System features

AN2945

12/18

Doc ID 15468

These options allow automatically enabled safety and robustness features, so that the

application can recover even if a disturbance or an attack occurs before the very first

instruction is fetched by the CPU.

The STM8S and STM32 devices have an embedded boot loader, making it possible

reprogram the internal Flash memory with an on-board serial interface (the UART for

instance). Any PC with a serial COM interface can then be used as a programming tool to

program or update the Flash and data EEPROM memory content. ST provides a software

utility to perform all operations supported by the boot loader.

3.4

Safety

The automotive industry first pushed for increasing the reliability of MCU-based electronic

controls. This has been followed by similar requests from the industrial segments, and

household appliances now have to comply with a specific standard, IEC60335-1. Both the

STM32 and STM8S devices are Class B compliant according to this standard. Compliance

is obtained by using dedicated self-test libraries certified by an independent test institute,

and also with the help of some specific hardware circuitry. Both the software and hardware

contribute to significantly reduce the development and qualification time of applications with

stringent functional safety requirements.

●

Watchdogs

The MCUs embed two watchdogs:

–

The Window Watchdog is intended to monitor the main loop and check that loop

time is within a given time frame. It runs on the system clock.

–

In parallel, an independent watchdog can be activated to increase the system’s

robustness This watchdog will indeed continue to operate even in the case of a

main clock failure (for instance due to a broken crystal).

●

Clock monitoring

The standard also requires the detection of crystal failure or oscillations at harmonics/

subharmonics. This is achieved using the clock system described in Section 3.2: Clock,

to periodically measure the external crystal or resonator frequency with the internal

clock source. Finally, a clock security system (CSS) also monitors the HSE source and

automatically switches back the system clock to the internal HSI clock in case of a

failure.