STM8AF safety architecture
UM1915
26/43
UM1915 Rev 3
3.6.17 Reset
and
clock control subsystems
Periodical read-back of configuration registers - CLK_SM_0
This diagnostic measure, typically referred to as “Read back periodic by software of
configuration registers”, executes a periodical check of the configuration registers of the
Reset and Clock Control logic respect to their expected values (previously stored in RAM
and adequately updated after each configuration change). It mainly addresses transient
faults affecting the configuration registers, detecting bit flips. The registers test is executed
at least once per DTI.
Clock Security System (CSS) - CLK_SM_1
The Clock Security System (CSS) detects the loss of HSE and LSE clock activity and
executes the corresponding recovery action, e.g. switch-off HSE and commute on the HSI.
For this reason it is able to detect potential abnormal situations:
•
loss of external clock,
•
abnormal activation of HSE (or LSE) despite being disabled by design.
The CSS detection of abnormal condition is considered as equivalent to hardware faults
and brings to similar recovery actions by the application software.
Independent watchdog - CLK_SM_2
The independent watchdog is fed by a dedicated oscillator; therefore, major failures on
clock generation at system level does not affect its behavior but may lead to a violation of the
IWDG window for the key value write by the application software, leading to a system reset.
Note that the efficiency of this safety mechanism is strongly dependent on the correct
window setting and handling for the IWDG. The refresh of the IWDG has to be
implemented to bring alteration of the program flow able to bypass the time window limit.
3.6.18 Auto-wakeup
timer
(AWU)
The AWU is used to provide an internal wakeup time base that is used when the MCU
goes into Active-halt power saving mode.
Periodical read-back of configuration registers - AWU _SM_0
This diagnostic measure, typically referred to as “Read back periodic by software of
configuration registers”, executes a periodical check of the configuration registers of the
watchdogs respect to their expected values (previously stored in RAM and adequately
updated after each configuration change). It mainly addresses transient faults affecting the
configuration registers, detecting bit flips. The registers test is executed at least once per
DTI.
Software test for auto-wakeup timer at startup - AWU _SM_1
This safety mechanism ensures the right functionality of the auto-wakeup timer. At startup,
the software test programs the auto-wakeup timer with the required time interval, stores a
specific flag in the RAM and waits for the reset signal. After the wake-up, the software
understands that the AWU has correctly triggered, and does not execute the procedure
again. This method has to be applied only in case the implemented safety goal plans the
use of the auto-wakeup feature.