Error Handler

Contains API prototypes for the Error Handler. More...

Topics
	Error Handler Config
	Declares configurations for the Error Handler.

Files
file	define_error_callback.h
	Defines error callback type for the Error Handler.
file	define_error_criticality.h
	Defines error criticality type for the Error Handler.
file	define_error_ids.h
	Defines for IDs associated with specific errors.
file	error_handler.c
	Implements APIs for the Error Handler.
file	error_handler.h
	Contains API prototypes for the Error Handler.
file	error_handler_actions.c
	Implements APIs for Error Handler Actions.
file	error_handler_actions.h
	Contains API prototypes for Error Handler Actions.

Typedefs
typedef void(*	errCallback_t) (errId_t id)
	Defines a function pointer type for error handling callback functions.

Enumerations
enum	errCrit_t
	Defines criticality levels used by EH_HandleError to determine the appropriate response for each reported errId_t. More...
enum	errId_t
	Defines unique Error IDs for reporting system errors to EH_HandleError. More...

Functions
void	EH_HandleError (errFlag_t flag, errId_t id)
	Handles error based on configured Error ID criticality if the error flag is set.
void	EH_ProcessNotificationLog (void)
	Processes all Error IDs in the log by calling the configured handler callback.
void	EH_InitiateSafeState (errId_t id)
	Transitions the system into a Safe State and resets the device.
void	EH_PushNotificationLog (errId_t id)
	Pushes Error ID to the Notification Error Log for later handling.
errId_t	EH_PopNotificationLog (void)
	Pops the last Error ID from the Notification Error Log for error handling.

Detailed Description

Contains API prototypes for the Error Handler.

The Error Handler is responsible for providing a configurable and centralized error handling mechanism for both hardware and software error flags. Unique Error IDs are reported by Tasks and handled according to their configured criticality levels.

Copyright

© 2026 Microchip Technology Inc. and its subsidiaries.

Subject to your compliance with these terms, you may use Microchip software and any derivatives exclusively with Microchip products. It is your responsibility to comply with third party license terms applicable to your use of third party software (including open source software) that may accompany Microchip software.

THIS SOFTWARE IS SUPPLIED BY MICROCHIP "AS IS". NO WARRANTIES, WHETHER EXPRESS, IMPLIED OR STATUTORY, APPLY TO THIS SOFTWARE, INCLUDING ANY IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE.

IN NO EVENT WILL MICROCHIP BE LIABLE FOR ANY INDIRECT, SPECIAL, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL LOSS, DAMAGE, COST OR EXPENSE OF ANY KIND WHATSOEVER RELATED TO THE SOFTWARE, HOWEVER CAUSED, EVEN IF MICROCHIP HAS BEEN ADVISED OF THE POSSIBILITY OR THE DAMAGES ARE FORESEEABLE. TO THE FULLEST EXTENT ALLOWED BY LAW, MICROCHIP'S TOTAL LIABILITY ON ALL CLAIMS IN ANY WAY RELATED TO THIS SOFTWARE WILL NOT EXCEED THE AMOUNT OF FEES, IF ANY, THAT YOU HAVE PAID DIRECTLY TO MICROCHIP FOR THIS SOFTWARE.

UML Class Diagrams

UML Activity Diagrams

UML Sequence Diagrams

Typedef Documentation

errCallback_t

typedef void(* errCallback_t) (errId_t id)

Defines a function pointer type for error handling callback functions.

The function pointer type is used to configure which callback to issue for an Error ID in EH_HandleError for NON_CRITICAL errors and in EH_ProcessNotificationLog for NOTIFICATION errors.

Parameters

id	The Error ID passed by the Error Handler for application specific handling.

Enumeration Type Documentation

errCrit_t

enum errCrit_t

Defines criticality levels used by EH_HandleError to determine the appropriate response for each reported errId_t.

Warning

'CRITICAL' is initialized to zero to ensure that any uninitialized instances of criticality default to 'CRITICAL'.

Enumerator
CRITICAL	Error is handled immediately with a Safe State transition
NON_CRITICAL	Error is handled immediately with a custom callback
NOTIFICATION	Error is logged for later handling with a custom callback
IGNORE	Error is not handled

errId_t

enum errId_t

Defines unique Error IDs for reporting system errors to EH_HandleError.

This enum facilitates a centralized error handling system, allowing for expansion by adding new Error IDs as required by the application. Each Error ID can be associated with a specific criticality level to determine how and when the error is handled. Errors are reported at the Task level, usually following a detected error during Middleware operations.

Warning

'ERRID_NONE' is initialized to zero and 'ERRID_MAX' is set to the highest enumerator value to ensure correct input validation in the Error Handler. Add additional application-specific error IDs within this range.

