 |
AVR SD Safety Framework 1.0.0
|
|
AVR SD Safety Framework 1.0.0
|
Defines and declares configurations for Tasks. More...
Files | |
| file | tasks_config.c |
| Defines and initializes configurations for Tasks. | |
| file | tasks_config.h |
| Defines and declares configurations for Tasks. | |
Macros | |
| #define | STRICT_SAFE_STATE DISABLED |
| Configures whether to use a strict Safe State to Mission Mode transition in TM_PreStartup and TM_Startup. | |
| #define | HEARTBEAT_OUTPUT DISABLED |
| Enables the heartbeat output signal on an I/O pin before entering Mission Mode. | |
| #define | SWDT_OPEN_WINDOW 500U |
| Configures the open window size used for the Synchronous Watchdog (SWDT). | |
| #define | WWDT_CLOSED_WINDOW WDT_TIMEOUT_CLK128 |
| Configures the Windowed Watchdog Timer (WWDT) closed window duration in Mission Mode. | |
| #define | WWDT_OPEN_WINDOW WDT_TIMEOUT_CLK64 |
| Configures the Windowed Watchdog Timer (WWDT) open window duration in Mission Mode. | |
| #define | INIT_WDT_DURATION WDT_TIMEOUT_CLK128 |
| Configures the timeout period, from executing T_InitSafetySystem to the first T_HandleWatchdog call, in OSC32K clock cycles. | |
| #define | INIT_SWDT_DURATION 4700UL |
| Configures the run-time duration between executing T_InitSafetySystem and the first T_HandleSyncWatchdog call in main clock cycles. | |
| #define | INIT_CLOCK_FRQ CLK_FRQ_20_MHZ |
| Configures the clock frequency for the device. | |
| #define | INIT_CLOCK_DIV CLK_FRQ_DIV_OFF |
| Configures the clock division for the device. | |
| #define | INIT_REDUNDANT_CFD ENABLED |
| Enables or disables redundant CFD initialization. | |
| #define | INIT_CFM0_WIN_REF 25U |
| Configures the reference value for the Clock Frequency Measure 0 (CFM0) window. | |
| #define | INIT_CFM0_WIN_HIGH 17293U |
| Configures the high value of the Clock Frequency Measure 0 (CFM0) window. | |
| #define | INIT_CFM0_WIN_LOW 13594U |
| Configures the low value of the Clock Frequency Measure 0 (CFM0) window. | |
| #define | INIT_REDUNDANT_CFM DISABLED |
| Enables or disables redundant CFM initialization. | |
| #define | INIT_ERRCTRL_TIMEOUT 0xFFU |
| Configures the ALARM and CONFIG state timeout period for the Error Controller. | |
| #define | INIT_FLOAT_NONCRITICAL DISABLED |
| Configures whether all I/O pins should be floated (tri-stated) when an error controller channel, errCh_t, with errCrit_t of NON_CRITICAL is set. | |
| #define | INIT_FLOAT_NOTIFICATION DISABLED |
| Configures whether all I/O pins should be floated (tri-stated) when an error controller channel, errCh_t, with errCrit_t of NOTIFICATION is set. | |
| #define | INIT_INT_ROUND_ROBIN DISABLED |
| Configures round robin schedule scheme for level 0 interrupts. | |
| #define | INIT_INT_ALT_VECTOR_LOC DISABLED |
| Configures alternative interrupt vector location when using a bootloader. | |
| #define | INIT_INT_LVL0_START 0U |
| Configures the execution priority order of level 0 (normal priority) interrupt vectors. | |
| #define | INIT_INT_LVL1 0U |
| Configures which interrupt vector should have the level 1 (highest) priority. | |
| #define | INIT_VMON_ALWAYS_ON ENABLED |
| Configures whether the Voltage Regulator Monitor (VMON) is enabled in deep sleep modes. | |
| #define | INIT_VMON_FULL_POWER_MODE ENABLED |
| Configures the Voltage Regulator Monitor (VMON) power mode. | |
| #define | INIT_VLM_THRESHOLD VLM_THRESHOLD_PCT_15 |
| Configures the Voltage Level Monitor threshold. | |
| #define | INIT_VLM_TRIGGER VLM_TRIGGER_FALLING |
| Configures the Voltage Level Monitor trigger condition. | |
| #define | INIT_NVM_ECC_ALL_ONES ECC_ALL_ONES_APPDATA_EEPROM |
| Configures the "ECC all ones" scheme in Non-Volatile Memory. | |
| #define | INIT_STACK_LIMIT (INTERNAL_SRAM_START + INTERNAL_SRAM_SIZE - 250U) |
| Configures the max depth of the hardware call stack by setting the Stack Pointer limit address. | |
| #define | INIT_STACK_LIMIT_LOCK ENABLED |
| Configures whether the Stack Pointer Limit (SPLIM) LOCK should be enabled or disabled. | |
| #define | DIAG_STARTUP_CFD0 DISABLED |
| Enables or disables execution of the CFD0 diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_CFD1 DISABLED |
| Enables or disables execution of the CFD1 diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_CFM0 ENABLED |
| Enables or disables execution of the CFM0 diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_CFM1 DISABLED |
| Enables or disables execution of the CFM1 diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ECC_EEPROM DISABLED |
| Enables or disables execution of the EEPROM ECC error diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_SPLIM ENABLED |
| Enables or disables execution of the SPLIM error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_CFD0 ENABLED |
| Enables or disables execution of the CFD0 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_CFD1 ENABLED |
| Enables or disables execution of the CFD1 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_CFM0 DISABLED |
| Enables or disables execution of the CFM0 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_CFM1 DISABLED |
| Enables or disables execution of the CFM1 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_EEPROM ENABLED |
| Enables or disables execution of the EEPROM error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_EVSYS0 DISABLED |
| Enables or disables execution of the EVSYS0 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_STARTUP_ERRCH_EVSYS1 DISABLED |
| Enables or disables execution of the EVSYS1 error channel diagnostic in T_RunStartupDiagnostics. | |
| #define | DIAG_PERIODIC_SWDT_COUNT ENABLED |
| Enables or disables execution of the SWDT count diagnostic in T_HandleSyncWatchdog. | |
| #define | DIAG_PERIODIC_WDT_COUNT DISABLED |
| Enables or disables periodic completion of the WDT Count diagnostic in T_HandleWatchdog. | |
| #define | DIAG_PERIODIC_CFD0 DISABLED |
| Enables or disables execution of the CFD0 diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_CFD1 DISABLED |
| Enables or disables execution of the CFD1 diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_CFM0 ENABLED |
| Enables or disables execution of the CFM0 diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_CFM1 DISABLED |
| Enables or disables execution of the CFM1 diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_VMON DISABLED |
| Enables or disables execution of the VMON diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_SWDT_EXPIRE DISABLED |
| Enables or disables execution of the SWDT expire diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ECC_EEPROM DISABLED |
| Enables or disables execution of the EEPROM ECC error diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_SPLIM ENABLED |
| Enables or disables execution of the SPLIM error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_CFD0 ENABLED |
| Enables or disables execution of the CFD0 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_CFD1 ENABLED |
| Enables or disables execution of the CFD1 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_CFM0 DISABLED |
| Enables or disables execution of the CFM0 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_CFM1 DISABLED |
| Enables or disables execution of the CFM1 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_EEPROM ENABLED |
| Enables or disables execution of the EEPROM error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_EVSYS0 DISABLED |
| Enables or disables execution of the EVSYS0 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | DIAG_PERIODIC_ERRCH_EVSYS1 DISABLED |
| Enables or disables execution of the EVSYS1 error channel diagnostic in T_RunNextLatentFaultDiag. | |
| #define | PERIODIC_CRCSCAN DISABLED |
| Enables or disables periodic CRCSCAN of Flash in T_EnterIdleSleep. | |
| #define | PERIODIC_CRCSCAN_PIT DISABLED |
| Enables or disables automatic wake-up from periodic CRCSCAN in T_EnterIdleSleep. | |
| #define | SHUTDOWN_CRCSCAN DISABLED |
| Enables or disables running a CRCSCAN on Flash in TM_Shutdown before entering sleep. | |
| #define | CRCSCAN_BOOT_SECTION ENABLED |
| Enables or disables running a CRCSCAN on the BOOT Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity. | |
| #define | CRCSCAN_APPCODE_SECTION DISABLED |
| Enables or disables running a CRCSCAN on the APPCODE Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity. | |
| #define | CRCSCAN_APPDATA_SECTION DISABLED |
| Enables or disables running a CRCSCAN on the APPDATA Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity. | |
| #define | CRCSCAN_CRC32 DISABLED |
| Enables using 32-bit CRC width or the default 16-bit when running a CRCSCAN in T_EnterIdleSleep and T_VerifyFlashIntegrity. | |
| #define | DIAG_PERIODIC_CRCSCAN ENABLED |
