SLVSDJ1A July   2016  – May 2017 TPS65381A-Q1

PRODUCTION DATA.  

  1. Device Overview
    1. 1.1 Features
    2. 1.2 Applications
    3. 1.3 Description
    4. 1.4 Typical Application Diagram
  2. Revision History
  3. Pin Configuration and Functions
  4. Specifications
    1. 4.1 Absolute Maximum Ratings
    2. 4.2 ESD Ratings
    3. 4.3 Recommended Operating Conditions
    4. 4.4 Thermal Information
    5. 4.5 Electrical Characteristics
    6. 4.6 Timing Requirements
    7. 4.7 Switching Characteristics
    8. 4.8 Typical Characteristics
  5. Detailed Description
    1. 5.1 Overview
    2. 5.2 Functional Block Diagram
    3. 5.3 Feature Description
      1. 5.3.1 VDD6 Buck Switch-Mode Power Supply
      2. 5.3.2 VDD5 Linear Regulator
      3. 5.3.3 VDD3/5 Linear Regulator
      4. 5.3.4 VDD1 Linear Regulator
      5. 5.3.5 VSOUT1 Linear Regulator
      6. 5.3.6 Charge Pump
      7. 5.3.7 Wake-Up
      8. 5.3.8 Reset Extension
    4. 5.4 Device Functional Modes
      1. 5.4.1  Power-Up and Power-Down Behavior
      2. 5.4.2  Safety Functions and Diagnostics Overview
      3. 5.4.3  Voltage Monitor (VMON)
      4. 5.4.4  TPS65381A-Q1 Internal Error Signals
      5. 5.4.5  Loss-of-Clock Monitor (LCMON)
      6. 5.4.6  Analog Built-In Self-Test (ABIST)
      7. 5.4.7  Logic Built-In Self-Test (LBIST)
      8. 5.4.8  Junction Temperature Monitoring and Current Limiting
      9. 5.4.9  Diagnostic MUX and Diagnostic Output Pin (DIAG_OUT)
        1. 5.4.9.1 Analog MUX (AMUX)
        2. 5.4.9.2 Digital MUX (DMUX)
        3. 5.4.9.3 Diagnostic MUX Output State (by MUX_OUT bit)
        4. 5.4.9.4 MUX Interconnect Check
      10. 5.4.10 Watchdog Timer (WD)
      11. 5.4.11 Watchdog Fail Counter, Status, and Fail Event
      12. 5.4.12 Watchdog Sequence
      13. 5.4.13 MCU to Watchdog Synchronization
      14. 5.4.14 Trigger Mode (Default Mode)
      15. 5.4.15 Q&A Mode
        1. 5.4.15.1 Watchdog Q&A Related Definitions
        2. 5.4.15.2 Watchdog Sequence in Q&A Mode
        3. 5.4.15.3 Question (Token) Generation
        4. 5.4.15.4 Answer Comparison and Reference Answer
          1. 5.4.15.4.1 Sequence of the 2-bit Watchdog Answer Counter
        5. 5.4.15.5 Watchdog Q&A Mode Sequence Events and WD_STATUS Register Updates
      16. 5.4.16 MCU Error Signal Monitor (MCU ESM)
        1. 5.4.16.1 TMS570 Mode
        2. 5.4.16.2 PWM Mode
      17. 5.4.17 Device Configuration Register Protection
      18. 5.4.18 Enable and Reset Driver Circuit
      19. 5.4.19 Device Operating States
      20. 5.4.20 STANDBY State
      21. 5.4.21 RESET State
      22. 5.4.22 DIAGNOSTIC State
      23. 5.4.23 ACTIVE State
      24. 5.4.24 SAFE State
      25. 5.4.25 State Transition Priorities
      26. 5.4.26 Power on Reset (NPOR)
    5. 5.5 Register Maps
      1. 5.5.1 Serial Peripheral Interface (SPI)
        1. 5.5.1.1 SPI Command Transfer Phase
        2. 5.5.1.2 SPI Data-Transfer Phase
        3. 5.5.1.3 Device Status Flag Byte Response
        4. 5.5.1.4 Device SPI Data Response
        5. 5.5.1.5 SPI Frame Overview
      2. 5.5.2 SPI Register Write Access Lock (SW_LOCK command)
      3. 5.5.3 SPI Registers (SPI Mapped Response)
        1. 5.5.3.1 Device Revision and ID
          1. 5.5.3.1.1 DEV_REV Register
          2. 5.5.3.1.2 DEV_ID Register
        2. 5.5.3.2 Device Status
          1. 5.5.3.2.1 DEV_STAT Register
        3. 5.5.3.3 Device Configuration
          1. 5.5.3.3.1 DEV_CFG1 Register
          2. 5.5.3.3.2 DEV_CFG2 Register
      4. 5.5.4 Device Safety Status and Control Registers
        1. 5.5.4.1  VMON_STAT_1 Register
        2. 5.5.4.2  VMON_STAT_2 Register
        3. 5.5.4.3  SAFETY_STAT_1 Register
        4. 5.5.4.4  SAFETY_STAT_2 Register
        5. 5.5.4.5  SAFETY_STAT_3 Register
        6. 5.5.4.6  SAFETY_STAT_4 Register
        7. 5.5.4.7  SAFETY_STAT_5 Register
        8. 5.5.4.8  SAFETY_ERR_CFG Register
        9. 5.5.4.9  SAFETY_BIST_CTRL Register
        10. 5.5.4.10 SAFETY_CHECK_CTRL Register
        11. 5.5.4.11 SAFETY_FUNC_CFG Register
        12. 5.5.4.12 SAFETY_ERR_STAT Register
        13. 5.5.4.13 SAFETY_ERR_PWM_H Register
        14. 5.5.4.14 SAFETY_ERR_PWM_L Register
        15. 5.5.4.15 SAFETY_PWD_THR_CFG Register
        16. 5.5.4.16 SAFETY_CFG_CRC Register
        17. 5.5.4.17 Diagnostics
          1. 5.5.4.17.1 DIAG_CFG_CTRL Register
          2. 5.5.4.17.2 DIAG_MUX_SEL Register
      5. 5.5.5 Watchdog Timer
        1. 5.5.5.1 WD_TOKEN_FDBK Register
        2. 5.5.5.2 WD_WIN1_CFG Register
        3. 5.5.5.3 WD_WIN2_CFG Register
        4. 5.5.5.4 WD_TOKEN_VALUE Register
        5. 5.5.5.5 WD_STATUS Register
        6. 5.5.5.6 WD_ANSWER Register
      6. 5.5.6 Sensor Supply
        1. 5.5.6.1 SENS_CTRL Register
  6. Application and Implementation
    1. 6.1 Application Information
    2. 6.2 Typical Application
      1. 6.2.1 Design Requirements
      2. 6.2.2 Detailed Design Procedure
        1. 6.2.2.1 VDD6 Preregulator
        2. 6.2.2.2 VDD1 Linear Controller
        3. 6.2.2.3 VSOUT1 Tracking Linear Regulator, Configured to Track VDD5
        4. 6.2.2.4 Alternative Use for VSOUT1 Tracking Linear Regulator, Configured for 6-V Output Tracking VDD3/5 In 3.3-V Mode
        5. 6.2.2.5 Alternative Use for VSOUT1 Tracking Linear Regulator, Configured for 9-V Output Tracking to 5-V Input from VDD5
        6. 6.2.2.6 Alternative Use for VSOUT1 Tracking Linear Regulator, Configured in Non-tracking Mode Providing a 4.5-V Output
      3. 6.2.3 Application Curves
    3. 6.3 System Examples
  7. Power Supply Recommendations
  8. Layout
    1. 8.1 Layout Guidelines
      1. 8.1.1 VDD6 Buck Preregulator
      2. 8.1.2 VDD1 Linear Regulator Controller
      3. 8.1.3 VDD5 and VDD3/5 Linear Regulators
      4. 8.1.4 VSOUT1 Tracking Linear Regulator
      5. 8.1.5 Charge Pump
      6. 8.1.6 Other Considerations
    2. 8.2 Layout Example
    3. 8.3 Power Dissipation and Thermal Considerations
  9. Device and Documentation Support
    1. 9.1 Documentation Support
      1. 9.1.1 Related Documentation
    2. 9.2 Receiving Notification of Documentation Updates
    3. 9.3 Community Resources
    4. 9.4 Trademarks
    5. 9.5 Electrostatic Discharge Caution
    6. 9.6 Glossary
  10. 10Mechanical, Packaging, and Orderable Information

Package Options

Mechanical Data (Package|Pins)
Thermal pad, mechanical data (Package|Pins)
Orderable Information

Detailed Description

Overview

The device integrates an asynchronous-buck switch mode power-supply converter with an internal FET that converts the input battery voltage to a 6-V preregulator output, which supplies the integrated regulators.

