Safety Manual for MPC5777M, Rev. 1.1
Functional safety requirements for application software
NXP Semiconductors24
3.2.13 Clock monitoring configuration
Clocks are supervised by the Clock Monitoring Units (CMUs). The CMUs are driven by the 16 MHz
internal reference clock oscillator (IRCOSC) to ensure independence from the monitored clocks. The
CMUs flag errors associated with conditions due to clocks being out of programmable bounds, and loss of
reference clock. If a supervised clock leaves the specified range for the device, an error signal is sent to
the FCCU. MPC5777M includes the CMUs as shown in the “Clocking” chapter of the MPC5777M
Reference Manual. It is the responsibility of the software to verify that the IRCOSC and XOSC are valid
before starting the CMUs.
Assumption: [SM_FMEDA_040]The CMU frequency thresholds shall be configured for high and low
limits which are used to compare with the MCU operating frequency. [end]
Assumption: [SCG18.035]The potential exactness (or the required inexactness) of the CMU thresholds
shall be taken into account for both the IRCOSC and clock, or clocks, being monitored. [end]
NOTE
Implementation hint: For example, for the upper threshold customer
should target CLKnominal_freq + CLKacc% and convert it into the number
of IRC cycles in the worst case (slowest possible IRCOSC), for example
IRC_freq = IRCnominal_freq – IRCacc%. The opposite applies to the
lower threshold.
Assumption: [SM_FMEDA_041] For ASIL D applications, the use of the CMUs is mandatory. If the
related modules are used by the application safety function, the user shall verify that the CMUs are not
disabled and their faults are managed by the FCCU. The FCCU’s default configuration does not manage
the CMU faults, so it shall be configured accordingly. [end]
Assumption: [SM_FMEDA_042]Application software shall check the configuration of the CMU once
after programming. [end]
Assumption: [SM_FMEDA_043]Once after the boot the application shall measure the CLKMT0_RMN
frequency (IRCOSC) with CLKMN0_RMT (XOSC) as reference clock exploiting the CMU frequency
measurement feature. To detect failure of the IRCOSC, the application software shall utilize the CMU’s
frequency meter to read the IRCOSC frequency and compare it against the expected value of 16
MHz
1
[end]
Assumption: [SM_FMEDA_044]After start-up, the CMU reaction path shall be tested by modifying the
CMU threshold. [end]
Assumption: [SM_FMEDA_045]To detect delays in clock mode switching and lost clock switching, the
software shall ensure the CMU is reprogrammed with the new expected clock frequency minimum and
maximum values within the FTTI. [end]
1. Nominal frequency of the IRCOSC is 16 MHz, but a post trim accuracy over voltage and temperature must be taken into
account (see the ‘Internal RC Oscillator electrical specifications’ in the MPC5777M Data Sheet).
To Next Page
Loading...
Need help?
General