| Enables or disables execution of the CRCSCAN error injection diagnostic in T_EnterIdleSleep. | |
| #define | DIAG_SHUTDOWN_CRCSCAN ENABLED |
| Enables or disables execution of the CRCSCAN error injection diagnostic in T_VerifyFlashIntegrity. | |
| #define | SHUTDOWN_SAFE_STATE ENABLED |
| Enables or disables entering a Safe State in T_InitSafeShutdown before shutdown sleep. | |
| #define | SHUTDOWN_WDT_DURATION WDT_TIMEOUT_CLK8K |
| Configures the Watchdog Timer (WDT) timeout used during sleep in TM_Shutdown. | |
| #define | SHUTDOWN_SUSPEND_CFD_CFM ENABLED |
| Enables or disables suspending clock monitors before shutdown sleep in TM_Shutdown. | |
| #define | SHUTDOWN_POWER_DOWN DISABLED |
| Configures whether to use Standby or Power-Down sleep mode in TM_Shutdown. | |
| #define | DUR_RUN_STARTUP_DIAGNOSTICS 24000UL |
| Configures the run-time duration for T_RunStartupDiagnostics in system clock cycles. | |
| #define | DUR_START_MISSION_MODE 400UL |
| Configures the run-time duration for T_StartMissionMode in system clock cycles. | |
| #define | DUR_UNTIL_FIRST_SCHEDULE 400UL |
| Configures the run-time duration between exiting TM_Startup and the first T_HandleSyncWatchdog call in system clock cycles. | |
| #define | DUR_RUN_NEXT_LATENT_FAULT_DIAG 2600UL |
| Configures the run-time duration for T_RunNextLatentFaultDiag in system clock cycles. | |
| #define | DUR_HANDLE_NOTIFICATION_ERRORS 11000UL |
| Configures the run-time duration for T_HandleNotificationErrors in system clock cycles. | |
| #define | DUR_HANDLE_RESET_REASON 700UL |
| Configures the run-time duration for T_HandleResetReason in system clock cycles. | |
| #define | DUR_ENTER_IDLE_SLEEP 150UL |
| Configures the run-time duration for T_EnterIdleSleep in system clock cycles. | |
| #define | DUR_UNTIL_SAFE_SHUTDOWN 100000UL |
| Configures the run-time duration between completing the application-specific shutdown Task and entering shutdown sleep in system clock cycles. | |
| #define | PRE_STARTUP_SWDT_RESET_VAL 0xFFFFUL |
| Configures the new SWDT reset value after performing the SWDT Expire diagnostic in T_RunResetDiagnosticFsm in system clock cycles. | |
| #define | DIAG_PERIODIC_SWDT_RESET_VAL 3500UL |
| Configures the new Synchronous Watchdog Timer (SWDT) reset value after performing the SWDT Expire diagnostic in T_RunNextLatentFaultDiag in system clock cycles. | |
| #define | DIAG_FLASH_ADDRESS PROGMEM_START |
| Configures the Flash address used by Flash ECC error injection diagnostics. | |
| #define | DIAG_EEPROM_ADDRESS EEPROM_START |
| Configures the EEPROM address used by NVM parity and EEPROM ECC error injection diagnostics. | |
Variables | |
| const rstCallback_t | resetReasonCallback = &T_ResetReasonExampleCallback |
| Configures the user-configurable callback function used for application specific reset handling in T_HandleResetReason. | |
Defines and declares configurations for Tasks.
This file declares the global defines and external constants used by Tasks. The constants are defined and initialized in tasks_config.c to ensure a single instance across all translation units using the configuration.
| #define CRCSCAN_APPCODE_SECTION DISABLED |
Enables or disables running a CRCSCAN on the APPCODE Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity.
This macro configures, at compile-time, whether to perform a CRCSCAN of the APPCODE Flash section or skip it. See CRCSCAN_BOOT_SECTION and CRCSCAN_APPDATA_SECTION for enabling scanning of the other two potential Flash sections.
PERIODIC_CRCSCAN setting is enabled.
This setting is only applicable for T_VerifyFlashIntegrity if it is called. The function is called in TM_Shutdown if the SHUTDOWN_CRCSCAN setting is enabled.
See PERIODIC_CRCSCAN and SHUTDOWN_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
Valid configurations:
| #define CRCSCAN_APPDATA_SECTION DISABLED |
Enables or disables running a CRCSCAN on the APPDATA Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity.
This macro configures, at compile-time, whether to perform a CRCSCAN of the APPDATA Flash section or skip it. See CRCSCAN_BOOT_SECTION and CRCSCAN_APPCODE_SECTION for enabling scanning of the other two potential Flash sections.
PERIODIC_CRCSCAN setting is enabled.
This setting is only applicable for T_VerifyFlashIntegrity if it is called. The function is called in TM_Shutdown if the SHUTDOWN_CRCSCAN setting is enabled.
See PERIODIC_CRCSCAN and SHUTDOWN_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
Valid configurations:
| #define CRCSCAN_BOOT_SECTION ENABLED |
Enables or disables running a CRCSCAN on the BOOT Flash Section in T_EnterIdleSleep and T_VerifyFlashIntegrity.
This macro configures, at compile-time, whether to perform a CRCSCAN of the BOOT Flash section or skip it. See CRCSCAN_APPCODE_SECTION and CRCSCAN_APPDATA_SECTION for enabling scanning of the other two potential Flash sections.
PERIODIC_CRCSCAN setting is enabled.
This setting is only applicable for T_VerifyFlashIntegrity if it is called. The function is called in TM_Shutdown if the SHUTDOWN_CRCSCAN setting is enabled.
See PERIODIC_CRCSCAN and SHUTDOWN_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
Enabling this option to scan the Boot section may be incompatible with the Boot Section Read Protection (BOOTRP) setting in NVMCTRL. See MW_EnableCrcScan for more details.
Valid configurations:
| #define CRCSCAN_CRC32 DISABLED |
Enables using 32-bit CRC width or the default 16-bit when running a CRCSCAN in T_EnterIdleSleep and T_VerifyFlashIntegrity.
This macro configures, at compile-time, whether to calculate a 32-bit or 16-bit CRC checksum when performing a CRCSCAN of Flash. When enabled, the 32-bit mode is selected and when disabled, the default 16-bit width is used. When the CRCSCAN completes a scan of a Flash section, it expects that the last 4 (for CRC32) or 2 (for CRC16) bytes contain the stored CRC checksum for comparison with the calculated one.
PERIODIC_CRCSCAN setting is enabled.
This setting is only applicable for T_VerifyFlashIntegrity if it is called. The function is called in TM_Shutdown if the SHUTDOWN_CRCSCAN setting is enabled.
See PERIODIC_CRCSCAN and SHUTDOWN_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
Valid configurations:
| #define DIAG_EEPROM_ADDRESS EEPROM_START |
Configures the EEPROM address used by NVM parity and EEPROM ECC error injection diagnostics.
This macro is used by T_RunStartupDiagnostics and T_RunNextLatentFaultDiag to provide the EEPROM address passed to MW_DiagNvmParity and MW_DiagNvmEepromEcc.
MW_DiagNvmParity tolerates this because the default INIT_NVM_ECC_ALL_ONES setting disregards all-ones in EEPROM.
The EEPROM parity diagnostic may modify the data at this address. The injected parity error is intended to block the write, but a diagnostic failure may allow the write to complete. Reserve this location for diagnostic use.
DIAG_PERIODIC_ECC_EEPROM is enabled. Reading erased EEPROM raises an ECC error that the diagnostic cannot distinguish from its own injection, and if INIT_NVM_ECC_ALL_ONES disregards all-ones for EEPROM the error flag is suppressed instead, so the diagnostic reports an error and the injection is left armed. Disregarding all-ones is therefore not a substitute for initializing the data. See MW_DiagNvmEepromEcc for details.
Valid configurations: between EEPROM_START and EEPROM_END, as defined in the device-specific header file.
| #define DIAG_FLASH_ADDRESS PROGMEM_START |
Configures the Flash address used by Flash ECC error injection diagnostics.
This macro is used by T_RunStartupDiagnostics and T_RunNextLatentFaultDiag to provide the Flash read address passed to MW_DiagNvmFlashEcc.
This is a byte address in the Flash address space, starting at PROGMEM_START. It is not an address in the Flash region mapped into CPU Data Space, and it is therefore unaffected by the Flash section selected by NVMCTRL.CTRLB.FLMAP.
The diagnostic only reads the configured address. The data at this location is not modified.
INIT_NVM_ECC_ALL_ONES defaults to a value that disregards all-ones in that section.
INIT_NVM_ECC_ALL_ONES disregards all-ones for that section the error flag is suppressed instead, so the diagnostic reports an error and the injection is left armed. Disregarding all-ones is therefore not a substitute for initializing the data. See MW_DiagNvmFlashEcc for details.
If Flash read protection is enabled (BOOTRP in NVMCTRL.CTRLB), a read of the BOOT section from outside it returns 0x00 instead of the Flash contents, so the diagnostic result cannot be relied on. When the diagnostic executes outside the BOOT section, this address must point to APPCODE or APPDATA. The default value points to the start of Flash, which is inside the BOOT section.