A fixed 5-V linear regulator with an internal FET is integrated to be used as, for example, a CAN supply. A second linear regulator, also with an internal FET, regulates the 6 V to a selectable 5-V or 3.3-V MCU I/O voltage. A linear regulator controller with an external FET and resistor-divider regulates the 6 V to an externally adjustable core voltage of between 0.8 V and 3.3 V. A linear regulator with two different modes of operation (tracking mode and non-tracking mode) with adjustable voltage between 3.3 V and 9.5 V can be used as a supply for external sensor.

The device monitors undervoltage and overvoltage on all regulator outputs, battery voltage, and internal supply rails. A second band-gap reference, independent from the main band-gap reference used for regulation circuit, is used for undervoltage and overvoltage monitoring. In addition, regulator current-limits and temperature protections are implemented.

The device supports wakeup from IGNITION or wakeup from a CAN transceiver.

Functional Block Diagram

TPS65381A-Q1 FBD_lvsbc4.gif

Feature Description

VDD6 Buck Switch-Mode Power Supply

The purpose of the VDD6 buck switch-mode power supply is to reduce the power dissipation inside the device as a preregulator. The VDD6 supply regulates from the battery voltage (main supply) range to 6 V. The VDD6 output is used as the input voltage for the VDD5, VDD3/5, VDD1, and can also be used for VSOUT1 regulator depending on the required VSOUT1 output voltage. The VDD6 supply is intended as a preregulator, therefore the output accuracy of VDD6 is less than the other integrated regulators. The VDD6 current capability is set to supply the VDD5, VDD3/5, VDD1, and VSOUT1 regulators at their respective maximum output currents. Power dissipation and thermal analysis should be performed to ensure the PCB design and thermal management can support the required power dissipation in the application.

This switch-mode power supply operates with fixed-frequency adaptive on-time control PWM. The control loop is based on a hysteretic comparator. The internal N-channel MOSFET is turned on at the beginning of each cycle if the sensed voltage on the VDD6 pin is below the hysteretic comparator threshold. When the MOSFET is turned on, it is on for a minimum of 7% duty cycle (7% of fclk_VDD6). This MOSFET is turned off when the hysteretic comparator detects a voltage on the VDD6 pin above the threshold. The VDD6 regulator may skip pulses if the output voltage remains above the hysteretic comparator when the clock edge occurs. When the MOSFET is turned off, the external Schottky diode recirculates the energy stored in the inductor for the remainder of the switching period. The VDD6 regulator enters dropout mode (100% duty cycle) for a supply voltage below approximately 7 V on the VBATP pin.

The internal MOSFET is protected from excessive power dissipation by a current-limit circuit. The VDD6 regulator also shares an overtemperature protection circuit with the VDD3/5 regulator. When overtemperature is detected by this circuit, the device transitions to the STANDBY state (all regulators switched off).

Because the control loop of the VDD6 regulator is based on a hysteretic comparator, the effective capacitance on the output, and effective series resistance (ESR) of the output capacitance must be considered. The effective capacitance of the output capacitors at the operating voltage (6 V, DC bias derating), tolerance, temperature range, and lifetime must meet the effective capacitance range for VDD6 (CVDD6). The capacitor supplier should provide the necessary derating data to calculate the effective capacitance. The hysteretic comparator also requires a specified ESR to ensure balanced operation. Typically low-ESR ceramic capacitors are used for the output, so an external resistor is required to bring the total ESR into the specified ESR range for the CVDD6. A general guideline to achieve balanced operation is RESR = L / (15 × CEffective). Using a higher-effective output capacitance allows for a lower ESR, which leads to lower-voltage ripple. Additionally, the inductance influences the system: using a lower inductance value allows for lower ESR, however, the peak inductor current will be higher.

VDD5 Linear Regulator

The VDD5 pin is a regulated supply of 5 V ±2% overtemperature and battery supply range. A low-ESR ceramic capacitor is required for loop stabilization. This capacitor must be placed close to the pin of the device. This output is protected against shorts to ground by a current-limit. This output also limits output-voltage overshoot during power up and during line or load transients.

On an initial IGN or CANWU power cycle, the soft-start circuit on this regulator is initiated, which is typically from 1 ms to 2 ms. This output can require a larger output capacitor to ensure that during load transients the output does not drop below the required regulation specifications.

The internal MOSFET is protected from excess power dissipation with junction-overtemperature protection. In case of an overtemperature condition in the VDD5 pin, only the VDD5 regulator switches off by clearing bit D4 in the SENS_CTRL register. To re-enable the VDD5 pin, bit D4 in the SENS_CTRL register must be set again.

VDD3/5 Linear Regulator

The VDD3/5 pin is a regulated supply of 3.3 V or 5 V ±2% overtemperature and battery supply range. The output voltage level is selected with the SEL_VDD3/5 pin (open pin selects 3.3 V, grounded pin selects 5 V). The state of this selection pin is sampled and latched directly at the first initial IGN or CANWU power cycle. When latched, any change in the state of this selection pin after the first initial IGN or CANWU power cycle does not change the initially selected state of the VDD3/5 regulator.

A low-ESR ceramic capacitor is required for loop stabilization. This capacitor must be placed close to the pin of the device. This output is protected against shorts to ground by a current-limit. This output also limits output-voltage overshoot during power up or during line or load transients.

On an initial IGN or CANWU power cycle, the soft-start circuit on this regulator is initiated, which is typically from 1 ms to 2 ms. This output may require a larger output capacitor to ensure that during load transients the output does NOT drop below the required regulation specifications.

The internal MOSFET is protected from excess power dissipation with a current-limit circuit and junction overtemperature protection. In case of an overtemperature in the VDD3/5 pin, the TPS65381A-Q1 device enters the STANDBY state (all regulators switched-off).

VDD1 Linear Regulator

The VDD1 pin is an adjustable regulated supply from 0.8 V to 3.3 V. This regulator uses a ±2% reference (VDD1SENSE). The tolerance of the external feedback resistor divider resistors have an impact to the overall VDD1 regulation tolerance. To reduce on-chip power consumption, an external power NMOS is used. The regulation loop and the command gate drive are integrated. TI recommends applying a resistor with a value of 100 kΩ to 1 MΩ between the gate and source of the external power NMOS. The VDD1 gate output is limited to prevent gate-source overvoltage stress during power up or during line or load transients.

On an initial IGN or CANWU power cycle, the soft-start circuit on this regulator is initiated, which is typically from 1 ms to 2 ms. This soft-start is meant to prevent any voltage overshoot at start-up. The VDD1 output may require larger output capacitor to ensure that during load transients the output does not drop below the required regulation specifications.

The VDD1 LDO has no current-limit and no overtemperature protection for the external NMOS FET. Therefore, supplying the VDD1 pin from the VDD6 pin is recommended (see Section 5.2). In this way, the VDD6 pin current-limit acts as current-limit for the VDD1 pin and the power dissipation is limited also. To avoid damage in the external NMOS FET, selecting the current rating of the VDD1 pin well above the maximum-specified VDD6 current-limit is recommended.

