ST SPC582B Series Installation and operating instructions

Introduction
This application note describes the FCCU failure input sources. Furthermore, for each of them, it describes how to verify the
integrity of the error reaction path and the recommended methods to inject a fault.
The device mentioned in this document is the SPC582Bx (40 nm–Body–ASIL B). Most of the concepts, however, are also valid
for the other devices belonging to the 40 nm and 55 nm families of SPC5 32-bit automotive MCUs.
Before reading this document, the reader should have a clear understanding about the usage of FCCU. For further details on
this module, refer to “Fault Collection and Control Unit (FCCU)” chapter of the SPC582Bx microcontroller reference manual
RM0403. For description of the functional and electrical problems of the SPC582Bx devices, the reader should also refer to the
SPC582Bx errata sheet ES0413.
A reference code is available.
SPC582Bx FCCU fault sources and reaction
AN5752
Application note
AN5752 - Rev 1 - November 2021
For further information contact your local STMicroelectronics sales office.
www.st.com

1Overview
The FCCU is a key element of the functional safety concept of the SPC58 and SPC57 families of SPC5
32-bit automotive MCUs. It is responsible for collecting and reacting to failure notifications coming from different
modules indicated as monitors. Examples of monitors are CMU, MEMU, XBIC and so forth.
Figure 1. FCCU monitor to reaction path
FCC
U
Clear
Clear
Error out/in
Reset request Reset
Fault
Fault
Set
Set
.
.
.
INTC
Interrupt request
(ALARM)
Interrupt
RGM
NMI
Monitor 1
Monitor N
.
Core_0
FCCU
FOSU
destructive
reset
Note: Some monitors might miss the set and clear signals.
The Figure 1 shows how the FCCU is connected to the other blocks. The reader shall consider the above figure,
and all other figures in this document, as a logic schema that not exactly reflects the physical implementation in
the silicon.
In case of a fault, the FCCU can move the device into the safe state (the safety manual defines the safe states)
without any core intervention. Since the FCCU and the whole error reaction path are prone to latent failures, the
safety concept requires the execution of a software test to verify the integrity of the error reaction. The user shall
run this software test at least once per trip time.
Note: The safety analysis assumes a trip time of 12 hours.
This document goes through the list of the faults reported by the FCCU. For each of them it describes how to
test the reaction path to fulfill the previous requirement. Note that the user cannot test the error reaction path for
certain monitors.
The Table 1 lists and describes all FCCU input fault sources for SPC582Bx MCUs.
Table 1. FCCU failure inputs
FCCU input # Source Failure description Error reaction path
0 PMC DIG Temperature out of range Not testable
1 PMC DIG Voltage out of range from LVDs Not testable
2 PMC DIG Voltage out of range from HVDs Not testable
3 PMC DIG Digital PMC initialization error during DCF data load Not testable
4 PMC DIG Digital PMC voltage detector BIST Testable
5 SSCM/FLASH_0 SSCM transfer error OR Flash memory initialization error Not testable
6 STCU BIST result-wrong signature (STCU unrecoverable fault) Testable
AN5752
Overview
AN5752 - Rev 1 page 2/35

