AN3077 datasheet(10/82 Pages) STMICROELECTRONICS

10 / 82 page

General information

AN3077

10/82

DocID16384 Rev 10

Defining these states as safe for the MCU means that the overall system must react safely

to the Device_Number being in, and entering, any of these states. For the ‘Completely

unpowered’ and ‘Reset’ states the addition of a pullup or pulldown resistor on relevant

signals may be necessary. If an ‘Explicit indication of internal error’ occurs on FCCU_F[0:1],

the application must not depend on the MCU for continued operation. This also means that

the system must be able to remain in a safe state without any additional actions from the

MCU.

Mandatory: The system must transition to a safe state when there is an indication of an

error.

Depending on the configuration the system may disable, or reset, the Device_Number as a

reaction to the error signal.

If a system continuously switches between a standard operating state and the reset state,

without any device shutdown, the system is not considered to be in a Safe state.

Mandatory: The application must identify and signal such switching as a failure condition.

2.3

Failure indication time

The Device_Number failure indication time must be taken into consideration when

determining application safety strategies, because it must be less than the FTTI.

Failure indication time has three components, two of which are influenced by configuration

settings: recognition time + internal processing time + indication time.

Each component of failure indication time is described as follows:

●

Recognition time is the maximum of the recognition time of all involved safety

mechanisms. The three mechanisms with the longest time are:

–ADC(a) recognition time is the most demanding HW test in terms of timing. The

self-test requires the ADC conversion to complete a full test. A single full test takes

at least 70 µs(b).

–

Recognition time related to the FMPLL loss of clock: it depends on how the

FMPLL is configured, but is approximately 20 µs.

–

Diagnostic cycle time of software self-tests. This time depends closely on the

software implementation.

●

Internal processing time lasts maximum 10 RC clock cycles (RC is the internal safe

clock with nominal frequency of 16 MHz).

●

Indication time, the time to notify an observer about the failure, depends on indication

protocol configured in the Fault Collection and Control Unit (FCCU):

–

Dual Rail protocol and time switching protocol:

–

FCCU configured as “fast switching mode”: indication delay is maximum 64

µs. As soon as FCCU receives a fault signal, FCCU reports the failure to the

outside world via output pin (if properly configured).

ADC recognition time shall be used only if ADC is used by the safety function.

This value takes into account the steps needed to run the three ADC hardware self-tests.

AN3077 Datasheet(PDF) 10 Page - STMicroelectronics

AN3077 Datasheet(HTML) 10 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

Datasheet Download

Link URL