Preventing erroneous activation of debug mode (SM_047 in the S32 Safety manual)

[Matthias_LEHMANN]

Hello,

I'm a bit confused about SM_047 in the S32 Safety Manual. The cookbook (examples for implemting the assumptions from the safety manual, downloaded as draft from another post) says that this assumption is fulfilled if it is ensured that no debugging device is connected (essentially a process barrier, maybe also a physical one if the correspondint pads are not accessible). However, the following sentence states that debugging should also be disabled in the field. Is this already achieved by not connecting any debugging devices (i.e. essentially by the first sentence) or does this second sentence imply that an additional HW-barrier is also required? Specifically, the safety manual states that JTAG-TMS should be pulled low. If that's the case however, it looks like it's not possible to programm the controller anymore? We use SWD-DIO to programm the controller during production. Once fully assembled, the controller is in its casing and this interface is physically not accessible anymore. Would that satisfy the assumption, even if JTAG-TMS is not permanently pulled low by a resistor?

What's the recommended solution to prevent erroneous activation of debug mode in the field, but at the same time allow debugging and programming the controller during production?

Best regards

Matthias

[Matthias_LEHMANN]

Thanks aarul, the implementation hint in Rev 6 of the safety manual now suggests the opposite solution compared to Rev 5, which makes more sense and makes implementation straightforward. Your answer and the corrected safety manual now close this topic - thanks again.

[aarul · Accepted solution]

Hi

The JTAG TMS pin should be pulled high as indicated in latest Safety Manual - Rev6. I believe pulling it high should not impact your debugger connection during production.

Please let us know if this is still an issue.

Regards

-Aarul