VDE Prüf- und Zertifizierungsinstitut GmbH / VDE Testing and Certification Institute. VDE Prüfbericht / VDE Test Report AS

Transcription

1 rüf- und Zertifizierungsinstitut GmbH / rüfbericht / Test Report rüfbericht Nr. Report No.... : -Aktenzeichen File No.... : Ausstellungsdatum Date issue... : Labor Laboratory... : Adresse Address... : rüfort / Adresse Testing location/ address... : Genehmigungsinhaber Applicant's name... : Genehmigungsinhaber Adresse Applicant's address... : Angewandte Norm(en) Applied standard(s)... : Art des rüflings Test item description... : Warenzeichen Trade Mark... : Typenbezeichnungen(en) Type reference(s)... : 9103-AS / rüf- und Zertifizierungsinstitut GmbH Merianstrasse Offenbach/Main; Germany rüf- und Zertifizierungsinstitut GmbH Merianstrasse Offenbach/Main; Germany Microchip Technology Inc. Vestre Rosten 79; 7075 TILLER; NORWAY DIN EN ( ): ; EN :2012 DIN EN Ber.1 ( Ber.1): EN :2012/AC:2014 EN :2012/A11:2014 DIN EN ( ): ; EN :2011 IEC :2010 IEC :2010 IEC :2010/AMD1:2013 IEC :2010/AMD2:2015 Micro Controler Self-Diagnostic Routines for TINY AVR1- Series File Name Revision classb_cpu_gcc.c 1.0 classb_cpu_iar.c 1.0 classb_interrupt_monitor.h 1.0 classb_freq.h 1.0 classb_crc.h 1.0 classb_crc_hw.h 1.0 rüfbericht Nr AS6-1 1 age Haftungsausschluss / Disclaimer: Dieser rüfbericht enthält das Ergebnis einer einmaligen Untersuchung an dem zur rüfung vorgelegten Erzeugnis. Ein Muster dieses Erzeugnisses wurde geprüft, um die Übereinstimmung mit den nachfolgend aufgeführten Normen bzw. Abschnitten Normen festzustellen. Der rüfbericht berechtigt Sie nicht zur Benutzung eines Zertifizierungszeichens des und berücksichtigt ausschließlich die Anforderungen der unten genannten Regelwerke. Wenn gegenüber Dritten auf diesen rüfbericht Bezug genommen wird, muss dieser rüfbericht in voller Länge an gleicher Stelle verfügbar gemacht werden This test report contains the result a singular investigation carried out on the product submitted. A sample this product was tested to found the accordance with the thereafter listed standards or clauses standards resp. The test report does not entitle for the use a Certification Mark and considers solely the requirements the specifications mentioned below. Whenever reference is made to this test report towards third party, this test report shall be made available on the very spot in full length.

2

3 rüf- und Zertifizierungsinstitut GmbH / Mögliche rüfergebnisse ossible test case verdicts: rüfung nicht anwendbar Test case does not apply to the test object : rüfung erfüllt (positiv) Test object does meet the requirement... : (ass) rüfung nicht erfüllt (negativ) Test object does not meet the requirement : F (Fail) Abschließendes rüfergebnis Final Verdict: Bemerkung / Remark... : */* F Umgebungsbedingungen (falls relevant) Environmental conditions (if applicable) Umgebungstemperatur Ambient temperature Atmosphärischer Druck Atmospheric pressure Relative Luftfeuchtigkeit Relative humidity Nennwert / Rated values... : C ha % Überprüfter Wert / Verified values... : Bereich bestätigt : Deutscher Wetterdienst Range confirmed by: Deutscher Wetterdienst (Meteorological service) rüfbericht Nr AS6-1 age 3

