UM1915 Rev 3
27/43
UM1915
STM8AF safety architecture
42
3.6.19 Watchdogs
(IWDG,
WWDG)
Periodical read-back of configuration registers - WDG_SM_0
This diagnostic measure, typically referred to as “Read back periodic by software of
configuration registers”, executes a periodical check of the configuration registers of the
watchdogs respect to their expected values (previously stored in RAM and adequately
updated after each configuration change). It mainly addresses transient faults affecting the
configuration registers, detecting bit flips. The registers test is executed at least once per
DTI.
Software test for watchdog at startup - WDG_SM_1
This safety mechanism ensures the right functionality of the internal watchdogs in use. At
startup, the software test programs the watchdog with the required expiration timeout,
stores a specific flag in the RAM and waits for the reset signal. After the watchdog reset,
the software understands that the watchdog has correctly triggered, and does not execute
the procedure again.
3.6.20
Debug/SWIM (single wire interface module)
Independent watchdog - DBG_SM_0
The debug unintentional activation due to hardware random fault results in a massive
disturbance of the independent watchdog or alternately, the other system watchdog
WWDG or an external one.
3.6.21
Interrupt controller (NVIC and EXTI)
Periodical read-back of configuration registers - INTC _SM_0
This diagnostic measure, typically referred to as “Read back periodic by software of
configuration registers”, is implemented by executing a periodical check of the
configuration registers of each used system peripheral respect to its expected value,
previously stored in RAM and adequately updated after each configuration change. It
mainly addresses the transient faults that affect the configuration registers, by detecting bit
flips. The register test is executed at least once per DTI.
Expected and unexpected interrupt check - INTC_SM_1
According to ISO 26262-5 Table D.1 recommendations, a safety mechanism/measure for
incorrect interrupt executions and for omission of or continuous interrupts must be
implemented. The method of expected and unexpected interrupt check is implemented at
application software level. It contributes to detect both permanent and transient fault for all
the above-reported failure modes affecting interrupt handling.
The guidelines for the implementation of the method are the following:
•
The list of the implemented interrupt for the MCU is well documented, reporting also
the expected frequency of each request when possible (for example the interrupts
related to ADC conversion completion, therefore coming on a deterministic way).
•
Individual counters are maintained for each served interrupt request, in order to detect
in a given time frame the cases of a) no interrupt at all b) too many interrupt requests
(“babbling idiot” interrupt source). The control of the time frame duration must be