ST SPC582B Series, Application Note, Page: 2 / 35

1 Overview
The FCCU is a key element of the functional safety concept of the SPC58 and SPC57 families of SPC5
32-bit automotive MCUs. It is responsible for collecting and reacting to failure notifications coming from different
modules indicated as monitors. Examples of monitors are CMU, MEMU, XBIC and so forth.
Figure 1. FCCU monitor to reaction path
FCC
U
Clear
Clear
Error out/in
Reset request Reset
Fault
Fault
Set
Set
.
.
.
INTC
Interrupt request
(ALARM)
Interrupt
RGM
NMI
Monitor 1
Monitor N
.
Core_0
FCCU
FOSU
destructive
reset
Note: Some monitors might miss the set and clear signals.
The Figure 1 shows how the FCCU is connected to the other blocks. The reader shall consider the above figure,
and all other figures in this document, as a logic schema that not exactly reflects the physical implementation in
the silicon.
In case of a fault, the FCCU can move the device into the safe state (the safety manual defines the safe states)
without any core intervention. Since the FCCU and the whole error reaction path are prone to latent failures, the
safety concept requires the execution of a software test to verify the integrity of the error reaction. The user shall
run this software test at least once per trip time.
Note: The safety analysis assumes a trip time of 12 hours.
This document goes through the list of the faults reported by the FCCU. For each of them it describes how to
test the reaction path to fulfill the previous requirement. Note that the user cannot test the error reaction path for
certain monitors.
The
Table 1 lists and describes all FCCU input fault sources for SPC582Bx MCUs.
Table 1. FCCU failure inputs
FCCU input # Source Failure description Error reaction path
0 PMC DIG Temperature out of range Not testable
1 PMC DIG Voltage out of range from LVDs Not testable
2 PMC DIG Voltage out of range from HVDs Not testable
3 PMC DIG Digital PMC initialization error during DCF data load Not testable
4 PMC DIG Digital PMC voltage detector BIST Testable
5 SSCM/FLASH_0 SSCM transfer error OR Flash memory initialization error Not testable
6 STCU BIST result-wrong signature (STCU unrecoverable fault) Testable
AN5752
Overview
AN5752 - Rev 1
page 2/35