If the VDD1 regulator is not used, leave the VDD1_G and VDD1_SENSE pins open. An internal pullup device on the VDD1_SENSE pin detects the open connection and pulls up the VDD1_SENSE pin. This forces the regulation loop to bring the VDD1_G output down. This mechanism also masks the VDD1_OV flag in VMON_STAT_2 register and therefore the ENDRV pin action from a VDD1 overvoltage (OV) condition is also masked. These actions are equivalent to clearing the NMASK_VDD1_UV_OV bit in the DEV_CFG1 register to 0. This internal pullup device on the VDD1_SENSE pin also prevents a real VDD1 overvoltage on the MCU core supply in case of an open connection to the VDD1_SENSE pin, as it brings the VDD1_G pin down. Therefore, in this situation, the VDD1 output voltage is 0 V.

By default, VDD1 monitoring is disabled. If the VDD1 pin is used in the application, TI recommends to set the NMASK_VDD1_UV_OV bit in the DEV_CFG1 register to 1 when the device is in the DIAGNOSTIC state. This setting enables driving and extending the reset to the external MCU when a VDD1 undervoltage event is detected.

VSOUT1 Linear Regulator

The VSOUT1 regulator is a regulated supply with two separate modes: tracking mode and non-tracking mode. The mode selection occurs with the VTRACK1 pin. When the voltage applied on the VTRACK1 pin is above 1.2 V, the VSOUT1 pin is in tracking mode. When the VTRACK1 pin is shorted to ground, the VSOUT1 regulator is in non-tracking mode. This mode selection occurs during the first ramp-up of the VDDx rails and is latched after the first VDDx ramp-up is complete. Therefore, after completion of the VDDx ramp-up, any change on the VTRACK1 pin no longer affects the selected tracking or non-tracking mode.

In tracking mode, the VSOUT1 regulator tracks the input reference voltage on the VTRACK1 pin with a gain factor determined by the external resistive divider. The tracking offset between the VTRACK1 and VSFB1 pins is ±35 mV. This mode allows, for instance, the VSOUT1 output voltage to be 5 V while tracking the VDD3 (3.3-V) supply. In unity-gain feedback, the VSOUT1 output voltage can directly follow the VDD5 pin or the VDD3 pin.

In non-tracking mode, the VSOUT1 output voltage is proportional to a fixed reference voltage of 2.5 V at the VSFB1 pin, with a gain factor determined by the external resistive divider. This mode allows the VSOUT1 pin to be any factor of the internal reference voltage.

Both in tracking and non-tracking mode, the VSOUT1 output voltage must be 3.3 V or higher. The VSOUT1 regulator can track the VDD3/5 pin in 3.3-V setting within the specified limits.

The VSOUT1 regulator has a separate input supply to reduce the internal power dissipation. For an output voltage of 3.3 V or 5 V, for instance, the VDD6 supply can be used as the input supply. For an output voltage greater than 5 V, the VBATP pin can be used as the input supply. The maximum power dissipation for the internal FET must not exceed 0.6 W to avoid overtemperature (thermal shutdown).

A low-ESR ceramic capacitor is required for loop stabilization; this capacitor must be placed close to the pin of the device. This supply limits output-voltage overshoot during power up or during line or load transients.

This supply rail is intended for going outside the ECU and therefore is protected against shorts to external chassis ground by a current-limit. The supply rail can be shorted externally within the specified short circuit voltages, VSOUT1SH. If the output can be shorted to voltages outside the specified short circuit voltage range, additional external protection is required.

The VSOUT1 regulator is disabled by default on start-up. After the NRES pin release, the MCU can enable the VSOUT1 regulator through a SPI command by setting bit D0 in the SENS_CTRL register. After this SPI command, the soft-start circuit on this regulator is initiated, which is typically from 1 ms to 2 ms. This output may require a larger output capacitor to ensure that during load transients the output does NOT drop below the required regulation specifications. Regardless of tracking or non-tracking mode, the VSFB1 pin is ramped to the desired value after completion of the soft start.

The internal MOSFET is protected from excess power dissipation with a current-limit circuit and junction-overtemperature protection. In case of an overtemperature condition in the VSOUT1 pin, only the VSOUT1 regulator is switched off by clearing bit 0 in the SENS_CTRL register. To re-enable the VSOUT1 pin, first bit 2 in the SAFETY_STAT 1 register must be cleared on read-out, and afterwards bit 0 in the SENS_CTRL register must be set again.

The VSOUT1 pin voltage can be observed by the ADC input of the MCU through the DIAG_OUT pin (see Section 5.4.9), which allows the detection of a short to any other supply prior to enabling the VSOUT1 LDO.

NOTE

The VSOUT1_EN bit is in the SENS_CTRL register which is only reinitialized by a power-on reset (NPOR) event and not a transition through the RESET state. If the VSOUT1_EN bit was previously set to 1, it remains set to 1 and the VSOUT1 regulator remains enabled after events that cause a transition to the RESET state. In a fault case that would cause an undervoltage or overvoltage on the VSOUT1 pin, when a BIST runs automatically on the transition from the RESET to the DIAGNOSTIC state, the VSOUT1_UV or VSOUT1_OV condition during the BIST run would cause the device to go to the SAFE state because of the detected ABIST_ERR.

Charge Pump

The charge pump is used to generate an overdrive voltage from the VBATP supply that is used for driving the gates of the internal NMOS FETs in the VDDx and VSOUT1 supply rails. The charge pump is a hysteretic architecture, when the VCP voltage is high enough, the CP_OV bit sets and the charge pump stops pumping until the VCP voltage drops below the threshold, the CP_OV bit clears and the charge pump starts pumping again. The charge pump overdrive is provided internally to the device through the linear regulators, VCP12 and VCP17. Furthermore, this overdrive voltage can drive the gate of an external NMOS FET acting as reverse-battery protection. Such reverse-battery protection allows for lower battery voltage operation compared to a traditional reverse battery-blocking diode. When using the charge pump (VCP) to drive the gate of an NMOS for reverse battery protection, a series resistance of about 10 kΩ must be connected between the VCP pin and the gate of the NMOS FET (see Section 5.2). This series resistance is required to limit any current out of the VCP pin when the gate of the NMOS FET is driven to a negative voltage, because the absolute maximum rating of the VCP pin is limited to –0.3 V because of a parasitic reverse diode to the substrate (ground).

The charge pump requires two external capacitors, one pumping capacitor (Cpump) and one storage capacitor (Cstore). To have sufficient overdrive voltage out of the charge pump even at low battery voltage, the external load current on the VCP pin must be less than 100 µA.

Wake-Up

The TPS65381A-Q1 device has two wake-up pins: IGN and CANWU. Both pins have a wake-up threshold level from 2 V to 3 V, and a hysteresis from 50 mV to 200 mV.

The IGN wake-up pin is level-sensitive and is deglitched with the IGN_deg deglitch (filter) time. The TPS65381A-Q1 device provides a power-latch function (POST_RUN) for this IGN pin, allowing the MCU to decide when to power down the TPS65381A-Q1 device through SPI command. For this, the MCU must set the IGN power-latch bit 4 (IGN_PWRL) in the SPI SAFETY_FUNC_CFG register, and read the unlatched status of the deglitched (filtered) IGN pin on the SPI register, DEV_STAT, bit 0 (IGN). To enter the STANDBY state, the MCU must clear the IGN_PWRL bit. For this, the TPS65381A-Q1 device must be in the DIAGNOSTIC state because this SPI register is only writable in the DIAGNOSTIC state. The IGN_PWRL bit is also cleared after a detected CANWU wake-up event. Furthermore, the TPS65381A-Q1 device provides an optional transition to the RESET state after a detected IGN wake-up during POST_RUN (see Figure 5-2).

