what values to select as arguments for eMcem_setupinjectionChannel

[Rudved_3366]

Hello @danielmartynek 

We are using S32K394 microcontroller, and I am facing an issue selecting the right bit values for the below function 2nd 3rd arguments:

how we have to select values to pass in 2nd and 3rd arguments,

if i take below example to inject a single bit and double bit errors, then what values i need to pass and how do i select the data and check bits:

and i tried with one example with some random values for SRAM and after inject the fault and before write or read some memory its randomly injecting some memory location, but i want to inject any specific memory location how do i perform that activity:

example code which i tried:

please help me how to select these 2 argument values based on memory and how do inject fault in specific location.

Thankyou!

[danielmartynek]

Hello @Rudved_3366,

Regarding your initial request involving an error injection into SRAM0, please refer to the EMI_2_CH_0 definition in the Reference Manual.

 

EMCEM_EIM_2_CH_0 targets SRAM0 and provides access to 64 data bits and 8 check bits.

You configured:

eMcem_SetupInjectionChannel(EMCEM_EIM_2_CH_0, 55U, 66U);

According to the Error Injection Channel Descriptor n, Word0 (EICHD0_WORD0 – EICHD4_WORD0) description in the Reference Manual:

Data bit index 55 corresponds to WORD[1], bit 23.
Check bit index 66 corresponds to WORD[0], bit 26.

As a result, the injection setup inverts one data bit and one check bit in SRAM0. In this configuration, the generated fault pattern is interpreted as an uncorrectable ECC error, which is reported by ERM0_CH0.

Regarding DTCM_1.

It seems to be all correct.

The ERM channel identifies the error source, in this case CH12 corresponds to DTCM1.

The ERM address is the latched address associated with that channel, not a complete global address.

Regards,

Daniel

[Rudved_3366]

Hello @danielmartynek :

Thank you for the info, i have got clarity on how to select on bits but as per info in the emcem manual after injecting the fault we need to read or write corresponding fault injection related memory area but currently i am not performing that action but still faults are injecting, how it works then?

Below info is is present in section 3.4.2 of S32K3 eMcem(S32K3_SAF_EMCEM_UM) Software Product Rev. 10.0 — 21 January 2025

[danielmartynek]

Hello @Rudved_3366,

This could be caused by the fact that your stack or application data is located in the memory region where the fault is being injected.

Please analyze the address captured by the ERM and then locate the corresponding address in the .map file. This will help determine whether the injected fault is affecting the stack, a global variable, or another critical memory region used by the application.

[Rudved_3366]

@danielmartynek : And additional to above question: 

Can you please give me some more info about what is latched address? how can I map this to global address, if it's an offset address of DTCM then I can do DTCM start address is 0x20000000 and add the offset address, it will be sure that fault is injected at within the expected address.

[danielmartynek]

Yes, that is correct. Simply add the value captured by the ERM to the base address of the affected memory region identified by the ERM channel. In your case, the memory base address is 0x20000000

Regards,

Daniel

[Rudved_3366]

Also, I'm injecting the fault to DTCM1, and fault injection is happening but the memory address reporting in the register is not from DTCM1.

please find the attched screenshots:

Calling functions to inject fault:

Debugger:

EIM module data:

ERM status info:

Setting NCE10 is okay, as its default setting as we are not initialized the ITCM0,

but you can see NCE2 error is set.

But the address reporting here is wrong as per memory allocation excel screen shot which i attached:

And here also once I'm injecting the fault before reading or writing memory I'm getting an error.(this I'm testing in Trace32 debugger).