ST STM8AF Series User manual

October 2019 UM1915 Rev 3 1/43
1
UM1915
User manual
STM8AF safety manual
Introduction
The microcontrollers of the STM8AF Series, featuring different memory densities, packages
and peripherals, are designed for automotive applications.
This document describes how to use them in the context of a safety-related system
(STM8A-SafeASIL functional safety package), specifying the user's responsibilities for
installation and operation, in order to reach the targeted safety integrity level.
This manual applies to the following STM8AF products:
•the STM8AF62 line, which is the mainstay of the automotive STM8A 8-bit MCU:
– low density devices with 8 Kbytes of Flash memory: STM8AF6223/26
– medium density devices with 16 to 32 Kbytes of Flash memory: STM8AF624x,
STM8AF6266/68, STM8AF612x/4x and STM8AF6166/68
– high density devices with 32 to 128 Kbytes of Flash memory:STM8AF6269/8x/Ax and
STM8AF6178/99/9A
•the STM8AF52 line: STM8AF automotive MCUs with CAN:
– high density devices with 32 to 128 Kbytes of Flash memory: STM8AF52xx and
STM8AF51xx
System designers can avoid going into the details of the ISO26262 functional safety
standard application to the STM8AF microcontrollers by following the indications reported in
this manual.
This manual is written in compliance with ISO 26262. It also indicates how to use the
STM8AF MCUs in the context of other functional safety standards such as IEC 61508.
The safety analysis summarized in this manual takes into account the variation in terms of
memory size, number of internal peripherals and the different packages available among
the different part numbers of STM8AF microcontrollers.
This manual has to be read along with the technical documentation on related part numbers
available on www.st.com/stm8.
www.st.com

Contents UM1915
2/43 UM1915 Rev 3
Contents
1 About this document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.1 Purpose and scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.2 Terms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 Reference normative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.4 Annexes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2 STM8AF device development process . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1 STMicroelectronics standard development process . . . . . . . . . . . . . . . . . . 8
3 STM8AF safety architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1.1 Definition of the SEooC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2 STM8AF as a SEooC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.3 Assumed safety requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.3.1 The target safety metrics (ASIL, SPFM, LFM and PMHF) . . . . . . . . . . . 11
3.3.2 The assumed target time intervals (FTTI and MPFDI) . . . . . . . . . . . . . . 12
3.4 Electrical specifications and environment limits . . . . . . . . . . . . . . . . . . . . 13
3.5 Systematic safety integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.6 Safety mechanisms/measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.6.1 STM8AF core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.6.2 Program Flash memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.6.3 Data EEPROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6.4 RAM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6.5 Boot ROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.6.6 Basic enhanced CAN (beCAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.6.7 LINUART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.6.8 USART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.6.9 I2C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.6.10 SPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.6.11 Analog to digital converter (ADC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.6.12 Advanced control and general purpose timers (TIM 1 and TIM 2/3) . . . 22
3.6.13 Basic timer (TIM 4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.6.14 GPIO - Ports A/B/C/D/E/F/G/H . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

UM1915 Rev 3 3/43
UM1915 Contents
3
3.6.15 Address and Data bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.6.16 Supply voltage system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3.6.17 Reset and clock control subsystems . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.6.18 Auto-wakeup timer (AWU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.6.19 Watchdogs (IWDG, WWDG) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.6.20 Debug/SWIM (single wire interface module) . . . . . . . . . . . . . . . . . . . . . 27
3.6.21 Interrupt controller (NVIC and EXTI) . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.6.22 Latent fault detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.6.23 Disable and periodic cross-check of unintentional activation
of unused peripherals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.7 Assumption of use (AoU) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.7.1 List of AoUs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4 Safety analysis results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.1 Hardware random failure analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.1.1 Safety analysis result customization . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.1.2 General requirements for FFI (freedom from interferences ) . . . . . . . . . 34
4.2 Dependent failures analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.2.1 Power supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.2.2 Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
5 List of evidences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Appendix A Change impact analysis for other safety standards. . . . . . . . . . . . 37
A.1 IEC 61508 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
A.1.1 Architectural categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
A.1.2 Safety metrics re-computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A.1.3 Work products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

