General information

AN4475

6/27

DocID026216 Rev 1

1

General information

1.1

Mission profile

The assumed mission profile is:

•

Lifetime: 20 years

•

Total operating hours: 12000 hours

•

•

1.2

Safe state

The Safe states of the SPC563MXX are as follows:

•

Completely unpowered

•

Reset

•

Operating correctly

•

Explicitly indicating an internal error

If the SPC563Mxx signals an internal failure via its error out signals, the surrounding

subsystem is longer use the SPC563Mxx outputs for safety functions since these signals

are no longer considered reliable. If an error is indicated, the system must be able to remain

in a Safe state without any additional MCU actions. Depending on its configuration, the

system may disable, or reset, the SPC563Mxx as a reaction to the error signal.

Suggested: the system must set the system itself to a safe state when an error is indicated.

1.3

Failure indication time

The SPC563Mxx failure indication time has taken into consideration when determining

application safety strategies, because it must be less than the FTTI.

1.4

Error handling

Error handling can be split into two categories:

•

Handling of errors during run-time

•

Handling of errors during boot-time

Suggested: run-time failures are handled in a time shorter than the FTTI.

Suggested: boot-time failures are handled before the safety function starts.

a.

Trip time is defined as the maximum MCU operation time without Power-On Reset.

b.

Quoting the ISO262562, the Fault Tolerant Time Interval (FTTI) is the time-span in which a fault or faults can

be present in a system before a hazardous event occurs.