ST STM8AF6166, User Manual, Page: 34 / 43

Safety analysis results UM1915
34/43 UM1915 Rev 3
4.1.1 Safety analysis result customization
The safety analysis executed for STM8AF devices and contained in this safety manual is
considered to be safety relevant, that is able to interfere with the safety function, to all
microcontroller parts, with no exclusion. This is in line with the conservative approach to be
followed during the analysis of a general-purpose microcontroller, in order to be agnostic
versus the final application. This means that no STM8AF module has been declared as “non
safety-related”, and therefore all STM8AF modules are included in SPF computations.
In end-user applications, not all the STM8AF parts/modules are used for the
implementation of the safety function. Requiring the implementation of the respective safety
mechanism for those parts could result in overkill; as a consequence, a dedicated analysis
has been done. According to this analysis, the end user can define the selected STM8AF
parts as “non safety-related” under the following conditions:
•
collect rationales and evidences that the parts play no role in safety function
implementation
•
collect rationales and evidences that the parts do not interfere with the safety
function during normal operation
•
fulfill the below-reported general condition for the mitigation of the intra-MCU
interferences (
Table 5 )
The end user is allowed for “non safety-related” parts to do the following:
•
discard the part contribution from metrics computations in FMEDA
•
not implement the related safety mechanisms listed in Table 3 .
See [1] for more information.
4.1.2 General requirements for FFI (freedom from interferences )
A dedicated analysis has highlighted a list of general requirements to be followed by end
users to be authorized to declare selected STM8AF parts as “not safety relevant”. The
analysis considers two situations: the part is not used at all (disabled), or the part is used for
a function that is not safety-related (for example a GPIO port driving a “power-on” signaling
LED on the electronic board), and considers the possible interferences due to hardware
random faults affecting not-safety-relevant parts.
The requirement for the end user is to implement the safety mechanism detailed in
Diagnostic despite any evaluation about their contribution to the safety metrics
computations. Those safety mechanisms are reported in Table 5 .
Table 5. List of general requirements for FFI
Diagnostic Description
INTC_SM_0 Periodical read-back of configuration registers
INTC_SM_1 Expected and unexpected interrupt check by application software
FFI_SM_0 Unused peripheral disable
FFI_SM_1 Periodical read-back of interference avoidance registers
BUS_SM_0 Periodical software test for interconnections
GPIO_SM_1 Dual channel redundancy for input GPIO lines
GPIO_SM_2 Loop-back configuration for output GPIO lines