Motor Control Lighting Development Tools Motor ... - ICC Media GmbH

MICROCONTROLLERSSafer household appliances withlow-cost ARM Cortex-M based MCUsBy Vincent Onde, STMicroelectronicsHardware parity checkadoption in the embeddedmarket for general purposeMCUs, combined with anever-increasing number ofsystem monitoring and safetyfeatures, makes applicationssimpler to be certified, safetyrelateddevelopment taskseasier to be implemented,and most important, makeshousehold appliances safer. Since 2007, household appliance manufacturershave had to adhere to the IEC60335safety standard for all new designs. This standardcovers everything from mechanical systemsto embedded electronics to ensure theequipment is safe and reliable, and more specifically,that a failure will not present a safetyhazard to the user.The electronics section refers to another standard,the IEC60730, which covers automaticelectronic control for a wide range of applications.In particular, Annex H is important forembedded systems developers since it focuseson programmable devices. Microcontrollers arecommon in white goods, often used in multiples:typically, one manages the dashboard while anotherone handles valve and motor control.The standard distinguishes three software classes,A, B and C, depending on the danger apiece of equipment presents if it fails. If thesafety of the appliance does not rely on software,it falls into Class A - room thermostats orlighting controls, for example. At the oppositeend of the spectrum, if the software is intendedto prevent special hazards such as an explosionin electronically-fired gas burners, it is evaluatedas Class C. Class C is not covered in thisarticle since most household appliances whoseelectronic controls must prevent unsafe operationbelong to Class B. Class B includes washingmachines for example, with the potentialissues related to electronically controlled doorlocks or to thermal cut-offs of motors. TheIEC60730 table H.11.12.7 in Annex H lists themicrocontroller components to be tested, thefaults to be detected, and the acceptable measures,for both software class B and C. It includesthe CPU (registers and program counter), interrupts(handling and execution), clock frequencymonitoring, checks on variable memory(RAM) and invariable memory (flash, EEP-ROM), external communications, and peripherals.These checks are first done exhaustivelyduring the MCU boot, even before the systemstart-up code execution takes place. Why? Themain reason is that the RAM test is ‘destructive’and would corrupt the initialized variables.What is asked for within a RAM check? ForClass B, the standard requires single-bit DCfault detection (for instance stuck-at or couplingfault) to be done periodically. Since mostof the entry-level MCUs do not have paritybits included in their SRAM, the test must beimplemented by software. March algorithmsdetect these faults with a limited number ofpasses: March C- fits perfectly (using 10.n operations,n being the number of locations tobe tested) but March X (6.n operations) isalso accepted by test institutes in particularcases. Once the test is complete, the RAMmemory is erased (thus the term ‘destructivetest’). Carrying out a March test following thereset does not present particular difficulties. Ithas no real drawback other than slowing downthe start-up procedure a little bit: given thesmall quantity of embedded SRAM, usuallythis is not even noticeable. On the other hand,it can be quite a challenge if repeated duringrun-time.Firstly, it must be made transparent: the applicationmust handle the RAM without particularprotocol, as if the test were not implemented.Practically speaking, this imposes the followingconditions. It must be implemented in an interruptservice routine (ISR), served with the highestpriority. This guarantees the data will not beaccessed by the application while testing is done.A memory buffer must be provisioned, so thatthe content of the RAM area being checked canfirst be backed up and finally restored before resumingthe applicative tasks. Obviously, thisbuffer must also be periodically verified.Secondly, it must not suspend the applicationfor too much time. The check is usually splitin a number of partial tests to limit the timespent in this top level task. Still, the numberof locations tested at once cannot be lowerthan 3 consecutive locations (this is mandatoryto have coupling fault coverage), which representsno less than 30 successive read/write accessesusing a March C- algorithm. Although27 April 2013