![]() |
AVR SD Safety Framework 1.0.0
|
Contains API prototypes for the Memory Manager. More...
Files | |
| file | midware_memory_manager.c |
| Implements APIs for the Memory Manager. | |
| file | midware_memory_manager.h |
| Contains API prototypes for the Memory Manager. | |
| file | midware_memory_manager_diag.c |
| Implements APIs for the Memory Manager Diagnostic. | |
| file | midware_memory_manager_diag.h |
| Contains API prototypes for the Memory Manager Diagnostics. | |
| file | midware_memory_manager_diag_asm.h |
| Contains assembly APIs for the Memory Manager Diagnostics. | |
Enumerations | |
| enum | persistentFlag_t |
| Enum for persistent flags used to store data between non-POR/BOR device resets. More... | |
| enum | persistentVal_t |
| Enum for persistent values used to store data between non-POR/BOR device resets. More... | |
| enum | eccAllOnes_t |
| Type defines for available "ECC all ones" (ECCALL1) options. More... | |
Functions | |
| errFlag_t | MW_GetClearBusError (void) |
| Reads and clears the flag indicating an error in the Bus Matrix. | |
| errFlag_t | MW_GetClearCpuDataParityError (void) |
| Reads and clears the flag indicating a data bus parity error in the CPU. | |
| errFlag_t | MW_GetClearCpuInstrParityError (void) |
| Reads and clears the flag indicating an instruction bus parity error in the CPU. | |
| errFlag_t | MW_GetClearCpuOpcodeError (void) |
| Reads and clears the flag indicating an illegal opcode error in the CPU. | |
| errFlag_t | MW_GetClearRamStackError (void) |
| Reads and clears the flag indicating a stack pointer limit error in SRAM. | |
| errFlag_t | MW_GetClearRamEccCompError (void) |
| Reads and clears the flag indicating an ECC comparator error in the RAM controller. | |
| errFlag_t | MW_GetClearRamEcc1Error (void) |
| Reads and clears the flag indicating an ECC single-bit error in SRAM. | |
| errFlag_t | MW_GetClearRamEcc2Error (void) |
| Reads and clears the flag indicating an ECC multi-bit error in SRAM. | |
| errFlag_t | MW_GetClearRamParityError (void) |
| Reads and clears the flag indicating a bus parity error detected in the RAM controller. | |
| errFlag_t | MW_GetClearNvmEccCompError (void) |
| Reads and clears the flag indicating an ECC comparator error in the NVM controller. | |
| errFlag_t | MW_GetClearNvmFlashEcc1Error (void) |
| Reads and clears the flag indicating an ECC single-bit error in Flash. | |
| errFlag_t | MW_GetClearNvmFlashEcc2Error (void) |
| Reads and clears the flag indicating an ECC multi-bit error in Flash. | |
| errFlag_t | MW_GetClearNvmParityError (void) |
| Reads and clears the flag indicating a bus parity error detected in the NVM controller. | |
| errFlag_t | MW_GetClearNvmEepromEcc1Error (void) |
| Reads and clears the flag indicating an ECC single-bit error in EEPROM. | |
| errFlag_t | MW_GetClearNvmEepromEcc2Error (void) |
| Reads and clears the flag indicating an ECC multi-bit error in EEPROM. | |
| errFlag_t | MW_SetNvmEccAllOnes (eccAllOnes_t config) |
| Sets ECC all Ones (ECCALL1) scheme. | |
| errFlag_t | MW_SetRamStackLimit (uint16_t splimAddr, bool lockEnable) |
| Sets the Stack Pointer Limit value and optionally locks the value to prevent modification. | |
| void | MW_StorePersistentFlag (persistentFlag_t flagType, bool flag) |
| Stores two redundant boolean flags in General Purpose Registers (GPR) for preserving data between resets. | |
| void | MW_StorePersistentVal (persistentVal_t valueType, uint8_t value) |
| Stores a value in General Purpose Registers (GPR) for preserving data between resets. | |
| bool | MW_GetPersistentFlag (persistentFlag_t flagType) |
| Reads two redundant bits for each boolean flags in General Purpose Registers (GPR) that is stored for preserving data between resets. | |
| uint8_t | MW_GetPersistentVal (persistentVal_t valueType) |
| Reads a value in General Purpose Registers (GPR) that is stored for preserving data between resets. | |
| bool | MW_IsPersistentFlagsCorrupt (void) |
| Compares two redundant bits for each boolean flags in General Purpose Registers (GPR) and checks if any of the flags are corrupted. | |
| bool | MW_IsPersistentValsCorrupt (void) |
| Checks if any of the stored persistent values are corrupted. | |
| void | MW_ClearPersistentFlags (void) |
| Clears all stored persistent flags in GPR. | |
| void | MW_ClearPersistentVals (void) |
| Clears all stored persistent values in GPR. | |
| errFlag_t | MW_DiagRamParity (void) |
| This function performs error injection diagnostic to detect faults in the RAM parity checker triggered by RAM access. | |
| errFlag_t | MW_DiagNvmParity (uint16_t eepromDiagAddr) |
| This function performs error injection diagnostic to detect faults in the CPU and NVM bus parity checkers triggered by NVM access. | |
| errFlag_t | MW_DiagRamEcc (void) |
| This function performs error injection diagnostic to detect faults in the redundant RAMCTRL ECC checkers. | |
| errFlag_t | MW_DiagNvmFlashEcc (uint16_t flashDiagAddr) |
