Fault Collection and Control Unit (FCCU)
Chip mode RESET
Figure 2328. STCU-FCCU (case b)
UNKNOWN RESET
RESET RUN
RUN
END (failure) STCU state
STCU flags
(to FCCU)
FCCU state
Chip mode
RESET
RESET
FAULT FAULT
UNKNOWN NORMAL FAULT/ALARM
Figure 2329. STCU-FCCU (case c)
UNKNOWN RESET
RM0391
STCU state
STCU flags
(to FCCU)
FCCU state
RESET RUN
FAULT
END (serious failure)
FAULT
RESET UNKNOWN NORMAL
89.5.9 EOUT interface
The FCCU provides up to two bidirectional signals (EOUT interface) as a failure indication to the external world (refer to table “FCCU failure inputs” in the “Functional safety” chapter for details). These signals need to be mapped to appropriate pins for external visibility. Since
SIUL2 does not control the pad buffer enable during Alternate function, FCCU provides a mechanism to drive the pad in OD (Open Drain) mode where the pad is driven Hi-Z when
FCCU drives logic ‘1’ else it drives logic ‘0’ (when FCCU drives logic '0'). The selection to
OD is done by OD bit in FCCU_CFG register. Different protocols for the EOUT interface are supported, selecting the FCCU_CFG.FOM register field:
• Dual rail protocol
• Time switching protocol
• Bi-stable protocol
• Test mode
The signal polarity can be programmed by setting the PS field in the FCCU_CFG register.
For example, for PS = 0, FCCU Error output[0] = 0 and FCCU Error output[1] = 1 in FAULT state for bi-stable and for PS = 1, it is inverted.
All the diagrams and tables are related to the default configuration selection: switching mode (FCCU_CFG.SM = 0b). In case of inverted polarity (FCCU_CFG.PS = 1b) all the values on the EOUT output pins are inverted.
Two modes can be programmed to define the EOUT protocol transitions in dual rail or time switching mode:
• slow switching mode: no EOUT frequency violation during the FCCU state transition
(NORMAL to FAULT or vice-versa and CONFIG to NORMAL). The EOUT protocol
3762/4266 RM0391 Rev 5
RM0391 Fault Collection and Control Unit (FCCU) transition occurs after a max delay equal to the duration of the semi-period of the
EOUT frequency.
• fast switching mode: The EOUT protocol transition (NORMAL to FAULT or vice-versa and CONFIG to NORMAL) occurs immediately. A pulse with the minimum duration corresponding to 16 MHz/1024 (IRCOSC clock) period can occur in fast switching mode. It implies a frequency violation of the EOUT protocol.
Note:
The EOUT frequency is generated by dividing IRCOSC clock by a fixed factor of 2
18
. With an IRCOSC clock of 16 MHz, this drives a signal of 61 Hz on EOUT.
The external monitor of the EOUT protocol should oversample the EOUT signals in order to synchronize periodically the external clock (used by the monitor) and the IRCOSC clock detecting the edge transition of the EOUT protocol in dual rail or time switching mode.
In case of a failure event or on software request for Error pin indication, the pin(s) are set to faulty state for a minimum time T_min, even if SW tries to release it before. If SW configures the error pins to OK(1) and if a fault comes trying to drive the pin to NOK(0), then priority is given to the fault indication and error pins indicate NOK, that is an incoming fault is not masked when SW has set the error pin to high. During the T_min by a non-SW fault, the
FCCU FSM moves independently of this pin state (low) and as soon as the timer expires, the pin behavior is dictated by the state in which the FSM finds itself in and it is not possible to set the pins to OK by SW moving FCCU to CONFIG state, as long as this timer is running.
No SW intervention is needed to bring the pin from the low state. The SW can bring the pin back to OK state by clearing the faults and waiting for the T_min to expire, after which the
FCCU automatically enters NORMAL state and the error pin indicates OK.
In case another failure event happens within T_min after a first one, the T_min counter is restarted.
Resets (except the power on reset, and software bit FCCU_RST in RGM_PRST5) should not influence the state of the failure indication, pins.
The transition from FAULT to CONFIG state is not possible but is shown to display the behavior in all four states: RESET, NORMAL, FAULT and CONFIG.
Table 2208. FCCU error pin behavior on STATE transitions
(1)
Transition from NORMAL to
FAULT state
Fault signaling state with Fault disabled
Internal
Error pin
Error pin enable
| enabled
Error pad
NORMAL+CONFIG states
Internal error pin
Error pin enable
Error pad
Transition from NORMAL to
ALARM state with Fault disabled | enabled
Internal error pin
Error pin enable
Error pad
Disabled NA | OK NA | 1 NA | OK OK 1 OK NA | OK NA | 1 NA | OK
Enabled NA | NOK NA | 1 NA | NOK OK 1
1. Table valid only after SW has written FCCU_SET_AFTER_RESET bit to 1.
OK NA | OK NA | 1 NA | OK
Note: FCCU remains in NORMAL state when fault is disabled hence, “NA” (Not Applicable) appears in the above table.