4 rüf- und Zertifizierungsinstitut GmbH / Durchgeführte rüfungen / erformed tests Abschnitt Clause R rüfanforderungen / Requirement + Test ANNEX R (NORMATIVE) SOFTWARE EVALUATION IEC :2010 rogrammable electronic circuits requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2 validated in accordance with the requirements this annex Ergebnis Anmerkung Result Remark Beurteilung Verdict R.1 rogrammable electronic circuits using stware rogrammable electronic circuits requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2 constructed so that the stware does not impair compliance with the requirements this standard R.2 Requirements for the architecture R rogrammable electronic circuits requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2 use measures to control and avoid stware-related faults/errors in safety-related data and safety-related segments the stware rogrammable electronic circuits requiring stware incorporating measures to control the fault/error conditions specified in table R.2 have one the following structures: - single channel with periodic self-test and monitoring - dual channel (homogenous) with comparison - dual channel (diverse) with comparison rogrammable electronic circuits requiring stware incorporating measures to control the fault/error conditions specified in table R.1 have one the following structures: - single channel with functional test - single channel with periodic self-test - dual channel without comparison R.2.2 Measures to control faults/errors R When redundant memory with comparison is provided on two areas the same component, the data in one area is stored in a different format from that in the other area rüfbericht Nr AS6-1 age 4

5 rüf- und Zertifizierungsinstitut GmbH / R R R R R rüfbericht Nr. rogrammable electronic circuits with functions requiring stware incorporating measures to control the fault/error conditions specified in table R.2 and that use dual channel structures with comparison, have additional fault/error detection means for any fault/errors not detected by the comparison For programmable electronic circuits with functions requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2, means are provided for the recognition and control errors in transmissions to external safety-related data paths For programmable electronic circuits with functions requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2, the programmable electronic circuits incorporate measures to address the fault/errors in safety-related segments and data indicated in table R.1 and R.2 as appropriate For programmable electronic circuits with functions requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2, detection a fault/error occur before compliance with clause 19 is impaired The stware is referenced to relevant parts the operating sequence and the associated hardware functions R Labels used for memory locations are unique R R The stware is protected from user alteration safety-related segments and data Stware and safety-related hardware under its control is initialized and terminates before compliance with clause 19 is impaired R.3 Measures to avoid errors R.3.1 General For programmable electronic circuits with functions requiring stware incorporating measures to control the fault/error conditions specified in table R.1 or R.2, the following measures to avoid systematic fault in the stware are applied Stware that incorporates measures used to control the fault/error conditions specified in table R.2 is inherently acceptable for stware required to control the fault/error conditions specified in table R.1 R.3.2 Specification R Stware safety requirements: Stware Id: 1.0 The specification the stware safety requirements includes the descriptions listed R Stware architecture 9103-AS6-1 age 5

6 rüf- und Zertifizierungsinstitut GmbH / R The specification the stware architecture includes the aspects listed - techniques and measures to control stware faults/errors (refer to R.2.2); Document ref. No: Available on request at manufacturer. - interactions between hardware and stware; - partitioning into modules and their allocation to the specified safety functions; - hierarchy and call structure the modules (control flow); - interrupt handling; - data flow and restrictions on data access; - architecture and storage data; - time-based dependencies sequences and data R The architecture specification is validated against the specification the stware safety requirements by static analysis R Module design and coding R Based on the architecture design, stware is suitably refined into modules Stware module design and coding is implemented in a way that is traceable to the stware architecture and requirements R Stware code is structured R Coded stware is validated against the module specification by static analysis The module specification is validated against the architecture specification by static analysis R Stware validation The stware is validated with reference to the requirements the stware safety requirements specification Compliance is checked by simulation : - input signals present during normal operation Self-diagnostic routines only - anticipated occurrences - undesired conditions requiring system action rüfbericht Nr AS6-1 age 6

