General information

AN4287

6/27

DocID024464

Rev 2

2

General information

2.1

Mission profile

The assumed mission profile is:

•

Lifetime: 20 years;

•

Total operating hours: 12000 hours;

•

•

2.2

Safe state

By definition, the Safe states of the SPC564A7x/SPC564A80 are as follows:

•

Completely unpowered;

•

Reset;

•

Operating correctly;

•

Explicitly indicating an internal error.

If the SPC564A7x/SPC564A80 signals an internal failure, the surrounding subsystem shall

no longer use the SPC564A7x/SPC564A80 outputs for safety functions since these signals

are no longer considered reliable. If an error is indicated, the system must be able to remain

in a Safe state without any additional actions. Depending on its configuration, the system

may disable, or reset, the SPC564A7x/SPC564A80 as a reaction to the error signal.

Suggested: the system must transition the system itself to a safe state when an error is

indicated.

2.3

Failure indication time

The SPC564A7x/SPC564A80 failure indication time must be taken into consideration when

determining application safety strategies, because it must be less than the FTTI.

2.4

Error handling

Error handling can be split into two categories:

•

Handling of errors during run-time;

•

Handling of errors during boot-time.

Suggested: run-time failures shall be handled in a time shorter than the FTTI.

Suggested: boot-time failures shall be handled before the safety application starts.

a.

Trip time is defined as the maximum MCU operation time without Power-On Reset.

b.

Process Safety Time (PST), also named Fault Tolerance Time Interval (FTTI), is maximum time between the

first faulty output and a failure indication or reset.