ST STM32L4 Series User Manual page 89

Diagnostic
CAN_SM_0
CAN_SM_1
CAN_SM_2
USB_SM_0
USB_SM_1
USB_SM_2
USB_SM_3
FFI_SM_0
FFI_SM_1
CoU_1
CoU_2
CoU_3
CoU_4
CoU_5
CoU_6
CoU_7
CoU_8
DUAL_SM_0
1. To achieve on the single MCU local safety metrics compatible with SIL2 target , method CPU_SM_6 could
be sufficient. Anyway, to understand the rationale behind "++" classification for both methods, refer to the
"Recommendations" row of related description in
details.
UM2305 - Rev 10
Description
Controller area network (bxCAN)
Periodic read-back of configuration registers
Protocol error signals
Information redundancy techniques on messages,
including end-to-end protection.
Universal serial bus full-speed device interface (OTG_FS)
Periodic read-back of configuration registers
Protocol error signals
Information redundancy techniques on messages
Information redundancy techniques on messages,
including end-to-end protection.
Part separation (no interference)
Disable of unused peripherals
Periodic read-back of interference avoidance registers
®
Arm Cortex
®
The reset condition of Arm Cortex
compatible as valid safe state at system level
Device debug features must not be used in safety
function(s) implementation.
®
Arm Cortex
Low-power mode state must not be used in safety
function(s) implementation.
Device peripherals
End user must implement the required combination of
safety mechanism/CoUs for each STM32 peripheral used
in implementation of safety function(s).
Flash memory subsystem
During Flash memory bank mass erase and
reprogramming there must not be safety functions(s)
executed by Device.
On‑field Application software live update by dual‑bank
Flash memory system must include the execution of
code/data integrity check through methods such as
FLASH_SM_0
CPU subsystem
In case of multiple safety functions implementations,
methods to guarantee their mutual independence must
include use.
Clock recovery system (CRS)
CRS features must not be used in safety function(s)
implementation.
Cross-check between two STM32 MCUs
Section 3.6 Hardware and software diagnostics
®
-M4 CPU
®
- M4 CPU must be
Debug
®
-M4 / Supply system
Device
Conditions of use
Rank Perm
++ X
++ X
++ X
++ X
++ X
++ X
+ X
++ -
++ -
++ -
++ -
++ -
++ X
++ -
++ X
++ -
++ -
o X
for more
UM2305
Trans
X
X
X
X
X
X
X
-
-
-
-
-
X
-
X
-
-
X
page 89/110