Valid configurations: between PROGMEM_START and PROGMEM_END, as defined in the device-specific header file.
| #define DIAG_PERIODIC_CFD0 DISABLED |
Enables or disables execution of the CFD0 diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Clock Failure Detection channel 0 (CFD0) diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if INIT_REDUNDANT_CFD is disabled and the application requires Latent Fault detection during Mission Mode. See Tips and Tricks for more information on how this can be implemented.
This configuration only ensures that T_RunNextLatentFaultDiag initiates the diagnostic. The end diagnostics are not called as part of the Run Next Latent Fault Diagnostic function and must be scheduled as part of the TM_Scheduler schedule. It is the responsibility of the application to determine when to call the end diagnostic to avoid calling it before the diagnostic is complete.
This diagnostic temporarily disables the safety mechanism in Mission Mode, potentially masking true faults during execution. It also disables global interrupts during execution, which may delay the servicing of other error-handling interrupts. The global interrupts are only disabled for the duration of the begin or end functions and are restored for the duration between the start and completion of this diagnostic.
This diagnostic is disabled by default since the redundant CFD monitor is enabled by default in INIT_REDUNDANT_CFD.
Valid configurations:
| #define DIAG_PERIODIC_CFD1 DISABLED |
Enables or disables execution of the CFD1 diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Clock Failure Detection channel 1 (CFD1) diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if CFD1 is used by the application while INIT_REDUNDANT_CFD is disabled and the application requires Latent Fault detection during Mission Mode. See Tips and Tricks for more information on how this can be implemented.
This diagnostic temporarily disables the safety mechanism in Mission Mode, potentially masking true faults during execution. It also disables global interrupts during execution, which may delay the servicing of other error-handling interrupts. The global interrupts are only disabled for the duration of the begin or end functions and are restored for the duration between the start and completion of this diagnostic.
This diagnostic is disabled by default since the redundant CFD monitor is enabled by default in INIT_REDUNDANT_CFD.
Valid configurations:
| #define DIAG_PERIODIC_CFM0 ENABLED |
Enables or disables execution of the CFM0 diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Clock Frequency Monitor channel 0 (CFM0) diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if INIT_REDUNDANT_CFM is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables the safety mechanism in Mission Mode, potentially masking true faults during execution. It also disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
This diagnostic is enabled by default since the redundant CFM monitor is disabled by default in INIT_REDUNDANT_CFM
Valid configurations:
| #define DIAG_PERIODIC_CFM1 DISABLED |
Enables or disables execution of the CFM1 diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Clock Frequency Monitor channel 1 (CFM1) diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if CFM1 is used by the application while INIT_REDUNDANT_CFM is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables the safety mechanism in Mission Mode, potentially masking true faults during execution. It also disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
| #define DIAG_PERIODIC_CRCSCAN ENABLED |
Enables or disables execution of the CRCSCAN error injection diagnostic in T_EnterIdleSleep.
This macro configures, at compile-time, whether to execute the CRCSCAN error injection diagnostic in T_EnterIdleSleep before starting a scan of the next Flash section. This diagnostic is not included in the normal startup and periodic diagnostic execution Tasks, because the CRCSCAN in Flash mode is not used as a safety mechanism in Mission Mode by default. Instead, it can optionally run "on demand" before starting a CRCSCAN of Flash. The diagnostic should be enabled if the application requires latent fault detection of the CRCSCAN in Mission Mode.
PERIODIC_CRCSCAN setting is enabled.
T_EnterIdleSleep is called instead.
If enabled, T_EnterIdleSleep depends on T_HandleCrcInterrupt to handle the CRCSCAN interrupt required to complete the diagnostic.
This diagnostic may be incompatible with the Boot Section Read Protection (BOOTRP) setting in NVMCTRL. See MW_DiagCrcScan for more details.
See PERIODIC_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
| #define DIAG_PERIODIC_ECC_EEPROM DISABLED |
Enables or disables execution of the EEPROM ECC error diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the EEPROM ECC error diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the application requires Latent Fault detection during Mission Mode and EEPROM is used.
This diagnostic is disabled by default since it requires an initialized EEPROM address, since it is a redundant test of the NVM ECC checkers, and since DIAG_PERIODIC_ERRCH_EEPROM is enabled by default to test the EEPROM error channel.
MW_DiagNvmEepromEcc for details.
This diagnostic cannot replace the MW_DiagNvmFlashEcc diagnostic since it only tests the ECC1 and ECC2 checkers and not the ECC comparator.
| #define DIAG_PERIODIC_ERRCH_CFD0 ENABLED |
Enables or disables execution of the CFD0 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the CFD0 error channel diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if DIAG_PERIODIC_CFD0 is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
This diagnostic is enabled by default since the redundant CFD monitor is enabled by default by INIT_REDUNDANT_CFD and thus DIAG_PERIODIC_CFD0 is disabled. However, when the diagnostic is disabled, the error channel is never tested. Therefore this diagnostic is enabled to achieve test coverage of the error channel.
Valid configurations:
| #define DIAG_PERIODIC_ERRCH_CFD1 ENABLED |
Enables or disables execution of the CFD1 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the CFD1 error channel diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the CFD1 error channel is in use while the DIAG_PERIODIC_CFD1 is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
This diagnostic is enabled by default since the redundant CFD monitor is enabled by default by INIT_REDUNDANT_CFD and thus DIAG_PERIODIC_CFD1 is disabled. However, when the diagnostic is disabled, the error channel is never tested. Therefore this diagnostic is enabled to achieve test coverage of the error channel.
Valid configurations:
| #define DIAG_PERIODIC_ERRCH_CFM0 DISABLED |
Enables or disables execution of the CFM0 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the CFM0 error channel diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the DIAG_PERIODIC_CFM0 is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
This diagnostic is disabled by default since the full CFM0 diagnostic is enabled by default in DIAG_PERIODIC_CFM0.
Valid configurations:
| #define DIAG_PERIODIC_ERRCH_CFM1 DISABLED |
Enables or disables execution of the CFM1 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the CFM1 error channel diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the CFM1 is in use while the DIAG_PERIODIC_CFM1 is disabled and the application requires Latent Fault detection during Mission Mode.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
| #define DIAG_PERIODIC_ERRCH_EEPROM ENABLED |
Enables or disables execution of the EEPROM error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the EEPROM error channel diagnostic in the T_RunNextLatentFaultDiag function. The diagnostic should be enabled if the EEPROM is used while the DIAG_PERIODIC_ECC_EEPROM macro is not enabled and the application requires Latent Fault detection during Mission Mode and a more application specific error injection diagnostic is not implemented.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
This diagnostic is enabled by default since the full EEPROM ECC diagnostic is disabled by default in DIAG_PERIODIC_ECC_EEPROM. However, when the diagnostic is disabled, the error channel is never tested. Therefore this diagnostic is enabled to achieve test coverage of the error channel.
Valid configurations:
| #define DIAG_PERIODIC_ERRCH_EVSYS0 DISABLED |
Enables or disables execution of the EVSYS0 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the EVSYS0 error channel diagnostic in the T_RunNextLatentFaultDiag function. The diagnostic should be enabled if the EVSYS0 error channel is used and the application requires Latent Fault detection during Mission Mode and a more application specific error injection diagnostic is not implemented.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
| #define DIAG_PERIODIC_ERRCH_EVSYS1 DISABLED |
Enables or disables execution of the EVSYS1 error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the EVSYS1 error channel diagnostic in the T_RunNextLatentFaultDiag function. The diagnostic should be enabled if the EVSYS1 error channel is used and the application requires Latent Fault detection during Mission Mode and a more application specific error injection diagnostic is not implemented.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
| #define DIAG_PERIODIC_ERRCH_SPLIM ENABLED |
Enables or disables execution of the SPLIM error channel diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Stack Pointer Limit (SPLIM) error channel diagnostic in the T_RunNextLatentFaultDiag function. The diagnostic should be enabled if the application requires Latent Fault detection during Mission Mode and an actual SPLIM error injection diagnostic is not implemented.
This diagnostic temporarily disables global interrupts during execution, which may delay the servicing of other error-handling interrupts.
| #define DIAG_PERIODIC_SWDT_COUNT ENABLED |
Enables or disables execution of the SWDT count diagnostic in T_HandleSyncWatchdog.
This macro configures, at compile-time, whether to include the Synchronous Watchdog Timer (SWDT) count diagnostic in the T_HandleSyncWatchdog function. This diagnostic should be enabled if the application requires Latent Fault detection during Mission Mode.
| #define DIAG_PERIODIC_SWDT_EXPIRE DISABLED |
Enables or disables execution of the SWDT expire diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Synchronous Watchdog Timer (SWDT) expire diagnostic in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the application requires Latent Fault detection during Mission Mode.