FCCU input # Source Failure description Error reaction path
7 STCU BIST result-wrong signature (STCU recoverable fault) Testable
8 STCU MBIST control activation Testable
9 GLUE LOGIC JTAG, NPC or debug functionality moved out of reset or
SSCM activation Testable
10 PLATFORM/DMA DMA_1 gasket monitor error Not testable
11 PLATFORM/DSMC DSMC ECC error Not testable
12 PLATFORM/CORE Core_2 I-bus ECC error Not testable
13 PLATFORM/CORE Core_2 D-bus ECC error Not testable
14 PLATFORM/DMA DMA_1 ECC error Not testable
15 PLATFORM/DMA DMA_1 TCD EDC after ECC Not testable
16 FLASH_0/1 Flash reset error Not testable
18 PLATFORM/SWT SWT_2 reset request Testable
21 MEMU System RAM ECC correctable error Testable
22 MEMU System RAM ECC uncorrectable error Testable
23 MEMU System RAM ECC overflow error(1) Testable
24 MEMU Peripheral RAM ECC correctable error Testable
25 MEMU Peripheral RAM ECC uncorrectable error Testable
26 MEMU Peripheral RAM ECC overflow error(2) Testable
27 MEMU Flash ECC correctable error Testable
28 MEMU Flash ECC uncorrectable error Testable
29 MEMU Flash ECC overflow error Testable
30 IMA IMA activation Testable
32 PLATFORM/SMPU SMPU XBAR 1 monitor incorrectly refuses an access Not testable
34 PLATFORM/SMPU SMPU XBAR 1 monitor correctly refuses an access Testable
48 PLATFORM/DMA DMA_1 TCD RAM feedback error Testable
49 PLL DIG PLL0 loss of lock error Testable
50 PLL DIG PLL1 Loss of Lock error Testable
51 CMU CMU_0 error (XOSC less than IRC, XTAL pin floating,
EXTAL pin floating) Not testable
52 CMU Frequency out of range(3) Testable
53 CMU Frequency out of range(4) Testable
54 CMU Frequency out of range(5) Testable
56 PLATFORM/XBAR 1 XBIC error detected Testable
63 FLASH_0 Flash read reference error Testable
64 PLATFORM/FLASH_1 EDC after ECC error for Flash array Testable
65 PLATFORM/FLASH_1 EDC after ECC error for Flash controller Not testable
66 PLATFORM/FLASH_1 Flash encoding error Testable
67 PLATFORM/FLASH_1 PFLASH address feedback error Testable
74 PLATFORM/PRAM 2 Corrupted system RAM access or late-write buffer mismatch Not testable
75 PLATFORM/PRAM 2 EDC after ECC for system RAM Not testable
78 TCU Test circuitry group 1 activation Not testable
AN5752
Overview
AN5752 - Rev 1 page 3/35

FCCU input # Source Failure description Error reaction path
79 TCU Test circuitry group 2 activation Not testable
80 TCU Test circuitry group 3 activation Not testable
81 TCU Test circuitry group 4 activation Not testable
84 PLATFORM/CORE Safety Core_2 exception (machine check exception) Testable
89 PLATFORM/PBRIDGE PBRIDGE_1 e2eEDC error Not testable
91 PLATFORM/PBRIDGE PBRIDGE_2 e2eEDC error Not testable
94 MC_RGM Safe mode entry indication Not testable
95 COMPENSATION CELLS Pad compensation deactivation Not testable
96 GLUE LOGIC Error input pin (from the external world) Testable
1. Aggregate of RAM correctable error overflow flag, RAM uncorrectable error overflow flag, RAM error buffer overflow flag.
2. Aggregate of peripheral RAM correctable error overflow flag, peripheral RAM uncorrectable error overflow flag, peripheral
RAM error buffer overflow flag.
3. FHH or FLL event for CMU_0.
4. FHH or FLL event from CMU_1, CMU_2, CMU_3, CMU_11, CMU_14.
5. FHH or FLL event from CMU_6, CMU_12.
Before the safety application starts, the user shall configure a proper reaction for each FCCU failure input
source. See “FCCU registers reset values” paragraph in SPC582Bx Reference Manual for the device default
configuration.
Possible reactions to a failure are:
• Internal reactions:
Note: The user can configure separately the internal reaction for each FCCU input.
– No reset reaction
– IRQ
– Short functional reset
– Long functional reset
– NMI
• External reaction:
– Error out (EOUT) signaling.
The FCCU controls EOUT pins that signal the status of the MCU without any core intervention.
A dedicated module called FOSU monitors the integrity of the FCCU. The FOSU triggers a destructive reset if its
internal counter reaches a timeout before the FCCU takes a reaction to an incoming – and enabled – fault.
Note: There is a 'do nothing' FOSU input coming from the FCCU that indicates that the FCCU is programmed for no
reaction.
The FOSU does not require any configuration done by the user. A functional reset has no impact on the FCCU.
AN5752
Overview
AN5752 - Rev 1 page 4/35

