Functional safety requirements for application software

AN4287

14/27

DocID024464

Rev 2

Double Write PWM Outputs

Implementation hint: Each double write can be implemented using two pads configured as

eMIOS200 channel by the SIU unit and configured as PWM by eMIOS200 module. PWM

set of data (duty cycle and period) shall be applied by software. The two selected pads shall

not be physically adjacent to minimize CCFs. SIU pads can be configured via the relevant

pad configuration registers (PCRn). eTPU2 channels instead of eMIOS200 channels can be

used.

3.10

Enhanced Queued Analog-to-Digital Converter (eQADC)

The SPC564A7x/SPC564A80 device is equipped with one eQADC module integrating two

analog-to-digital converter macro-cells.

Suggested: acquisition of some reference voltages shall be done. These specific software

countermeasures can run once after the Power-On Reset (POR) before running the SIF

and/or once per FTTI.

Rationale: to check the integrity of the eQADC module.

Implementation hint: some eQADC channels are internally connected to some reference

voltages as Buffered Band Gap, Reference Voltage for 1.2 V LVD and so on (refer to the

SPC564A7x/SPC564A80 Reference Manual to have all additional details).

Moreover recommendation is to acquire analog input redundantly.

This module, if safety relevant, shall be used to implement the following function:

•

Double read analog inputs;

•

Additional mechanisms.

3.10.1

Double read analog inputs

Suggested: safety relevant analog inputs shall be acquired redundantly using both analog-

to-digital converter macro-cells integrated in the eQADC module. The measured values

shall be compared by software.

Rationale: to verify that the two measured analog input values match.

Implementation hint: shared channels shall not be used for double read operation in order

to avoid CCFs due to the pad sharing.

Implementation hint: SIU pads can be configured via the relevant pad configuration

registers (PCRn).

3.10.2

Additional mechanisms

The two analog-to-digital converter macro-cells share the same digital interface. To increase

the diagnostic coverage against failures impacting this common logic, some additional

counter measures can be developed. For example:

•

Oversampling;

•

Plausibility check.

Suggested: the analog inputs shall be acquired redundantly in time.

Rationale: to increase the diagnostic coverage.