The diagnostic is disabled by default as it requires special scheduling considerations. Since this diagnostic forces the SWDT to expire immediately, regardless of current count value, it must also set a new duration for the next SWDT period. This duration is configured using DIAG_PERIODIC_SWDT_RESET_VAL, and should be configured to account for the remaining SWDT period that was skipped.
| #define DIAG_PERIODIC_SWDT_RESET_VAL 3500UL |
Configures the new Synchronous Watchdog Timer (SWDT) reset value after performing the SWDT Expire diagnostic in T_RunNextLatentFaultDiag in system clock cycles.
Since the diagnostic skips the remaining duration of the current SWDT period, this value should be configured such that the original SWDT duration is maintained, avoiding side effects of running the diagnostic. This value can be measured and configured at compile-time if T_RunNextLatentFaultDiag is run in TM_Scheduler, where the task has a fixed SWDT duration, by looking at the SWDT count value before the error injection bit is set. Another option is to read the SWDT count value at run-time before calling the diagnostic function directly. See MW_DiagSwdtExpire for more details.
This macro is only used if DIAG_PERIODIC_SWDT_EXPIRE is ENABLED.
Valid configurations: between 1 and UINT24_MAX.
If the value is smaller than the remaining execution time of the Task, the SWDT will time out.
Default with tolerance assumes DUR_RUN_NEXT_LATENT_FAULT_DIAG of 2600 cycles and 300 cycles until MW_DiagSwdtExpire is executed. This is an estimate and may vary with optimization level.
| #define DIAG_PERIODIC_VMON DISABLED |
Enables or disables execution of the VMON diagnostic in T_RunNextLatentFaultDiag.
This macro configures, at compile-time, whether to include the Voltage Regulator Monitor (VMON) Over and Under diagnostics in the T_RunNextLatentFaultDiag function. This diagnostic should be enabled if the application requires Latent Fault detection during Mission Mode.
VMON diagnostics take considerably longer time to execute compared to the other error injection diagnostics (up to 50-200 microseconds). This is because of how it interfaces with analog circuitry. Thus, T_RunNextLatentFaultDiag starts the diagnostic in interrupt mode, and relies on T_HandlePowerInterrupt to complete the diagnostic and report the result. This diagnostic will temporarily disable the VMON safety mechanism during Mission Mode and can mask a true fault from being detected during execution.
| #define DIAG_PERIODIC_WDT_COUNT DISABLED |
Enables or disables periodic completion of the WDT Count diagnostic in T_HandleWatchdog.
When enabling this diagnostic, it is assumed that MW_DiagWdtCountBegin is called before each call to T_HandleWatchdog with sufficient time separation, otherwise this diagnostic will always result in an error.
It is crucial to ensure a separation of at least 4 WDT Clock cycles between the start of the diagnostic and end, accounting for clock source frequency variations. This is because the synchronized count register is only updated every 4th WDT clock cycle. Instead of busy-waiting for the count register to be updated, a separate begin and end API is provided. See MW_DiagWdtCountEnd for more information.
The Watchdog Timer (WDT) counter diagnostic is disabled by default since its execution depends on application specific schedules to start the diagnostic with sufficient time separation. See Tips and Tricks for information on whether to enable this diagnostic and how to use it.
Valid configurations:
| #define DIAG_SHUTDOWN_CRCSCAN ENABLED |
Enables or disables execution of the CRCSCAN error injection diagnostic in T_VerifyFlashIntegrity.
This macro configures, at compile-time, whether to execute the CRCSCAN error injection diagnostic in the T_VerifyFlashIntegrity function before starting a CRCSCAN. This diagnostic is not included in the normal startup and periodic diagnostic execution Tasks, because the CRCSCAN in Flash mode is typically not used as a safety mechanism in Mission Mode. Instead, it can optionally run "on demand" before starting a CRCSCAN of Flash. The diagnostic should be enabled if the application requires Latent Fault detection of the CRCSCAN.
This setting is only applicable for T_VerifyFlashIntegrity if it is called. The function is called in TM_Shutdown if the SHUTDOWN_CRCSCAN setting is enabled.
See SHUTDOWN_CRCSCAN for further information on user requirements, side effects and assumptions for using this feature.
This diagnostic may be incompatible with the Boot Section Read Protection (BOOTRP) setting in NVMCTRL. See MW_DiagCrcScan for more details.
| #define DIAG_STARTUP_CFD0 DISABLED |
Enables or disables execution of the CFD0 diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the Clock Failure Detection channel 0 (CFD0) diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if INIT_REDUNDANT_CFD is disabled.
This configuration only ensures that T_RunStartupDiagnostics initiates the diagnostic. The end diagnostics are not called as part of the Run Startup Diagnostics function and must be scheduled as part of the TM_Startup schedule. It is the responsibility of the application to determine when to call the end diagnostic to avoid calling it before the diagnostic is complete.
This diagnostic is disabled by default since the redundant CFD monitor is enabled by default in INIT_REDUNDANT_CFD.
Valid configurations:
| #define DIAG_STARTUP_CFD1 DISABLED |
Enables or disables execution of the CFD1 diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the Clock Failure Detection channel 1 (CFD1) diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if CFD1 is used by the application and the INIT_REDUNDANT_CFD is disabled. See Tips and Tricks for more information on how this can be implemented.
This diagnostic is disabled by default since the redundant CFD monitor is enabled by default in INIT_REDUNDANT_CFD.
Valid configurations:
| #define DIAG_STARTUP_CFM0 ENABLED |
Enables or disables execution of the CFM0 diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the Clock Frequency Monitor channel 0 (CFM0) diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the INIT_REDUNDANT_CFM is disabled.
This diagnostic is enabled by default since the redundant CFM monitor is disabled by default in INIT_REDUNDANT_CFM
Valid configurations:
| #define DIAG_STARTUP_CFM1 DISABLED |
Enables or disables execution of the CFM1 diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the Clock Frequency Monitor channel 1 (CFM1) diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if CFM1 is used by the application and the INIT_REDUNDANT_CFM is disabled.
| #define DIAG_STARTUP_ECC_EEPROM DISABLED |
Enables or disables execution of the EEPROM ECC error diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the EEPROM ECC diagnostic in the T_RunStartupDiagnostics function. The EEPROM ECC diagnostic is redundant to the Flash ECC diagnostic due to testing the same ECC checkers located in the NVM controller. This diagnostic can be enabled if a check of the entire chain from injection to Error Controller channel on EEPROM is desired. If enabled, the DIAG_STARTUP_ERRCH_EEPROM can be disabled as it only tests the EEPROM error channel in the Error Controller. This diagnostic is not needed if the application does not use EEPROM.
This diagnostic is disabled by default since it requires an initialized EEPROM address, since it is a redundant test of the NVM ECC checkers, and since DIAG_STARTUP_ERRCH_EEPROM is enabled by default to test the EEPROM error channel.
MW_DiagNvmEepromEcc for details.
This diagnostic cannot replace the MW_DiagNvmFlashEcc diagnostic since it only tests the ECC1 and ECC2 checkers and not the ECC comparator.
Valid configurations:
| #define DIAG_STARTUP_ERRCH_CFD0 ENABLED |
Enables or disables execution of the CFD0 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the CFD0 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if DIAG_STARTUP_CFD0 is disabled.
This diagnostic is enabled by default since the redundant CFD monitor is enabled by default by INIT_REDUNDANT_CFD. Testing the only channel makes sure that the Error Controller works as intended.
Valid configurations:
| #define DIAG_STARTUP_ERRCH_CFD1 ENABLED |
Enables or disables execution of the CFD1 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the CFD1 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the CFD1 is in use by the application while the DIAG_STARTUP_CFD1 is disabled.
This diagnostic is enabled by default since the redundant CFD monitor is enabled by default by INIT_REDUNDANT_CFD. Testing the only channel makes sure that the Error Controller works as intended.
Valid configurations:
| #define DIAG_STARTUP_ERRCH_CFM0 DISABLED |
Enables or disables execution of the CFM0 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the CFM0 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if DIAG_STARTUP_CFM0 is disabled.
This diagnostic is disabled by default since the full CFM0 diagnostic is enabled by default in DIAG_STARTUP_CFM0.
Valid configurations:
| #define DIAG_STARTUP_ERRCH_CFM1 DISABLED |
Enables or disables execution of the CFM1 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the CFM1 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the CFM1 is in use by the application while the DIAG_STARTUP_CFM1 is disabled.
| #define DIAG_STARTUP_ERRCH_EEPROM ENABLED |
Enables or disables execution of the EEPROM error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the EEPROM error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the EEPROM is used by the application and the more thorough DIAG_STARTUP_ECC_EEPROM diagnostic is not enabled.
This diagnostic is enabled by default since the full EEPROM ECC diagnostic is disabled by default in DIAG_STARTUP_ECC_EEPROM.
Valid configurations:
| #define DIAG_STARTUP_ERRCH_EVSYS0 DISABLED |
Enables or disables execution of the EVSYS0 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the EVSYS0 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the EVSYS0 error channel is used by the application and a more application specific error injection diagnostic is not implemented.
| #define DIAG_STARTUP_ERRCH_EVSYS1 DISABLED |
Enables or disables execution of the EVSYS1 error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the EVSYS1 error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled if the EVSYS1 error channel is used by the application and a more application specific error injection diagnostic is not implemented.
| #define DIAG_STARTUP_ERRCH_SPLIM ENABLED |
Enables or disables execution of the SPLIM error channel diagnostic in T_RunStartupDiagnostics.