RM0391 Rev 5 3763/4266
3806
Fault Collection and Control Unit (FCCU) RM0391
89.5.9.1 Dual rail protocol
Dual rail encoding is an alternate method for encoding bits. In contrast with classical encoding, where each signal carries a single-bit value, dual rail encoded circuits use two
wires to carry each bit. The encoding scheme is given in Table 2209 and the related timing diagram is given in Figure 2330
and Figure 2331
.
Logical state
Table 2209. Dual rail encoding
Dual rail encoding
(FCCU Error output pins [1:0])
Note nonfaulty nonfaulty faulty faulty reset configuration
10
01
00
11 high-Z
(1) same as NORMAL
(2) toggling toggling no toggling toggling
1. Final value depends on the SoC settings at pad level.
2. Till FCCU_SET_AFTER_RESET is written, the Error indicating pads are driven to High impedance from
FCCU's side. That bit is write-able only after the FCCU enters CONFIG state. Hence on entry to CONFIG state, user may still see high impedance.
Note:
As long as FCCU is in NORMAL or ALARM state, output will show “nonfaulty” signal. Output pins #0, #1 will toggle between 01 and 10.
In the RESET phase the output pins are set as “high impedance” (32) .
Figure 2330 and
Figure 2331 are formatted to display the behavior in all four phases (reset,
normal, error, and config), not to imply transitions between one phase to another. In particular, transition from error phase to config phase is not possible.
Figure 2330. Dual rail protocol (slow switching mode)
Reset phase or self-test Normal phase Error phase Config phase
EOUT[0]
EOUT[1]
Input or high-Z
Output High-Z
3764/4266
32. Actual value depends on the SOC settings at pad level.
RM0391 Rev 5
RM0391
EOUT[0]
EOUT[1]
Fault Collection and Control Unit (FCCU)
Figure 2331. Dual rail protocol (fast switching mode)
Reset phase or self-test Normal phase Error phase Config phase
Input or high-Z
Output High-Z
89.5.9.2 Time switching protocol
The encoding scheme is given in Table 2210
and the related timing diagram is given in
Figure 2332 .
Logical state
Table 2210. Time switching encoding
Time switching encoding
(FCCU Error output pins [1:0])
Note nonfaulty nonfaulty faulty reset configuration
10
01
10 high-Z
(1) same as NORMAL
(2) toggling no toggling no toggling toggling
1. Final value depends on the SoC settings at pad level.
2. Till FCCU_SET_AFTER_RESET is written, the Error indicating pads are driven to High impedance from
FCCU's side. That bit is write-able only after the FCCU enters CONFIG state. Hence on entry to CONFIG state, user may still see high impedance.
Note:
As long as FCCU is in NORMAL or ALARM state, outputs will show “nonfaulty” signal.
Output pins #0, #1 will toggle between 01 and 10.
In the FAULT state, the output pin FCCU Error output pin[0] is set as low.
In Time Switching mode the second output (FCCU Error output pin[1]) is the inverted signal of first output (FCCU Error output pin[0]).
In the RESET phase the output pins are set as “high impedance”
(33)
.
Figure 2332 is formatted to display the behavior in all four phases (reset, normal, error, and
config), not to imply transitions between one phase to another. In particular, transition from error phase to config phase is not possible.
33. Actual value depends on the SOC settings at pad level.
RM0391 Rev 5 3765/4266
3806
Fault Collection and Control Unit (FCCU)
Figure 2332. Time switching protocol
Reset phase or self-test Normal phase Error phase
EOUT[0]
EOUT[1]
Input or high-Z
Output
Config phase
RM0391
89.5.9.3 Bi-stable protocol
The encoding scheme is given in Table 2211 and the related timing diagram is given in
Figure 2333 .
Logical state
Table 2211. Bi-stable encoding
Bi-stable encoding
(FCCU Error output pins [1:0])
Note nonfaulty faulty reset configuration
01
10 high-Z
(1) same as NORMAL
(2) no toggling no toggling no toggling no toggling
1. Final value depends on the SoC settings at pad level.
2. Till FCCU_SET_AFTER_RESET is written, the Error indicating pads are driven to High impedance from
FCCU's side. That bit is write-able only after the FCCU enters CONFIG state. Hence on entry to CONFIG state, user may still see high impedance.
Note:
In the FAULT state, the faulty logical state is indicated. In NORMAL or ALARM state, “nofaulty” state is indicated. In Bi-stable mode the second output (FCCU Error output[1]) is the inverted signal of first output (FCCU Error output[0]).
In the RESET phase the output pins are set as “high impedance” (34) .
Figure 2333 is formatted to display the behavior in all four phases (reset, normal, error, and
config), not to imply transitions between one phase to another. In particular, transition from error phase to config phase is not possible.
3766/4266
34. Actual value depends on the SOC settings at pad level.
RM0391 Rev 5
