VDE Prüf- und Zertifizierungsinstitut GmbH / VDE Testing and Certification Institute. VDE Prüfbericht / VDE Test Report. 26 Report No.

Transcription

1 rüf- und Zertifizierungsinstitut GbH / rüfbericht / Test Report rüfbericht Nr. Report No.... : -Aktenzeichen File No.... : / Ausstellungsdatu Date issue... : Labor Laboratory... : Adresse Address... : rüfort / Adresse Testing location/ address... : Genehigungsinhaber Applicant's nae... : Genehigungsinhaber Adresse Applicant's address... : Angewandte Nor(en) Applied standard(s)... : Art des rüflings Test ite description... : Warenzeichen Trade Mark... : rüf- und Zertifizierungsinstitut GbH Merianstrasse Offenbach/Main; Gerany rüf- und Zertifizierungsinstitut GbH Merianstrasse Offenbach/Main; Gerany Renesas Electronics Europe GbH Karl-Haerschidt-Straße 42; Aschhei-Dornach; Gerany DIN EN ( ): ; EN :2012 DIN EN Ber.1 ( Ber.1): EN :2012/AC:2014 EN :2012/A11:2014 DIN EN ( ): ; EN :2011 IEC :2010 IEC :2010/AMD1:2013 IEC :2010/AMD2:2015 IEC :2010 IEC :2010/AMD1:2015 Self-Diagnostic Routines for Micro controller Failies S1; S3; S5 and S7 rüfbericht Nr. 1 age Haftungsausschluss / Disclaier: Dieser rüfbericht enthält das Ergebnis einer einaligen Untersuchung an de zur rüfung vorgelegten Erzeugnis. Ein Muster dieses Erzeugnisses wurde geprüft, u die Übereinstiung it den nachfolgend aufgeführten Noren bzw. Abschnitten Noren festzustellen. Der rüfbericht berechtigt Sie nicht zur Benutzung eines Zertifizierungszeichens des und berücksichtigt ausschließlich die Anforderungen der unten genannten Regelwerke. Wenn gegenüber Dritten auf diesen rüfbericht Bezug genoen wird, uss dieser rüfbericht in voller Länge an gleicher Stelle verfügbar geacht werden This test report contains the result a singular investigation carried out on the product subitted. A saple this product was tested to found the accordance with the thereafter listed standards or clauses standards resp. The test report does not entitle for the use a Certification Mark and considers solely the requireents the specifications entioned below. Whenever reference is ade to this test report towards third party, this test report shall be ade available on the very spot in full length.

2 rüf- und Zertifizierungsinstitut GbH / Typenbezeichnungen(en) Type reference(s)... : S1 S3 S5 S7 cpu_test.c cpu_test.c cpu_test.c cpu_test.c CU_Test_Control. CU_Test_Control. CU_Test_Control. CU_Test_Control. cpu_test_coupling.c cpu_test_coupling.c cpu_test_coupling.c cpu_test_coupling.c CU_Test_General_High.as CU_Test_General_High. CU_Test_General_High. CU_Test_General_High.as CU_Test_General_Low. CU_Test_General_Low. CU_Test_General_Low. CU_Test_General_Low. --- fpu_control. fpu_control. fpu_control. --- fpu_exten. fpu_exten. fpu_exten. --- fpu_test_coupling.c fpu_test_coupling.c fpu_test_coupling.c --- TestFUCouplingEnd. TestFUCouplingEnd. TestFUCouplingEnd. --- TestFUCouplingStart_A. TestFUCouplingStart_A. TestFUCouplingStart_A. --- TestFUCouplingStart_B. TestFUCouplingStart_B. TestFUCouplingStart_B. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingStart_A.as TestGRsCouplingStart_B.as TestGRsCouplingStart_A.as TestGRsCouplingStart_B.as --- TestFUCouplingS0_S3_A.as --- TestFUCouplingS0_S3_B.as --- TestFUCouplingS4_S7_A.as TestGRsCouplingStart_A.as TestGRsCouplingStart_B.as TestFUCouplingS0_S3_A.as TestFUCouplingS0_S3_B.as TestFUCouplingS4_S7_A.as TestGRsCouplingStart_A.as TestGRsCouplingStart_B.as TestFUCouplingS0_S3_A.as TestFUCouplingS0_S3_B.as TestFUCouplingS4_S7_A.as rüfbericht Nr. age 2

