AN3324

Module software requirements for non applicative peripherals

Doc ID 18311 Rev 2

13/37

This is an additional Safety Layer since the STCU propagates the L/MBIST and internal

faults using the CF/NCF lines toward FCCU. So reading the above registers helps in

increasing the STCU auto-test coverage.

3.3

Redundancy Control Checker Unit (RCCU)

The RCCU unit performs a cycle-by-cycle comparison of the outputs of the modules

The RCCU is able to detect any mismatch between the outputs of two replicated modules.

The error information is forwarded to the Reset Generation Module (RGM) (see Section 3.4:

Reset Generation Module (MC_RGM)) and to the Fault Collection and Control Unit (FCCU)

(see Section 3.5: Fault Collection and Control Unit (FCCU)).

Fault injection for the RCCUs controlled by the FCCU is provided primarily for software

development and validation purposes.

The RCCU’s are only enabled when SPC56EL60 is in the LSM mode.

Note:

Application software must assert that the LSM mode is activated (see Section 3.1: System

Status and Configuration Module (SSCM)).

RCCU is automatically managed by the SPC56EL60 device and user cannot disable it.

3.4

Reset Generation Module (MC_RGM)

User has to configure MC_RGM and FCCU (Fault Collection and Control Unit) (see

Section 3.5: Fault Collection and Control Unit (FCCU)) to react to critical application faults.

User has to trigger reset sequence when one of the following events happen:

●

a CMU1/2 clock freq. too high/low event

●

a PLL1 fail event

●

a system clock freq. too high/low event

●

a oscillator freq. too low event

●

a PLL0 fail event

●

a core watchdog reset event

Note:

RGM_FERD (Functional Event Reset Disable Register) set to zero so that all events trigger

a reset sequence. User should set to zero RGM_FEAR (Functional Event Alternate Request

Register) to allow to generate a SAFE mode request on events if the reset is disabled.

3.5

Fault Collection and Control Unit (FCCU)

User has to configure the FCCU so that it reacts to generate a functional reset or so that it

forces the MCU to switch in fail safe.

It is possible to configure the reaction for each fault source and ensuring the rule described

above is valid for each individual source.

b.

The SoR is the logical part of the device that contains all the modules that are replicated for functional safety

reasons.