| This function performs error injection diagnostic to detect faults in the NVMCTRL ECC checkers with Flash read trigger. | |
| errFlag_t | MW_DiagNvmEepromEcc (uint16_t eepromDiagAddr) |
| This function performs error injection diagnostic to detect faults in the NVMCTRL ECC checkers with EEPROM read trigger. | |
| void | ASM_InjectCpuDataParityRam (void) |
| This function makes the CPU inject a parity error in the data of the following RAM write, which is detected by the RAM Data Parity Checker. | |
| void | ASM_InjectCpuAddressParityRam (void) |
| This function makes the CPU inject a parity error in the address of the following RAM read, which is detected by the RAM address Parity Checker. | |
| void | ASM_InjectCpuControlParityRam (void) |
| This function makes the CPU inject a parity error in the control of the following RAM read, which is detected by the RAM control Parity Checker. | |
| void | ASM_InjectNvmDataParity (uint16_t eepromDiagAddr) |
| This function makes the NVMCTRL inject a parity error in the data of the following NVM (EEPROM) read, which is detected by the CPU data Parity Checker. | |
| void | ASM_InjectNvmInstructionParity (void) |
| This function makes the NVMCTRL inject a parity error in the instruction of the following NVM fetch, which is detected by the CPU instruction Parity Checker. | |
| void | ASM_InjectCpuDataParityNvm (uint16_t eepromDiagAddr) |
| This function makes the CPU inject a parity error in the data of the following NVM (EEPROM) write, which is detected by the NVM data Parity Checker. | |
| void | ASM_InjectCpuAddressParityNvm (uint16_t eepromDiagAddr) |
| This function makes the CPU inject a parity error in the address of the following NVM (EEPROM) read, which is detected by the NVM address Parity Checker. | |
| void | ASM_InjectCpuControlParityNvm (uint16_t eepromDiagAddr) |
| This function makes the CPU inject a parity error in the control of the following NVM (EEPROM) read, which is detected by the NVM control Parity Checker. | |
| void | ASM_InjectRamEccComp (void) |
| This function makes the RAM controller inject a comparator error in the following RAM read, which is detected by the RAM ECC Checker. | |
| void | ASM_InjectRamEcc1 (uint16_t ramDiagAddr) |
| This function makes the RAM controller inject a 1-bit ECC error in the following RAM read, which is detected by the RAM ECC Checker. | |
| void | ASM_InjectRamEcc2 (uint16_t ramDiagAddr) |
| This function makes the RAM controller inject a 2-bit ECC error in the following RAM read, which is detected by the RAM ECC Checker. | |
| void | ASM_TriggerFlashEcc (uint16_t flashDiagAddr) |
| This function performs a read from the provided Flash address to trigger ECC error detection after an ECC error has been injected via NVMCTRL.CTRLD. | |
| void | ASM_TriggerEepromEcc (uint16_t eepromDiagAddr) |
| This function performs a read from the provided EEPROM address to trigger ECC error detection after an ECC error has been injected via NVMCTRL.CTRLD. | |
Contains API prototypes for the Memory Manager.
The Memory Manager provides services to Tasks to ensure correct interaction with features of the RAMCTRL, NVMCTRL, CPU and GPR peripherals.
| enum eccAllOnes_t |
Type defines for available "ECC all ones" (ECCALL1) options.
When this feature is enabled for a memory section, it disregards the ECC check on Non-volatile Memory words read as all 1's from that section. This prevents false ECC errors when the application reads erased memory.
These available configurations are only applicable for Non-volatile Memory and does not affect RAM.
ECC_ALL_ONES_APPDATA_EEPROM, which in turn excludes APPCODE and BOOT.
| enum persistentFlag_t |
Enum for persistent flags used to store data between non-POR/BOR device resets.
Several diagnostics triggers a reset of the device to verify the functionality of a safety mechanism. These flags are used to store data between resets and indicate if diagnostics are ongoing or if a fault has occurred. The flags are written to General Purpose Registers (GPR) and are stored redundantly, meaning each flag consists of two bits stored in two different locations.
| enum persistentVal_t |
Enum for persistent values used to store data between non-POR/BOR device resets.
Whenever the device is reset, it may be necessary to determine the cause of the reset initiated by software. These values are used to store data between resets and indicate the reason for the reset and any associated Error ID or Error Injection reason. The persistent value types are used to write data to and read data from specific locations in the General Purpose registers (GPR). A checksum is always calculated when storing a value and can be verified when reading from these locations.
| void ASM_InjectCpuAddressParityNvm | ( | uint16_t | eepromDiagAddr | ) |
This function makes the CPU inject a parity error in the address of the following NVM (EEPROM) read, which is detected by the NVM address Parity Checker.