List of tables UM1915
4/43 UM1915 Rev 3
List of tables
Table 1. Terms and abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Table 2. List of STM8AF assumed requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 3. Target safety metric values at the item level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Table 4. List of safety mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Table 5. List of general requirements for FFI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Table 6. Some reference architectures for IEC 61508 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Table 7. Mapping between this document content and IEC 61508-2 Annex D requirements . . . . . 40
Table 8. IEC 61508 work product grid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Table 9. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

UM1915 Rev 3 5/43
UM1915 List of figures
5
List of figures
Figure 1. Definition of the STM8AF as a SEooC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Figure 2. Relationship between assumptions and SEooC development . . . . . . . . . . . . . . . . . . . . . . 10
Figure 3. STM8AF FTTI allocation and cycle time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Figure 4. Correlation matrix between SIL and ASIL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

About this document UM1915
6/43 UM1915 Rev 3
1 About this document
1.1 Purpose and scope
This document is addressed to system designers willing to evaluate the safety of their
solutions. It describes how to use STM8AF microcontrollers in the context of a
safety-related
system, specifying the user responsibilities for installation and operation, to reach the desired
safety integrity level.
1.2 Terms and abbreviations
Table 1. Terms and abbreviations
Acronym Definition
AoU Assumptions to use
ASIL Automotive safety integrity level
CCF Common cause failure
COTS Commercial off-the-shelf
CPU Central processing unit
CRC Cyclic redundancy check
DC Diagnostic coverage
DTI Diagnostic test interval
FIT Failure in time
FTTI Fault tolerant time interval
FMEA Failure mode effect analysis
FMEDA Failure mode effect diagnostic analysis
HFT Hardware fault tolerance
HW Hardware
INTC Interrupt controller
LFM Latent fault metric
MCU Microcontroller unit
MPF Multiple point failures
MPFDI Multiple point fault detection interval
NVIC Nested vector interrupt controller
PMHF Probabilistic metric for random hardware failures
QM Quality management
SFF Safe failure fraction
SIL Safety Integrity level
SEooC Safety element out of context
SPF Single point fault
SPFM Single point fault metric
SW Software

UM1915 Rev 3 7/43
UM1915 About this document
42
1.3 Reference normative
This document is written in compliance with the ISO 26262 international standard for
functional safety of electrical and/or electronic (E/E) systems within road vehicles.
The versions used as reference is:
•ISO 26262:2018 – Road Vehicles Functional Safety Standards
This safety manual follows the list of recommended contents in Annex A, clause A.3.10 of
ISO 26262-10.
The other functional safety standard considered in this manual is:
•IEC 61508:1-7 ©IEC:2010.
1.4 Annexes
UM2138 is a collection of FMEDA snapshots. It is a static document reporting the safety
metrics computed for different detail levels (at microcontroller level and for microcontroller
basic functions) for a given combination of safety mechanisms, a given set of assumptions
and for a given part number. If a FMEDA computation sheet is needed, contact your local
STMicroelectronics sales representative to receive information on expected delivery dates
for specific MCU target part numbers.
UM2139 provides clarifications, guidelines and examples on how to handle the FMEDA
results for STM8AF MCUs.
[1] UM2138 FMEDA analysis for STM8AF Series MCUs
[2] UM2139 FMEDA handling for STM8AF Series MCUs

STM8AF device development process UM1915
8/43 UM1915 Rev 3
2 STM8AF device development process
The development process of a microelectronic device used in safety critical applications
must take into account the adequate management to reduce the probability of
systematic faults introduced during the design phase.
ISO 26262-10 Annex A (“A.3.7: Example of techniques or measures to detect or avoid
systematic failures during design of a microcontroller”) act as a guidance in tailoring the
microcontroller standard design and manufacturer process to the compliance of ISO 26262
requirements. The checklist reported in the named Annex A (Table A.8) helps to
collect all
related evidences of a given real process.
2.1 STMicroelectronics standard development process
STMicroelectronics (ST) serves four industry domains:
•Standard products.
•Automotive products: ST automotive products are AEC-Q100 compliant. They are
subject to specific stress testing and processing instructions in order to achieve the
required quality levels and product stability.
•Automotive safety: a subset of the automotive domain. ST uses as a reference the
ISO 26262 Road vehicles Functional safety standard. ST supports customer inquiries
regarding product failure rates and FMEDA to support hardware system compliance to
established safety goals. ST provides products that are safe in their intended use,
working in cooperation with customers to understand the mission profile, adopt
common methods and define countermeasures for residual risks.
•Medical products: ST complies with applicable regulations for medical products and
applies due diligence in the development and validation of these products.
STMicroelectronics product development process, compliant with the ISO/TS 16949
standard, is a set of interrelated activities dedicated to transform customer specification
and market or industry domain requirements into a semiconductor device and all its
associated elements (package, module, sub-system, application, hardware, software and
documentation), qualified respecting ST internal procedures and able to be manufactured
using ST internal or subcontracted technologies.

UM1915 Rev 3 9/43
UM1915 STM8AF safety architecture
42
3 STM8AF safety architecture
This section describes the safety architecture to implement when using STM8AF
microcontrollers for automotive applications.
3.1 Introduction
The STM8AF microcontroller described in this document is a Safety element out of context
(SEooC), that is, a safety element that can be used in different safety applications.
The aim of this section is to define the context of the analysis in terms of assumptions with
respect to reference safety requirements as also assumptions with respect to the design
external to that SEooC.
As a consequence of the SEooC approach, the goal is not to provide an exhaustive hazard
and risk analysis of the system around the microcontroller, but rather to list the
system-related information (such as the application-related assumptions for dangerousness
factors, frequency of failures and diagnostic coverage already guaranteed by the
application) that have been considered during the following steps of the analysis.
3.1.1 Definition of the SEooC
The automotive industry develops generic elements for different applications and for
different customers. These generic elements can be developed concurrently and by
different companies in different tiers of the supply chain, as a distributed development.
Assumptions are made both on the requirements (including safety requirements) on the
element at higher levels of design and also on the design external to the element.
In a safety context, these elements can be developed as a “Safety Element out of Context”
(SEooC), as described in ISO 26262-10, Clause 9.
According to ISO 26262, a “safety element out of context (SEooC)” is a safety-related
element that is not developed for a specific item, i.e. in the context of a particular vehicle. A
SEooC can be a system, an array of systems, a subsystem, a software component or a
hardware component.
This document considers the STM8AF as a SEooC to whom an ASIL capability is
required, up to and including ASILB, i.e. it can be used in ASILA and ASILB
environments.
3.2 STM8AF as a SEooC
The STM8AF is a general purpose RISC microcontroller, suitable for embedded
applications and, in particular, for safety related applications.
For a detailed description of the STM8AF functionality refer to the reference manuals,
available on www.st.com.
In this document, the SEooC is identified as the STM8AF microcontroller (MCU),
referenced as a functional block inserted in a system defined by Figure 1. The MCU acts as
the processing unit of the system, i.e. acquiring field data from sensors, processing
them according to the implemented algorithm, and taking decisions that bring to specific
commands to external actuators. The MCU is connected directly or indirectly to
sensors
and actuators through communication buses.

STM8AF safety architecture UM1915
10/43 UM1915 Rev 3
Figure 1. Definition of the STM8AF as a SEooC
Other components, like the external HW components needed to guarantee either the
functionality of the STM8AF (external memory, clock quartz) or its safety (e.g. the external
watchdog, voltage supervisors) can be connected to the SEooC.
3.3 Assumed safety requirements
A SEooC is developed, according to ISO 2626-10 clause 9, on the basis of assumptions for
its
intended functionality, use and context, including external interfaces (Figure 2).
Figure 2. Relationship between assumptions and SEooC development
The validity of the aforementioned assumptions is checked, in the context of the actual
item, after the integration of the SEooC.
In this document it is assumed that the concept specification, the hazard and risk analysis,
the overall safety requirement specification and the consequent allocation have determined
the assumed safety requirements reported in Table 2.
069
5HPRWH
FRQWUROOHU
5HPRWH
FRQWUROOHU
5HPRWH
FRQWUROOHU
5HPRWH
FRQWUROOHU
6HQVRU
$FWXDWRU
6
6
$
$
3URFHVVLQJHOHPHQW
6(RR&
670$)
069
$VVXPSWLRQV
$VVXPHGUHTXLUHPHQWV $VVXPSWLRQVRQGHVLJQ
H[WHUQDOWR6(RR&
6(RR&UHTXLUHPHQWV 6(RR&GHVLJQ