3 rüf- und Zertifizierungsinstitut GbH / --- TestFUCouplingS4_S7_B.as --- TestFUCouplingS8_S11_A.a s --- TestFUCouplingS8_S11_B.a s --- TestFUCouplingS12_S15_A. --- TestFUCouplingS12_S15_B. --- TestFUCouplingS16_S19_A. --- TestFUCouplingS16_S19_B. --- TestFUCouplingS20_S23_A. --- TestFUCouplingS20_S23_B. --- TestFUCouplingS24_S27_A. --- TestFUCouplingS24_S27_B. --- TestFUCouplingS28_S31_A. --- TestFUCouplingS28_S31_B. TestFUCouplingS4_S7_B.as TestFUCouplingS8_S11_A.a s TestFUCouplingS8_S11_B.a s TestFUCouplingS12_S15_A. TestFUCouplingS12_S15_B. TestFUCouplingS16_S19_A. TestFUCouplingS16_S19_B. TestFUCouplingS20_S23_A. TestFUCouplingS20_S23_B. TestFUCouplingS24_S27_A. TestFUCouplingS24_S27_B. TestFUCouplingS28_S31_A. TestFUCouplingS28_S31_B. TestFUCouplingS4_S7_B.as TestFUCouplingS8_S11_A. TestFUCouplingS8_S11_B. TestFUCouplingS12_S15_A. TestFUCouplingS12_S15_B. TestFUCouplingS16_S19_A. TestFUCouplingS16_S19_B. TestFUCouplingS20_S23_A. TestFUCouplingS20_S23_B. TestFUCouplingS24_S27_A. TestFUCouplingS24_S27_B. TestFUCouplingS28_S31_A. TestFUCouplingS28_S31_B. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_B. TestGRsCouplingR0_B. TestGRsCouplingR0_B. TestGRsCouplingR0_B. rüfbericht Nr. age 3

4 rüf- und Zertifizierungsinstitut GbH / TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_B. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_B. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_B. TestGRsCouplingR10_R12_ A. TestGRsCouplingR10_R12_ B. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_B. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_B. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_B. TestGRsCouplingR10_R12_ A. TestGRsCouplingR10_R12_ B. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_B. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_B. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_B. TestGRsCouplingR10_R12_ A. TestGRsCouplingR10_R12_ B. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_B. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_B. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_B. TestGRsCouplingR10_R12_ A. TestGRsCouplingR10_R12_ B. clock_onitor.c clock_onitor.c clock_onitor.c clock_onitor.c crc.c crc.c crc.c crc.c CRC_Verify.c CRC_Verify.c CRC_Verify.c CRC_Verify.c ratest_arch_c.c ratest_arch_c.c ratest_arch_c.c ratest_arch_c.c ratest_arch_c_hw.c ratest_arch_c_hw.c ratest_arch_c_hw.c ratest_arch_c_hw.c ratest_arch_hw.c ratest_arch_hw.c ratest_arch_hw.c ratest_arch_hw.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c ratest_stack.c ratest_stack.c ratest_stack.c ratest_stack.c test_adc14.c test_adc14.c test_adc12.c test_adc12.c rüfbericht Nr. age 4

5 rüf- und Zertifizierungsinstitut GbH / Suppleentary Inforation: If existing the executable code in files for each type icro controller are identically. Differences are related to coends only. The routines for S7 had been tested under file reference / Retesting for additional types icro controllers not needed. Beessungsdaten Ratings... : rüfbericht Nr. age 5

