBIST/MBIST and to react to detected faults by triggering

a Non-Critical Fault (NCF) that signals the FCCU (See “Self-Test Control Unit (STCU)”

chapter in the Device_Number Reference Manual for details).

Mandatory: LBISTs and MBISTs shall be configured to be executed once per trip time (trip

time defined in Section 2.1, Mission profile).

3.3.2

Checking

Mandatory: Once after boot, before the safety application starts, application software shall

carry out some STCU checking steps for ensuring STCU reliability.

Note:

Implementation hint: See “Integrity SW Operations” section of the “Self-Test Control Unit

(STCU)” chapter in the Device_NumberReference Manual for details.

Note:

Rationale: STCU manages the execution, and checks the result, of the LBISTs and

MBISTs. The STCU’s correct behavior must be verified by checking the expected results

with software.

The Integrity SW should confirm that all MBISTs and LBISTs finished successfully with no

additional errors flagged. This software confirmation prevents a fault within the STCU itself

from incorrectly indicating that the self-test passed.

This is an additional safety layer since the STCU propagates the LBIST/MBIST and internal

faults using the NCF signals of the FCCU. So, reading STCU_LBS, STCU_LBE,

STCU_MBSL, STCU_MBSH, STCU_MBEL, STCU_MBEH and STCU_ERR registers helps

increase the STCU auto-test coverage.

3.4

Reset Generation Module (MC_RGM)

A redundant fault notification path is achieved through the use of the MC_RGM and the

FCCU. MC_RGM configuration is application dependent.

Mandatory: However, to have the redundant notification path, both MC_RGM and FCCU

shall be configured to react to critical application faults.

AN3077 датащи(PDF) 14 Page - STMicroelectronics

AN3077 датащи(HTML) 14 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

датащи скачать

ссылки URL