AN3077 datasheet(49/82 Pages) STMICROELECTRONICS

49 / 82 page

DocID16384 Rev 10

49/82

AN3077

Functional safety requirements for application software

Note:

Implementation hint: In general, the following two application-dependent configurations

must be executed before CMU monitoring will be enabled:

●

The first configuration is related to the XOSC_CLK monitor of CMU_0. The software

shall configure CMU_0_CSR[RCDIV] to select a divider for the IRCOSC. The divided

RCOSC frequency will be compared with the XOSC_CLK.

●

The second configuration relates to the other clock signals being monitored. The high

frequency reference (CMU_n_HFREFR_A[HFREF_A]) and low frequency reference

(CMU_n_LFREFR_A[LFREF_A]) shall be configured depending on the SoR (CMU_0),

motor control related peripherals (CMU_1) and FlexRay (CMU_2) clock frequencies.

Once the CMUs are configured, the clock monitoring must be enabled by asserting

CMU_n_CSR[CME_A] (= 1).

3.21

Frequency-Modulated Phase-Locked Loop (FMPLL)

Mandatory: Application software has the responsibility of checking that the system uses the

system FMPLL clock as system clock before running any safety element function

(PLL_SWCHECK).

Note:

Rationale: To decrease the risk of a glitch from the crystal or IRCOSC

Note:

Implementation hint: Application software can verify the current system clock by checking

MC_ME_GS[S_SYSCLK] status. MC_ME_GS[S_SYSCLK] = 0x4 indicates system FMPLL

clock is used as system clock.

Mandatory: Each FMPLL provides a loss of lock error indication which is routed to the

MC_RGM and FCCU. The application software must enable the respective fault and

configure the FCCU to manage the fault.

Note:

Rationale: To check the integrity of the FMPLL clock

Since the system can be driven by the IRCOSC, if there is a system clock fault, an FMPLL

fault is considered a Non-Critical Fault (NCF). If the FMPLL successfully relocks after a

clock fault it will typically stay relocked since the locking process includes built in hysteresis

between loosing and regaining the lock.

Note:

Implementation hint: Software must clear FMPLL_n_CR[PLL_FAIL_MASK] so the pll_fail

output is not masked.

To enable the RGM input related to FMPLL loss of clock, RGM_FERD[D_PLLn] and

RGM_FEAR[AR_PLLn] must be configured.

To enable FCCU fault paths, registers in the FCCU must be configured (NCF_CFG0,

NCFS_CFG0, NCF_TOE0, etc.). Loss of lock signals from FMPLL_0 and FMPLL_1 provide

the FCCU NCF[2] and NCF[3] inputs, respectively.

The MC_RGM and FCCU configuration includes the reaction in case of FMPLL loss of lock.

This reaction is application-dependent.

3.22

Internal RC Oscillator (IRCOSC)

The frequency meter of CMU_0 must be exploited to verify the availability and frequency of

the IRCOSC. This feature allows measuring the IRCOSC frequency using the external

oscillator as the clock source.

AN3077 датащи(PDF) 49 Page - STMicroelectronics

AN3077 датащи(HTML) 49 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

датащи скачать

ссылки URL