DocID026216 Rev 1

17/27

AN4475

Functional safety requirements for application software

26

confirms the correctness of LVI circuits operation. Then, the correct value of the

PMC_TRIMR register can be restored.

Suggested: [covers: SW_POR_SELF_TEST] correct execution of Power-On Reset

sequence is checked. These specific software countermeasures can run once after the

Power-On Reset (POR) before the safety function starts. [end]

Implementation hint: e.g. reserved RAM is used to store a key which can be used if the

current reset is a POR or not according to the POR bit in the ECSM_MRSR register.

Moreover the default reset value of the registers of each IP can be checked.

2.16

Error Correction Status Module (ECSM)

The ECSM reports ECC/EDC failures affecting both volatile and non-volatile memories. The

ECSM reports detection/correction of single-bit errors and detection of double-bit ones.

ECC functionality concerns data and not the addresses. ECC is automatically calculated on

memory write accesses and is checked while read accesses are executed on memory.

Suggested: to enable ECC reporting logic in the ECSM in order to provide an optional

managing failures interrupt mechanism. In addition to the interrupt generation, the ECSM

reports specific information about the failure (memory address, attributes and data, bus

master number, etc.) which can be useful for subsequent management of the failure.

Rationale: to manage failures.

Suggested: [covers: SW_ECSM_SELF_TEST] specific software countermeasures are

implemented to detect ECSM permanent faults. These specific software countermeasures

can run once after the Power-On Reset (POR) before the safety function starts. [end]

2.17

Periodic Interrupt Timer (PIT_RTI)

Suggested: [covers: SW_PIT_APPLICATION] Specific software countermeasures are

implemented to detect PIT transient and permanent faults. These specific software

countermeasures can run once after the Power-On Reset (POR) before the safety function

starts and/or once per FTTI. [end]

Rationale: to detect possible PIT failures.

Implementation hint: Test implementation is application-dependent. In general PIT module

is used in such a way that a possible failure is detected by the SWT module (or other

means).

2.18

System Timer Module (STM)

Suggested: [covers: SW_STM_APPLICATION] Specific software countermeasures is

implemented to detect STM transient and permanent faults. These specific software

countermeasures can run once after the Power-On Reset (POR) before running the SIF

and/or once per FTTI. [end]

Rationale: to detect possible STM failures.

Implementation hint: Test implementation is application-dependent. In general STM is

used in such a way that a possible failure is detected by the SWT module (or other means).