Functional safety requirements for application software

AN4475

8/27

DocID026216 Rev 1

Suggested: [covers: HW_CQM] FMPLL is configured to use the external oscillator

(XTAL_OSC) as their source clock and all safety relevant modules are clocked with the

FMPLL generated clock signal. The CQM loss-of-clock (XTAL_OSC failure, i.e. FMPLL

reference failure) and the CQM loss-of-lock (FMPLL failure) detection is enabled with

relevant ISR request. The management of these errors is application-dependent. These

specific software countermeasures can run once after the Power-On Reset (POR) before

the safety function starts. [end]

Rationale: to reduce the impact of glitches stemming from the external quartz crystal or the

RC_OSC and to check the FMPLL clock integrity.

Suggested: [covers: SW_CQM_SELF_TEST] specific software countermeasures are

implemented to detect CQM permanent faults. These specific software countermeasures

can run once after the Power-On Reset (POR) before the safety application starts. [end]

Implementation hint: This safety mechanism could consist of the following tests: (1) IRC

frequency is measured using CQM and it is checked if the measured value is or not in the

correct range; (2) CQM Crystal clock monitor feature is checked setting a wrong

configuration and servicing the CQM ISR which occurs in this case; (3) CQM0 PLL clock

monitor feature is checked setting a wrong configuration and CGM.CQM_0_LFREFR_A and

servicing the CQM ISR which occurs in this case.

Suggested: [covers: SW_PLL_SELF_TEST] SW checks that the device is using FMPLL

clock as system clock and the integrity of the CQM module before the safety function starts.

[end]

Rationale: to check the correctness of FMPLL configuration and the integrity of the CQM

module.

Implementation hint: e.g. a wrong PLL configuration is set in order to inject a loss-of-lock

and then the CQM response is tested.

2.4

General-Purpose Static RAM (SRAM)

Suggested: [covers: HW_SRAM_ECC] the system SRAM is protected by a single error

correction/dual error detection (SEC/DED) ECC scheme. The SEC/DED ECC scheme

reporting is configured (interrupt request). The SRAM SEC/DED concerns data and not the

addresses. Such configuration has done once after the Power-On Reset (POR) before the

safety application starts. [end]

Suggested: [covers: SW_SRAM_SELF_TEST] in order to increase the diagnostic

coverage, specific software countermeasures are implemented to detect RAM address logic

faults. These specific software countermeasures can run once per FTTI. [end]

Rationale: to verify the integrity of RAM address logic.

Suggested: [covers: SW_SRAM_ECC_SELF_TEST] in order to increase the diagnostic

coverage, specific software countermeasures are implemented to detect fault in the RAM

ECC logic. The aim is to assure that correct data are not accidentally modified and that bit

errors are properly corrected/detected. These specific software countermeasures can run

once per FTTI. [end]

Rationale: to check the correct working of RAM ECC logic.

Implementation hint: ECSM module can force the generation of single-bit and/or double-bit

data inversions in RAM allowing the check of the ECC logic. In particular ECSM module can

generate errors during data write cycles, such that subsequent reads of the corrupted