STM8AF safety architecture
UM1915
28/43
UM1915 Rev 3
regulated according to the individual interrupt expected frequency.
•
Interrupt vectors related to unused interrupt source point to a default handler that
reports, in case of triggering, a faulty condition (unexpected interrupt).
•
In case an interrupt service routine is shared between different sources, a plausibility
check on the caller identity is implemented.
•
Interrupt requests related to not-safety-relevant peripherals are handled with the same
method here described, despite their originator safety classification; in order to
decrease the complexity of this method implementation, the use of polling instead of
interrupt for not-safety-relevant peripherals is suggested.
3.6.22 Latent
fault
detection
ISO 26262 considers also a metric for “latent” faults. The latent fault is a multiple-point fault
which presence is not detected by a safety mechanism nor perceived by the driver within
the multiple-point fault detection interval. In practical words, the latent fault is a combination
of a fault in a safety mechanism - that by itself does NOT cause the violation of the safety
goal (function) - and a fault in the mission logic supervised by that safety mechanism.
The following reported methods mainly address latent fault for the planned safety
mechanism at MCU level.
Independent Watchdog - LAT_SM_0
Each safety mechanism implemented as periodical software testing runs on the CPU.
Possible faults in the safety mechanism are therefore faults in the “support” for the
execution that is the CPU. The independent watchdog is considered here as safety
mechanism addressing the program counter failures due to the CPU hardware random
faults.
Periodical core self-test software - LAT_SM_1
As the major part of the safety mechanism described in this safety manual is implemented
by software, the periodical core self-test software execution able to detect faults in the
STM8 CPU acts as safety mechanism for latent faults. For implementation details refer to
the description of
CPU_SM_0
safety mechanism.
3.6.23
Disable and periodic cross-check of unintentional activation
of unused peripherals
This section reports the safety mechanism that addresses peripherals not used by the
safety application, or not used at all.
Unused peripherals disable - FFI_SM_0
This method contributes to the reduction of the probability of cross-interferences caused by
peripherals not used by the software application. It is implemented by end users, taking
care of disabling by software (for instance during the system boot) each peripheral that is
not used.
Periodical read-back of interference avoidance registers - FFI_SM_1
This method contributes to the reduction of the probability of cross-interferences between
peripherals that can potentially conflict on the same output pins, including for instance
unused peripherals (refer to FFI_SM_0). This diagnostic measure executes a periodical