Note

Error IDs ending with _CH correspond to Error Channels in the ERRCTRL. The errCrit_t configured for each of these IDs defines the severity level used for the corresponding channel in hardware by T_InitSafetySystem. For a detailed description of each Error Channel, refer to the data sheet. Use errorIdCritLut to select the appropriate criticality level.

Enumerator
ERRID_NONE	Error is always ignored
ERRID_ERRFLAG_VAL	errFlag_t is invalid value
ERRID_ERRID_VAL	errId_t is invalid value
ERRID_SAFE_IO	Safe I/O fault detected
ERRID_FORCE_FLOAT	Forced Float could not be disabled
ERRID_SWDT_RESET_VAL	SWDT reset value is invalid
ERRID_WWDT_TIMEOUT_VAL	Windowed WDT timeout value is invalid
ERRID_GPR_VALS	Stored GPR values corrupt or unreliable
ERRID_GPR_FLAGS	Stored GPR flags corrupt or unreliable
ERRID_INIT_WATCHDOGS	Watchdogs initialization error detected
ERRID_INIT_CLOCKS	Clocks initialization error detected
ERRID_INIT_ERRCTRL	Error Controller initialization error detected
ERRID_INIT_INTERRUPTS	Interrupts initialization error detected
ERRID_INIT_POWER	Power initialization error detected
ERRID_INIT_MEMORIES	Memories initialization error detected
ERRID_INIT_CRCSCAN	CRCSCAN initialization error detected
ERRID_INIT_SLEEP	Sleep mode initialization error detected
ERRID_INT_DISABLED	Global interrupts could not be enabled
ERRID_BOD_VLM	BOD VLM trigger condition detected
ERRID_CRC_FLASH	CRC Scan of Flash error detected
ERRID_BAD_IRQ	Interrupt request issued without dedicated ISR
ERRID_NMI	Non-Maskable Interrupt completed without a device reset
ERRID_NMI_UNKNOWN	Non-Maskable Interrupt triggered by unknown source
ERRID_VREGFAIL_CH	ERRCTRL Channel Set
ERRID_VREGFAIL_VOV	VMON overvoltage detected
ERRID_VREGFAIL_VUV	VMON undervoltage detected
ERRID_BUSERR_CH	ERRCTRL Channel Set
ERRID_BUSERR_BUSERR	Bus error detected
ERRID_RAM_PARITY	RAMCTRL parity error detected
ERRID_NVM_PARITY	NVMCTRL parity error detected
ERRID_BUSERR_PARITYD	Data bus parity error detected
ERRID_RAM2_CH	ERRCTRL Channel Set
ERRID_RAM2_ECC2	Multi-bit ECC error in SRAM detected
ERRID_RAM2_COMP	ECC comparator error in SRAM detected
ERRID_FLASH2_CH	ERRCTRL Channel Set
ERRID_FLASH2_ECC2	Multi-bit ECC error in Flash detected
ERRID_FLASH2_COMP	ECC Comparator error in Flash detected
ERRID_OPC_CH	ERRCTRL Channel Set
ERRID_OPC_OPC	Illegal opcode in CPU detected
ERRID_OPC_PARITYI	Instruction bus parity error detected
ERRID_SPLIM_CH	ERRCTRL Channel Set
ERRID_RAM1_CH	ERRCTRL Channel Set
ERRID_FLASH1_CH	ERRCTRL Channel Set
ERRID_VREGWARN_CH	ERRCTRL Channel Set
ERRID_VREGWARN_VDENTER	VMON diagnostic mode entry detected
ERRID_VREGWARN_VDEXIT	VMON diagnostic mode exit detected
ERRID_VREGWARN_VERR	VMON internal error detected
ERRID_VREGWARN_VSLP	VMON sleep mode entry detected
ERRID_VREGWARN_VDIS	VMON disable detected
ERRID_VREGWARN_SERR	Sleep instruction error detected
ERRID_CFD0_CH	ERRCTRL Channel Set
ERRID_CFD1_CH	ERRCTRL Channel Set
ERRID_CFM0_CH	ERRCTRL Channel Set
ERRID_CFM1_CH	ERRCTRL Channel Set
ERRID_SWDT_CH	ERRCTRL Channel Set
ERRID_SWDT_BADPC	SWDT non-PRECLEAR command error detected
ERRID_SWDT_BADC	SWDT non-CLEAR command error detected
ERRID_SWDT_UC	SWDT unexpected command error detected
ERRID_SWDT_EXP	SWDT counter expired error detected
ERRID_EEPROM_CH	ERRCTRL Channel Set
ERRID_EEPROM_ECC1	Single-bit ECC error in EEPROM detected
ERRID_EEPROM_ECC2	Multi-bit ECC error in EEPROM detected
ERRID_EVSYS0_CH	ERRCTRL Channel Set
ERRID_EVSYS0_CLEAR	Error controller failed to clear the EVSYS0 channel
ERRID_EVSYS1_CH	ERRCTRL Channel Set
ERRID_EVSYS1_CLEAR	Error controller failed to clear the EVSYS1 channel
ERRID_DIAG_CPU_COMP	CPU comparator diagnostic error detected
ERRID_DIAG_SWDT_EXPIRE	SWDT expire diagnostic error detected
ERRID_DIAG_SWDT_COUNT	SWDT count diagnostic error detected
ERRID_DIAG_WDT_EXPIRE	WDT expire diagnostic error detected
ERRID_DIAG_WDT_COUNT	WDT count diagnostic error detected
ERRID_DIAG_CFM0	CFM0 diagnostic error detected
ERRID_DIAG_CFM1	CFM1 diagnostic error detected
ERRID_DIAG_CFD0	CFD0 diagnostic error detected
ERRID_DIAG_CFD1	CFD1 diagnostic error detected
ERRID_DIAG_VMON_OVER	VREG Monitor Overvoltage diagnostic error detected
ERRID_DIAG_VMON_UNDER	VREG Monitor Undervoltage diagnostic error detected
ERRID_DIAG_PARITY_RAM	RAM parity diagnostic error detected
ERRID_DIAG_PARITY_NVM	NVM parity diagnostic error detected
ERRID_DIAG_ECC_RAM	RAM ECC diagnostic error detected
ERRID_DIAG_ECC_FLASH	Flash ECC diagnostic error detected
ERRID_DIAG_ECC_EEPROM	EEPROM ECC diagnostic error detected
ERRID_DIAG_ERRCH_SPLIM	Error Controller SPLIM channel diagnostic error detected
ERRID_DIAG_ERRCH_CFD0	Error Controller CFD0 channel diagnostic error detected
ERRID_DIAG_ERRCH_CFD1	Error Controller CFD1 channel diagnostic error detected
ERRID_DIAG_ERRCH_CFM0	Error Controller CFM0 channel diagnostic error detected
ERRID_DIAG_ERRCH_CFM1	Error Controller CFM1 channel diagnostic error detected
ERRID_DIAG_ERRCH_EEPROM	Error Controller EEPROM channel diagnostic error detected
ERRID_DIAG_ERRCH_EVSYS0	Error Controller EVSYS0 channel diagnostic error detected
ERRID_DIAG_ERRCH_EVSYS1	Error Controller EVSYS1 channel diagnostic error detected
ERRID_DIAG_CRCSCAN	CRCSCAN diagnostic error detected
ERRID_MAX	Reserved/invalid, used as sentinel value for Error ID.

