Module Operation
465
SPNU563A – March 2018
Copyright © 2018, Texas Instruments Incorporated
System Memory Protection Unit (NMPU)
11.2.2 Diagnostic Mode
Diagnostic mode can be used to verify the MPU address and access permission comparator logic.
Entering or exiting the diagnostic mode will automatically clear the MPUERRSTAT and MPUERRADDR
registers. Memory protection must be disabled while entering or exiting diagnostic mode. There are two
different diagnostic modes: internal diagnostic mode and external diagnostic mode.
11.2.2.1 Internal Diagnostic Mode
In internal diagnostic mode, diagnostic logic inside the NMPU module drives the input of the MPU address
and access permission comparator logic. You can program the address for which comparison needs to be
performed and the type of transaction (read/write and user/privilege). For every write to the
MPUDIAGADDR register, an address and access permission comparison is performed and the results are
stored in MPUERRSTAT and MPUERRADDR registers. ERROR output to ESM will be generated if
ERRENA key in MPUCTRL2 register is Ah. You must ensure that no bus transactions from the master are
going on while NMPU is in internal diagnostic mode. NMPU does not accept any access originated from
the bus master and ensures that the internal diagnostic logic will not result in any bus transactions on to
the bus interconnect.
How to use the internal diagnostic mode is discussed in
11.2.2.2 External Diagnostic Mode
In external diagnostic mode, the actual bus master initiates the access to the NMPU. Address of the
access from the bus master is replaced by the address in MPUDIAGADDR register before the address
reaches the address comparator logic. In this mode, both bus error response and ERROR pulse to ESM
(if ERRENA = Ah) are generated for accesses that violate the access permissions. This diagnostic mode
is useful to test the full signal chain from bus master access generation logic to NMPU comparator logic.
How to use the external diagnostic mode is discussed in
11.2.3 Functional Fail Safe
Since NMPU module check and manipulate address or mode of bus master transaction, it is important to
have functional fail safe features to guarantee that faults in MPU region checking, address translation, or
user mode translation can be detected.
11.2.3.1 Run-time Diagnostics for Functional Features
Since features like input address masking, address translation and mode translation are integrated along
with a critical function like memory protection, NMPU needs to have the following hardware logic for run-
time diagnostics. This logic is implemented using 1oo1D safety architecture.
•
There are two independent blocks (primary and checker) running in lock-step and compare address
masking output every cycle. Outputs from NMPU are driven by the primary block.
•
There are two independent blocks (primary and checker) running in lock-step and compare address
translation output every cycle. Outputs from NMPU are driven by the primary block.
•
There are two independent blocks (primary and checker) running in lock-step and compare mode
translation output every cycle. Outputs from NMPU are driven by the primary block.
•
If there is a lockstep comparison error, DIAGERR bit in MPUERRSTAT register is set to 1. ERRFLAG
bit in the same register is also set. ERROR pulse output to ESM is generated irrespective of ERRENA
key value in MPUCTRL2 register.
•
A fault insertion allows user verifying that the individual lockstep comparator logic is functional and
avoid latent fault. User can program the fault insertion bits in MPUDIAGCTRL register to introduce a
fault in one of the lockstep comparator inputs for input address masking, address translation or mode
translation during start up or shut down of the device.