The CANWU pin is level sensitive and is deglitched with CANWU_deg (filter) time. The deglitched (filtered) CANWU wake-up signal is latched, into CANWU_L, allowing the MCU to decide when to power down the TPS65381A-Q1 device through the WR_CAN_STBY SPI command.

NOTE

The WR_CAN_STBY command should not be written to the device while the CANWU pin or IGN pin is still high. The device starts to transition to the STANDBY state and immediately transitions to the RESET state because of the wake-up request received on the CANWU or IGN pin. The registers are reinitialization according to post LBIST (because of a RESET transition) or according to NPOR (because of a STANDBY transition).

Both the IGN and CANWU pins are high voltage pins. If the pins are connected to lines with transients, the application should provide proper filtering and protection to ensure the pins stay within the specified voltage range.

NOTE

If the application does not require wake up from IGN (ignition or KL15) or wake up from CANWU (a CAN or other transceiver), but the device should wake up any time power is supplied, one method is to connect the IGN pin to the VBATP pin (and VBAT_SAFING) through a 10-kΩ or greater series resistor. When the VBATP supply is turned on, the IGN pin also goes high and allows the device to wake up (power up) as soon as the voltage levels allow the release of NPOR circuits for the VBATP and VBAT_SAFING pins, and the IGN pin is high.

Reset Extension

During a power-up event, the TPS65381A-Q1 device releases the reset to the external MCU through the NRES pin with a certain delay time (reset extension time) after the VDD3/5 and VDD1 pins have crossed the respective undervoltage thresholds.

This reset extension time is externally configurable with a resistor between the RESEXT pin and ground. When shorting the RESEXT pin to ground, the minimum reset extension time is typically 1.4 ms. For a 22-kΩ external resistor, the typical reset extension time is 4.5 ms.

Device Functional Modes

Power-Up and Power-Down Behavior

Figure 5-1 shows the power-up and power-down behavior.

TPS65381A-Q1 PwrUp_Dn_SLVSBC4.gif
During a power-up event, the analog BIST (ABIST) begins automatically after the VDD6 rail ramps above the UV threshold. If the ABIST fails, the device transitions to the SAFE state.
The device may not be able to respond to MCU SPI communication during a BIST, so if the MCU boots faster than the BIST, it should wait until the BIST is complete to use SPI communication. If the ABIST, LBIST, or both fail, the device transitions to the SAFE state.
The level of the ENDRV pin depends on the watchdog failure counter, WD_FAIL_CNT[2:0], the ENABLE_DRV bit, and the signals shown in Figure 5-14. The MCU should only set the ENABLE_DRV bit when the WD_FAIL_CNT[2:0] counter is below 5.
Figure 5-1 Power-Up and Power-Down Behavior
TPS65381A-Q1 IGN_Pwr_Ltch_SLVSBC4.gif
Under slow VBAT ramp-down and when the VDD3/5 rail is configured as a 5-V rail, the NRES output can be pulled low when VBAT is at approximately 6.3 V. This occurs because of an undervoltage transient on VDD3/5 rail.
Under slow VBAT ramp-up and when the VDD3/5 rail is configured as a 5-V rail, the NRES output can be pulled low when VBAT is at approximately 6.6 V. This occurs because of an undervoltage transient on VDD3/5 rail.
Under similar conditions, undervoltage transients are observed on VDD5 and VSOUT1 rails.
Figure 5-2 IGN Power Latch and POST-RUN Reset

Safety Functions and Diagnostics Overview

The TPS65381A-Q1 device is intended for use in automotive and industrial safety-relevant applications. The following list of monitoring and protection blocks are those that improve the diagnostic coverage and decrease the undetected fault rate:

  • Voltage monitor (VMON)
  • Analog built-in self-test (ABIST) diagnostics for safety analog blocks
  • Logic built-in self-test (LBIST) for safety controller functions
  • Loss-of-clock monitor (LCMON)
  • Junction temperature monitoring for all power supplies with internal FET
  • Current-limit for all power supplies
  • Analog MUX (AMUX) for externally monitored diagnostics and debug
  • Digital MUX (DMUX) for externally monitored diagnostics and debug
  • Watchdog configurable for trigger mode (open and close window) or question and answer mode
  • MCU error signal monitor (ESM) for monitoring the error output from functional safety architecture MCUs
  • Controlled and protected enable output (ENDRV) for external power stages or peripheral wakeup
  • Device configuration register CRC protection
  • SPI command decoder with parity check
  • SPI data output feedback check
  • Reset circuit for initializing external MCU
  • EEPROM analog trim content CRC protection
  • Device state controller with SAFE state in case of detected error event

Voltage Monitor (VMON)

The VBAT supply voltage, all regulator outputs, and internally generated voltages are supervised by a voltage monitor module (VMON). An undervoltage or overvoltage condition is indicated by the corresponding VMON register status flag bits:

  • VMON flag bit cleared to 0 when power supply is within specification
  • VMON flag bit set to 1 when power supply is outside tolerance band

The monitoring occurs by undervoltage and overvoltage comparators. The reference voltage (BANDGAP_REF2) for the VMON module is independent of the system reference voltage (BANDGAP_REF1) used by the regulators. A glitch-filtering function ensures reliable monitoring without false setting of the VMON status flag bits. The complete VMON block is supplied by a separate supply pin, VBAT_SAFING.

The VMON comparator diagnostics are covered by the ABIST executed during device startup and power up or activated with the SPI command by the external MCU SPI request when the device is in the DIAGNOSTIC or ACTIVE state. Each monitored voltage rail is emulated for undervoltage and overvoltage conditions on the corresponding comparator inputs, therefore forcing the corresponding comparator to toggle multiple times (in a toggling pattern observed and checked by the ABIST controller). The monitored voltage rails themselves are not affected during this self-test, so no real undervoltage or overvoltage event occurs on any of these rails because of this self-test.

Table 5-1 lists an overview of the performed voltage monitoring. As listed in this table, an overvoltage protection is implemented for some of the internal supply rails.

Table 5-1 Voltage Monitoring Overview(1)