This macro configures, at compile-time, whether to include the SPLIM error channel diagnostic in the T_RunStartupDiagnostics function. The diagnostic should be enabled unless an actual SPLIM error injection diagnostic is implemented.
| #define DUR_ENTER_IDLE_SLEEP 150UL |
Configures the run-time duration for T_EnterIdleSleep in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Scheduler. See Measurements page for more information.
The Synchronous Watchdog (SWDT) stops counting while in Idle sleep. The selected duration should thus only account for the execution time when not sleeping, but should add a tolerance for executing the interrupt handler of the wake-up source.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_HANDLE_NOTIFICATION_ERRORS 11000UL |
Configures the run-time duration for T_HandleNotificationErrors in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Scheduler. See Measurements page for more information.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_HANDLE_RESET_REASON 700UL |
Configures the run-time duration for T_HandleResetReason in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Startup. See Measurements page for more information.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_RUN_NEXT_LATENT_FAULT_DIAG 2600UL |
Configures the run-time duration for T_RunNextLatentFaultDiag in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Scheduler. See Measurements page for more information.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_RUN_STARTUP_DIAGNOSTICS 24000UL |
Configures the run-time duration for T_RunStartupDiagnostics in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Startup. See Measurements page for more information.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_START_MISSION_MODE 400UL |
Configures the run-time duration for T_StartMissionMode in system clock cycles.
This macro is used to ensure a fixed run-time duration of the function call in TM_Startup. See Measurements page for more information.
DUR_START_MISSION_MODE and DUR_UNTIL_FIRST_SCHEDULE are passed as one combined argument to T_HandleSyncWatchdog meaning their sum is limited to a 24-bit value minus the configured SWDT_OPEN_WINDOW.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW - DUR_UNTIL_FIRST_SCHEDULE).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_UNTIL_FIRST_SCHEDULE 400UL |
Configures the run-time duration between exiting TM_Startup and the first T_HandleSyncWatchdog call in system clock cycles.
This macro is used to ensure a fixed run-time duration of the application after TM_Startup. By default, this is the duration until the first TM_Scheduler call. See Measurements page for more information.
DUR_START_MISSION_MODE and DUR_UNTIL_FIRST_SCHEDULE are passed as one combined argument to T_HandleSyncWatchdog meaning their sum is limited to a 24-bit value minus the configured SWDT_OPEN_WINDOW.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW - DUR_START_MISSION_MODE).
Setting this macro to 0 will not disable the Synchronous Watchdog Timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the execution time of the Task, the SWDT will time out.
| #define DUR_UNTIL_SAFE_SHUTDOWN 100000UL |
Configures the run-time duration between completing the application-specific shutdown Task and entering shutdown sleep in system clock cycles.
This macro is used to ensure that the final Windowed Watchdog (WWDT) clear occurs in its open window before the new shutdown configuration is applied (see SHUTDOWN_WDT_DURATION).
The first thing TM_Shutdown does after being called is to clear the WWDT before using the Synchronous Watchdog (SWDT) to ensure a fixed duration when calling the application-specific shutdown Task. It then uses the SWDT again to wait DUR_UNTIL_SAFE_SHUTDOWN clock cycles before clearing the WWDT a final time, applying the new configuration and proceeding to perform shutdown sleep.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
To prevent the WWDT clear from happening inside the closed window or the WWDT from timing out, this macro must be configured so that:
t_app + t_align > WWDT closed window, t_app + t_align < WWDT total timeout, t_align > measured WCET + tolerance,
where t_app is the duration of the application shutdown Task (0 if Task is NULL), t_align is DUR_UNTIL_SAFE_SHUTDOWN, and WCET is the worst-case execution time between starting the SWDT and reaching the point where the SWDT is actually cleared during initialization of the safe shutdown. The WWDT closed window is equal to the configured WWDT_CLOSED_WINDOW and the WWDT total timeout is the sum of the configured WWDT_CLOSED_WINDOW and WWDT_OPEN_WINDOW values.
Window alignment is only required before shutdown is configured. During shutdown, both WDT and SWDT are used without windowed mode.
Default with tolerance assumes an application-specific shutdown Task set to NULL (thus zero duration) and a WWDT_CLOSED_WINDOW set to WDT_TIMEOUT_CLK128 and WWDT_OPEN_WINDOW set to WDT_TIMEOUT_CLK64 with a main clock at 20 MHz. This ensures the WDT is approximately in the middle of its open window.
| #define HEARTBEAT_OUTPUT DISABLED |
Enables the heartbeat output signal on an I/O pin before entering Mission Mode.
This macro is used by T_StartMissionMode to configure whether the heartbeat functionality will be enabled or not for the device. If enabled, a 1 kHz square wave heartbeat signal is output on a configured I/O pin. When enabled, the error controller will tri-state the signal when it enters the FAULT state, and force it low when entering the CONFIG state.
The heartbeat signal output is manually disabled when initiating a Safe State transition in software using the Error Handler.
| #define INIT_CFM0_WIN_HIGH 17293U |
Configures the high value of the Clock Frequency Measure 0 (CFM0) window.
This macro is used by T_InitSafetySystem to configure the upper limit of the tolerance window of measured main clock ticks. This macro together with the INIT_CFM0_WIN_LOW macro determines the frequency error tolerance window. The CFM0 is configured to monitor the main clock with the internal 32K oscillator as the reference clock.
If changing the main clock frequency or source, the CFM0 configuration must also be updated.
Valid configurations: between 0 and UINT16_MAX. See cfmWindow_t.
The high value of the CFM0 window should be larger than the INIT_CFM0_WIN_LOW window value for correct operation.
CFM1 is expected to be configured by the application.
| #define INIT_CFM0_WIN_LOW 13594U |
Configures the low value of the Clock Frequency Measure 0 (CFM0) window.
This macro is used by T_InitSafetySystem to configure the lower limit of the tolerance window of measured main clock ticks. This macro together with the INIT_CFM0_WIN_HIGH macro determines the frequency error tolerance window. The CFM0 is configured to monitor the main clock with the internal 32K oscillator as the reference clock.
If changing the main clock frequency or source, the CFM0 configuration must also be updated.
Valid configurations: between 0 and UINT16_MAX. See cfmWindow_t.
The low value of the CFM0 window should be smaller than the INIT_CFM0_WIN_HIGH window value for correct operation.
CFM1 is expected to be configured by the application.
| #define INIT_CFM0_WIN_REF 25U |
Configures the reference value for the Clock Frequency Measure 0 (CFM0) window.
This macro is used by T_InitSafetySystem to configure the duration of reference clock cycles to wait when measuring the number of main clock source ticks. The CFM0 is configured to monitor the main clock with the internal 32K oscillator as the reference clock.
This value should be configured depending on the application FDTI and the acceptable resolution of the tolerance window (see INIT_CFM0_WIN_HIGH and INIT_CFM0_WIN_LOW) and the selected main clock frequency (see INIT_CLOCK_FRQ). A longer measurement time will allow for higher resolution of the tolerance window, but at the cost of a longer FDTI and vice versa.
If changing the main clock frequency or source, the CFM0 configuration must also be updated. See Tips and Tricks for how to schedule an application startup task to configure external oscillators and clocks.
Valid configurations: between 0 and UINT16_MAX. See cfmWindow_t.
The reference value should be larger than zero, but low enough to ensure that the CFM counter does not overflow which will cause the counter to stop and a CFM error will be triggered.
CFM1 is expected to be configured by the application.
| #define INIT_CLOCK_DIV CLK_FRQ_DIV_OFF |
Configures the clock division for the device.
This macro is used by T_InitSafetySystem to initialize the division of the main clock in the startup sequence by choosing one of the available clock divisions defined by the clkFrqDiv_t. This macro in combination with INIT_CLOCK_FRQ, configures the initial main clock frequency of the device. Setting this macro to CLK_FRQ_DIV_OFF disables the clock divider.
Valid configurations: see clkFrqDiv_t.
| #define INIT_CLOCK_FRQ CLK_FRQ_20_MHZ |
Configures the clock frequency for the device.
This macro is used by T_InitSafetySystem to set the frequency output of the internal high-frequency oscillator (OSCHF) by choosing one of the available frequencies defined by the clkFrq_t. This macro in combination with INIT_CLOCK_DIV, configures the initial main clock frequency of the device.
If the application requires usage of a different clock source such as an external clock or oscillator as main clock, it can be re-configured in the application specific startup schedule. See Tips and Tricks for how to schedule an application startup task to configure external oscillators and clocks.
Valid configurations: see clkFrq_t.
| #define INIT_ERRCTRL_TIMEOUT 0xFFU |
Configures the ALARM and CONFIG state timeout period for the Error Controller.
