Skip to main content

NXP S32K3 Family

Corellium Atlas provides models of NXP S32K3 family SoCs with specific focus on the S32K388 and a board model for the NXP S32K3X8EVB-Q289 board with S32K358 SoC.

SoC Variations​

NXP described the S32K3 family as:

"The S32K3 Family of 32-bit microcontrollers (MCUs) offers Arm® Cortex®-M7-based MCUs in single, dual and lockstep core configurations. S32K3 Family offers scalability in number of cores, memory and peripherals, ensuring high-performance and functional safety compliant with ISO 26262 up to ASIL D."

While not all configurations of part number and single and lockstep core options are included in default availability any combination can be provided in in a reasonable timely manner. Currently the following configurations have been assembled if not made generally available: S32K310, S32K311, S32K312, S32K314, S32K322, S32K324, S32K328, S32K338, S32K341, S32K342, S32K344, S32K348, S32K358, S32K388. This can be summarized as S32K3x[01248], note that this explicitly excludes the S32K3x6, S32K36x, S32K7x, S32K39x, and S32K389 which have not been evaluated for coverage.

Board Details​

All SoC variants have been configured as a "bare" SoC meaning they have minimal external devices available, primarily RAM and boot storage. I/O pins are connected to CoreModel interfaces and UARTs are available via console but other external deices are not present. In most cases many bare metal executables will work.

Additionally the S32K338, S32K348, S32K358, and S32K388 are available on a model of the 3X8EVB-Q289 board which NXP described as:

The S32K3X8EVB-Q289 is an evaluation and development board for general-purpose automotive and industrial applications.

Again all external supported I/O connections are available via CoreModel interfaces.

Testing and Limitations​

With the exception of the following limitations section the functionality of NXP's S32K3xx Reference Manual Document identifier: S32K3XXRM Rev. 11, 2025-07-11 are believed implemented. Testing status is included below.

System Level Testing​

  • Test cases that pass out of the box
    • Can_Example_S32K358
    • Crc_Example_S32K358
    • Dio_Example_S32K358
    • Dma_Ip_DmaTransfer_S32K358
    • Crypto_SymmetricPrimitives_S32K358
    • Eth_InternalLoopback_S32K358
    • Gmac_Ip_InternalLoopback_S32K358
    • Gpt_Example_S32K358
    • Icu_BlinkLed_ASR_Emios_S32K358
    • Lcu_Ip_LcuControlMotor_S32K358
    • Pit_Gpt_Ip_Example_S32K358
    • Rm_DMAUX_Example_S32K358
    • SBCFS26 Example IP S32K358
    • Siul2_Dio_Ip_Example_S32K358
    • Wdg_Example_S32K358
  • Test casts that pass with minor modifications
    • Emios_Icu_Ip_BlinkLed_S32K358 - requires CoreModel connections for external diodes and jumpers
    • UART_Example_S32K358 - required changes to skip FlexIO (see limitations below), LPUART works
    • Usdhc_Ip_Example_S32K358 - requires fixes to hardcoded assumptions (SDCARD vs eMMC)
  • Test cases where subsets pass
    • Crypto_CmacCtr_KeyGenBD_S32K358 - Test not compatible with current HSE_B firmware, subset that match work
    • OCU example S32K358 - EMIOS Single action output compare (SAOC) model tested
    • Platform_MPU_IP_Example_S32K358 - not all expected failures actually fail, test does not catch
    • S32K3XX_demo_app - HSE Tests: Mode 2 works, model 1 partial support as Trace32 is not connected to program ADKP, other models not fully tested functionality outside of SHE is not implemented
  • Test cases that appear defective
    • Fee_Example_S32K358 - Test does not properly Initialize S32K, appear to expect other prior setup that is not documented
  • Tests that cover only known limitations
    • Adc_example_S32K358 - ADC not implemented
    • I2C_HLD_FLEXIO_Transfer_S32K358 - FLEXIO not implemented
    • Lin_Ip_FrameTransfer_S32K358 - Does not signal any errors, however it should be testing LIN over FlexIO which is a limitation

Functional Units with Documented Limitations​

  • Modules where functionality is not visible at this level of abstraction

    • AIPS_Lite - functionality is below abstraction level
    • Arm Cortex-M7 LS - Lock Step functionality is abstracted out and no checker core is instantiated in platform
    • AXBS - Crossbar Switch - functionality is below abstraction level, interface implemented as register stub
    • TSPC - TouchSensing PIN - functionality is below abstraction level, register stub
    • XBIC - Crossbar Integrity Checker - functionality is below abstraction level, register Stub

  • Modules intentionally unimplemented. Interfaces fully functional but has no effect

    • JDC - JTAG Data Communication - JTAG system will report operation without error though no data transport will be implemented as equivalent functionality is implemented via GDB-Remote protocol tested in both GDB and Trace32
    • JTAGC - JTAG Controller - JTAG system will report operation without error though no data transport will be implemented as equivalent functionality is implemented via GDB-Remote protocol tested in both GDB and Trace32
    • MC_PCU - Power Control Unit - Implemented as registers + state machines necessary to indicate correct operation
    • PMC - Power Management Controller - Implemented as registers + state machines necessary to indicate correct operation
    • SELFTEST_GPR - Self-test General-Purpose Registers - Implemented as read write registers with no effect on other units
    • STCU2 - Self-Test Control Unit - Implemented as read write registers with no effect on other units
    • WKPU - Wakeup Unit - Implemented as registers + state machines necessary to indicate correct operation

  • Modules with specific known limitations

    • HSE_B - Hardware Security Engine - The subset supporting AutoSAR SHE (Secure Hardware Extension R22-11, Document 948) fully implemented, NXP DemoApp passes, secure boot is not supported, other aspects partial
    • MC_ME - Mode Entry Module - Partially implemented, cpu core enable/disable implemented, clock disable only implemented for peripherals with explicit notions of time
    • MC_RGM - Reset Generation Module - CPU reset implemented. Domain and peripheral resets non-functional
    • SAI - Synchronous Audio Interface - Implemented as file I/O rather than as pass through to the host

  • Modules not implemented

    • AES_ACCEL - AES Accelerator - No public documentation or test cases
    • VIRT_WRAPPER - Virtualization Wrapper - Use model unclear
    • PCMC - Power Conversion and Motor Control - Exclusively part of the S32K3x6

  • Implementation in progress

    • ADC - Analog-to-Digital Converter - Registers implemented, plan to supply values via an API that uses floating point values in engineering units
    • eMIOS - Enhanced Modular IO Subsystem - GPIO and Upcounters implemented, other modes of eMIOS will be supported as fixed I/O interfaces rather than as a programmable unit once use cases are defined
    • LPCMP - Low Power Comparator - Registers implemented, plan to supply values via an API that uses floating point values in engineering units
    • TempSense - Temperature Sensor - Registers implemented, plan to supply values via an API that uses floating point values in engineering units

  • Planned implementations

    • EIM - Error Injection Module - To be Implemented as read write registers with no effect on other units other than the ERM
    • ERM - Error Reporting Module - To be Implemented as registers with values supplied via an API to trigger error reporting and set status registers
    • FlexIO Model - Flexible I/O - To be implemented as fixed I/O interfaces rather than as a programmable unit once use case is defined
    • LCU - Logic Control Unit - To be implemented to reflect configuration of programmable units but not support update

Note modules where all tests pass and NXP system level testing appears complete are not listed

Firmware​

The model is supplied with a simple UART counter demo that prints an incrementing 2 digit integer counter to the console.