6

7 rüf- und Zertifizierungsinstitut GbH / Ugebungsbedingungen (falls relevant) Environental conditions (if applicable) Ugebungsteperatur Abient teperature Atosphärischer Druck Atospheric pressure Relative Luftfeuchtigkeit Relative huidity Nennwert / Rated values... : C ha % Überprüfter Wert / Verified values... : Bereich bestätigt : Deutscher Wetterdienst Range confired by: Deutscher Wetterdienst (Meteorological service) rüfbericht Nr. age 7

8 rüf- und Zertifizierungsinstitut GbH / Durchgeführte rüfungen / erfored tests Abschnitt Clause R rüfanforderungen / Requireent + Test ANNEX R (NORMATIVE) SOFTWARE EVALUATION IEC :2010 rograable electronic circuits requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2 validated in accordance with the requireents this annex Ergebnis Anerkung Result Reark Beurteilung Verdict R.1 rograable electronic circuits using stware rograable electronic circuits requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2 constructed so that the stware does not ipair copliance with the requireents this standard R.2 Requireents for the architecture R rograable electronic circuits requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2 use easures to control and avoid stware-related faults/errors in safety-related data and safety-related segents the stware rograable electronic circuits requiring stware incorporating easures to control the fault/error conditions specified in table R.2 have one the following structures: - single channel with periodic self-test and onitoring - dual channel (hoogenous) with coparison - dual channel (diverse) with coparison rograable electronic circuits requiring stware incorporating easures to control the fault/error conditions specified in table R.1 have one the following structures: - single channel with functional test - single channel with periodic self-test - dual channel without coparison R.2.2 Measures to control faults/errors R When redundant eory with coparison is provided on two areas the sae coponent, the data in one area is stored in a different forat fro that in the other area rüfbericht Nr. age 8

9 rüf- und Zertifizierungsinstitut GbH / R R R R R rograable electronic circuits with functions requiring stware incorporating easures to control the fault/error conditions specified in table R.2 and that use dual channel structures with coparison, have additional fault/error detection eans for any fault/errors not detected by the coparison For prograable electronic circuits with functions requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2, eans are provided for the recognition and control errors in transissions to external safety-related data paths For prograable electronic circuits with functions requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2, the prograable electronic circuits incorporate easures to address the fault/errors in safety-related segents and data indicated in table R.1 and R.2 as appropriate For prograable electronic circuits with functions requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2, detection a fault/error occur before copliance with clause 19 is ipaired The stware is referenced to relevant parts the operating sequence and the associated hardware functions R Labels used for eory locations are unique R R The stware is protected fro user alteration safety-related segents and data Stware and safety-related hardware under its control is initialized and terinates before copliance with clause 19 is ipaired R.3 Measures to avoid errors R.3.1 General For prograable electronic circuits with functions requiring stware incorporating easures to control the fault/error conditions specified in table R.1 or R.2, the following easures to avoid systeatic fault in the stware are applied Stware that incorporates easures used to control the fault/error conditions specified in table R.2 is inherently acceptable for stware required to control the fault/error conditions specified in table R.1 R.3.2 Specification R Stware safety requireents: Stware Id: see table Type references The specification the stware safety requireents includes the descriptions listed rüfbericht Nr. age 9

10 rüf- und Zertifizierungsinstitut GbH / R Stware architecture R The specification the stware architecture includes the aspects listed - techniques and easures to control stware faults/errors (refer to R.2.2); Docuent ref. No: Available on request at anufacturer - interactions between hardware and stware; - partitioning into odules and their allocation to the specified safety functions; - hierarchy and call structure the odules (control flow); - interrupt handling; - data flow and restrictions on data access; - architecture and storage data; - tie-based dependencies sequences and data R The architecture specification is validated against the specification the stware safety requireents by static analysis R Module design and coding R Based on the architecture design, stware is suitably refined into odules Stware odule design and coding is ipleented in a way that is traceable to the stware architecture and requireents R Stware code is structured R Coded stware is validated against the odule specification by static analysis The odule specification is validated against the architecture specification by static analysis R Stware validation The stware is validated with reference to the requireents the stware safety requireents specification Copliance is checked by siulation : - input signals present during noral operation Self-diagnostic routine only - anticipated occurrences - undesired conditions requiring syste action rüfbericht Nr. age 10

