AN3077 datasheet(47/82 Pages) STMICROELECTRONICS

47 / 82 page

DocID16384 Rev 10

47/82

AN3077

Functional safety requirements for application software

3.17

Software Watchdog Timer (SWT)

Mandatory: These requirements apply to the SWT for ASIL D applications:

●

Both of the following must be true:

–

The SWT is enabled

–

Configuration registers hard locked to avoid unwanted modification

●

The SWT time window settings must be set to a value less than the FTTI. Detection

latency shall be smaller than FTTI.

●

Before the safety function is executed, software must verify that the SWT is enabled by

reading the SWT control register (SWT_CR[WEN] = 1).

Note:

Rationale: To detect a defective program sequence

Mandatory: Control flow monitoring can be implemented by SWT. However, other control

flow monitoring approaches that do not used the SWT may also be used.

Device_Number provides the hardware support (SWT) to implement both control flow and

temporal monitoring methods. Refer to the Device_Number Reference Manual for the SWT

functional description.

Note:

Implementation hint: To enable the SWT, and to hard lock the configuration register,

SWT_CR[WEN] and SWT_CR[HLK] must be asserted (= 1).

The timeout register (SWT_TO) must contain a 32-bit value that represents a timeout less

than the FTTI.

If Windowed mode and Keyed Service mode (two pseudorandom key values used to

service the watchdog) are enabled, it is possible to reach a high effective temporal flow

monitoring.

3.18

Redundancy Control Checking Unit (RCCU)

The task of the RCCU unit is to perform a cycle-by-cycle comparison of the outputs of the

modules included in the SoR. The SoR is the logical part of the device that contains all the

modules that are replicated for functional safety reasons.

The RCCU is able to detect any mismatch between the outputs of two replicated modules.

The error information is forwarded to the MC_RGM and FCCU.

For ASIL D applications, use of the RCCU is indispensable. The use of RCCU’s is

automatically managed by the Device_Number device, users cannot disable the RCCU.

Note:

Rationale: To catch faults in the processing channel

The RCCUs are only enabled when the Device_Number is in LSM. Application software

must determine whether LSM mode is activate. Please refer to Section 3.2.2: Checking for

further details.

3.19

Cyclic Redundancy Checker Unit (CRC)

The CRC module computes CRC checksums, which offloads the CPU. The CRC has the

capability of processing two CRC calculations simultaneously.

AN3077 Datasheet(PDF) 47 Page - STMicroelectronics

AN3077 Datasheet(HTML) 47 Page - STMicroelectronics

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

Datasheet Download

Link URL