VOLTAGE RAIL OUTPUT VOLTAGE CREATED FROM REFERENCE MONITORING DETECTION THRESHOLDS MONITORED AGAINST REFERENCE MONITORED PIN OV PROTECTION LEVEL OV PROTECTION REFERENCE IMPACT ON DEVICE BEHAVIOR
UV OV UV OV
SUPPLY INPUT
VBAT N/A N/A 4.2 to 4.5 V 34.7 to 36.7 V VMON_BG VBATP N/A N/A SPI flag VMON_STAT_1 D6
STANDBY state
NRES = 0, ENDRV = 0
SPI flag VMON_STAT_1 D7
RESET state (when MASK_VBATP_OV = 0)
SUPPLY OUTPUTS
VDD6 6 V ± 10% MAIN_BG 5.2 to 5.4 V 7.8 to 8.2 V VMON_BG VDD6 N/A N/A SPI flag VMON_STAT_2 D6 SPI flag VMON_STAT_2 D7
VDD5 5 V ± 2% MAIN_BG 4.5 to 4.85 V 5.2 to 5.45 V VMON_BG VDD5 N/A N/A SPI flag VMON_STAT_2 D4 SPI flag VMON_STAT_2 D5
ENDRV = 0
VDD3/5 (5 V) 5 V ± 2% MAIN_BG 4.5 to 4.85 V 5.2 to 5.5 V VMON_BG VDD3/5 N/A N/A SPI flag VMON_STAT_2 D2
RESET state
NRES = 0, ENDRV = 0
SPI flag VMON_STAT_2 D3
ENDRV = 0
VDD3/5 (3.3 V) 3.3 V ± 2% 3 to 3.17 V 3.43 to 3.6 V
VDD1 0.8 V to 3.3 V –1% to +2%
VDD1_SENSE = 800 mV –1% to +2%
MAIN_BG 0.94 to 0.98 × VDD1 1.03 to 1.06 × VDD1 VMON_BG VDD1_SENSE N/A N/A SPI flag VMON_STAT_2 D0
RESET state
NRES = 0, ENDRV = 0
(when NMASK_VDD1_UV_OV=1)
SPI flag VMON_STAT_2 D1
ENDRV = 0
(when NMASK_VDD1_UV_OV=1)
VSOUT1 (non-tracking) 3.3 V to 9.5 V ± 2%
VDSFB1 = 2.5 V ± 2%
MAIN_BG 0.88 to 0.94 × VSOUT1 1.06 to 1.12 × VSOUT1 MAIN_BG VSFB1 N/A N/A SAFETY_STAT1 D5 SPI flag SAFETY_STAT1 D4
VSOUT1 (tracking) 3.3 V to 9.5 V ± 2%
VDSFB1 = VTRACK1 ± 20 mV
VTRACK1 VTRACK1 VSFB1 N/A N/A
INTERNAL SUPPLIES
VCP17 17 V (typ) MAIN_BG N/A 27 V (typ) VMON_BG N/A 27 V (typ) VMON_BG N/A SPI flag VMON_STAT_1 D5 → STANDBY state
NRES = 0, ENDRV = 0
VCP12 12 V (typ) MAIN_BG 7.43 V (typ) 14.2 V (typ) VMON_BG N/A 14.2 V (typ) VMON_BG SPI flag VMON_STAT_1 D3 SPI flag VMON_STAT_1 D4
VDD5, VDD3/5 and VDD1 not operational → STANDBY state
NRES = 0, ENDRV = 0
AVDD 6.9 V (typ) Internal LV Zener 3.6 V (typ) N/A Independent local band gap N/A NA Internal MV Zener NPOR → STANDBY state
NRES = 0, ENDRV = 0
No Change
AVDD_VMON 6.9 V (typ) Internal LV Zener 3.56 V (typ) N/A Independent local band gap Indirectly monitoring VBAT_SAFING < 10.48 V Internal MV Zener SPI flag VMON_STAT_1 D2 → NPOR → STANDBY state
NRES = 0, ENDRV = 0
SPI flag VMON_STAT_1 D2 → NPOR → STANDBY state
NRES = 0, ENDRV = 0
DVDD 3 V (typ) MAIN_BG 2.472 V (typ) 3.501 V (typ) VMON_BG N/A N/A N/A NPOR → STANDBY state
NRES = 0, ENDRV = 0
NPOR → STANDBY state
NRES = 0, ENDRV = 0
INTERNAL REFERENCES
MAIN_BG 2.5 V ± 2% MAIN_BG 2.364 V (typ) 2.617 V (typ) VMON_BG N/A N/A N/A STANDBY state
NRES = 0, ENDRV = 0
STANDBY state
NRES = 0, ENDRV = 0
VMON_BG 2.5 V ± 2% VMON_BG 2.364 V (typ) 2.617 V (typ) MAIN_BG N/A N/A N/A STANDBY state
NRES = 0, ENDRV = 0
STANDBY state
NRES = 0, ENDRV = 0
N/A = Not applicable

TPS65381A-Q1 Internal Error Signals

Table 5-2 lists a useful overview of the TPS65381A-Q1 device internal error signals and the impact of the signals on the device behavior.

Table 5-2 Internal Error Signals

DETECTIVE CONDITION (THRESHOLD LEVEL) DEGLITCH TIME TO SET FLAG (µs) DEVICE STATE WHEN FLAG IS SET
DMUX POS. NO. SIGNAL NAME DESCRIPTION MIN TYP MAX UNIT ELEC. CHAR. NO. MIN TYP MAX ELEC. CHAR. NO. NRES ENDRV DEVICE STATE
D1.2 NAVDD_UV AVDD undervoltage comparator output (inverted) 3.6 V 15 30 LOW LOW STANDBY
D1.3 BG_ERR1 VMON or main band gap is OFF (set to 1 when VMON band gap > main band gap) Main band gap = 2.364 (VMON band gap = 2.477) V 15 30 LOW LOW STANDBY
D1.4 BG_ERR2 VMON or main band gap is OFF (set to 1 when VMON band gap < main band gap) Main band gap = 2.617 (VMON band gap = 2.477) V 15 30 LOW LOW STANDBY
D1.5 NVCP12_UV VCP12 charge pump undervoltage comparator (inverted) 7.43 V 15 30 Not changed Not changed Not changed
D1.6 VCP12_OV VCP12 charge-pump overvoltage comparator 14.2 V 15 30 LOW LOW STANDBY
D1.7 VCP17_OV VCP17 charge-pump overvoltage comparator 21 V 15 30 LOW LOW STANDBY
D1.8 NVDD6_UV VDD6 undervoltage comparator (inverted) 5.2 5.4 V 6.22 10 40 6.18 Not changed Not changed Not changed
D1.9 VDD6_OV VDD6 overvoltage comparator 7.8 8.2 V 6.23 10 40 6.18 Not changed Not changed Not changed
D1.10 NVDD5_UV VDD5 undervoltage comparator (inverted) 4.5 4.85 V 6.8 10 40 6.18 Not changed Not changed Not changed
D1.11 VDD5_OV VDD5 overvoltage comparator 5.2 5.45 V 6.10 10 40 6.18 Not changed LOW Not changed
D1.12 NVDD3/5_UV VDD3/5 undervoltage comparator; 3.3-V setting (inverted) 3 3.17 V 6.12 10 40 6.18 LOW LOW RESET
VDD3/5 undervoltage comparator; 5-V setting (inverted) 4.5 4.85
D1.13 VDD3/5_OV VDD3/5 overvoltage comparator; 3.3-V setting 3.43 3.6 V 6.14 10 40 6.18 Not changed LOW Not changed
VDD3/5 overvoltage comparator; 5-V setting 5.2 5.5
D1.14 NVDD1_UV VDD1 undervoltage comparator (inverted) 0.94 0.98 VDD1 6.16 10 40 6.18 Not changed when NMASK_VDD1_UV_OV = 0 (default config) Not changed when NMASK_VDD1_UV_OV = 0 (default config) Not changed when NMASK_VDD1_UV_OV = 0 (default config)
When NMASK_VDD1_UV_OV = 1: NRES = LOW When NMASK_VDD1_UV_OV = 1: ENDRV = LOW When NMASK_VDD1_UV_OV = 1: RESET
D1.15 VDD1_OV VDD1 overvoltage comparator 1.03 1.06 VDD1 6.17 10 40 6.18 Not changed Not changed (default config) Not changed
When MASK_VDD1_UV_OV = 1: ENDRV = LOW
D1.16 LOCLK Loss-of-system-clock comparator 0.742 2.64 MHz 0.379 1.346 LOW LOW STANDBY
D3.4 CP_OV Charge-pump overvoltage comparator VBAT + 12 V N/A N/A N/A Not changed Not changed Not changed
D3.5 NCP_UV Charge-pump undervoltage comparator (inverted) VBAT + 6 V N/A N/A N/A Not changed Not changed Not changed
D3.8 CP_DIFF3V Indicates VCP-VBATP > 3 V VBAT + 3 V N/A N/A N/A Not changed Not changed Not changed
D3.10 NVBAT_UV VBAT undervoltage comparator (inverted) 4.2 4.5 V 6.1 200 6.7 LOW LOW STANDBY
D3.11 VBATP_OV VBAT overvoltage comparator 34.7 36.7 V 6.5 200 6.7 LOW (default config) LOW (default config) RESET (default config)
When MASK_VBATP_OV = 1: NRES unchanged When MASK_VBATP_OV = 1: ENDRV unchanged When MASK_VBATP_OV = 1: device state unchanged
D3.12 VDD5_OT VDD5 overtemperature 175 210 °C 3.13 45 64 LOW LOW Device state depends on NMASK_VDD5_OT bit setting:
NMASK_VDD5_OT = 0 : no impact to device state
NMASK_VDD5_OT = 1 : VDD5 disabled → RESET
D3.13 VDD3/5_OT VDD3/5 overtemperature 175 210 °C 2.13 45 64 LOW LOW Device state depends on NMASK_VDD3/5_OT bit setting:
NMASK_VDD3/5_OT = 0 : VDD3/5 disabled → VDD3/5 UV event → RESET
NMASK_VDD3/5_OT = 1 : STANDBY
D3.14 VSOUT1_OT VSOUT1 overtemperature 175 210 °C 5.13 45 64 Not changed Not changed Not changed
D3.15 VDD5_CL VDD5 current-limit(1) 350 650 mA 2.14 15 30 Not changed Not changed Not changed
D3.16 VDD3/5_CL VDD3/5 current-limit 350 650 mA 3.14 15 30 Not changed Not changed Not changed
D4.2 VSOUT1_CL VSOUT1 current-limit 100 500 mA 5.19 15 30 Not changed Not changed Not changed
D4.3 NVSOUT1_UV VSOUT1 undervoltage comparator (inverted) 0.88 0.94 VSOUT1 6.19 10 40 6.21 Not changed Not changed Not changed
D4.4 VSOUT1_OV VSOUT1 overvoltage comparator 1.06 1.12 VSOUT1 6.20 10 40 6.21 Not changed Not changed Not changed
D4.5 NDVDD_UV DVDD undervoltage comparator (inverted) 2.472 V 0 LOW LOW STANDBY
D4.6 DVDD_OV DVDD overvoltage comparator 3.501 V 0 LOW LOW STANDBY
D4.8 VS_TRK_MODE VSOUT1 in track-mode indication 1.2 V 5.3a N/A N/A N/A Not changed Not changed Not changed
D4.9 VMON_TRIM_ERR VMON trim error Set when bit-flip in VMON trim registers is detected 5 10 LOW LOW STANDBY
VDD5_CL DMUX output is valid only when VDD5_EN bit in SENS_CTRL register is set to 1. When VDD5_EN is cleared to 0, this VDD5_CL will be high.

