Is there a simple way to prevent that the STM32F0 is supplied parasitic through the protection diodes of the GPIOs? The device seems not to provide a brownout reset circuit, or am I wrong?

[GTelk]

We use a STM32F0 in an application with increased safety requirements. The power supply is secured by a simple fuse and we have to assure that the STM32F0 is in reset state when the fuse is blown (EN60335).

Since we have a second power supply in the system, the STM32F0 might be supplied by energy passing the protection diodes of the GPIOs, if these GPIOs are connected to devices supplied by the second power supply. The STM32F0 might work even if the fuse is blown in these cases.

Ok, we could place resistors in every signal connected to the STM32F0, limiting the current. But is there a simpler solution? As far as I see the device does not have a brownout detection...?

[Tesla DeLorean]

>>As far as I see the device does not have a brownout detection...?

Well there's that and the fact the device can be probably function at below 1.2V

Surely what you want is a POR circuit on the supply side, and behind a diode, that clamps reset low, up to a very high threshold voltage

[GTelk]

It seems that there is nothing helpful "on chip", e.g. a brownout reset circuit or a separate input, to be used for an undervoltage lockout - or am I wrong?

[Tesla DeLorean]

Not a part I'm actively using...

I always use external POR circuits on synchronous/clocked designs, creates less dependencies and failures.

No, I think you're going to have to design in "safety" outside of the CPU, probably want an external watchdog too.

[LMI2]

There are chips which guard or check if power supplies are allright. But I don't what those chips are called. Some modern gate or buffers do that too.

[Uwe Bonnes]

In my understanding, FT tolerant pins can be powered up to about 4 Volt with VDD =0. They will not backpaoer the MCU. Does your design only use fully tolerant between the powered device and the MCU?

[GTelk]

No, unfortunately we need ADC inputs also to be connected to the second power supply, and as far as I see Pins with an ADC option are not Fault Tolerant...

[Uwe Bonnes]

Fault tolerant is a nice translation for "FT" pins, but the data sheey says "5 V tolerant I/O". I looked at the L412 and it has FT ADC pins. Probably before deep sleep these pins need to be set appropriate.

[MikeDB]

Do you really need an STM32 ? This sort of thing is built into the latest Atmel xTINYs and xMEGAs

[Uwe Bonnes]

<MCU wars on> Tell me any Tiny that runs at full speed at 3.3Volt or any X-Mega that has 5 Volt tolerant pins </MCU wars off>

[MikeDB]

ATTINY414 would be a good start. And it hardly sounds like the OP is pushing the performance envelope in any case. But it does have all the things the OP is asking for.

[Ozone]

Working with safety-related SW, I am pretty sure "FT" in ST's datasheets means NOT "fault tolerant".

And no STM32 GPIO tolerates 5V in analog mode.

To contribute to the MCU wars, there are some vendors that have Cortex M working with 5V VDD. Like Spansion/Cypress devices.

[Jeroen3]

The simplest way to force the chip in reset is to keep power on the chip, and use a voltage monitor on the fused line to pull reset low.

There is no way from inside to the chip to prevent it being powered from it's diodes. Even the POR won't work reliably, since power is unpredictable.

This should have been mitigated in circuit design stage already. Either with resistors or gates.

As bugfix you could load the outside Vdd net so the voltage drop over the diodes is to high for the chip to turn on. This probably goes over current spec.

[GTelk]

Thank you all for the helpful hints!

I agree now that we need to add some external components to ensure that the STM32F0 is in reset state when the fuse is blown.