2FCCU fault injection, clearing and fake fault interface
The application can use the fault injection to diagnose physical defects affecting the connections between the
hardware monitors and the FCCU. The procedure to inject a fault depends on the specific monitor.
Three different sets of fault inputs can be distinguished:
• faults injectable by using the FCCU fake fault interface (“Mon 1” in Figure 2);
• faults injectable by using a SW procedure to stimulate the fault (“Mon 2” in Figure 2);
• faults not injectable (“Mon 3” in Figure 2).
Figure 2. FCCU inner diagram
FCCU_RFF
register
RGM
Error out
Reset request
Mon 1
Fault
CLEAR
INTC
Interrupt request
SET
SET
CLEAR
Mon 2
Fault
Mon 3
Fault
FCCU_RF_Sn
register
Mon 2 Register
FSM
The FCCU can trigger a fault event directly in the monitor (even if no real failure is occurred) through the fake fault
interface.
To generate this fault event, an additional (and optional) signal is available (set signal in Figure 2, yellow arrow).
Note: Not all monitors embed this interface. When available, fake fault injection method is suggested in the following
sections.
The fake fault injection is executed by a write operation into the FCCU_RFF register and the corresponding
reaction is not maskable. Some monitors miss the set signal. In this case (set signal in Figure 2, blue arrow) the
write operation into the FCCU_RFF register does not affect the monitor but only the FCCU reaction.
AN5752
FCCU fault injection, clearing and fake fault interface
AN5752 - Rev 1 page 5/35

To clear a fault directly in the monitor, an additional (and optional) signal is available (clear signal in Figure 2,
yellow arrow). The de-assertion of the FCCU_RF_Sn status bit indicates that the software has properly cleared
the fault. Some monitors miss the clear signal. In this case (clear signal in Figure 2, blue arrow) the fault can be
cleared by a write operation into a specific register of the monitor.
Depending on the monitor, the fault indication is a pulse, that is, fault edge triggered, or a constant value, fault
level triggered.
The fault management shall consider that the user can configure a fault as:
• HW recoverable fault, that is, the fault status within the FCCU remains asserted until the monitor keeps the
fault indication asserted. As soon as the monitor clears the fault indication, it also clears the fault status
within the FCCU.
• SW recoverable fault, that is, the fault status within the FCCU remains asserted until the software clears it
even if the monitor de-asserts the fault indication.
The generic recommendation is to configure all faults as SW recoverable. In such a way, the FCCU clears the
respective status flag only after an explicit request from the software. In case of HW recoverable, the status flag
automatically clears, and the application may not react properly to the incoming fault.
AN5752
FCCU fault injection, clearing and fake fault interface
AN5752 - Rev 1 page 6/35