7 rüf- und Zertifizierungsinstitut GmbH / TABLE R.1 e GENERAL FAULT/ERROR CONDITIONS Component a Fault/error Acceptable measures b, c Definitions Document reference for applied measure Document reference for applied test Ver-di ct 1 CU 1.1 Registers Stuck at Functional test, or periodic self-test using either: - static memory test, or H H Documentation available on request at manufacturer - word protection with single bit redundancy H H rogramme counter Stuck at Functional test, or eriodic self-test, or Independent time-slot monitoring, or H H H Logical monitoring the programme sequence H Interrupt handling and execution No interrupt or too frequent interrupt Functional test, or time-slot monitoring H H Documentation available on request at manufacturer 3 Clock Wrong frequency (for quartz synchroniz ed clock: harmonics/ sub-harmo nics only) Frequency monitoring, or time slot monitoring H H Documentation available on request at manufacturer 4. Memory 4.1 Invariable memory All single bit faults eriodic modified checksum, or multiple checksum, or H H Documentation available on request at manufacturer word protection with single bit redundancy H Variable memory DC fault eriodic static memory test, or word protection with single bit redundancy H H Documentation available on request at manufacturer 4.3 Addressing (relevant to variable and invariable memory) Stuck at Word protection with single bit redundancy including the address H Covered indirectly by all other routines 5 Internal data path rüfbericht Nr AS6-1 age 7

8 rüf- und Zertifizierungsinstitut GmbH / 5.1 Data Stuck at Word protection with single bit redundancy H Addressing Wrong address Word protection with single bit redundancy including the address H External communication 6.1 Data Hamming distance 3 Word protection with multi-bit redundancy, or H CRC single work, or H Transfer redundancy, or H rotocol test H Timing Wrong point in time Time-slot monitoring, or scheduled transmission Time-slot and logical monitoring, or H H H comparison redundant communication channels by either: - reciprocal comparison H independent hardware comparator H Wrong sequence Logical monitoring, or time-slot monitoring, or H H Scheduled transmission H Input/output periphery 7.1 Digital I/O Fault conditions specified in lausibility check H Analog I/O A/D and D/Aconverter Fault conditions specified in lausibility check H Documentation available on request at manufacturer Analog multiplexer 9 Custom chips d e.g. ASIC, GAL, gate array Wrong addressing Any output outside the static and dynamic functional specificatio n lausibility check H eriodic self-test H NOTE A Stuck-at fault model denotes a fault model representing an open circuit or a non-varying signal level. A DC fault model denotes a stuck-at fault model incorporating short circuit between signal lines. rüfbericht Nr AS6-1 age 8

9 rüf- und Zertifizierungsinstitut GmbH / a) For fault/error assessment, some components are divided into their sub-functions. b) For each sub-function in the table, the Table R.2 measure will cover the stware fault/error. c) Where more than one measure is given for a sub-function, these are alternatives. d) To be divided as necessary by the manufacturer into sub-functions. e) Table R.1 is applied according to the requirements R.1 to R inclusive. rüfbericht Nr AS6-1 age 9

10 rüf- und Zertifizierungsinstitut GmbH / IEC :2010 Clause Requirement + Test Result - Remark Verdict H.6 Classification, additions H.6.18 Class control function (A, B,C)... H.7 Information in addition to Table 1 provided: 66 - Stware sequence documentation; clause: 9; method: X rogram documentation; clause: 9, 12; method: X Stware fault analysis; clause: H.11.12, H ; method: X Stware class(es) and structure; clause: H , H , H , H ; method: D Analytical measures and fault/error control techniques employed; clause: H , 2, 4; method: X Stware fault/error detection time(s) for controls with stware Classes B or C; clause: H , 6; method: X Control response(s) in case detected fault/error; clause: 7; method: X Maximum number reset actions within a time period; clause 3.6, 3.4; method: D Number remote reset actions; clause H ; method: X... m Controls with stware classes B or C had information provided for safety-related segments the stware. Information on the non-safety related segments was sufficient to establish that they did not influence safety-related segments... n Stware sequence was documented and, together with the operating sequence, included a description the control system philosophy, the control flow, data flow and the timings... rüfbericht Nr AS6-1 age 10