If the EEPROM address points to uninitialized data, an ECC error may occur.
| eepromDiagAddr | An address to data in EEPROM, used to trigger the EEPROM read instruction. |
| void ASM_InjectCpuAddressParityRam | ( | void | ) |
This function makes the CPU inject a parity error in the address of the following RAM read, which is detected by the RAM address Parity Checker.
| void ASM_InjectCpuControlParityNvm | ( | uint16_t | eepromDiagAddr | ) |
This function makes the CPU inject a parity error in the control of the following NVM (EEPROM) read, which is detected by the NVM control Parity Checker.
If the EEPROM address points to uninitialized data, an ECC error may occur.
| eepromDiagAddr | An address to data in EEPROM, used to trigger the EEPROM read instruction. |
| void ASM_InjectCpuControlParityRam | ( | void | ) |
This function makes the CPU inject a parity error in the control of the following RAM read, which is detected by the RAM control Parity Checker.
| void ASM_InjectCpuDataParityNvm | ( | uint16_t | eepromDiagAddr | ) |
This function makes the CPU inject a parity error in the data of the following NVM (EEPROM) write, which is detected by the NVM data Parity Checker.
This error injection assumes that neither EEBUSY nor FBUSY is set and does not wait for the NVM controller to become available. The caller must verify that the NVM controller is ready before calling this function.
This error injection assumes that EEPROM is not busy and will not wait for it to become available (and potentially get stuck). It is up to the caller to verify that the EEPROM is ready to accept write instructions.
This error injection does not restore the stored EEPROM value after injecting an error preventing the application to use this address. The parity safety mechanism should prevent any corrupted data to be written to EEPROM. If the safety mechanism fails the corrupted data will be written to the address giving two unwanted scenarios:
| eepromDiagAddr | An address to data in EEPROM, used to trigger the EEPROM write instruction. |
| void ASM_InjectCpuDataParityRam | ( | void | ) |
This function makes the CPU inject a parity error in the data of the following RAM write, which is detected by the RAM Data Parity Checker.
| void ASM_InjectNvmDataParity | ( | uint16_t | eepromDiagAddr | ) |
This function makes the NVMCTRL inject a parity error in the data of the following NVM (EEPROM) read, which is detected by the CPU data Parity Checker.
This injection tests the CPU data Parity Checker and could also be tested using RAM as an injection point. Since the instruction bus parity must be tested using NVM trigger the same is done for this injection.
If the EEPROM address points to uninitialized data, an ECC error may occur.
| eepromDiagAddr | An address to data in EEPROM, used to trigger the EEPROM read instruction. |
| void ASM_InjectNvmInstructionParity | ( | void | ) |
This function makes the NVMCTRL inject a parity error in the instruction of the following NVM fetch, which is detected by the CPU instruction Parity Checker.
| void ASM_InjectRamEcc1 | ( | uint16_t | ramDiagAddr | ) |
This function makes the RAM controller inject a 1-bit ECC error in the following RAM read, which is detected by the RAM ECC Checker.
This function injects an actual ECC error at the provided address, meaning the address must not point to application data. The function reads from 4 bytes ahead of the provided address to flush the RAM buffer (when present in devices with 32-bit RAM ECC granularity), ensuring the corrupted data is written to physical RAM. Therefore, the provided address must have at least 4 bytes of valid allocated memory following it. Additionally, due to RAM buffer alignment, the 3 bytes preceding the provided address must also be reserved, as they may reside within the same RAM double word as the injection point. These requirements can be achieved by reserving an array of at least 8 bytes where the address points to an index at least 3 from the start of it and 4 from the end.
| ramDiagAddr | An address to data in RAM, used to inject ECC error. |
| void ASM_InjectRamEcc2 | ( | uint16_t | ramDiagAddr | ) |
This function makes the RAM controller inject a 2-bit ECC error in the following RAM read, which is detected by the RAM ECC Checker.
This function injects an actual ECC error at the provided address, meaning the address must not point to application data. The function reads from 4 bytes ahead of the provided address to flush the RAM buffer (when present in devices with 32-bit RAM ECC granularity), ensuring the corrupted data is written to physical RAM. Therefore, the provided address must have at least 4 bytes of valid allocated memory following it. Additionally, due to RAM buffer alignment, the 3 bytes preceding the provided address must also be reserved, as they may reside within the same RAM double word as the injection point. These requirements can be achieved by reserving an array of at least 8 bytes where the address points to an index at least 3 from the start of it and 4 from the end.
| ramDiagAddr | An address to data in RAM, used to inject ECC error. |
| void ASM_InjectRamEccComp | ( | void | ) |
This function makes the RAM controller inject a comparator error in the following RAM read, which is detected by the RAM ECC Checker.
| void ASM_TriggerEepromEcc | ( | uint16_t | eepromDiagAddr | ) |
This function performs a read from the provided EEPROM address to trigger ECC error detection after an ECC error has been injected via NVMCTRL.CTRLD.
The NVMCTRL ECC injection mechanism requires a data read from NVM to trigger detection. This function performs that read using assembly, ensuring that the instruction is not optimized away by the compiler.
EEPROM is accessed through CPU Data Space, so this address is a Data Space address. This differs from ASM_TriggerFlashEcc, which takes an address in the Flash address space.