11 rüf- und Zertifizierungsinstitut GbH / TABLE R.1 e GENERAL FAULT/ERROR CONDITIONS Coponent a Fault/error Acceptable easures b, c Definitions Docuent reference for applied easure Docuent reference for applied test Ver-di ct 1 CU 1.1 Registers Stuck at Functional test, or periodic self-test using either: - static eory test, or H H Docuentation available on request at anufacturer - word protection with single bit redundancy H H rograe counter Stuck at Functional test, or eriodic self-test, or Independent tie-slot onitoring, or H H H Logical onitoring the prograe sequence H Interrupt handling and execution No interrupt or too frequent interrupt Functional test, or tie-slot onitoring H H Clock Wrong frequency (for quartz synchroniz ed clock: haronics/ sub-haro nics only) Frequency onitoring, or tie slot onitoring H H Docuentation available on request at anufacturer 4. Meory 4.1 Invariable eory All single bit faults eriodic odified checksu, or ultiple checksu, or H H Docuentation available on request at anufacturer word protection with single bit redundancy H Variable eory DC fault eriodic static eory test, or word protection with single bit redundancy H H Docuentation available on request at anufacturer 4.3 Addressing (relevant to variable and invariable eory) Stuck at Word protection with single bit redundancy including the address H Covered by 1.1; 3; 4.1; Internal data path rüfbericht Nr. age 11

12 rüf- und Zertifizierungsinstitut GbH / 5.1 Data Stuck at Word protection with single bit redundancy H Addressing Wrong address Word protection with single bit redundancy including the address H External counication 6.1 Data Haing distance 3 Word protection with ulti-bit redundancy, or H CRC single work, or H Transfer redundancy, or H rotocol test H Tiing Wrong point in tie Tie-slot onitoring, or scheduled transission Tie-slot and logical onitoring, or H H H coparison redundant counication channels by either: - reciprocal coparison H independent hardware coparator H Wrong sequence Logical onitoring, or tie-slot onitoring, or H H Scheduled transission H Input/output periphery 7.1 Digital I/O Fault conditions specified in lausibility check H Analog I/O A/D and D/Aconverter Fault conditions specified in lausibility check H Docuentation available on request at anufacturer Analog ultiplexer 9 Custo chips d e.g. ASIC, GAL, gate array Wrong addressing Any output outside the static and dynaic functional specificatio n lausibility check H eriodic self-test H NOTE A Stuck-at fault odel denotes a fault odel representing an open circuit or a non-varying signal level. A DC fault odel denotes a stuck-at fault odel incorporating short circuit between signal lines. rüfbericht Nr. age 12

13 rüf- und Zertifizierungsinstitut GbH / a) For fault/error assessent, soe coponents are divided into their sub-functions. b) For each sub-function in the table, the Table R.2 easure will cover the stware fault/error. c) Where ore than one easure is given for a sub-function, these are alternatives. d) To be divided as necessary by the anufacturer into sub-functions. e) Table R.1 is applied according to the requireents R.1 to R inclusive. Suppleentary inforation: */* To 1.1 Registers: The routines include stuck-at and coupling failure detection. The user can set stuck-at detection only or stuck plus coupling failure detection. To 1.3 rogra Counter In the routines for register test 1.1 a sall routine for testing progra counter is integrated. This routine does not cover copletely the requireent standard. It is a support for easures referenced in the table above. Additional easures Details Reference Verdict Watch Dog test Fail Trigger and Rest Source Monitoring Docuentation available on request at anufacturer Stack ointer Register and Stack Meory Test Write-read-verify with pattern for register and March-C for eory Additional hardware features rotection Reference Verdict Ra parity error detection Stuck at or illegal odification - any access to undefined eory - write access to invariable Invalid eory access detection eory (ROM) function - instruction fetch fro special predefined eory areas Window Watch dog with independent clock ort Output Enable On Chip Teperature Voltage Monitoring - Loss clock the arithetic logical unit (ALU) or the coplete icro controller - peranent execution an undefined endless loop - peranent undefined code execution ( runaway stware ) - tie slot onitoring Set WM outputs to High- Ipedance when failure is indicated fro external or detected by stware Over Teperature for Silicon Device Under voltage detection to avoid unstable operation Docuentation available on request at anufacturer rüfbericht Nr. age 13

