AN4475
Application note
Safety Application Guide for SPC563Mxx family
Introduction
This document contains guidelines in order to configure and use the SPC563Mxx device for
safety relevant applications. These guidelines are preceded by one of the following bold text
statements:
•
•
•
Suggested
Implementation hint
Rationale
These guidelines are useful approaches for the specific topics under discussion even if they
are not mandatory. The user needs to use discretion in deciding whether these measures
are appropriate for their applications.
This document is valid only under the assumption that the MCU is used in automotive
applications for use cases requiring a fail-safe MCU and if the environmental conditions
specified in the SPC563Mxx device data sheet are maintained.
Together with the standard documentation as the reference manual and the datasheet, also
SPC563Mxx device errata sheet must be taken into account during system design and
implementation (see
Chapter Appendix B: Document references).
May 2014
DocID026216 Rev 1
1/27
www.st.com
Contents
AN4475
Contents
1
General information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.1
1.2
1.3
1.4
Mission profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Safe state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Failure indication time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Error handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2
Functional safety requirements for application software . . . . . . . . . . . 7
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
Application software requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
System Clock and Frequency-Modulated Phase-Locked Loop (FMPLL) . 7
General-Purpose Static RAM (SRAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
FLASH memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Interrupt Controller (INTC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Enhanced Direct Memory Access (eDMA) . . . . . . . . . . . . . . . . . . . . . . . . 10
Communication peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
I/O peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
Read digital inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Read PWM inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Write digital outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Write PWM outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Enhanced Time Processing Unit (eTPU2) . . . . . . . . . . . . . . . . . . . . . . . 14
2.10
Enhanced Queued Analog-to-Digital Converter (eQADC) . . . . . . . . . . . . 14
2.10.1
2.10.2
Double read analog inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Additional mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
Temperature sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Software Watchdog Timer (SWT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Multi-Layer AHB Crossbar Switch (XBAR) . . . . . . . . . . . . . . . . . . . . . . . . 16
Peripheral Bridge (PBRIDGE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Power Management Controller (PMC) . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Error Correction Status Module (ECSM) . . . . . . . . . . . . . . . . . . . . . . . . . 17
Periodic Interrupt Timer (PIT_RTI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
System Timer Module (STM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2/27
DocID026216 Rev 1
AN4475
Contents
2.19
All safety relevant modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3
Functions of external devices for safety applications . . . . . . . . . . . . . 19
3.1
3.2
3.3
External Watchdog function (EXWD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Power Supply Monitor function (PSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
PWM Output Monitor function (PWMM) . . . . . . . . . . . . . . . . . . . . . . . . . . 20
4
ECC logic test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.1
4.2
4.3
4.4
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Data pattern – Walking 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
UTEST mode ECC logic check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Fault coverage and execution time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Appendix A Further information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
A.1
A.2
Conventions and terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Acronyms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Appendix B Document references . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
DocID026216 Rev 1
3/27
3
List of tables
AN4475
List of tables
Table 1.
Table 2.
Table 3.
Table 4.
Data pattern used by the ECC logic test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
List of conventions and terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Acronyms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4/27
DocID026216 Rev 1
General information
AN4475
1
1.1
General information
Mission profile
The assumed mission profile is:
•
•
•
•
Lifetime: 20 years
Total operating hours: 12000 hours
Trip time
(a)
: 10 hours
Fault Tolerant Time Interval
(b)
: 10 ms
1.2
Safe state
The Safe states of the SPC563MXX are as follows:
•
•
•
•
Completely unpowered
Reset
Operating correctly
Explicitly indicating an internal error
If the SPC563Mxx signals an internal failure via its error out signals, the surrounding
subsystem is longer use the SPC563Mxx outputs for safety functions since these signals
are no longer considered reliable. If an error is indicated, the system must be able to remain
in a Safe state without any additional MCU actions. Depending on its configuration, the
system may disable, or reset, the SPC563Mxx as a reaction to the error signal.
Suggested:
the system must set the system itself to a safe state when an error is indicated.
1.3
Failure indication time
The SPC563Mxx failure indication time has taken into consideration when determining
application safety strategies, because it must be less than the FTTI.
1.4
Error handling
Error handling can be split into two categories:
•
•
Handling of errors during run-time
Handling of errors during boot-time
Suggested:
run-time failures are handled in a time shorter than the FTTI.
Suggested:
boot-time failures are handled before the safety function starts.
a. Trip time is defined as the maximum MCU operation time without Power-On Reset.
b.
Quoting the ISO262562, the Fault Tolerant Time Interval (FTTI) is the time-span in which a fault or faults can
be present in a system before a hazardous event occurs.
6/27
DocID026216 Rev 1
传感器
京公网安备 11010802033920号
Copyright © 2005-2026 EEWORLD.com.cn, Inc. All rights reserved
电子工程世界