The read result is intentionally discarded. The purpose of the read is solely to trigger the ECC detection mechanism.
| eepromDiagAddr | An address to data in EEPROM in CPU Data Space, used to trigger ECC error detection. |
| void ASM_TriggerFlashEcc | ( | uint16_t | flashDiagAddr | ) |
This function performs a read from the provided Flash address to trigger ECC error detection after an ECC error has been injected via NVMCTRL.CTRLD.
The NVMCTRL ECC injection mechanism requires a data read from NVM to trigger detection. This function performs that read using the LPM instruction in assembly, ensuring that the instruction is not optimized away by the compiler. An instruction fetch does not consume the injected error, so the injection remains armed until this read is performed.
LPM addresses the Flash directly in the Flash address space rather than through the Flash region mapped into CPU Data Space. The trigger is therefore unaffected by the Flash section selected by NVMCTRL.CTRLB.FLMAP.
The read result is intentionally discarded. The purpose of the read is solely to trigger the ECC detection mechanism.
| flashDiagAddr | A byte address to data in Flash, used to trigger ECC error detection. |
| void MW_ClearPersistentFlags | ( | void | ) |
Clears all stored persistent flags in GPR.
| void MW_ClearPersistentVals | ( | void | ) |
Clears all stored persistent values in GPR.
This function also clears the checksum of these values.
| errFlag_t MW_DiagNvmEepromEcc | ( | uint16_t | eepromDiagAddr | ) |
This function performs error injection diagnostic to detect faults in the NVMCTRL ECC checkers with EEPROM read trigger.
The diagnostic starts by disabling global and non-maskable interrupts. This is done to prevent the interrupt routines from triggering and reporting actual errors. The error channels that will trigger due to the diagnostic are configured by disabling float and setting the severity to NOTIFICATION.
Before starting the error injection sequence, the function verifies that the NVM is not busy. If the EEBUSY or FBUSY flag in NVMCTRL.STATUS is set, no ECC injection is started and the function returns ERROR. This prevents the diagnostic from starting while the NVM controller reports Flash or EEPROM busy.
The diagnostic runs injection tests on the NVM ECC checkers using EEPROM as the trigger. The injection tests are done by setting the injection bit for the specific checker in the correct control register before performing an instruction that triggers that checker.
This diagnostic does the following error injection tests:
The 2-bit error injection will trigger the Bus error channel.
This diagnostic does not test the ECC comparator as that is covered in full by MW_DiagNvmFlashEcc.
After the ECC1 and ECC2 injections, the diagnostic verifies the error was correctly detected by checking interrupt flags and error channels. The reported error address is verified against the configured EEPROM address. For the ECC1 injection, it also verifies that the reported ECC syndrome matches the expected value, before clearing the interrupt flags and error channels.
After clearing the interrupts and error channels, the diagnostic restores the global interrupt state, enables NMI, and restores the error channels used to their original configuration.
NMI is expected to be enabled by default. If NMI is intentionally kept disabled, it must be disabled again after the diagnostic completes.
This diagnostic temporarily disables the safety mechanism (EEPROM and BUSERR error channels) when called in Mission Mode, potentially masking true faults during execution. It also disables global interrupt during execution, which may delay the servicing of other error-handling interrupts. The original configuration is restored when the diagnostic is complete.
Error injection will not be initiated if the Error Controller is not in NORMAL state or the EEPROM or BUSERR error channels is already set. If either of these conditions occur, the diagnostic function will return an error indicating that the error injection process could not be started.
This diagnostic is redundant as the NVM controller shares the ECC checkers between Flash and EEPROM. Therefore, the MW_DiagNvmFlashEcc diagnostic is sufficient to achieve full coverage of the NVM ECC checker. This diagnostic is included to enable testing the full error chain by injecting an error in the EEPROM and verifying that it triggers the correct error channel. Additionally, error channel diagnostics are available to ensure that the EEPROM error channel functions as expected without the need to inject any errors into the EEPROM itself.
| eepromDiagAddr | A valid EEPROM address, pointing to initialized data. Used to trigger EEPROM reads during NVM ECC diagnostics. |
This diagnostic only reads from the EEPROM address. The data at this location is not modified.
eccAllOnes_t configuration disregards all 1's for EEPROM the ECC error flag is suppressed instead. The diagnostic then reports an error, and because the injection is cleared only when an ECC 1-bit or 2-bit flag is detected, it remains armed and is applied to the next Non-volatile Memory access that raises a flag. Only the ECC check bits are injected, so stored data is not altered, but the error is reported far from its cause.
| ERROR | Fault detected in the NVMCTRL ECC1 or ECC2 error detection mechanisms, reported address or syndrome did not match the expected value, eepromDiagAddr was invalid, the diagnostic did not start, or NVM was busy. |
| NO_ERROR | No fault detected in the redundant NVMCTRL ECC checkers. |
| errFlag_t MW_DiagNvmFlashEcc | ( | uint16_t | flashDiagAddr | ) |
This function performs error injection diagnostic to detect faults in the NVMCTRL ECC checkers with Flash read trigger.
The diagnostic starts by disabling global and non-maskable interrupts. This is done to prevent the interrupt routines from triggering and reporting actual errors. The error channels that will trigger due to the diagnostic are configured by disabling float and setting the severity to NOTIFICATION.