This macro is used by T_InitSafetySystem to configure the deadline for clearing any triggered error channels with a NONCRITICAL severity before the Error Controller automatically transitions into the FAULT state and issues a machine check reset. The timeout value is also used when entering the CONFIG state to avoid getting stuck and will also issue a machine check reset if not entering NORMAL state within the deadline. The value should be configured according to FDTI requirements and the WCET of the application specific nonCriticalErrorCallback in the Error Handler and the configured main clock frequency (see INIT_CLOCK_FRQ).
Before T_InitSafetySystem, the timeout is initialized to the maximum value, meaning the initial ERRCTRL configuration execution time does not need to be accounted for when setting this configuration.
The timeout value is INIT_ERRCTRL_TIMEOUT * 4 clock cycles for a maximum of 1020 main clock cycles.
Valid configurations: between 1 and UINT8_MAX.
| #define INIT_FLOAT_NONCRITICAL DISABLED |
Configures whether all I/O pins should be floated (tri-stated) when an error controller channel, errCh_t, with errCrit_t of NON_CRITICAL is set.
This macro is used by T_InitSafetySystem to enable or disable floating of I/O pins for all NON_CRITICAL errors.
| #define INIT_FLOAT_NOTIFICATION DISABLED |
Configures whether all I/O pins should be floated (tri-stated) when an error controller channel, errCh_t, with errCrit_t of NOTIFICATION is set.
This macro is used by T_InitSafetySystem to enable or disable floating of I/O pins for all NOTIFICATION errors.
| #define INIT_INT_ALT_VECTOR_LOC DISABLED |
Configures alternative interrupt vector location when using a bootloader.
This macro is used by T_InitSafetySystem to configure whether to use an alternative interrupt vector location when using a bootloader. See the description of the IVSEL bit in CPUINT.CTRLA for more information.
Valid configurations:
| #define INIT_INT_LVL0_START 0U |
Configures the execution priority order of level 0 (normal priority) interrupt vectors.
This macro is used by T_InitSafetySystem to configure the execution order of simultaneous level 0 (normal) priority interrupts, by specifying which interrupt vector has the lowest priority. An interrupt vector number value of 0 will disable the level 0 priority feature. If an interrupt vector value of X is set, the level 0 interrupt with highest priority is vector X+1, followed by X+2 and so on, making X the lowest priority vector.
Valid configurations: between 0 (Disabled) and the highest interrupt vector available to the device (see 'Interrupt Vector Mapping Table' in the data sheet) except for interrupt vector number 1 as this is the vector for Non-Maskable Interrupts (NMI) and always has the highest priority. Setting this macro to 1 has no effect.
| #define INIT_INT_LVL1 0U |
Configures which interrupt vector should have the level 1 (highest) priority.
This macro is used by T_InitSafetySystem to configure the level 1 priority interrupt, and accepts an interrupt vector number as value. The priority level 1 interrupts will interrupt any level 0 interrupt handler already executing. An interrupt vector number value of 0 will disable the level 1 priority feature.
It is recommended not to use this feature unless the level 1 interrupt is more safety critical than all other error handling for the application, as it may abort error handling performed by the Error Controller. If the level 1 interrupt always returns from the Interrupt Service Routine (ISR), it should not have any adverse impact on other ISRs.
This macro should not be set to any of the Error Controller channel sources, as it will lead to data hazards due to all error channel sources having redundant interrupt handling.
Valid configurations: between 0 (Disabled) and the highest interrupt vector available to the device (see 'Interrupt Vector Mapping Table' in the data sheet) except for interrupt vector number 1 as this is the vector for Non-Maskable Interrupts (NMI) and always has the highest priority. Setting this macro to 1 has no effect.
| #define INIT_INT_ROUND_ROBIN DISABLED |
Configures round robin schedule scheme for level 0 interrupts.
This macro is used by T_InitSafetySystem to enable or disable round robin scheduling of level 0 interrupts.
Valid configurations:
| #define INIT_NVM_ECC_ALL_ONES ECC_ALL_ONES_APPDATA_EEPROM |
Configures the "ECC all ones" scheme in Non-Volatile Memory.
This macro is used by T_InitSafetySystem to configure whether ECC errors are disregarded when reading all '1's (empty memory) from non-volatile memory sections. Reading empty memory can lead to false ECC errors, which in turn triggers error handling that can transition the device to a Safe State.
It is recommended to fill the empty memory sections with defined data, such as NOP instructions in Flash, to mitigate the chance of having false ECC errors. Enabling this feature reduces the diagnostic coverage of the ECC mechanism for the covered sections.
MW_DiagNvmParity reads DIAG_EEPROM_ADDRESS, which does not contain initialized data by default, and reading it would otherwise trigger ECC errors. MW_DiagNvmFlashEcc does not rely on this feature, since DIAG_FLASH_ADDRESS defaults to the reset vector, which is typically programmed.
The default value is chosen for development, where Non-volatile Memory sections may still be erased. Production configurations should use ECC_ALL_ONES_NONE to keep full ECC coverage and catch unexpected NVM access. This requires that every section the application reads contains initialized data, including DIAG_EEPROM_ADDRESS and any Flash locations that may be prefetched.
DIAG_PERIODIC_ECC_EEPROM. See MW_DiagNvmFlashEcc and MW_DiagNvmEepromEcc for details.
Valid configurations: see eccAllOnes_t.
| #define INIT_REDUNDANT_CFD ENABLED |
Enables or disables redundant CFD initialization.
This macro configures, at compile-time, whether to initialize CFD1 to mirror the configuration of CFD0 in T_InitSafetySystem, in order to have redundant operation. This approach eliminates the need for performing error injection diagnostics, which have a varying execution time and can take several hundred microseconds.
If the CFDs are not configured with redundant operation, it is recommended to enable error injection diagnostics for the used CFDs. See the following configurations:
DIAG_STARTUP_CFD1 or the DIAG_PERIODIC_CFD1 is disabled:
Valid configurations:
| #define INIT_REDUNDANT_CFM DISABLED |
Enables or disables redundant CFM initialization.
This macro configures, at compile-time, whether to initialize CFM1 to mirror the configuration of CFM0 in T_InitSafetySystem.
If the CFMs are not configured with redundant operation, it is recommended to enable error injection diagnostics. See the following configurations:
DIAG_STARTUP_CFM1 or the DIAG_PERIODIC_CFM1 is disabled:
This configuration is disabled by default since running the CFM diagnostics is fast compared to the CFD diagnostics, thus CFM1 can be configured by the application to monitor other clocks. If CFM redundancy on the main clock is desired, this configuration can be enabled.
Valid configurations:
| #define INIT_STACK_LIMIT (INTERNAL_SRAM_START + INTERNAL_SRAM_SIZE - 250U) |
Configures the max depth of the hardware call stack by setting the Stack Pointer limit address.
This macro is used by T_InitSafetySystem to configure the Stack Pointer Limit (SPLIM) SRAM address. This address marks the limit of the stack. If the stack pointer has a value lower than the configured stack limit, an error flag is set and reported to the error controller. This macro accepts an unsigned 16-bit integer value. The stack limit value can be protected from change by enabling the INIT_STACK_LIMIT_LOCK.
Valid configurations: an address between 'INTERNAL_SRAM_START' and 'INTERNAL_SRAM_END', as defined in the device specific header file (avr/io.h). For example, if the desired max stack depth is 200, the value should be set equal to 'INTERNAL_SRAM_END' - 200. Setting the value to 'INTERNAL_SRAM_START' will effectively disable this feature.
| #define INIT_STACK_LIMIT_LOCK ENABLED |
Configures whether the Stack Pointer Limit (SPLIM) LOCK should be enabled or disabled.
This macro is used by T_InitSafetySystem to configure whether the specified SPLIM address INIT_STACK_LIMIT will be locked and protected from change.
Valid configurations:
| #define INIT_SWDT_DURATION 4700UL |
Configures the run-time duration between executing T_InitSafetySystem and the first T_HandleSyncWatchdog call in main clock cycles.
This macro is used by T_InitSafetySystem to set the initial Synchronous Watchdog timeout period in the startup sequence. The value can be configured up to a 24-bit value minus the configured SWDT_OPEN_WINDOW value in main clock cycles (see INIT_CLOCK_FRQ). The specified duration ensures a fixed execution time between the SWDT being enabled in T_InitSafetySystem and the first T_HandleSyncWatchdog call, and should be set to be larger than the Worst-Case Execution Time (WCET) of T_InitSafetySystem. The first call to T_HandleSyncWatchdog is immediately after T_InitSafetySystem in TM_Startup.
Valid configurations: between 0 and (UINT24_MAX - SWDT_OPEN_WINDOW).
Setting this macro to 0 will not disable the Synchronous Watchdog timer (SWDT), but will load a reset value equal to SWDT_OPEN_WINDOW. If the value is smaller than the remaining execution time of the Task, the SWDT will time out.
| #define INIT_VLM_THRESHOLD VLM_THRESHOLD_PCT_15 |
Configures the Voltage Level Monitor threshold.