Loss-of-Clock Monitor (LCMON)

The LCMON detects internal oscillator failures including:

  • Oscillator clock stuck high or stuck low
  • Reduced clock frequency

The LCMON is enabled during a power-up event after the power-on reset (NPOR) is released. The clock monitor remains active during device normal operation (STANDBY, RESET, DIAGNOSTIC, ACTIVE, and SAFE states). In case of a clock failure:

  • The device transitions to the STANDBY state.
  • All regulators are disabled.
  • The digital core is reinitialized.
  • The reset to the external MCU is asserted low.
  • The failure condition is indicated by the LOCLK bit in the SAFETY_STAT_4 register.

The LCMON has a self-test structure that is activated and monitored by an analog BIST (ABIST). The external MCU can recheck the LCMON any time when the device is in the DIAGNOSTIC state or ACTIVE state. The enabled diagnostics emulate a clock failure that causes the clock-monitor output to toggle. The clock-monitor toggling pattern is checked by the ABIST, while the external MCU can check that the loss-of-clock status bit is being set during active test. During this self-test, the actual oscillator frequency (4 MHz) is not changed because of this self-test.

Analog Built-In Self-Test (ABIST)

The ABIST is the controller and monitor circuit for performing self-checking diagnostics on critical analog functions:

  • VMON undervoltage and overvoltage comparators
  • Clock monitor (LCMON)
  • EEPROM analog-trim content check (CRC protection)

During the self-test on the VMON undervoltage and overvoltage comparators, the monitored voltage rails are left unchanged, so no real undervoltage or overvoltage event occurs on any of these rails because of these self-tests. Furthermore, also during the self-check on the clock monitor, the actual oscillator frequency (4 MHz) is not changed because of this self-test.

TPS65381A-Q1 Ana_BIST_States_lvsbc4.gif
For impact to the device state if any ABIST function has a FAIL, see Section 5.4.19.
Figure 5-3 Analog BIST Run States

The ABIST is activated with every device power-up event or any transition to the RESET state. The ABIST can also be run by the external MCU by setting the ABIST_EN bit in the SAFETY_BIST_CTRL register. During an ABIST run, the device cannot monitor the state of the regulated supplies, and the ENDRV pin is pulled low. The ABIST run time is approximately 300 µs. The ABIST can be performed in the ACTIVE state on an MCU request, depending on system safety requirements (such as a system-fault response time), ENDRV pin will be low during ABIST run.

A running ABIST is indicated in the ABIST_RUN bit (bit D0) in the SAFETY_STAT_3 register. This bit is set to 1 during the ABIST run and is cleared to 0 when the ABIST is complete. In case of an ABIST failure while in the DIAGNOSTIC state, including power-up event, the device enters the SAFE state without asserting a reset to the external MCU and the ABIST_ERR status flag remains latched in the digital core until a successful ABIST run. This allows the external MCU to detect the ABIST failure by reading the ABIST_ERR bits in the SAFETY_STAT_3 register. In case of an ABIST failure while in the ACTIVE state, the device sets the ABIST_ERR status flag, but no state transition occurs.

Logic Built-In Self-Test (LBIST)

The logic BIST (LBIST) tests the digital-core safety functions. The LBIST has these characteristics:

  • An application-controllable logic BIST engine, which applies test vectors to the digital core.
  • The LBIST engine provides stuck-at fault test coverage to logic blocks under test.
  • The LBIST run time is typically 4.2 ms (±5%). After the LBIST, a 16-ms (typical) wait period occurs to fill the digital filters covered by the LBIST. During this time, the ABIST runs. The total BIST time is approximately 21 ms. The SPI registers may be unavailable during a BIST, so no SPI reads or writes should be made while the BIST is running.
  • The LBIST engine has a time-out counter as a fail-safe feature.

The BIST (LBIST with ABIST) is activated and run in the DIAGNOSTIC state with any transition out of the RESET state during power-up events. The BIST is also activated with any other transition out of the RESET state unless the AUTO_BIST_DIS bit in the SAFETY_BIST_CTRL register is set.

The MCU can run the LBIST (BIST) by setting the LBIST_EN bit in the SAFETY_BIST_CTRL register.

NOTE

In the ACTIVE state the following considerations must be considered if a manual run of the LBIST is initiated by setting the LBIST_EN bit to 1. The LBIST should only be run in the ACTIVE state if the system-safety timing requirements can allow the total 21-ms BIST time and ENDRV being low for the 21-ms time.

NOTE

In the ACTIVE or DIAGNOSTIC or SAFE state the following considerations must be considered if a manual run of the LBIST is initiated by setting the LBIST_EN bit to 1. After the LBIST is complete the WD_FAIL_CNT[2:0] counter is re-initialized to 5. The MCU should resynchronize to the TPS65381A-Q1 watchdog by writing to the WD_WIN1_CFG or WD_WIN2_CFG register or by immediately causing a bad event. Both of these resynchronization options start a new watchdog sequence and increment the WD_FAIL_CNT[2:0] counter. If the WD_RST_EN bit is set to 1 (enabled), the watchdog service routine in the MCU must ensure good events are sent to the watchdog to start decrementing the WD_FAIL_CNT[2:0] counter before it reaches 7 +1 which cause a transition to the RESET state. After the LBIST is complete some of the registers are reinitialized. If the these configuration registers change from the initialized values, these registers must be reconfigured to the required setting for the application.