Before starting the error injection sequence, the function verifies that the NVM is not busy. If the EEBUSY or FBUSY flag in NVMCTRL.STATUS is set, no ECC injection is started and the function returns ERROR. This prevents the diagnostic from starting while the NVM controller reports Flash or EEPROM busy.
The diagnostic runs injection tests on the NVM ECC checkers using Flash as the trigger. The injection tests are done by setting the injection bit for the specific checker in the correct control register before performing an instruction that triggers that checker.
This diagnostic does the following error injection tests:
The 2-bit error injection will trigger the Bus error channel.
After the ECC1 and ECC2 injections, the diagnostic verifies the error was correctly detected by checking interrupt flags and error channels. The reported error address is verified against the configured Flash address. For the ECC1 injection, it also verifies that the reported ECC syndrome matches the expected value, before clearing the interrupt flags and error channels.
After clearing the interrupts and error channels, the diagnostic restores the global interrupt state, enables NMI, and restores the error channels used to their original configuration.
NMI is expected to be enabled by default. If NMI is intentionally kept disabled, it must be disabled again after the diagnostic completes.
This diagnostic temporarily disables the safety mechanism (FLASH1, FLASH2 and BUSERR error channels) when called in Mission Mode, potentially masking true faults during execution. It also disables global interrupt during execution, which may delay the servicing of other error-handling interrupts. The original configuration is restored when the diagnostic is complete.
Error injection will not be initiated if the Error Controller is not in NORMAL state or the FLASH1, FLASH2 or BUSERR error channels is already set. If either of these conditions occur, the diagnostic function will return an error indicating that the error injection process could not be started.
| flashDiagAddr | A valid byte address in the Flash address space, starting at PROGMEM_START, pointing to initialized data. Used to trigger Flash reads during NVM ECC diagnostics. |
This diagnostic only reads from the Flash address. The data at this location is not modified.
The address is a Flash address as used by the LPM instruction. It is not an address in the Flash region mapped into CPU Data Space, so it is unaffected by the Flash section selected by NVMCTRL.CTRLB.FLMAP.
The configured address must contain initialized data. Reading erased Flash returns all 1's in both the data and the ECC bits, which normally raises an ECC error the diagnostic cannot distinguish from its own injection. If the eccAllOnes_t configuration disregards all 1's for that section, the ECC error flag is suppressed instead. The diagnostic then reports an error, and because the injection is cleared only when an ECC 1-bit or 2-bit flag is detected, it remains armed and is applied to the next Non-volatile Memory access that raises a flag. That access is unrelated to the diagnostic, at an unpredictable address and time. Only the ECC check bits are injected, so stored data is not altered, but the error is reported far from its cause.
If Flash read protection is enabled (BOOTRP in NVMCTRL.CTRLB), a read of the BOOT section from outside it returns 0x00 instead of the Flash contents, so the diagnostic result cannot be relied on. When this function executes outside the BOOT section, the address must point to APPCODE or APPDATA. The default address is inside the BOOT section.
| ERROR | Fault detected in the NVMCTRL ECC error detection mechanisms, reported address or syndrome did not match the expected value, flashDiagAddr was invalid, the diagnostic did not start, or NVM was busy. |
| NO_ERROR | No fault detected in the redundant NVMCTRL ECC checkers. |
| errFlag_t MW_DiagNvmParity | ( | uint16_t | eepromDiagAddr | ) |
This function performs error injection diagnostic to detect faults in the CPU and NVM bus parity checkers triggered by NVM access.
The diagnostic starts by disabling global and non-maskable interrupts. This is done to prevent the interrupt routines from triggering and reporting actual errors. The error channels that will trigger due to the diagnostic are configured by disabling float and setting the severity to NOTIFICATION.
Before starting the error injection sequence, the function verifies that the NVM is not busy. If the EEBUSY or FBUSY flag in NVMCTRL.STATUS is set, no parity injection is started and the function returns ERROR. This prevents the diagnostic from starting while the NVM controller reports Flash or EEPROM busy.
The diagnostic runs several injection test on different NVM and CPU parity checkers on the device. The injection tests are done by setting the injection bit for the specific checker in the correct control register before performing an instruction that triggers that checker. To make sure that the trigger instruction is known, and not a random instruction, the injection and trigger actions are done using assembly functions.
This diagnostic does the following error injection tests:
The interrupt flags and error channels are cleared after the injection tests have been completed. This is done regardless of whether the tests succeeded or failed.
After clearing the interrupts and error channels, the diagnostic restores the global interrupt state, enables NMI, and restores the error channels used to their original configuration.
NMI is expected to be enabled by default. If NMI is intentionally kept disabled, it must be disabled again after the diagnostic completes.
This diagnostic temporarily disables the safety mechanism (BUSERR and OPC error channels) when called in Mission Mode, potentially masking true faults during execution. It also disables global interrupt during execution, which may delay the servicing of other error-handling interrupts. The original configuration is restored when the diagnostic is complete.
Error injection will not be initiated if the Error Controller is not in NORMAL state or the BUSERR or OPC error channels is already set. If either of these conditions occur, the diagnostic function will return an error indicating that the error injection process could not be started.
