DocID024464

Rev 2

11/27

AN4287

Functional safety requirements for application software

applied on selected pads in order to be acquired and then the acquired values shall be

compared by software.

Rationale: to verify that the two input values match.

Implementation hint: if, for a specific application, a plausibility check on a single

acquisition assures sufficient diagnostic coverage, it can replace the redundant acquisition.

This hint is a special case of deviating from recommended requirements as described in the

Preface. The two selected pads shall not be physically adjacent to minimize CCFs. Each

pad not dedicated to a specific function can be configured as GPIO with the exception of

ADC pads, as they can only be configured as GPIs. SIU pads can be configured via the

relevant pad configuration registers (PCRn).

3.9.2

Read PWM inputs

Suggested: digital inputs shall be acquired redundantly. Each double acquisition can be

implemented using two pads configured as eMIOS200 channel by the SIU unit and

configured with input capture feature by eMIOS200 module. PWM input signal shall be

applied on selected pads in order to be acquired and then the acquired set of data (duty

cycle and period) shall be compared by software.

Rationale: to verify that the two sets of data match.

Implementation hint: the comparison must take into account possible approximation

because of different capturing of the input asynchronous signals. Each pad not dedicated to

a specific function can be configured as GPIO with the exception of ADC pads, as they can

only be configured as GPIs. SIU pads can be configured via the relevant pad configuration

registers (PCRn). The two selected pads shall not be physically adjacent to minimize CCFs.

PWM input signal can be generated using one other eMIOS200 channel correctly

configured or one eTPU2 channel correctly configured and the eTPU2 channels instead of

the eMIOS200 channels can be used.

3.9.3

Write digital outputs

Suggested: digital outputs shall be written either redundantly or with read-back. Write

digital output operation can be implemented as single write digital output with read-back or

double write digital output.

Rationale: to verify that the two output values match.

Implementation hint: if, for a specific application, a plausibility check on a single write

assures sufficient diagnostic coverage, it can replace the redundant write or the write with

read-back. This hint is a special case of deviating from recommended requirements as

described in the Preface. Each pad not dedicated to a specific function can be configured as

GPIO with the exception of ADC pads, as they can only be configured as GPIs. SIU pads

can be configured via the relevant pad configuration registers (PCRn).

Single write digital output with read-back

Implementation hint: SIU pads are used to perform a single write digital output with read-

back. The read-back shall be done using the external configuration or the internal. SIU pads

shall be configured as follows:

•

External read-back: one SIU pad is configured to allow read-back of the output write on

the selected SIU pad and the loop-back is done with an external connection outside the

device. Using this configuration, only half of the available digital outputs can be used as