11 rüf- und Zertifizierungsinstitut GmbH / o - Safety-related data and safety-related segments the stware sequence, the malfunction which could result in noncompliance with the requirements Clauses 17, 25, 26 and 27, are identified... Included the operating sequence... Stware fault analysis was related to the hardware fault analysis in Clause H q - rogramming documentation was supplied in a programming design language declared by the manufacturer... r Different stware classes applied to different control functions... s - Measures declared are chosen by manufacturer from the requirements Clauses H to 4 inclusive... H.11 Constructional requirements H Controls using stware Controls using stware were so constructed that the stware did not impair control compliance with the requirements this standard H Requirements for the architecture H Control functions with stware class B or C use measures to control and avoid stware-related faults/errors in safety-related data and safetyrelated segments the stware, as detailed in H to H inclusive H Control functions with stware class C have one the following structures: single channel with periodic self-test and monitoring (H ) dual channel (homogenous) with comparison (H ) dual channel (diverse) with comparison (H ) Control functions with stware class B have one the following structures: single channel with functional test (H ) single channel with periodic self-test (H ) rüfbericht Nr AS6-1 age 11

12 rüf- und Zertifizierungsinstitut GmbH / dual channel without comparison (H ) H Other structure permitted with equivalent level safety to those in H H Measures to control faults/errors Redundant memory with comparison provided on two areas the same component: data stored in different formats Stware class C using dual channel structures with comparison: additional fault/error detection means Stware class B or C: means for recognition and control errors in transmission to external safety-related data paths: Means took into account errors data, addressing, transmission timing and sequence protocol Stware class B or C: within the control, measures are taken to address the fault/errors in safety-related segments and data indicated in Table H.1 and identified in Table 1 requirement 68. Measures others than those specified in 4 utilized to satisfy the requirements listed in Table H Stware fault/error detection: occur not later than declared time(s), Table 1, requirement 71 acceptability declared time(s): evaluated during fault analysis the control For controls with functions, classified as Class B or C, detection fault/error: results in the response declared in Table 1, requirement 72 for Class C: independent means capable performing this response provided 8 Class C, dual channel structure, loss dual channel capability: deemed to be an error 9 Stware referenced: rüfbericht Nr AS6-1 age 12

13 rüf- und Zertifizierungsinstitut GmbH / to relevant parts the operating sequence to the associated hardware functions 10 Labels used for memory locations are unique Stware protected from user alteration safetyrelated segments and data Stware and safety-related hardware under its control is initialized to and terminates at a declared state, Table 1, requirement H Measures to avoid errors 1 For controls with stware class B or C the measures shown in Figure H.1 to avoid systematic faults are applied Other methods utilized that incorporate disciplined and structured processes including design and test phases Specification Stware safety requirements The specification the stware safety requirements includes: A description each safety related function to be implemented, including its response time(s): - functions related to the application including their related stware classes - functions related to the detection, annunciation and management stware or hardware faults A description interfaces between stware and hardware A description interfaces between any safety and non-safety related functions Stware architecture The description stware architecture include the following aspects: Techniques and measures to control stware faults/errors (refer to H ) rüfbericht Nr AS6-1 age 13

14 rüf- und Zertifizierungsinstitut GmbH / Interactions between hardware and stware artitioning into modules and their allocation to the specified safety functions Hierarchy and call structure the modules (control flow) Interrupt handling Data flow and restrictions on data access Architecture and storage data Time based dependencies sequences and data The architecture specification is verified against the specification the stware safety requirements by static analysis 2.3 Module design and coding Stware is suitably refined into modules. Stware module design and coding are implemented in a way that is traceable to the stware architecture and requirements. The module design specified: function(s) interfaces to other modules data Stware code is structured Coded stware is verified against the module specification, and the module specification is verified against the architecture specification by static analysis 2.4 Design and coding standards rogram design and coding standards is used during stware design and maintenance Coding standards : specified programming practice proscribed unsafe language features rüfbericht Nr AS6-1 age 14