NVM write is done on EEPROM to avoid writing to Flash. This also means that the CPU does not halt for the duration of the write as would be the case for Flash. If the error is detected, the write is automatically aborted. However, if not detected, the write will complete. For this reason the EEPROM address passed to this diagnostic must be reserved for diagnostic use.
| eepromDiagAddr | A valid EEPROM address, reserved for diagnostic use, pointing to initialized data. Used for NVM read/write during NVM Parity diagnostics. |
EEPROM address must point to valid, initialized data and must be exclusively reserved for diagnostic use. The diagnostic may modify the data at this address if the parity safety mechanism fails to abort the write (see ASM_InjectCpuDataParityNvm). The application must not rely on preserving the value stored at this location.
If the EEPROM address points to uninitialized data (all 0xFF in both data and ECC), reading it may cause a 2-bit ECC error regardless of whether error injection succeeded, giving a false positive. The address must contain initialized data, unless all-ones data is configured not to trigger an ECC error.
| ERROR | Fault detected in the CPU or NVM bus parity checkers, eepromDiagAddr was invalid, the diagnostic did not start, or NVM was busy. |
| NO_ERROR | No fault detected in the CPU or NVM bus parity checkers. |
| errFlag_t MW_DiagRamEcc | ( | void | ) |
This function performs error injection diagnostic to detect faults in the redundant RAMCTRL ECC checkers.
The diagnostic starts by disabling global and non-maskable interrupts. This is done to prevent the interrupt routines from triggering and reporting actual errors. The error channels that will trigger due to the diagnostic are configured by disabling float and setting the severity to NOTIFICATION.
The diagnostic runs injection tests on the RAM ECC checkers. The injection tests are done by setting the injection bit for the specific checker in the correct control register before performing an instruction that triggers that checker. To make sure that the trigger instruction is known, and not a random instruction, the injection and trigger actions are done using assembly functions.
This diagnostic does the following error injection tests:
The 2-bit error injection will trigger the Bus error channel.
After the ECC1 and ECC2 injections, the diagnostic verifies the error was correctly detected by checking interrupt flags and error channels. The reported error address is verified against the reserved diagnostic array. For the ECC1 injection, it also verifies that the reported ECC syndrome matches the expected value, before clearing the interrupt flags and error channels.
After clearing the interrupts and error channels, the diagnostic restores the global interrupt state, enables NMI, and restores the error channels used to their original configuration.
NMI is expected to be enabled by default. If NMI is intentionally kept disabled, it must be disabled again after the diagnostic completes.
This diagnostic temporarily disables the safety mechanism (RAM1, RAM2 and BUSERR error channels) when called in Mission Mode, potentially masking true faults during execution. It also disables global interrupt during execution, which may delay the servicing of other error-handling interrupts. The original configuration is restored when the diagnostic is complete.
Error injection will not be initiated if the Error Controller is not in NORMAL state or the RAM1, RAM2, or BUSERR error channels is already set. If either of these conditions occur, the diagnostic function will return an error indicating that the error injection process could not be started.
| ERROR | Fault detected in the RAMCTRL ECC error detection mechanisms or diagnostic failed to start due to illegal conditions. |
| NO_ERROR | No fault detected in the redundant RAMCTRL ECC checkers. |
| errFlag_t MW_DiagRamParity | ( | void | ) |
This function performs error injection diagnostic to detect faults in the RAM parity checker triggered by RAM access.
The diagnostic starts by disabling global and non-maskable interrupts. This is done to prevent the interrupt routines from triggering and reporting actual errors. The error channels that will trigger due to the diagnostic are configured by disabling float and setting the severity to NOTIFICATION.
The diagnostic runs several injection test on different parity checkers on the device. The injection tests are done by setting the injection bit for the specific checker in the correct control register before performing an instruction that triggers that checker. To make sure that the trigger instruction is known, and not a random instruction, the injection and trigger actions are done using assembly functions.
This diagnostic does the following error injection tests:
The interrupt flags and error channels are cleared after the injection tests have been completed. This is done regardless of whether the tests succeeded or failed.
After clearing the interrupts and error channels, the diagnostic restores the global interrupt state, enables NMI, and restores the error channels used to their original configuration.
NMI is expected to be enabled by default. If NMI is intentionally kept disabled, it must be disabled again after the diagnostic completes.
This diagnostic temporarily disables the safety mechanism (BUSERR error channel) when called in Mission Mode, potentially masking true faults during execution. It also disables global interrupt during execution, which may delay the servicing of other error-handling interrupts. The original configuration is restored when the diagnostic is complete.
Error injection will not be initiated if the Error Controller is not in NORMAL state or the BUSERR error channel is already set. If either of these conditions occur, the diagnostic function will return an error indicating that the error injection process could not be started.
| ERROR | Fault detected in the RAM bus parity checker or diagnostic failed to start due to illegal conditions. |
| NO_ERROR | No fault detected in the RAM bus parity checker. |
| errFlag_t MW_GetClearBusError | ( | void | ) |
Reads and clears the flag indicating an error in the Bus Matrix.
This function checks whether the BUSERR interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | Bus error flag set. |
| NO_ERROR | Bus error flag not set. |
| errFlag_t MW_GetClearCpuDataParityError | ( | void | ) |
Reads and clears the flag indicating a data bus parity error in the CPU.