This macro is used by T_InitSafetySystem to configure the Voltage Level Monitor threshold relative to the Brown-Out Detector (BOD) threshold. Available thresholds are defined in the vlmThreshold_t. This macro together with INIT_VLM_TRIGGER configures the conditions for when a VLM interrupt will trigger.
Valid configurations: see vlmThreshold_t.
A value of VLM_THRESHOLD_OFF disables the feature.
| #define INIT_VLM_TRIGGER VLM_TRIGGER_FALLING |
Configures the Voltage Level Monitor trigger condition.
This macro is used by T_InitSafetySystem to configure which condition should trigger a VLM interrupt. Available triggers are defined in the vlmTrigger_t. This macro together with INIT_VLM_THRESHOLD configures the conditions for when a VLM interrupt will trigger.
Valid configurations: see vlmTrigger_t.
| #define INIT_VMON_ALWAYS_ON ENABLED |
Configures whether the Voltage Regulator Monitor (VMON) is enabled in deep sleep modes.
This macro is used by T_InitSafetySystem to enable or disable VMON operation in Standby and Power-Down sleep modes.
The VMON is intended to be active in all sleep modes, and should only be disabled for low-power applications.
Disabling this feature requires the application to also disable the VDIS (VMON is Disabled) interrupt and reconfigure the connected VREGWARN error channel to NOTIFICATION severity before entering Standby or Power-Down sleep mode to prevent possible errors from being reported after waking from sleep. See Tips and Tricks for a suggestion on how to achieve this.
Valid configurations:
| #define INIT_VMON_FULL_POWER_MODE ENABLED |
Configures the Voltage Regulator Monitor (VMON) power mode.
This macro is used by T_InitSafetySystem to enable or disable full power mode operation of VMON in sleep mode. Setting this macro to ENABLED will enable the VMON to operate with full speed even when the device is in sleep mode and reduce the start-up time of the VMON when waking up from sleep. Setting this macro to DISABLED will set the VMON in power-saving mode when the device is in sleep mode and increase the start-up time of the VMON when waking up from sleep.
Disabling this feature requires the application to also disable the VSLP (VMON Sleep Entry) interrupt and reconfigure the connected VREGWARN error channel to NOTIFICATION severity before entering Standby or Power-Down sleep mode to prevent possible errors from being reported after waking from sleep. See Tips and Tricks for a suggestion on how to achieve this.
Valid configurations:
| #define INIT_WDT_DURATION WDT_TIMEOUT_CLK128 |
Configures the timeout period, from executing T_InitSafetySystem to the first T_HandleWatchdog call, in OSC32K clock cycles.
This macro is used by T_InitSafetySystem to set the initial Watchdog timeout period in the startup sequence by choosing one of the available clock cycle durations defined by the wdtTimeout_t. The watchdog is configured to not use window mode while in the Safe State. The value should be configured such that it times out if the startup function takes longer than expected. Normally, the first watchdog clear will happen when calling T_HandleWatchdog in the first TM_Scheduler call. See WWDT_CLOSED_WINDOW and WWDT_OPEN_WINDOW for configuration of the windowed watchdog used in Mission Mode.
If the maximum available duration is too short, see Tips and Tricks section for how to increase the Watchdog Timer resolution.
Valid configurations: see wdtTimeout_t.
| #define PERIODIC_CRCSCAN DISABLED |
Enables or disables periodic CRCSCAN of Flash in T_EnterIdleSleep.
This macro configures, at compile-time, whether T_EnterIdleSleep performs a periodic CRCSCAN of Flash. When enabled, the Task starts a CRCSCAN of the next enabled Flash section when no scan is already ongoing before entering Idle sleep, and reports the result after the device wakes up, if the scan has completed.
Which sections to scan and the CRC width (16-bit or 32-bit) are configured using CRCSCAN_BOOT_SECTION, CRCSCAN_APPCODE_SECTION, CRCSCAN_APPDATA_SECTION and CRCSCAN_CRC32. If more than one section is enabled, each section is scanned in turn using Round Robin.
See PERIODIC_CRCSCAN_PIT to enable periodic wake-up after scanning the next 32 Flash words.
See DIAG_PERIODIC_CRCSCAN to enable or disable performing a CRCSCAN error injection diagnostic before starting a new section scan.
For a scan to complete successfully, the checksum must be stored in the last addresses of each enabled Flash section, as described in the device data sheet. The application is responsible for ensuring this is done when programming the device. For this reason, this setting is disabled by default.
It is the responsibility of the application to ensure that the selected Flash sections are valid with respect to the configured Flash partitioning in the Fuse settings.
This feature assumes no CRC Scan of Flash or CRC manual mode calculation is already in progress from another source. See T_EnterIdleSleep for additional requirements and assumptions.
Valid configurations:
| #define PERIODIC_CRCSCAN_PIT DISABLED |
Enables or disables automatic wake-up from periodic CRCSCAN in T_EnterIdleSleep.
This macro configures, at compile-time, whether the CRCSCAN periodic wake-up feature is enabled when PERIODIC_CRCSCAN is enabled. When enabled, the device wakes up after the next 32 Flash words have been scanned and returns from T_EnterIdleSleep, allowing the application to resume execution between scan steps. By calling T_EnterIdleSleep repeatedly, each enabled Flash section is eventually fully scanned.
PERIODIC_CRCSCAN setting is enabled with at least one of the CRCSCAN_BOOT_SECTION, CRCSCAN_APPCODE_SECTION or CRCSCAN_APPDATA_SECTION enabled.
If enabled, T_EnterIdleSleep depends on T_HandleCrcInterrupt to clear the PERIOD flag.
If another part of the system completes or aborts an ongoing CRC Scan and the application relies on this periodic wake-up feature as the wake-up source in T_EnterIdleSleep, the Task may enter Idle sleep without starting a new CRCSCAN and thus without a wake-up source. See T_EnterIdleSleep for more details.
Valid configurations:
| #define PRE_STARTUP_SWDT_RESET_VAL 0xFFFFUL |
Configures the new SWDT reset value after performing the SWDT Expire diagnostic in T_RunResetDiagnosticFsm in system clock cycles.
The MW_DiagSwdtExpire diagnostic requires the SWDT to be enabled, and thus has a side-effect of enabling the SWDT, which cannot be disabled again without a reset. For this reason, the diagnostic is included in T_RunResetDiagnosticFsm, since the subsequent diagnostic, MW_DiagWdtExpire, will normally reset the device and disable the SWDT. However, should the WDT diagnostic fail, the SWDT will be enabled with a certain duration. This macro specifies that duration, and should be configured to be equal to the desired timeout period in such a scenario.
A small value can be configured to intentionally let it expire and trigger an error (which will set the Error Controller in the ALARM state), or the timeout can be set such that it is cleared in time to perform error handling. Note that this scenario only occurs when the device has a defective WDT that cannot reset the device, and the SWDT is the only functioning watchdog.
The Task responsible for clearing the SWDT, T_HandleSyncWatchdog, will wait until reaching the open window. If using TM_Startup, consider that the first SWDT clear normally occurs during execution of the Startup sequence, after completing T_InitSafetySystem where the SWDT is initialized.
Valid configurations: between 1 and UINT24_MAX.
The default value is the measured amount of clock cycles between exiting the pre-startup sequence due to a failing WDT diagnostic and running the first T_HandleSyncWatchdog in TM_Startup with an added tolerance.
Default with tolerance is estimated to allow normal execution to reach T_InitSafetySystem to report WDT errors before the SWDT expires, while being short enough to expire within normal startup time if MW_DiagWdtExpire is stuck in pre-startup.
| #define SHUTDOWN_CRCSCAN DISABLED |
Enables or disables running a CRCSCAN on Flash in TM_Shutdown before entering sleep.
This macro configures, at compile-time, whether the Shutdown Task Manager performs a CRCSCAN on the specified Flash sections by calling T_VerifyFlashIntegrity. If enabled, the scan is started after the system has transitioned into the Safe State. Because the CRCSCAN requires Idle sleep mode to operate, the device enters Idle until all enabled sections are scanned, after which the Shutdown sequence continues.
Which sections to scan and the CRC width (16-bit or 32-bit) are configured using CRCSCAN_BOOT_SECTION, CRCSCAN_APPCODE_SECTION, CRCSCAN_APPDATA_SECTION and CRCSCAN_CRC32.
See DIAG_SHUTDOWN_CRCSCAN to enable or disable performing a CRCSCAN error injection before scanning the first section.
In order to perform a CRCSCAN of a Flash section or CRCSCAN error injection, T_VerifyFlashIntegrity configures the CRCSCAN, enters Idle sleep and waits for a Done interrupt to wake-up the device. Once a scan is completed, it relies on T_HandleCrcInterrupt to complete the diagnostic or report the result of the scan.
It is the responsibility of the application to ensure that the selected Flash sections are valid with respect to the configured Flash partitioning in the Fuse settings.
For a scan to complete successfully, the checksum must be stored in the last addresses of each enabled Flash section, as described in the device data sheet. The application is responsible for ensuring this is done when programming the device. For this reason, this setting is disabled by default.