14 rüf- und Zertifizierungsinstitut GbH / IEC :2010 Clause Requireent + Test Result - Reark Verdict H.6 Classification, additions H.6.18 Class control function (A, B,C)... H.7 Inforation in addition to Table 1 provided: 66 - Stware sequence docuentation; clause: H ; ethod: X rogra docuentation; clause: H , H ; ethod: X Stware fault analysis; clause: H.11.12, H ; ethod: X Stware class(es) and structure; clause: H , H , H , H ; ethod: D Analytical easures and fault/error control techniques eployed; clause: H , H , H ; ethod: X Stware fault/error detection tie(s) for controls with stware Classes B or C; clause: H , H ; ethod: X Control response(s) in case detected fault/error; clause: H ; ethod: X Maxiu nuber reset actions within a tie period; clause H , H ; ethod: D Nuber reote reset actions; clause H ; ethod: X... Controls with stware classes B or C had inforation provided for safety-related segents the stware. Inforation on the non-safety B related segents was sufficient to establish that they did not influence safety-related segents... n Stware sequence was docuented and, together with the operating sequence, included a description the control syste philosophy, the control flow, data flow and the tiings... rüfbericht Nr. age 14

15 rüf- und Zertifizierungsinstitut GbH / o - Safety-related data and safety-related segents the stware sequence, the alfunction which could result in noncopliance with the requireents Clauses 17, 25, and 27, are identified... Included the operating sequence... Stware fault analysis was related to the hardware fault analysis in Clause H q - rograing docuentation was supplied in a prograing design language declared by the anufacturer... r Different stware classes applied to different control functions... s - Measures declared are chosen by anufacturer fro the requireents Clauses H to H inclusive... H.11 Constructional requireents H Controls using stware Controls using stware were so constructed that the stware did not ipair control copliance with the requireents this standard H Requireents for the architecture H Control functions with stware class B or C use easures to control and avoid stware-related faults/errors in safety-related data and safetyrelated segents the stware, as detailed in H to H inclusive B H Control functions with stware class C have one the following structures: single channel with periodic self-test and onitoring (H ) dual channel (hoogenous) with coparison (H ) dual channel (diverse) with coparison (H ) Control functions with stware class B have one the following structures: single channel with functional test (H ) single channel with periodic self-test (H ) rüfbericht Nr. age 15

16 rüf- und Zertifizierungsinstitut GbH / dual channel without coparison (H ) H Other structure peritted with equivalent level safety to those in H H Measures to control faults/errors H H H H H Redundant eory with coparison provided on two areas the sae coponent: data stored in different forats Stware class C using dual channel structures with coparison: additional fault/error detection eans Stware class B or C: eans for recognition and control errors in transission to external safety-related data paths: Means took into account errors data, addressing, transission tiing and sequence protocol Stware class B or C: within the control, easures are taken to address the fault/errors in safety-related segents and data indicated in Table H.1 and identified in Table 1 requireent 68. Measures others than those specified in H utilized to satisfy the requireents listed in Table H.1 H H Stware fault/error detection: occur not later than declared tie(s), Table 1, requireent 71 acceptability declared tie(s): evaluated during fault analysis the control For controls with functions, classified as Class B or C, detection fault/error: results in the response declared in Table 1, requireent 72 for Class C: independent eans capable perforing this response provided H Class C, dual channel structure, loss dual channel capability: deeed to be an error H Stware referenced: rüfbericht Nr. age 16