This function checks whether the PARITYD interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | Data bus parity error flag set. |
| NO_ERROR | Data bus parity error flag not set. |
| errFlag_t MW_GetClearCpuInstrParityError | ( | void | ) |
Reads and clears the flag indicating an instruction bus parity error in the CPU.
This function checks whether the PARITYI interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | Instruction bus parity error flag set. |
| NO_ERROR | Instruction bus parity error flag not set. |
| errFlag_t MW_GetClearCpuOpcodeError | ( | void | ) |
Reads and clears the flag indicating an illegal opcode error in the CPU.
This function checks whether the OPC interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | Illegal opcode error flag set. |
| NO_ERROR | Illegal opcode error flag not set. |
| errFlag_t MW_GetClearNvmEccCompError | ( | void | ) |
Reads and clears the flag indicating an ECC comparator error in the NVM controller.
This function checks whether the COMP interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | ECC Comparator error flag set. |
| NO_ERROR | ECC Comparator error flag not set. |
| errFlag_t MW_GetClearNvmEepromEcc1Error | ( | void | ) |
Reads and clears the flag indicating an ECC single-bit error in EEPROM.
This function checks whether the EECC1 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
If the Application requires repair of ECC1 errors in memory, see Tips and Tricks for additional guidance.
| ERROR | ECC single-bit error flag set. |
| NO_ERROR | ECC single-bit error flag not set. |
| errFlag_t MW_GetClearNvmEepromEcc2Error | ( | void | ) |
Reads and clears the flag indicating an ECC multi-bit error in EEPROM.
This function checks whether the EECC2 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | ECC multi-bit error flag set. |
| NO_ERROR | ECC multi-bit error flag not set. |
| errFlag_t MW_GetClearNvmFlashEcc1Error | ( | void | ) |
Reads and clears the flag indicating an ECC single-bit error in Flash.
This function checks whether the FECC1 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
If the Application requires repair of ECC1 errors in memory, see Tips and Tricks for additional guidance.
| ERROR | ECC single-bit error flag set. |
| NO_ERROR | ECC single-bit error flag not set. |
| errFlag_t MW_GetClearNvmFlashEcc2Error | ( | void | ) |
Reads and clears the flag indicating an ECC multi-bit error in Flash.
This function checks whether the FECC2 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | ECC multi-bit error flag set. |
| NO_ERROR | ECC multi-bit error flag not set. |
| errFlag_t MW_GetClearNvmParityError | ( | void | ) |
Reads and clears the flag indicating a bus parity error detected in the NVM controller.
This function checks whether the PARITYD, PARITYA or PARITYC interrupt flag has been set or not. If set, clears the flags and returns ERROR.
There are three parity checkers for data, address and control signals in the NVM controller. However, this function treats all parity error flags as the same error. If any is set, all parity errors are cleared.
| ERROR | NVM parity error flag set. |
| NO_ERROR | NVM parity error flag not set. |
| errFlag_t MW_GetClearRamEcc1Error | ( | void | ) |
Reads and clears the flag indicating an ECC single-bit error in SRAM.
This function checks whether the ECC1 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
If the Application requires repair of ECC1 errors in memory, see Tips and Tricks for additional guidance.
| ERROR | ECC single-bit error flag set. |
| NO_ERROR | ECC single-bit error flag not set. |
| errFlag_t MW_GetClearRamEcc2Error | ( | void | ) |
Reads and clears the flag indicating an ECC multi-bit error in SRAM.
This function checks whether the ECC2 interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | ECC multi-bit error flag set. |
| NO_ERROR | ECC multi-bit error flag not set. |
| errFlag_t MW_GetClearRamEccCompError | ( | void | ) |
Reads and clears the flag indicating an ECC comparator error in the RAM controller.
This function checks whether the COMP interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | ECC comparator error flag set. |
| NO_ERROR | ECC comparator error flag not set. |
| errFlag_t MW_GetClearRamParityError | ( | void | ) |
Reads and clears the flag indicating a bus parity error detected in the RAM controller.
This function checks whether the PARITYD, PARITYA or PARITYC interrupt flag has been set or not. If set, clears the flags and returns ERROR.
There are three parity checkers for data, address and control signals in the RAM controller. However, this function treats all parity error flags as the same error. If any is set, all parity errors are cleared.
| ERROR | Bus parity error flag set. |
| NO_ERROR | Bus parity error flag not set. |
| errFlag_t MW_GetClearRamStackError | ( | void | ) |
Reads and clears the flag indicating a stack pointer limit error in SRAM.
This function checks whether the SPLIM interrupt flag has been set or not. If set, clears the flag and returns ERROR.
| ERROR | Stack pointer limit error flag set. |
| NO_ERROR | Stack pointer limit flag not set. |
| bool MW_GetPersistentFlag | ( | persistentFlag_t | flagType | ) |
Reads two redundant bits for each boolean flags in General Purpose Registers (GPR) that is stored for preserving data between resets.
A call to MW_IsPersistentFlagsCorrupt should be performed before calling this function to verify if any flags have been corrupted.