Function Documentation

EH_HandleError()

void EH_HandleError	(	errFlag_t	flag,
		errId_t	id )

Handles error based on configured Error ID criticality if the error flag is set.

This function evaluates the error flag and returns without further action if set to NO_ERROR. For ERROR, the appropriate error handling action is executed based on the configured Error ID criticality in the errorIdCritLut :

CRITICAL errors are immediately handled by calling EH_InitiateSafeState, where the Error ID will be stored to be handled after a system reset.

NON_CRITICAL errors are immediately handled by calling the application specific error handler callback configured in nonCriticalErrorCallback, where the Error ID is passed for handling according to application requirements.

NOTIFICATION errors are handled later by calling EH_PushNotificationLog, where the Error ID is put into a notification error log that is processed when calling EH_ProcessNotificationLog. The number of errId_t in the log is limited by the NOTIFICATION_LOG_SIZE configuration.

IGNORE errors are not handled.

Note

If the error flag is invalid, the error ID is updated to ERRID_ERRFLAG_VAL and handled regardless of the validity of the input Error ID.

Note

If the Error ID is invalid, the ID is updated to ERRID_ERRID_VAL and handled, except if the flag is set to NO_ERROR.

Note

Undefined Error ID criticality defaults to CRITICAL as a safety mechanism.

Note

The errId_t enum and errorIdCritLut are designed to be extendable to accommodate application-specific errors.

Warning

Negative Error IDs will lead to undefined behavior.

Warning

Error ID input validity checks rely on ERRID_MAX being the max value and ERRID_NONE being the smallest Error ID value.

Warning

An invalid function pointer in nonCriticalErrorCallback leads to undefined behavior.

Parameters

flag	The error flag indicating whether an error requires handling.
id	The Error ID corresponding to the error that occurred.