17 rüf- und Zertifizierungsinstitut GbH / to relevant parts the operating sequence to the associated hardware functions H Labels used for eory locations are unique H H Stware protected fro user alteration safetyrelated segents and data Stware and safety-related hardware under its control is initialized to and terinates at a declared state, Table 1, requireent H Measures to avoid errors 1 For controls with stware class B or C the easures shown in Figure H.1 to avoid systeatic faults are applied Other ethods utilized that incorporate disciplined and structured processes including design and test phases Specification Stware safety requireents The specification the stware safety requireents includes: A description each safety related function to be ipleented, including its response tie(s): - functions related to the application including their related stware classes - functions related to the detection, annunciation and anageent stware or hardware faults A description interfaces between stware and hardware A description interfaces between any safety and non-safety related functions Stware architecture The description stware architecture include the following aspects: Techniques and easures to control stware faults/errors (refer to H ) rüfbericht Nr. age 17

18 rüf- und Zertifizierungsinstitut GbH / Interactions between hardware and stware artitioning into odules and their allocation to the specified safety functions Hierarchy and call structure the odules (control flow) Interrupt handling Data flow and restrictions on data access Architecture and storage data Tie based dependencies sequences and data The architecture specification is verified against the specification the stware safety requireents by static analysis 2.3 Module design and coding Stware is suitably refined into odules. Stware odule design and coding are ipleented in a way that is traceable to the stware architecture and requireents. The odule design specified: function(s) interfaces to other odules data Stware code is structured Coded stware is verified against the odule specification, and the odule specification is verified against the architecture specification by static analysis 2.4 Design and coding standards rogra design and coding standards is used during stware design and aintenance Coding standards : specified prograing practice proscribed unsafe language features rüfbericht Nr. age 18

19 rüf- und Zertifizierungsinstitut GbH / specify procedures for source code docuentation specify data naing conventions Testing Module design (stware syste design, stware odule design and coding) A test concept with suitable test cases is defined based on the odule design specification. Each stware odule is tested as specified within the test concept Test cases, test data and test results are docuented Code verification a stware odule by static eans includes such techniques as stware inspections, walk-throughs, static analysis and foral pro Code verification a stware odule by dynaic eans includes functional testing, white-box testing and statistical testing 3.2 Stware integration testing A test concept with suitable test cases is defined based on the architecture design specification The stware is tested as specified within the test concept Test cases, test data and test results are docuented 3.3 Stware validation A validation concept with suitable test cases is defined based on the stware safety requireents specification The stware is validated with reference to the requireents the stware safety requireents specification as specified within the validation concept The stware is exercised by siulation or stiulation : rüfbericht Nr. age 19

20 rüf- und Zertifizierungsinstitut GbH / input signals present during noral operation anticipated occurrences undesired conditions requiring syste action Test cases, test data and test results are docuented 4 Other Ites Equipent used for stware design, verification and aintenance was qualified appropriately and deonstrated to be suitable for purpose in anifold applications Manageent stware versions: All versions are uniquely identified for traceability 4.3 Stware odification Stware odifications are based on a odification request which details the following: the hazards which ay be affected the proposed change the reasons for change An analysis is carried out to deterine the ipact the proposed odification on functional safety. A detailed specification for the odification is generated including the necessary activities for verification and validation, such as a definition suitable test cases The odification is carried out as planned The assessent the odification is carried out based on the specified verification and validation activities. All details odification activities are docuented For class C control functions: One the cobinations (a p) analytical easures given in the coluns table H.9 is used during hardware developent... rüfbericht Nr. age 20

21 rüf- und Zertifizierungsinstitut GbH / H Reotely actuated control functions H H H Data Exchange General Reotely actuated control functions are connected to separate, independent devices, which ay theselves contain control functions or provide other inforation and any data exchange between these devices does not coproise the integrity class B control function or class C control function. Type data - Message types for data exchange in a control function or functions are allocated to class A control function, class B control function or class C control function. The safety or protective relevance or influence, essage types or data exchange are allocated only to class B control function or class C control functions, see Table H.10. Counication Safety Related Data Transission Safety relevant data is transitted authentically concerning: data corruption address corruption wrong tiing or sequence Data variation or corrupted data did not lead to an unsafe state Before transitted data was used it was ensured that data corruption, address corruption and wrong tiing or sequence are addressed using the easures as given in Annex H. The following failure odes are addressed: peranent auto-sending or repetition, interruption data transfer H Access to data exchange - All types access to class B control function or class C control function related data exchange systes is clearly restricted Adequate hardware/stware easures are taken to ensure no unauthorized access to the control functions (class B and C; operating data, configuration paraeters and/or stware odules) rüfbericht Nr. age 21