Valid configurations:
| #define SHUTDOWN_POWER_DOWN DISABLED |
Configures whether to use Standby or Power-Down sleep mode in TM_Shutdown.
This macro configures, at compile-time, whether T_EnterShutdownSleep enters Power-Down sleep mode instead of the default Standby sleep mode during shutdown.
Power-Down typically provides lower power consumption than Standby by disabling more clock domains and peripherals in sleep. However, this can also impact which wake-up sources are available. See the device data sheet for more information.
A suitable wake-up source must be configured by the application before entering shutdown sleep. If no wake-up source is enabled, the device will not wake up. Ensure the selected wake-up source(s) are compatible with the selected sleep mode and peripheral configuration.
SHUTDOWN_SAFE_STATE and T_InitSafeShutdown for more information.
INIT_VMON_FULL_POWER_MODE settings as well as Tips and Tricks for information on disabling the Brown-out Detector (BOD) and Watchdog Timer (WDT) Clock Monitor.
Valid configurations:
| #define SHUTDOWN_SAFE_STATE ENABLED |
Enables or disables entering a Safe State in T_InitSafeShutdown before shutdown sleep.
This macro configures, at compile-time, whether T_InitSafeShutdown enters a Safe State by force floating (tri-stating) all I/O pins before entering shutdown sleep. This ensures that sleep can be safely entered, since several hardware safety mechanisms are inactive in deep sleep modes.
If the application requires an I/O pin to keep driving an output during shutdown sleep, such as a PWM signal, this setting can be disabled. It will then be the responsibility of the application to ensure safe operation before entering sleep. It is recommended to manually tri-state all other I/O pins in the application-specific shutdown Task passed to TM_Shutdown. See Tips and Tricks for more information.
If Safe State entry fails, ERRID_SAFE_IO is reported to the Error Handler. It is recommended to abort shutdown entry by performing a device reset if this occurs.
Valid configurations:
| #define SHUTDOWN_SUSPEND_CFD_CFM ENABLED |
Enables or disables suspending clock monitors before shutdown sleep in TM_Shutdown.
This macro configures, at compile-time, whether T_InitSafeShutdown stops the clock monitors CFM0, CFM1, CFD0 and CFD1 before entering shutdown sleep. Clock monitors can be impacted by sleep entry and exit depending on the monitored clock sources, and may report spurious errors when the device wakes up. When enabled, all of these monitors are stopped to prevent such error reporting during shutdown.
If the application requires specific clock monitoring during shutdown wake-ups, this setting should be disabled. In such cases, only clock sources that remain stable during sleep entry and wake-up should be monitored, and the application must instead stop or reconfigure the relevant monitors in the application-specific shutdown Task passed to TM_Shutdown.
Whether a clock source being monitored is affected by sleep depends on the selected sleep mode. See SHUTDOWN_POWER_DOWN for configuration of the shutdown sleep mode.
This setting affects all CFM and CFD monitors, regardless of how they were configured during initialization. Both CFM0 and CFD0 are configured to monitor the main clock at startup by default, while CFM1 and CFD1 may either be configured for redundant monitoring or configured by the application. See INIT_REDUNDANT_CFD, INIT_CFM0_WIN_REF and INIT_REDUNDANT_CFM.
Valid configurations:
| #define SHUTDOWN_WDT_DURATION WDT_TIMEOUT_CLK8K |
Configures the Watchdog Timer (WDT) timeout used during sleep in TM_Shutdown.
This macro configures the WDT timeout used during shutdown after T_InitSafeShutdown reconfigures the WDT to operate without windowed mode. The configured timeout is applied when the WDT is cleared in the Shutdown sequence, after which the WDT can be cleared at any time when the device wakes up.
The WDT provides a fallback recovery mechanism during shutdown by timing out if the device fails to wake up or if the shutdown loop fails to re-enter sleep as expected. Since the system has already transitioned into a Safe State, a more relaxed WDT configuration can be used compared to Mission Mode, which reduces the required wake-up frequency and removes the need for strict WDT clear timing.
The WDT must be periodically serviced by calling TM_ShutdownRequestWatchdogs while the device is awake before it expires. This is typically done from a wake-up interrupt handler. See Tips and Tricks for guidance on suitable handling strategies for different scenarios.
The Synchronous Watchdog Timer (SWDT) halts counting while the device is in sleep, but will resume counting each time the device wakes up. The SWDT is therefore configured to always operate in its open window during shutdown and is cleared together with the WDT.
TM_ShutdownRequestWatchdogs, for instance from the application-specific shutdown Task passed to TM_Shutdown.
Valid configurations: see wdtTimeout_t.
| #define STRICT_SAFE_STATE DISABLED |
Configures whether to use a strict Safe State to Mission Mode transition in TM_PreStartup and TM_Startup.
This macro configures, at compile-time, whether to enable the Strict Safe State mode in the T_EnsureSafeState Task. If enabled, all I/O-pins are force floated (tri-stated) at the beginning of the pre-startup sequence of TM_PreStartup. This ensures that the system maintains a strict Safe State even if application tasks, in the TM_Startup schedule, initializes peripherals and I/O-pins before officially entering Mission Mode. The T_StartMissionMode Task is responsible for disabling force-float after running the Startup schedule, to have a strict transition from Safe State to Mission Mode.
Depending on the peripheral and PORT configuration on the device, as well as the surrounding circuitry, disabling force floating of all I/O-pins simultaneously might result in a power surge. For this reason, this feature is disabled by default and should be thoroughly tested for the specific application when enabled.
Valid configurations:
| #define SWDT_OPEN_WINDOW 500U |
Configures the open window size used for the Synchronous Watchdog (SWDT).
This macro is used by T_InitSafetySystem and configures the open window used for the SWDT. The configured value allocates the number of clock cycles at the end of the total duration of the SWDT period where it is allowed to send a clear command. The T_HandleSyncWatchdog task, responsible for clearing the SWDT, will wait until reaching the open window before clearing immediately. For this reason, it treats the closed window period as the real SWDT timeout and thus assumes that the open window is configured to a small value.
Valid configurations: between 1 and UINT16_MAX.
| #define WWDT_CLOSED_WINDOW WDT_TIMEOUT_CLK128 |
Configures the Windowed Watchdog Timer (WWDT) closed window duration in Mission Mode.
This macro, together with WWDT_OPEN_WINDOW, is used to set the total timeout period of the WWDT in T_StartMissionMode. The timeout is intended to be configured equal to or smaller than the device Fault Detection Time Interval (FDTI), accounting for WDT clock tolerances.
The closed window is the period in which the watchdog cannot be cleared. A premature clear attempt will result in a hardware error. For this reason, it is recommended to set the closed window to a much larger value than the open window, within the limitations of the WDT granularity settings, to ensure clearing is only done at the end of the period. See the watchdog sections in Tips and Tricks for methods to increase the effective granularity and length of the WWDT timeout.
It is necessary to consider the duration of the total application schedule in addition to the time it takes from one schedule ending to the next one starting when configuring the closed window as TM_Scheduler will always try to clear the WDT before executing any scheduled tasks. If the WWDT is still in a closed window when calling TM_Scheduler it will result in a hardware error.
Valid configurations: see wdtTimeout_t.
Setting this macro to WDT_TIMEOUT_OFF will result in configuring the Watchdog Timer (WDT) to run in Normal mode instead of Window mode. This is not recommended, except during development.
| #define WWDT_OPEN_WINDOW WDT_TIMEOUT_CLK64 |
Configures the Windowed Watchdog Timer (WWDT) open window duration in Mission Mode.
This macro, together with WWDT_CLOSED_WINDOW, is used to set the total timeout period of the WWDT in T_StartMissionMode. The timeout is intended to be configured equal to or smaller than the device Fault Detection Time Interval (FDTI), accounting for WDT clock tolerances.
The open window is the period in which the watchdog can be cleared without an error. For this reason, it is recommended to set the open window to a much smaller value than the closed window, within the limitations of the WDT granularity settings, to ensure clearing is only done at the end of the period. See the watchdog sections in Tips and Tricks for methods to increase the effective granularity and length of the WWDT timeout.
Valid configurations: see wdtTimeout_t.
Setting this macro to WDT_TIMEOUT_OFF will disable the Watchdog Timer (WDT). This is not recommended, except during development.
| const rstCallback_t resetReasonCallback = &T_ResetReasonExampleCallback |
Configures the user-configurable callback function used for application specific reset handling in T_HandleResetReason.
This callback setting is configured in the tasks_config.c file and should be set to point to a function with a rstCallback_t type signature in order to implement application-specific handling of the identified device reset reason.
The callback passes a resetInfo_t input parameter, which is a structure containing the reset reason determined in T_DetermineResetReason and an Error ID. The values are validated in T_HandleResetReason before the callback is called. The Error ID is set to ERRID_NONE as long as the Reset Reason is not a software reset. If a software reset has occurred, the Error ID is set to the value stored by EH_InitiateSafeState before issuing the software reset.
Valid configuration: Only functions with the rstCallback_t type signature.
1.17.0