Here is the call graph for this function:

Here is the caller graph for this function:

EH_InitiateSafeState()

void EH_InitiateSafeState

(

errId_t

id

)

Transitions the system into a Safe State and resets the device.

This function immediately enters a Safe State by first disabling global interrupts and force floating all I/O pins. It then stores the reported Error ID in persistent memory so that the reset reason can be handled after the device reset. Finally, it enters an infinite loop where it tries to issue a software reset, disable the Error Controller heartbeat signal and re-attempt to float I/O pins in case it failed. This loop will continue until a successful device reset occurs, either through the software reset, an external reset, Error Controller reset or the Watchdog Timer expiring.

Warning

This Task will never return, as it ends in an infinite loop or successful device reset.

Note

The heartbeat signal will be attempted stopped regardless of whether it is enabled or not if the initial reset attempt fails. If enabled, it is assumed that the configured I/O pin used for the heartbeat signal is configured such that an external system will detect when the heartbeat is stopped (if the force floating of all I/O pins failed).

Parameters

id	The reported Error ID indicating the reset reason to store in persistent memory.

Note

The reported Error ID is stored in persistent memory using the PVAL_ERRID_REASON so that it can be handled after a device reset (in T_HandleResetReason).

Warning

It is assumed that the caller reports a valid Error ID with a value that fits within 8 bits, as required by PVAL_ERRID_REASON.

Warning

The Error ID and any persistent data stored between device resets is cleared upon Power-On Reset (POR) and Brown-out Reset (BOR).

Here is the call graph for this function:

Here is the caller graph for this function:

EH_PopNotificationLog()

errId_t EH_PopNotificationLog

(

void

)

Pops the last Error ID from the Notification Error Log for error handling.

The function returns the Error ID from the Notification Error Log unless it is empty, then ERRID_NONE is returned. The Notification Error Log is implemented as a stack using the Last-In-First-Out (LIFO) principle. This means that the error that is popped from the log is the last error that was pushed to the log when calling EH_PushNotificationLog. Once the error is popped from the log it is removed from the stack.

Note

If the Notification Error Log is empty, ERRID_NONE is returned.

Note

If the Error ID from the log is invalid, the return ID is updated to ERRID_ERRID_VAL.

Warning

Enters a critical section while retrieving the next Error ID to prevent concurrent access to the notification log. The previous global interrupt state is restored before return.

Returns

id The Error ID to handle from the Notification Error Log.

Return values

ERRID_NONE	The Error ID that indicates an empty Notification Error Log.
ERRID_ERRID_VAL	The Error ID returned when an invalid ID is popped from the log.

Here is the call graph for this function:

Here is the caller graph for this function:

EH_ProcessNotificationLog()

void EH_ProcessNotificationLog

(

void

)

Processes all Error IDs in the log by calling the configured handler callback.

The Notification Error Log is populated by EH_HandleError for later processing when handling errId_t with criticality NOTIFICATION. This Task needs to be called to do the handling of the errors at a later time.

The Error IDs in the Notification Error Log are processed by calling EH_PopNotificationLog to retrieve the logged errId_t and issuing the configured notificationErrorCallback. The last Error ID added to the log is the first to be processed (LIFO). Error IDs are removed from the log when they are processed and the processing ends when there are no more IDs in the log.

Note

The Notification Error Log has a limited size as defined by NOTIFICATION_LOG_SIZE in

error_handler_config.h. Error IDs will be ignored if pushed to the log when it is full, so it is recommended to process the log often depending on the configured log size.

Note

If new errors occur during callback handling, their errId_t may be directly added to the log in the callback, and will thus be the next to be handled. If so, the handling of these errors needs to be accounted for in the configuration of the notificationErrorCallback.

Warning

An invalid function pointer in notificationErrorCallback leads to undefined behavior.

Here is the call graph for this function:

Here is the caller graph for this function:

EH_PushNotificationLog()

void EH_PushNotificationLog

(

errId_t

id

)

Pushes Error ID to the Notification Error Log for later handling.

This function adds an Error ID to the Notification Error Log unless it is full. If the log is full, the Error ID is discarded. The Notification Error Log is implemented as a stack using the Last-In-First-Out (LIFO) principle. This means that the last error that is pushed to the log is the first error that is popped from the log when calling EH_PopNotificationLog.

Note

If the Error ID ERRID_NONE is pushed, it will be ignored.

Warning

The Notification Error Log is limited by NOTIFICATION_LOG_SIZE, if the log is full the reported Error ID will be ignored.

Warning

Enters a critical section while storing the Error ID to prevent concurrent access to the notification log. The previous global interrupt state is restored before return.

Parameters

id	The Error ID to report to the Notification Error Log.

Here is the call graph for this function:

Here is the caller graph for this function: