DocID024464

Rev 2

17/27

AN4287

Functional safety requirements for application software

3.16

Peripheral Bridge (PBRIDGE)

Suggested: PBRIDGE shall be configured in order to ensure that all bus masters (Core,

eDMA and FlexRay) can access only their allocated resources according to their access

rights. The configuration and the correct working of the PBRIDGE shall be checked. These

specific software countermeasures can run once after the Power-On Reset (POR) before

running the SIF and/or once per FTTI.

Rationale: to avoid to give access to the device resources to unauthorized master and to

deny access to authorized master.

Implementation hint: e.g. the integrity of the PBRIDGE module can be checked calculating

the CRC of the configuration registers value of 3 IPs and comparing each one with the

expected one. Different IPs could be chosen for each FTTI.

3.17

Power Management Controller (PMC)

SPC564A7x/SPC564A80 devices use three supply voltages, nominally 5V, 3.3V and 1.2V.

The 5V supply voltage must be supplied from the outside while the other supply voltages are

supplied by internal regulators. Moreover, SPC564A7x/SPC564A80 devices embed LVI for

all supply voltages. The PMC controls the internal regulators and the LVI circuits.

Suggested: LVI failure reaction for all supply voltages shall be configured (system reset or

interrupt request). These specific software countermeasures can run once after the Power-

On Reset (POR) before running the SIF.

Rationale: to check if supply voltages are in the correct operation range.

Suggested: LVI circuits operation (for supply voltages generated by internal regulators, i.e.

3.3V and 1.2V) shall be checked. These specific software countermeasures can run once

after the Power-On Reset (POR) before running the SIF.

Implementation hint: the output of each internal regulator can be set to a value lower than

the LVI threshold value configuring the PMC_ TRIMR register. According to this, enabling

only the interrupt request as LVI failure reaction, the generation of the LVI interrupt requests

confirms the correctness of LVI circuits operation. Then, the correct value of the PMC_

TRIMR register can be restored.

Suggested: correct execution of Power-On Reset sequence shall be checked. These

specific software countermeasures can run once after the Power-On Reset (POR) before

running the SIF.

Implementation hint: e.g. reserved RAM is used to store a key which can be used if the

current reset is a POR or not according to the POR bit in the ECSM_MRSR register.

Moreover the default reset value of the registers of each IP can be checked.

3.18

Error Correction Status Module (ECSM)

The ECSM is able to detect data storage failures in memory (FLASH and SRAM) and

addressing these.

The ECSM can detect and correct single-bit errors, detect double-bit faults and detect faults

affecting more than two bits. ECC functionality concerns data and not the addresses. ECC

is automatically calculated on memory write accesses and is checked while read accesses

are executed on memory.