Functional safety requirements for application software

AN4475

14/27

DocID026216 Rev 1

set of data (duty cycle and period) are applied by software. The two selected pads are not

physically adjacent to minimize CCFs. SIU pads can be configured via the relevant pad

configuration registers (PCRn). eTPU2 channels instead of eMIOS200 channels can be

used.

2.9.5

Enhanced Time Processing Unit (eTPU2)

Suggested: [covers: SW_ETPU_APPLICATION] considering that no specific hardware

protection is implemented against failures in the eTPU2, spurious/missing eTPU2 actions

caused by Electromagnetic Interference (EMI) or by bit flips in the interrupt registers of the

peripherals, applications not resilient against such errors include detection or protection

software countermeasures. These specific software countermeasures can run once after

the Power-On Reset (POR) before the safety function starts and once per FTTI. [end]

Rationale: to verify eTPU2 requests are serviced correctly.

Implementation hint: specific software countermeasures are implemented to detect

eTPU2 permanent faults. These specific software countermeasures are application-

dependent.

2.10

Enhanced Queued Analog-to-Digital Converter (eQADC)

The SPC563Mxx device is equipped with one eQADC module integrating two analog-to-

digital converter macro-cells.

Suggested: [covers: SW_ADC_SELF_TEST] acquisition of some reference voltages is

done. These specific software countermeasures can run once after the Power-On Reset

(POR) before the safety function starts and/or once per FTTI. [end]

Rationale: to check the integrity of the eQADC module.

Implementation hint: some eQADC channels are internally connected to some reference

voltages as Buffered Band Gap, Reference Voltage for 1.2 V LVD and so on (refer to the

SPC563Mxx Reference Manual to have all additional details).

Moreover recommendation is to acquire analog input redundantly.

This module, if safety relevant, is used to implement the following function:

•

Double read analog inputs;

•

Additional mechanisms.

2.10.1

Double read analog inputs

Suggested: [covers: SW_DOUBLE_READ_AN_INPUT] safety relevant analog inputs are

acquired redundantly using both analog-to-digital converter macro-cells integrated in the

eQADC module. The measured values are compared by software. [end]

Rationale: to verify that the two measured analog input values match.

Implementation hint: shared channels are not be used for double read operation in order

to avoid CCFs due to the pad sharing. SIU pads can be configured via the relevant pad

configuration registers (PCRn).