Safety Manual for MPC5777M, Rev. 1.1
General information
NXP Semiconductors8
failure indication stays in failure mode for a configurable minimum time as shown in Equation 1. For
bi-stable protocol the time DELTA_T is configurable by software up to a maximum of 10 ms by
configuring FCCU_DELTA_T[DELTA_T].
T_min = 250 μs + FCCU_DELTA_T[DELTA_T] μs Eqn. 1
In case another failure event happens within T_min after the first failure event, the timer measuring T_min
is restarted.
2.7 Failure handling
The FCCU is responsible for reacting to internal failures. A different reaction can be configured for each
failure source.
Failure sources include:
• All failure indication signals from the modules within the MCU
• Control logic and signals monitored by the FCCU itself
• Software-initiated failure indications
• External failure input (via FI[0] pin)
The different failure sources, as represented by the FCCU failure inputs, are shown in “FCCU failure
inputs” table in the “Functional Safety” chapter of the MPC5777M Reference Manual.
Available failure reactions include:
• Maskable interrupt
• Non-maskable interrupt
•Reset
• Change the state of the failure indication pin(s)
• No reaction
Additionally, the transmission capabilities of the communication controllers can be disabled when the
FCCU transitions to the error state (see “Disabling of communication controllers” in the “Functional
Safety” chapter of the MPC5777M Reference Manual).
Software can read the failure source that caused a fault from the FCCU_RF_S[0:3] registers and can do so
either before or after a functional reset. Software can also reset the failure by resetting the respective status
bit, but the external failure indication will stay in failure mode for a configurable amount of time (see
Equation 1).
Error handling can be split into two categories:
• Handling of errors during runtime
• Handling of errors during boot-time (for example, LBIST, MBIST)
Assumption: [SM_FMEDA_003] Runtime errors shall be handled in a time shorter than the FTTI. [end]