NOTE

In the DIAGNOSTIC state the following considerations must be taken into account if a manual run of the LBIST is initiated by setting the LBIST_EN bit to 1. Setting the LBIST_EN bit to 1 clears the DIAG_EXIT_MASK bit to 0. If the DIAG_EXIT_MASK bit is being used to hold the device in the DIAGNOSTIC state for software debug, it must be set again to 1 after LBIST completion to stay in the DIAGNOSTIC state. The DIAGNOSTIC state time-out counter stops only during the running of the LBIST. After the LBIST is complete, the time-out counter continues from the last value. For a transition from the DIAGNOSTIC state to the ACTIVE state, the DIAG_EXIT bit must be set to 1.

During the BIST run, the device cannot monitor the state of regulated supplies and cannot respond to any SPI command, and therefore cannot monitor the state of the MCU through the watchdog timer. During the BIST run, the ENDRV pin is pulled low and the watchdog fail counter reinitializes to 5. After the BIST is complete, the following functions and registers reinitialize:

  • DEV_STAT
  • SAFETY_STAT_2
  • SAFETY_STAT_4
  • SAFETY_STAT_5 (but FSM[2:0] will immediately update to reflect the current device state)
  • WD_TOKEN_VALUE
  • WD_STATUS
  • SAFETY_CHECK_CTRL
  • DIAG_CFG_CTRL
  • DIAG_MUX_SEL

A running LBIST is indicated in the LBIST_RUN bit (bit D1) in the SAFETY_STAT_3 register. This bit is set to 1 while the LBIST is running and is cleared to 0 when the LBIST is complete. After the LBIST run, completion of the whole BIST is confirmed by the MCU by reading 0 for both the LBIST_RUN and ABIST_RUN bits.

In case of an LBIST failure in the DIAGNOSTIC state, the device enters the SAFE state. The external MCU can detect the LBIST failure by reading the LBIST_ERR bit in the SAFETY_STAT_3 register. In case of an LBIST failure while in the ACTIVE state, the device sets the LBIST_ERR status flag, but no state transition occurs. Because the ABIST is run during the LBIST, the ABIST_ERR bit can also be monitored by the MCU.

Junction Temperature Monitoring and Current Limiting

Each LDO with an internal power FET has junction temperature monitoring with overtemperature protection (thermal shutdown). In case of an overtemperature condition, a regulated supply can re-enable only after the overtemperature condition is removed.

For the VSOUT1 regulator, the overtemperature condition disables the regulator and clears the enable bit (VSOUT1_EN), while all other regulators remain enabled. When the VSOUT1 overtemperature condition is gone, the external MCU must set the enable control bit again to re-enable the regulator.

The VDD3/5 and VDD6 regulators share an overtemperature protection circuit. A overtemperature event disables the VDD3/5 regulator. If the NMASK_VDD3/5_OT is set to 1 (default), the device transitions to the STANDBY state. If the NMASK_VDD3/5_OT bit is cleared to 0, the device transitions to the RESET state when the VDD3/5 output reaches the UV level for the VDD3/5 regulator. In both cases the NRES pin goes low and resets the external MCU and the ENDRV pin is low. TI recommends using the device with the NMASK_VDD3/5_OT bit set to 1.

For the VDD5 regulator, the overtemperature condition clears the VDD5_EN enable bit and transitions to the RESET state. NRES pin goes low and resets the MCU and the ENDRV pin is low. All other regulators remain enabled. When the VDD5 overtemperature condition is gone, the MCU must set the enable control bit again to re-enable the regulator.

The VDD6, VDD3/5, VDD5, and VSOUT1 regulators include a current-limit circuit for protection against excessive power consumption and thermal overstress.

Table 5-3 lists an overview of the overtemperature and overcurrent protections for the supply output rails.

Table 5-3 Overtemperature and Overcurrent Protection Overview

VOLTAGE RAIL OVERTEMPERATURE PROTECTION OVERCURRENT PROTECTION
THRESHOLD (°C) IMPACT ON DEVICE BEHAVIOR CURRENT-LIMIT IMPACT ON DEVICE BEHAVIOR
VDD6 175 to 210 (shared with VDD6 and VDD3/5) Sets VDD3/5_OT (in SAFETY_STAT_1)
when NMASK_VDD3/5_OT = 1, STANDBY state
when NMASK_VDD3/5_OT = 0, disables VDD3/5, RESET when VDD3/5 reaches UV level
1.5 to 2.5 A None
VDD3/5 350 to 650 mA Sets VDD3/5_ILIM (in SAFETY_STAT_1)
VDD5 175 to 210 Sets VDD5_OT (in SAFETY_STAT_1)
when NMASK_VDD5_OT = 1, clears VDD5_EN (in SENS_CTRL) and VDD5 switched off, RESET state
when NMASK_VDD5_OT = 0, overtemperature indicated in VDD5_OT
350 to 650 mA Sets VDD5_ILIM (in SAFETY_STAT_1)
VDD1 None N/A None N/A
VSOUT1 175 to 210 Sets VSOUT1_OT (in SAFETY_STAT_1)
clears VSOUT1_EN (in SENS_CTRL) and VSOUT1 disabled
100 to 500 mA DIAG_OUT through digital MUX for VSOUT1_CL

Diagnostic MUX and Diagnostic Output Pin (DIAG_OUT)

Analog and digital critical signals, which are not directly connected to the MCU, are switched by a multiplexer to the external DIAG_OUT pin. The programming of the multiplexer is done with the DIAG_MUX_SEL register. The digital signals are buffered to have sufficient drive capabilities.

This multiplexer facilitates external pin-interconnect tests by feeding back the input pin state or feeding back internal module self-test status or safety comparator outputs.

TPS65381A-Q1 DIAG_OUT_A_lvsbc4.gif
These analog signals are multiplexed out with a divide ratio
If the application must measure analog signals with an MCU ADC and monitor digital signals with an MCU GPIO, the application design must assure the GPIO input stage does not affect the ADC measurements. If isolating the MCU GPIO is not possible within the MCU, the application design must achieve the necessary isolation externally.
Figure 5-4 Diagnostic Output Pin, DIAG_OUT

In case the DIAG_OUT pin is connected to a mixed analog or digital input pin of the MCU, TI recommends configuring this MCU input pin and the DIAG_OUT pin simultaneously in accordance with the desired type of signal (analog or digital). The type of signal (analog or digital) on the DIAG_OUT pin can be configured with the MUX_CFG[1:0] bits in the DIAG_CFG_CTRL register. The DIAG_OUT multiplexer can be globally enabled and disabled with bit 7 in the DIAG_CFG_CTRL register. When disabled, the DIAG_OUT pin is in the high-ohmic state (tri-state).

NOTE

When enabling the DIAG_OUT MUX while using SPI communication, the SDO pin is not in the high impedance state while the NCS pin is high and the DIAG_OUT MUX is enabled. Software or hardware modification may be required in the application. For hardware modifications check the SDO threshold level and drive capability if resistors are used to adjust the voltage level of the SDO pin on the SPI bus or use a buffer gate with an enable and tri-state output such as the SN74AHC1G125 to allow the downstream SDO signal to be in the high impedance state if required in the application while the NCS pin is high even if the DIAG_OUT MUX is enabled.

Analog MUX (AMUX)

Table 5-4 lists the selectable-analog internal signals on the DIAG_OUT pin. In the DIAG_CFG_CTRL register, the MUX_CFG[1:0] bits must be set to 10b for the analog MUX mode.

