Questions regarding SAF integration requirements

[AndreasStolze]

Hi,

there are a couple of unclear points from the S32K3 Safety Software Framework Safety Manual (Rev. 3 — 12 November 2021 SM40S32_SAFR1.0.0).

• SBOOT_EXT_007
  • what to test exactly for of the XRDC config? Should some registers be checked against reference values? Active fault injections to test the access protection?
• EMCEM_EXT_001
  • How to check? Just read some registers? Or do we need to loopback those pins to other GPIOs to read them back?
• EMCEM_EXT_002
  • How can the software do this? Is this some kind of fault injection during runtime?

Thank you
Andreas

[martinkaspar-r3 · Accepted solution]

Hello, here are our responses:

SBOOT_EXT_007 

No need to perform anything from the user application, SBOOT_EXT_007 has been removed in SAF K3 1.0.4 release.
To fulfill the assumption please enable associated XRDC check in the sBoot configuration plugin e.g.

For details please read sBoot UM description for associated Low Level requirements e.g.

EMCEM_EXT_001

This is just to test that calling the eMcem_EnterTestFOM was successful (see more info for this API in eMCEM UM and also for FOM test modes in RM) and the application set the EOUT pins correctly into the test mode.

After entering the test mode, you can set the EOUT value of specific pin by calling the eMcem_WriteErrorOutput API function and the readback, mentioned in that assumption, shall be done by calling the eMcem_ReadErrorOutput. Therefore, checking if you can write into those pins, which can be done in test mode only

EMCEM_EXT_002

Implementation of the SW fault trigger is application dependent, therefore user application is responsible for appropriate integration via eMcem API eMcem_AssertSWFault() – please read eMcem UM for more details.
Associated NCF_7 channel shall be appropriately configured for one of the R1, R2 or R3 reaction – please read SAF Safety Manual for more details about the reactions.
Configuration example for the NCF_7 channel:

and eventually for associated DCM channel alarm handler(s) when R1 reaction is set e.g.: