ST STM8AF6166, Руководство пользователя, Страница: 29 / 43

UM1915 Rev 3 29/43
UM1915 STM8AF safety architecture
42
check of the below described registers respect to their expected values (previously stored
in RAM and adequately updated after each configuration change). The register test is
executed at least once per DTI.
The configuration registers to be tested with this method are those related to clock disabling
features for peripherals and those related to the enabling of alternate functions on I/O pins.
3.7 Assumption of use (AoU)
This section describes the Assumptions of use (AoU) of the STM8AF that the MCU/system
integrator considers (together with the requirements listed in
Table 2: List of STM8AF
assumed requirements ) with respect to its intended use.
The AoUs are different from the HW safety requirements of STM8AF. The AoUs are
requirements for the MCU/system integrator.
3.7.1 List of AoUs
Table 4 summarizes the AoUs to be fulfilled by users of the STM8AF MCUs.
The results shown in Section 4: Safety analysis results are valid under the condition that the
AoU, described herein, and the assumed requirements listed in Table 2 , are fulfilled by the
STM8AF MCU/system integrator.
The following table lists the assumptions of use and for each of them shows the degree of
recommendation using the typical ISO 26262 coding in order to keep the text consistent
with the standard and to facilitate their interpretation by the user. For each AoU, the
degree of recommendation to use the corresponding method depends on the ASIL and is
categorized as follows:
•
“++” indicates that the assumption is highly recommended for the identified ASIL
• “+” indicates that the assumption is recommended for the identified ASIL
•
“o” indicates that the assumption has no recommendation for or against its usage for
the identified ASIL.
Table 4 provides a summary of the safety concept recommendations reported in
Section 3.6 .
The assumptions of use are reported in the form of safety mechanism (SM) requirements.
The “X” marker in the Perm and Trans columns of Table 4 indicates that the related safety
mechanism is effective for such fault model.
Table 4. List of safety mechanisms
STM8AF
function
Diagnostic Description
ASIL
B
Perm Trans
STM8 core
CPU_SM_0 Periodical core self-test software ++ X -
CPU_SM_1
Control flow monitoring in application
software
++ X X
CPU_SM_2
Double computation in application
++ - X
CPU_SM_3 Stack hardening for application software + X X
CPU_SM_4 Independent watchdog o X X