22 rüf- und Zertifizierungsinstitut GbH / H H H For class B and class C stware revisions the requireents H and hardware configuration anageent are applied and the control aintains its protective functions Reotely actuated control function operation have the duration or liits set before switching on except when autoatic switching f is realized at the end a cycle or the syste is designed for peranent operation. riority reotely actuated control functions over control functions does not lead to a hazardous condition. H Reote reset action is anually initiated. Reset functionality initiated by a hand-held device required at least two anual actions to activate H Reset functions are capable resetting the syste as intended H Unintended resets fro safe state do not occur. H H H Any fault the reset function does not cause the control or controlled function to result in a hazardous condition, and was evaluated for its Class B classification For reset functions initiated by anual action not in visible sight the appliance, the following additional requireents apply: the actual status and relevant inforation the process under control is visible to the user before, during and after the reset action; the axiu nuber reset actions within a tie period is declared. Following this, any further reset is denied unless the appliance is physically checked... The reset function is evaluated on the final application. Manual switching a therostat or device with siilar function that activates a reset is declared by the anufacturer and is suitable in the final application... rüfbericht Nr. age 22

23 rüf- und Zertifizierungsinstitut GbH / Ergänzende Inforation / Suppleentary inforation: The self-diagnostic routines entioned under I are foreseen for following easures table R.1 / H.1. S1 File Nae S3 File Nae S5 File Nae S7 File Nae Measure cpu_test.c cpu_test.c cpu_test.c cpu_test.c CU_Test_Control. CU_Test_Control. CU_Test_Control. CU_Test_Control. cpu_test_coupling.c cpu_test_coupling.c cpu_test_coupling.c cpu_test_coupling.c CU_Test_General_High. CU_Test_General_High. CU_Test_General_High. CU_Test_General_High. CU_Test_General_Low. CU_Test_General_Low. CU_Test_General_Low. CU_Test_General_Low. fpu_control. fpu_control. fpu_control. fpu_exten. fpu_exten. fpu_exten. fpu_test_coupling.c fpu_test_coupling.c fpu_test_coupling.c TestFUCouplingEnd. TestFUCouplingEnd. TestFUCouplingEnd. TestFUCouplingStart_A. TestFUCouplingStart_A. TestFUCouplingStart_A. TestFUCouplingStart_B. TestFUCouplingStart_B. TestFUCouplingStart_B. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingEnd. TestGRsCouplingStart_A. TestGRsCouplingStart_A. TestGRsCouplingStart_A. TestGRsCouplingStart_A. TestGRsCouplingStart_B. TestGRsCouplingStart_B. TestGRsCouplingStart_B. TestGRsCouplingStart_B. TestFUCouplingS0_S3_A. TestFUCouplingS0_S3_A. TestFUCouplingS0_S3_A. TestFUCouplingS0_S3_B. TestFUCouplingS0_S3_B. TestFUCouplingS0_S3_B. TestFUCouplingS4_S7_A. TestFUCouplingS4_S7_A. TestFUCouplingS4_S7_A. TestFUCouplingS4_S7_B. TestFUCouplingS4_S7_B. TestFUCouplingS4_S7_B. TestFUCouplingS8_S11_A. TestFUCouplingS8_S11_A. TestFUCouplingS8_S11_A. TestFUCouplingS8_S11_B. TestFUCouplingS8_S11_B. TestFUCouplingS8_S11_B. 1.1 CU Register rüfbericht Nr. age 23

