AN3181

Compliance with IEC and VDE standards

Doc ID 17286 Rev 2

9/31

The user can include a part or all of these VDE certified software modules into his project. If

the modules stay unchanged and are integrated in accordance with the guidelines provided

in this application note, development time and costs to have end-application certification

would be significantly reduced.

2.2

Application specific tests

The user should be aware that the following are also required for Class B certification but

are not included in the ST firmware library:

●

Analog: ADC/DAC & multiplexer

●

I/Os

●

Interrupts and external communication

●

Timing

●

External addressing

Table 3.

Overview of methods used in micro-specific tests provided with this

application note

Components to be

verified

Method used

CPU registers

Functional test A, X and Y registers, flags and stack pointer is done at

startup. In the run time flags are not tested. Stack pointer is tested for

overflow and underflow. If any error is found, the software jumps directly

to the Fail Safe routine.

Program counters

Two different watchdogs driven by two independent clock sources can

reset the device when the program counter is lost. The Window watchdog

Independent one (driven by low speed internal RC oscillator) is

impossible to disable once enabled. Both watchdogs must be serviced at

regular intervals. Program control flow is monitored by specific software

method, additionally. (see Section 3.1.3).

1.

Window WDG feature is not available at STM8L10x devices.

Addressing and data

path

This is tested indirectly by RAM functional and Flash integrity tests, stack

overflow (a specific pattern is written at a low boundary of stack space

and checked for corruption at regular intervals) and underflow (a second

pattern is written at a high boundary if it is not at the RAM end).

Clock

Two independent internal frequencies are used for the dedicated timer

clock and they are verified by reciprocal comparison. One frequency is fed

into the dedicated timer while the other gates it.

Non-volatile memory

A 16-bit CRC software checksum test of the entire memory is done at

startup and a partial memory test is repeated at runtime (block by block).

Variable memory space

March C- (March X optionally) full memory test is done at startup. Partial

memory test is repeated at run time (block by block). Word protection with

double inverse redundancy (inverse values stored in non-adjacent

memory space) is used for safety critical Class B variables. Class A

variable space, stack and unused space are not tested at run time.