AN4266 datasheet(45/76 Pages) STMICROELECTRONICS

45 / 76 page

AN4266

Functional safety requirements for application software

Doc ID 024283 Rev 2

45/76

Double Read Analog Inputs

Hardware elements

The Double Read Analog Input uses two analog input channels to acquire a replicated

analog input signal. Both ADC units acquire and digitize the two copies of a redundant

analog signal connected to the inputs. In this configuration (if applied to all possible analog

inputs), only half of the analog inputs are available to the applications (AN[0:8] of ADC_0 for

signals, and AN[0:8] of ADC_1 for signal copies).

Mandatory: The shared channels (AN[11:14]) suffer from CCF because they share pads

between each ADC module. Therefore, they are omitted (considered not safe) for double

reads. The comparison of the results is performed by application software (See Figure 14).

Note:

Rationale: ADC_0 and ADC_1 share a pad for the channels (AN[11:14]). Omitting them

from double read eliminates a possible source of CCF.

Mandatory: After boot but before executing the safety function the following tests shall be

executed to detect latent faults (See Section , Hardware BIST and Section , Hardware BIST

implementation):

●

SUPPLY SELF-TEST

●

RESISTIVE-CAPACITIVE SELF-TEST

●

CAPACITIVE SELF-TEST

Note:

Rationale: To check the integrity of the ADC modules

Mandatory: Before running the HW self-test, the customer must copy the threshold values

of the analog watchdogs from test sector into the watchdog registers (See “Self test analog

watchdog” section of the “Analog-to-Digital Converter (ADC)” chapter in SPC56xL70xx

Reference Manual).

Note:

Rationale: To set the correct threshold for the self-test

Safety Integrity Functions

Safety integrity is achieved by replicated acquisition with separate analog input channels

and software comparison by the processing function (See Figure 14).

Mandatory: The following software test must be implemented by the application software:

ADC0_SWTEST_REGCRC, ADC1_SWTEST_REGCRC, SIUL_SWTEST_REGCRC

Note:

Rationale: To verify that the configuration of the module used by this safety function

corresponds with what is expected

Note:

Rationale: To avoid CCF caused by improper configuration of the pads

Mandatory: In addition, the software test ADC_SWTEST_CMP must be implemented to

compare the channel reads.

ADC0_SWTEST_REGCRC

Once in the FTTI

ADC1_SWTEST_REGCRC

Once in the FTTI

SIUL_SWTEST_REGCRC

Once in the FTTI

Table 11.

Software BIST and/or test (continued)

Software BIST and/or test

Frequency

AN4266 Datasheet(PDF) 45 Page - STMicroelectronics

AN4266 Datasheet(HTML) 45 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

Datasheet Download

Link URL