15 rüf- und Zertifizierungsinstitut GmbH / specify procedures for source code documentation specify data naming conventions Testing Module design (stware system design, stware module design and coding) A test concept with suitable test cases is defined based on the module design specification. Each stware module is tested as specified within the test concept Test cases, test data and test results are documented Code verification a stware module by static means includes such techniques as stware inspections, walk-throughs, static analysis and formal pro Code verification a stware module by dynamic means includes functional testing, white-box testing and statistical testing 3.2 Stware integration testing A test concept with suitable test cases is defined based on the architecture design specification The stware is tested as specified within the test concept Test cases, test data and test results are documented 3.3 Stware validation A validation concept with suitable test cases is defined based on the stware safety requirements specification The stware is validated with reference to the requirements the stware safety requirements specification as specified within the validation concept The stware is exercised by simulation or stimulation : rüfbericht Nr AS6-1 age 15

16 rüf- und Zertifizierungsinstitut GmbH / input signals present during normal operation anticipated occurrences undesired conditions requiring system action Test cases, test data and test results are documented 4 Other Items Equipment used for stware design, verification and maintenance was qualified appropriately and demonstrated to be suitable for purpose in manifold applications Management stware versions: All versions are uniquely identified for traceability 4.3 Stware modification Stware modifications are based on a modification request which details the following: the hazards which may be affected the proposed change the reasons for change An analysis is carried out to determine the impact the proposed modification on functional safety. A detailed specification for the modification is generated including the necessary activities for verification and validation, such as a definition suitable test cases The modification is carried out as planned The assessment the modification is carried out based on the specified verification and validation activities. All details modification activities are documented For class C control functions: One the combinations (a p) analytical measures given in the columns table H.9 is used during hardware development... rüfbericht Nr AS6-1 age 16

17 rüf- und Zertifizierungsinstitut GmbH / H Remotely actuated control functions Data Exchange General Remotely actuated control functions are connected to separate, independent devices, which may themselves contain control functions or provide other information and any data exchange between these devices does not compromise the integrity class B control function or class C control function. Type data - Message types for data exchange in a control function or functions are allocated to class A control function, class B control function or class C control function. The safety or protective relevance or influence, message types or data exchange are allocated only to class B control function or class C control functions, see Table H.10. Communication Safety Related Data Transmission Safety relevant data is transmitted authentically concerning: data corruption address corruption wrong timing or sequence Data variation or corrupted data did not lead to an unsafe state Before transmitted data was used it was ensured that data corruption, address corruption and wrong timing or sequence are addressed using the measures as given in Annex H. The following failure modes are addressed: permanent auto-sending or repetition, interruption data transfer Access to data exchange - All types access to class B control function or class C control function related data exchange systems is clearly restricted Adequate hardware/stware measures are taken to ensure no unauthorized access to the control functions (class B and C; operating data, configuration parameters and/or stware modules) rüfbericht Nr AS6-1 age 17

18 rüf- und Zertifizierungsinstitut GmbH / For class B and class C stware revisions the requirements H and hardware configuration management are applied and the control maintains its protective functions Remotely actuated control function operation have the duration or limits set before switching on except when automatic switching f is realized at the end a cycle or the system is designed for permanent operation. riority remotely actuated control functions over control functions does not lead to a hazardous condition. 3.1 Remote reset action is manually initiated. Reset functionality initiated by a hand-held device required at least two manual actions to activate 3.2 Reset functions are capable resetting the system as intended 3.3 Unintended resets from safe state do not occur Any fault the reset function does not cause the control or controlled function to result in a hazardous condition, and was evaluated for its Class B classification For reset functions initiated by manual action not in visible sight the appliance, the following additional requirements apply: the actual status and relevant information the process under control is visible to the user before, during and after the reset action; the maximum number reset actions within a time period is declared. Following this, any further reset is denied unless the appliance is physically checked... The reset function is evaluated on the final application. Manual switching a thermostat or device with similar function that activates a reset is declared by the manufacturer and is suitable in the final application... H rotection against internal faults to ensure functional safety H Design and construction requirements rüfbericht Nr AS6-1 age 18