24 rüf- und Zertifizierungsinstitut GbH / TestFUCouplingS12_S15_A. TestFUCouplingS12_S15_A. TestFUCouplingS12_S15_A. TestFUCouplingS12_S15_B. TestFUCouplingS12_S15_B. TestFUCouplingS12_S15_B. TestFUCouplingS16_S19_A. TestFUCouplingS16_S19_A. TestFUCouplingS16_S19_A. TestFUCouplingS16_S19_B. TestFUCouplingS16_S19_B. TestFUCouplingS16_S19_B. TestFUCouplingS20_S23_A. TestFUCouplingS20_S23_A. TestFUCouplingS20_S23_A. TestFUCouplingS20_S23_B. TestFUCouplingS20_S23_B. TestFUCouplingS20_S23_B. TestFUCouplingS24_S27_A. TestFUCouplingS24_S27_A. TestFUCouplingS24_S27_A. TestFUCouplingS24_S27_B. TestFUCouplingS24_S27_B. TestFUCouplingS24_S27_B. TestFUCouplingS28_S31_A. TestFUCouplingS28_S31_A. TestFUCouplingS28_S31_A. TestFUCouplingS28_S31_B. TestFUCouplingS28_S31_B. TestFUCouplingS28_S31_B. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_A. TestGRsCouplingR0_B. TestGRsCouplingR0_B. TestGRsCouplingR0_B. TestGRsCouplingR0_B. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_A. TestGRsCouplingR1_R3_B. TestGRsCouplingR1_R3_B. TestGRsCouplingR1_R3_B. TestGRsCouplingR1_R3_B. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_A. TestGRsCouplingR4_R6_B. TestGRsCouplingR4_R6_B. TestGRsCouplingR4_R6_B. TestGRsCouplingR4_R6_B. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_A. TestGRsCouplingR7_R9_B. TestGRsCouplingR7_R9_B. TestGRsCouplingR7_R9_B. TestGRsCouplingR7_R9_B. TestGRsCouplingR10_R12_A. TestGRsCouplingR10_R12_A. TestGRsCouplingR10_R12_A. TestGRsCouplingR10_R12_A. TestGRsCouplingR10_R12_B. TestGRsCouplingR10_R12_B. TestGRsCouplingR10_R12_B. TestGRsCouplingR10_R12_B. clock_onitor.c clock_onitor.c clock_onitor.c clock_onitor.c 3. Clock crc.c crc.c crc.c crc.c 4.1 CRC_Verify.c CRC_Verify.c CRC_Verify.c CRC_Verify.c invariable eory rüfbericht Nr. age 24

25 rüf- und Zertifizierungsinstitut GbH / ratest_arch_c.c ratest_arch_c.c ratest_arch_c.c ratest_arch_c.c 4.2 ratest_arch_c_hw.c ratest_arch_c_hw.c ratest_arch_c_hw.c ratest_arch_c_hw.c variable eory ratest_arch_hw.c ratest_arch_hw.c ratest_arch_hw.c ratest_arch_hw.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c ratest_arch_x_wo_hw.c test_adc14.c test_adc14.c test_adc12.c test_adc12.c A/Dand D/Aconverter rüfbericht Nr. age 25

26 rüf- und Zertifizierungsinstitut GbH / Fotodokuentation / hoto docuentation: Test Setup for S7 (setup for S1; S3 and S5 nearly equal) rüf- und Messittel / Testing and easuring equipent: for S7 (tools for S1; S3 and S5 nearly equal) Editor: IAR Ebedded Workbenchfor ARM, v IAR Ebedded Workbench Coon Coponents, v. 7.2 Copiler/Linker: IAR Ebedded Workbenchfor ARM, v IAR Ebedded Workbench Coon Coponents, v. 7.2 Debugger: IAR Ebedded Workbenchfor ARM, v IAR Ebedded Workbench Coon Coponents, v. 7.2 Hardware: Renesas DK-S7G2 Developent Kit for Synergy S7 Messunsicherheit (optional nach Abschnitt c der IEC 17025) Uncertainty easureent (optional according to sub-clause c IEC 17025): END OF TEST REORT rüfbericht Nr. age