AN3307

Compliance with IEC and VDE standards

Doc ID 18186 Rev 4

13/37

3.2

Application-specific tests not included in the ST firmware

library

Users have to focus on all the remaining tests that cover application-specific MCU parts that

are not included in the ST firmware library:

●

Testing the analog blocks (AD/DA, multiplexer)

●

Testing the digital I/O

●

External Addressing

●

External communication

●

Timing and interrupts

The tests for the analog part depend on the application and peripheral capability of the

device. The pins used should be checked for correct analog intervals (by checking that the

measured voltages correspond to the real analog values) and free analog pins can be used

to read some reference voltages in conjunction with testing the analog multiplexers if they

are used in the application. The internal reference voltage should also be checked. Some

STM32 devices feature two (and some even three) independent ADC blocks. It make sense

to perform conversions on the same channel using two different ADC blocks for security

reasons.

Class B tests must also detect any malfunction of the digital I/Os. This could be covered by

plausibility checks together with some other application parts (for example, the change in an

analog signal from a temperature sensor should be checked when the heating/cooling digital

control is switched on/off). Selected port bits can be locked by applying the correct lock

sequence to the lock bit in the GPIOx_LCKR register to prevent unexpected changes to the

port configuration. Reconfiguration is only possible at the next reset sequence in this case.

In addition, the bit banding feature can be used for atomic manipulation of the SRAM and

peripheral registers.

Application interrupt occurrences and external communication flows should also be

checked. Different methods can be used: one method can use a set of incremental counters

with specific counters incremented by each interrupt or communication event. The values in

the counters are then checked periodically at given time intervals to make a cross-check

with an independent timebase. The number of events performed within the last period

should correspond to the application requirements. The configuration lock feature can be

used to secure the timer register settings with three levels controlled by the TIMx_BDTR

register.

Data exchange at communication sessions should be checked while including a redundant

information into the data packets. Parity, sync signals, CRC check sums, block repetition or

protocol numbering can be used for this purpose. Robust application software protocol

stacks like TCP/IP give higher level of protection, if necessary.