19 rüf- und Zertifizierungsinstitut GmbH / H Fault avoidance and fault tolerance Controls incorporating control functions class B or C are designed according to H taking into account the failure modes Cl. H for stware Systematic errors are avoided Random faults are dealt with by a proper system configuration Functional analysis the application resulted in a structured design with: Control flow Data flow Time related functions required by the application For custom-chips special attention was made to minimize systematic errors System configuration was failsafe or: Incorporated components with direct safety-critical functions guarded by safeguards that cause a completely independent safety shut-down in accordance to H stware class B or C - safeguards are built into hardware and, - safeguards are supplemented by stware H Time slot monitoring is sensitive to both an upper and a lower limit the time interval. Faults resulting in a shift the upper and/or lower limit are taken into account. In a class C control function when a single fault in a primary safeguard can render the safeguard inoperative, a secondary safeguard is provided The reaction time the secondary safeguard is in accordance with Clause H Documentation The documentation was based on 2 rüfbericht Nr AS6-1 age 19

20 rüf- und Zertifizierungsinstitut GmbH / The functional analysis the control and the safety related programs under its control are documented in a clear hierarchical way in accordance with the safety philosophy and the program requirements. Documentation provided for assessment included: A description the system philosophy, the control flow, data flow and timings. A clear description the safety philosophy the system with all safeguards and safety functions clearly indicated. Sufficient design information is provided to enable the safety functions or safeguards to be assessed Documentation for any stware within the system rogramming documentation is supplied in a programming design language declared by the manufacturer... Safety related data and safety related segments the operating sequence are identified and classified according to H There is a clear relationship between the various parts the documentation H Class B control function H Design and construction requirements Stware complies with stware class B H Class C control function H Design and construction requirements Stware complies with stware class C H Circuit and construction evaluation H Assessment Only the safety related stware (stware class B and C) as identified according to H were subjected to further assessment rüfbericht Nr AS6-1 age 20

21 rüf- und Zertifizierungsinstitut GmbH / Ergänzende Information / Supplementary information: The self-diagnostic routines mentioned below are foreseen for following measures table R.1 / H.1: File Name classb_cpu_gcc.c classb_cpu_iar.c classb_interrupt_monitor.h classb_freq.h Measure 1.1 Register 2. Interrupt handling and execution 3. Clock classb_crc.h classb_crc_hw.h CRC_16bit_alg.h CRC_16bit_lookup.h 4.1 Invariable memory CRC_32bit_alg.h CRC_32bit_lookup.h classb_sram.h classb_analog.h 4.2 Variable memory A/D- and D/A- converter Zusätzliche Funktion / Additional Feature: The micro controller provides a watch-dog circuit with independent clock from main clock. The watch-dog can be used in Window mode. If the watch-dog is used in window mode with a minimum window 50% the watch-dog also can be used for time-slot monitoring. For the watch-dog a self-diagnostic routine is provided: classb_wdt_test.c refision 1.0. rüfbericht Nr AS6-1 age 21

22 rüf- und Zertifizierungsinstitut GmbH / Fotodokumentation / hoto documentation: rüfbericht Nr AS6-1 age 22

23 rüf- und Zertifizierungsinstitut GmbH / rüf- und Messmittel / Testing and measuring equipment: Atmel Studio for debugging AtmelTolchainrovider : GCC: binutils: avr-libc: "2.0.0" For IAR I m using Embedded Workbench 7.4. Although the roduct Info page in the help menu say the following: Embedded Workbench for Atmel AVR Embedded Workbench Shared components Messunsicherheit (optional nach Abschnitt c der IEC 17025) Uncertainty measurement (optional according to sub-clause c IEC 17025): END OF TEST REORT rüfbericht Nr AS6-1 age