AN3077 datasheet(17/82 Pages) STMICROELECTRONICS

17 / 82 page

DocID16384 Rev 10

17/82

AN3077

Functional safety requirements for application software

Note:

Implementation hint: A possible way to detect spurious interrupts is to check

corresponding interrupt status in the interrupt status register of the related peripheral before

executing the Interrupt Service Routine (ISR) service code.

3.9

Semaphore Unit (SEMA4)

Semaphore modules are only used in DPM. Failures of the SEMA4 module may cause

unwanted interrupts in LSM. Each SEMA4 unit is connected to both replicated INTC

modules. This means that even in LSM when SEMA4 units are not used, a corrupted

SEMA4 could trigger continuous interrupts to both INTCs. To avoid this possible failure the

INTC shall have the SEMA4 interrupt masked (for example, SEMA4 units have the lowest

priority in the INTCs).

Mandatory: Application software shall keep these interrupt sources masked by

programming the interrupt controller appropriately.

3.10

Enhanced Direct Memory Access (eDMA) requests

Mandatory: For ASIL D applications, protection against spurious or missing safety relevant

eDMA requests must be implemented(d). The methodology used to satisfy this requirement

is application dependent.

Note:

Rationale: To manage spurious or missing eDMA transfer requests

Note:

Implementation hint: Some implementations which can satisfy these requirements are:

●

Counting the number of eDMA transfers triggered inside a control period and compare

this with what is the expected value.

●

If the eDMA is used to manage the analog acquisition with the Cross-Triggering Unit

(CTU) and ADC, the number of the converted ADC channels is saved in the CTU FIFO

together with the acquired value. The eDMA transfers this value from the CTU FIFO to

a respective SRAM location. Spurious or missing transfer requests can be detected by

comparing the converted channel with what is expected.

Mandatory: Designers must not use the Periodic Interrupt Timer (PIT) module to trigger an

eDMA transfer request for ASIL D applications.

Note:

Rationale: To avoid a faulty PIT (which is not redundant) from triggering an unexpected

eDMA transfer

3.11

Periodic Interrupt Timer (PIT)

Mandatory: For ASIL D applications the PIT module must be used in such a way that a

possible failure is detected by the Software Watchdog Timer (SWT).

Note:

Rationale: To catch possible PIT failures

Mandatory: If the PIT is used by ASIL D applications, a checksum of its configuration

registers must be calculated and compared with the expected value to verify that the PIT

eDMA is a replicated module. No software action is needed to detect faults inside this module.

AN3077 Datasheet(PDF) 17 Page - STMicroelectronics

AN3077 Datasheet(HTML) 17 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

Datasheet Download

Link URL