An invalid flag type returns false and will set the internal invalid input flag, which is used in MW_IsPersistentFlagsCorrupt as part of checking for data validity.
| flagType | The flag type to read. |
| true | Both redundant bits are set, flag is true. |
| false | One or both bits are not set, flag is false, or flagType is invalid. |
| uint8_t MW_GetPersistentVal | ( | persistentVal_t | valueType | ) |
Reads a value in General Purpose Registers (GPR) that is stored for preserving data between resets.
A call to MW_IsPersistentValsCorrupt should be performed before calling this function to verify if any values have been corrupted.
An invalid value type returns 0xFF and will set the internal invalid input flag, which is used in MW_IsPersistentValsCorrupt as part of checking for data validity.
| valueType | The value type to read. |
| bool MW_IsPersistentFlagsCorrupt | ( | void | ) |
Compares two redundant bits for each boolean flags in General Purpose Registers (GPR) and checks if any of the flags are corrupted.
This function reads both bits of a flag and compare their value. If both bits of a flag are zero, the flag is false. If both bits of the flag is one, the flag is true. If the two bits of a flag differ (one is zero and the other is one), the flag is considered corrupt due to a bit-flip or other issue. If any flag is found to be corrupt, it is assumed that all flags are corrupt. This is because the integrity of the operations to reset and write to the flags cannot be trusted if any data is corrupted. Additionally, this function checks whether the invalid input flag has been set or not.
| true | One or more flags have been corrupted, or invalid input flag is set. |
| false | No flag corruption detected. |
| bool MW_IsPersistentValsCorrupt | ( | void | ) |
Checks if any of the stored persistent values are corrupted.
This function calculates a new checksum for the stored values and compares it to the stored checksum. If the checksums do not match, the values are considered corrupted. Additionally, this function checks whether the invalid input flag has been set or not, indicating that the integrity of the operations to reset and write to the values cannot be trusted.
| true | Fault detected in the checksum or invalid input flag has been set. |
| false | No value corruption detected. |
| errFlag_t MW_SetNvmEccAllOnes | ( | eccAllOnes_t | config | ) |
Sets ECC all Ones (ECCALL1) scheme.
This function sets the ECC all ones scheme for the specified memory sections.
Enabling this feature for a section that an NVM ECC diagnostic reads while that section is uninitialized causes the diagnostic to report an error and leaves an error injection armed. See MW_DiagNvmFlashEcc and MW_DiagNvmEepromEcc.
| config | Which Non-volatile Memory sections have the feature enabled. Valid values are defined in eccAllOnes_t. |
| ERROR | Invalid config value. |
| NO_ERROR | Valid config value. |
| errFlag_t MW_SetRamStackLimit | ( | uint16_t | splimAddr, |
| bool | lockEnable ) |
Sets the Stack Pointer Limit value and optionally locks the value to prevent modification.
The Stack Pointer Limit (SPLIM) feature compares the current Stack Pointer (SP) RAM address with the configured SPLIM RAM address. The SP in the CPU points to the top of the stack in RAM and typically starts on the highest RAM address. If the stack grows larger than the specified limit, an error flag is set.
Valid splimAddr range is between INTERNAL_SRAM_START and INTERNAL_SRAM_END defined in the device-specific header file.
| splimAddr | The Stack Pointer Limit RAM address. |
| lockEnable | Enable or disable stack pointer lock. |
| ERROR | Invalid RAM address. |
| NO_ERROR | Valid RAM address. |
| void MW_StorePersistentFlag | ( | persistentFlag_t | flagType, |
| bool | flag ) |
Stores two redundant boolean flags in General Purpose Registers (GPR) for preserving data between resets.
This function stores the specified value for the specified persistentFlag_t in General Purpose Registers (GPR) in order to preserve data between non-POR/BOR device resets. Each flag value is stored using two redundant bits to detect data corruption. The stored flag value can be read using MW_GetPersistentFlag.
This function can be used to clear single flags by setting them to false, while MW_ClearPersistentFlags is used to clear all flags.
An invalid flag type is ignored and will set the internal invalid input flag, which is used in MW_IsPersistentFlagsCorrupt as part of checking for data validity.
All flags will default to false after a Power On Reset (POR) or Brownout Reset (BOR).
| flagType | The type of flag to store. |
| flag | Boolean value to store. |
| void MW_StorePersistentVal | ( | persistentVal_t | valueType, |
| uint8_t | value ) |
Stores a value in General Purpose Registers (GPR) for preserving data between resets.
This function stores the specified value for the specified persistentVal_t in General Purpose Registers (GPR) in order to preserve data between non-POR/BOR device resets. Each value is stored in specific locations which is protected by a checksum. The stored values can be read using MW_GetPersistentVal.
When a persistent value is updated, the new checksum is calculated from the intended GPR0 and GPR1 values held locally rather than from post-write GPR readback. This prevents corruption introduced during the GPR write from being incorporated into a matching checksum.
MW_ClearPersistentVals is used to clear all values.
An invalid value type is ignored and will set the internal invalid input flag, which is used in MW_IsPersistentValsCorrupt as part of checking for data validity.
This function verifies the stored checksum before writing any values. If the checksum has been corrupted, the function will return early to avoid calculating a new checksum. A corrupted checksum will be reported by MW_IsPersistentValsCorrupt.
All values will default to zero after a Power On Reset (POR) or Brownout Reset (BOR).
| valueType | The value type to store. |
| value | The value to store. |