3Faults description
The following sections describe all the faults collected by FCCU for SPC582Bx device and how, if possible, to
inject them for checking the integrity of the relevant reaction path.
The following convention is adopted in the following figures:
1. a green arrow marks the faults injectable by the FCCU fake fault interface;
2. a blue arrow marks the faults injectable by using a SW procedure to stimulate the fault;
3. a red arrow marks the faults that the user cannot inject.
3.1 PMC_DIG faults
PMC_DIG is the source of five different FCCU input faults.
For further details on PMC_DIG, refer to the device SPC582Bx microcontroller reference manual RM0403.
Figure 3. PMC_DIG faults
RGM
Error out
Reset request
reset
TSENS
FCCU
INTC
Interrupt request
Interrupt
LVDs
HVDs
DCF
BIST
PMC_Dig
Fault #2
Fault #0
Fault #1
Fault #3
Fault #4
Set
Clear
3.1.1 Temperature detector out of range (fault #0)
The temperature detector detects if the temperature exceeds the defined thresholds and the PMC_DIG forwards
this fault to the FCCU. There are three thresholds: TS0, TS1, and TS2. Temperature detector thresholds are
trimmed at testing phase and cannot be configured by the user.
The user cannot inject this fault.
3.1.2 Voltage out of range from LVDs (fault #1)
Each LVD detects a voltage that drops below the defined threshold and the PMC_DIG forwards this fault to the
FCCU. The MCU embeds some LVDs (for further details on LVDs, refer to SPC582Bx reference manual RM0403)
and their output signals are put in OR before arriving at the FCCU failure input #1.
The user cannot inject this fault.
3.1.3 Voltage out of range from HVDs (fault #2)
Each HVD detects a voltage that raises above the defined threshold and the PMC_DIG forwards this fault to
the FCCU. The MCU embeds some HVDs (for further details on LVDs, refer to SPC582Bx reference manual
RM0403) and their output signals are put in OR before arriving at the FCCU failure input #2.
The user cannot inject this fault.
AN5752
Faults description
AN5752 - Rev 1 page 7/35

3.1.4 Digital PMC initialization error during DCF data load (fault #3)
DCF records are used to configure certain registers in the device during system boot. If an error occurs while the
SSCM loads the values into the PMC registers, the PMC_DIG forwards this fault to the FCCU.
The user cannot inject this fault.
3.1.5 Digital PMC voltage detector BIST (fault #4)
The voltage detector BIST verifies the integrity of all the voltage monitors. In case the BIST fails, the PMC_DIG
forwards this fault to the FCCU.
The user can inject this fault by the FCCU fake fault interface.
The user must set the PMC_DIG_BIST_CTRL[NCFEN] bit to enable a user BIST not critical fault indication to the
FCCU and inject a fake fault by setting the FCCU_RFF[FRFC] field to the value 0x04. The FCCU error reaction
path is verified if both the FCCU_RF_S0[RFS4] and the BIST_CTRL[NCFST] status bits are set.
The BIST_CTRL[NCFST] status bit indicates a BIST fail on completion of BIST sequence, and it is cleared by HW
on clearing the relevant FCCU_RF_S0[RFS4] bit.
3.2 SSCM/Flash_0 fault
The SSCM reads the system configuration from the Flash memory and pushes it to the various clients inside the
microcontroller.
Note: System configuration is mainly saved as DCF records that are located either in the test or UTest sectors of the
Flash memory.
For further details on SSCM, refer to the device SPC582Bx reference manual RM0403.
Figure 4. SSCM/Flash faults
RGM
Error out
Reset request reset
SSCM
FCCU
INTC
Interrupt request
Interrupt
FLASH
Fault #5
3.2.1 SSCM transfer error OR Flash memory initialization error (fault #5)
A fault can occur while the SSCM loads the STCU configuration and the SSCM forwards this fault to the FCCU.
Moreover, an unexpected condition, for example, ECC double-bit detections on the reset reads, can occur within
the Flash memory during its initial configuration and the Flash memory forwards this fault to the FCCU.
The two error signals are put in OR before arriving to the FCCU failure input #5.
The user cannot inject this fault.
3.3 STCU faults
The STCU is a comprehensive programmable hardware module that controls the execution of the self-test during
both the off-line and/or on-line procedure. The STCU is the source of three different FCCU input faults. For further
details on STCU, refer to the device SPC582Bx microcontroller reference manual RM0403.
AN5752
SSCM/Flash_0 fault
AN5752 - Rev 1 page 8/35

Figure 5. STCU2 faults
RGM
Error out
Reset request reset
STCU2 FCCU
INTC
Interrupt request
Interrupt
Fault #7
Fault #6
Fault #8
Set
Clear
3.3.1 BIST result-wrong signature (STCU unrecoverable fault) (fault #6)
If the BIST detects a fault that is configured as unrecoverable fault, the STCU forwards this fault to the FCCU.
Note: The user shall configure the STCU to trigger either a recoverable or an unrecoverable fault if the BIST fails. This
configuration is done by programming the proper DCF records.
Although BIST is able to detect permanent faults, this fault can be also triggered in case of transient faults. The
STCU can trigger this fault only during BIST execution.
The user can inject this fault by the FCCU fake fault interface.
The user can inject a fake fault by setting the FCCU_RFF[FRFC] field to the value 0x06. The FCCU error reaction
path is verified if both the FCCU_RF_S0[RFS6] and the STCU2_ERR_STAT[UFSF] status bits are set.
The STCU2_ERR_STAT[UFSF] status bit indicates errors that trigger the unrecoverable fault condition, and it is
cleared by HW on clearing the relevant FCCU_RF_S0[RFS6] bit.
3.3.2 BIST result-wrong signature (STCU recoverable fault) (fault #7)
If the BIST detects a fault that is configured as recoverable fault, the STCU forwards this fault to the FCCU.
Note: The user shall configure the STCU to trigger either a recoverable or an unrecoverable fault if the BIST fails. This
configuration is done by programming the proper DCF records.
Although BIST is able to detect permanent faults, this fault can be also triggered in case of transient faults. The
STCU can trigger this fault only during BIST execution.
The user can inject this fault by the FCCU fake fault interface.
The user can inject a fake fault by setting the FCCU_RFF[FRFC] field to the value 0x07. The FCCU error reaction
path is verified if both the FCCU_RF_S0[RFS7] and the STCU2_ERR_STAT[RFSF] status bits are set.
The STCU2_ERR_STAT[RFSF] status bit indicates errors that trigger the recoverable faults condition, and it is
cleared by HW on clearing the relevant FCCU_RF_S0[RFS7] bit.
3.3.3 MBIST control activation (fault #8)
Unexpected activation of MBIST control signals may move the system RAM array into the BIST mode during the
execution of the application. The STCU detects this activation control and forwards this fault to the FCCU.
The user can inject this fault by the FCCU fake fault interface.
The user can inject a fake fault by setting the FCCU_RFF[FRFC] field to the value 0x08. The FCCU error reaction
path is verified if the FCCU_RF_S0[RFS8] status bit is set.
AN5752
STCU faults
AN5752 - Rev 1 page 9/35

3.4 Glue logic faults
Figure 6. Glue logic fault #9
RGM
Error out
Reset request reset
JTAG/
NPC
FCCU
INTC
Interrupt request
Interrupt
SSCM
Fault #9
Set
Clear
Figure 7. Glue logic fault #96
RGM
Error out
Reset request
reset
FCCU
INTC
Interrupt request
Interrupt
Fault #96
EOUT/EIN
SIUL PAD
3.4.1 JTAG-NPC or debug functionality out of reset or SSCM activation (fault #9)
Unexpected activation of JTAG, NPC or debug functionality during the execution of the application can interfere
with the application. If this event occurs, a dedicated glue logic forwards this fault to the FCCU. The hardware
also monitors the unwanted activation of the SSCM and, if this event occurs, a dedicated glue logic forwards this
fault to the FCCU. The two error signals are put in OR before arriving at the FCCU failure input #9.
The user can inject this fault by the FCCU fake fault interface.
The user can inject a fake fault by setting the FCCU_RFF[FRFC] field to the value 0x09. The FCCU error reaction
path is verified if the FCCU_RF_S0[RFS9] status bit is set.
3.4.2 Error input pin (from the external world) (fault #96)
If an external device pulls down the EIN (error input) pin, the MCU receives a notification of a faulty condition
detected by this external device. A dedicated glue logic forwards this fault to the FCCU.
The EOUT pin driven to FAULTY state (logic ‘0’) asserts back via the pad the EIN signal. This results in a loop
where FCCU is in FAULT state and driving EOUT which in turn keeps driving EIN.
AN5752
Glue logic faults
AN5752 - Rev 1 page 10/35