Table 5-4 Analog MUX Selection Table

SIGNAL
NUMBER
VOLTAGE RAIL
or
SIGNAL NAME
DESCRIPTION SUPPLY RANGE(2) DIVIDE
RATIO
DIVIDE RATIO ACCURACY(1) OUTPUT RESISTANCE (kΩ) DIAG_MUX_SEL[7:0]
MINIMUM MAXIMUM MINIMUM MAXIMUM
A.1 VDD5 Linear VDD5 regulator output 5.8 to 34 V 2 –2.25 % 0.75 % 20 50 0x01
A.2 VDD6 Switch mode preregulator 5.8 to 34 V 3 –3.75% 0.5 % 30 100 0x02
A.3 VCP Charge pump 5.8 to 18V 13.5 –6.25 % 2.25 % 90 200 0x04
5.8 to 34 V –6.25% 4.75 %
A.4 VSOUT1 Sensor supply voltage 5.8 to 34 V 4 –0.5 % 1.2 % 40 100 0x08
A.5 VBAT_SAFING Battery (supply) input for monitoring (VMON) and BG2 functions 5.8 to 18 V 10 –5 % 0 % 125 200 0x10
5.8 to 34 V –5 % 5.5 %
A.6 VBATP Battery (supply), main power supply 5.8 to 18V 10 –5 % 0 % 125 200 0x20
5.8 to 34 V –5 % 5.5 %
A.7 MAIN_BG Regulators band-gap reference 5.8 to 34 V 1 NA 3 15 0x40
A.8 VMON_BG Voltage-monitor band gap 5.8 to 34 V 1 NA 3 15 0x80
The given accuracies are without the DC load-current drawn from the DIAG_OUT pin. For overall accuracy calculation, the divide ratio accuracy and the drop voltage caused by IDIAG_OUT × output resistance must be considered.
The supply range is the input supply range for VBATP and VBAT_SAFING (VBATP = VBAT_SAFING).

In case one of the AMUX signals after the divide ratio is at a voltage above the VDDIO voltage, a clamp becomes active to avoid any voltage level higher than the VDDIO voltage on the DIAG_OUT pin.

To achieve the fastest stabilization of the signal switched to the DIAG_OUT pin, following the AMUX switching order from A.1 up to A.8 is not recommended.

The recommendation is to switch the order from high-to-low voltage, starting with A.8. For example: A.8 – A.7 – A.1 – A.2 – A.3 – A.5 – A.6 – A.4.

NOTE

The sensor-supply output voltage (VSOUT1) is 0 V in this example. If the VSOUT1 voltage is higher, then the switching order described in the previous example must be changed.

NOTE

In the application, a series resistance of at least 100 kΩ is required on the input capacitor filter of the ADC input of the MCU.

Digital MUX (DMUX)

The following tables list the selectable digital internal signals on the DIAG_OUT pin. In the DIAG_CFG_CTRL register, the MUX_CFG[1:0] bits must be cleared to 01b for the digital MUX mode.

Most of these signals are internal error signals that influence the device state and behavior of the NRES pin and the ENDRV pin. See Table 5-2 for a more detailed table listing the internal error signals and their impact on the device behavior.

Table 5-5 Digital MUX Selection Table – Group 1

SIGNAL NUMBER SIGNAL NAME DESCRIPTION CHANNEL GROUP
DIAG_MUX_SEL
[6:4]
CHANNEL NUMBER
DIAG_MUX_SEL
[3:0]
D1.1 RSV Reserved, logic 0 000b 0000b
D1.2 NAVDD_UV AVDD undervoltage comparator output (inverted) 000b 0001b
D1.3 BG_ERR1 VMON or main band gap is OFF 000b 0010b
D1.4 BG_ERR2 VMON or main band gap is OFF 000b 0011b
D1.5 NVCP12_UV VCP12 charge-pump undervoltage comparator (inverted) 000b 0100b
D1.6 VCP12_OV VCP12 charge-pump overvoltage comparator 000b 0101b
D1.7 VCP17_OV VCP17 charge-pump overvoltage comparator 000b 0110b
D1.8 NVDD6_UV VDD6 undervoltage comparator (inverted) 000b 0111b
D1.9 VDD6_OV VDD6 overvoltage comparator 000b 1000b
D1.10 NVDD5_UV VDD5 undervoltage comparator (inverted) 000b 1001b
D1.11 VDD5_OV VDD5 overvoltage comparator 000b 1010b
D1.12 NVDD3/5_UV VDD3/5 undervoltage comparator (inverted) 000b 1011b
D1.13 VDD3/5_OV VDD3/5 overvoltage comparator 000b 1100b
D1.14 NVDD1_UV VDD1 undervoltage comparator (inverted) 000b 1101b
D1.15 VDD1_OV VDD1 overvoltage comparator 000b 1110b
D1.16 LOCLK Loss-of-system-clock comparator 000b 1111b

Table 5-6 Digital MUX Selection Table – Group 2

SIGNAL NUMBER SIGNAL NAME DESCRIPTION CHANNEL GROUP
DIAG_MUX_SEL
[6:4]
CHANNEL NUMBER
DIAG_MUX_SEL
[3:0]
D2.1 RSV Reserved, logic 0 001b 0000b
D2.2 SYS_CLK System clock source 001b 0001b
D2.3 DFT Signal reserved for production test 001b 0010b
D2.4 WD_CLK Watchdog clock reference (0.55-ms period time) 001b 0011b
D2.5 RST_EXT_CLK Reset extension oscillator output 001b 0100b
D2.6 T_5US 5-µs time reference 001b 0101b
D2.7 T_15US 15-µs time reference 001b 0110b
D2.8 T_40US 40-µs time reference 001b 0111b
D2.9 T_2MS 2-ms time reference 001b 1000b
D2.10 UC_ERROR/WDI External MCU ERROR/WDI input pin 001b 1001b
D2.11 SPI_NCS SPI chip-select input pin 001b 1010b
D2.12 SPI_SDI SPI slave-data input pin 001b 1011b
D2.13 SPI_CLK SPI clock input pin 001b 1100b
D2.14 SDO_RDBCK SPI slave-data output-pin readback 001b 1101b
D2.15 UC_ERROR/WDI Same signal as D2.10 001b 1110b
D2.16 NRES_EXT_IN NRES pin readback (reset to external MCU) 001b 1111b

Table 5-7 Digital MUX Selection Table – Group 3

SIGNAL NUMBER SIGNAL NAME DESCRIPTION CHANNEL GROUP
DIAG_MUX_SEL
[6:4]
CHANNEL NUMBER
DIAG_MUX_SEL
[3:0]
D3.1 RSV Reserved, logic 0 010b 0000b
D3.2 DFT Signal reserved for production test 010b 0001b
D3.3 DFT Signal reserved for production test 010b 0010b
D3.4 CP_OV Charge-pump overvoltage comparator 010b 0011b
D3.5 NCP_UV Charge-pump undervoltage comparator (inverted) 010b 0100b
D3.6 CP_PH1 Charge-pump switching phase 1 010b 0101b
D3.7 CP_PH2 Charge-pump switching phase 2 010b 0110b
D3.8 CP_DIFF3V Indicates VCP-VBATP > 3 V 010b 0111b
D3.9 DFT Signal reserved for production test 010b 1000b
D3.10 NVBAT_UV VBAT undervoltage comparator (inverted) 010b 1001b
D3.11 VBATP_OV VBAT overvoltage comparator 010b 1010b
D3.12 VDD5_OT VDD5 overtemperature 010b 1011b
D3.13 VDD3/5_OT VDD3/5 overtemperature 010b 1100b
D3.14 VSOUT1_OT VSOUT1 overtemperature 010b 1101b
D3.15 VDD5_CL VDD5 current-limit 010b 1110b
D3.16 VDD3_CL VDD3 current-limit 010b 1111b

Table 5-8 Digital MUX Selection Table – Group 4

SIGNAL NUMBER SIGNAL NAME DESCRIPTION CHANNEL GROUP
DIAG_MUX_SEL
[6:4]
CHANNEL NUMBER
DIAG_MUX_SEL
[3:0]
D4.1 RSV Reserved, logic 0 011b 0000b
D4.2 VSOUT1_CL VSOUT1 current-limit 011b 0001b
D4.3 NVSOUT1_UV VSOUT1 undervoltage comparator (inverted) 011b 0010b
D4.4 VSOUT1_OV VSOUT1 overvoltage comparator 011b 0011b
D4.5 NDVDD_UV DVDD undervoltage comparator (inverted) 011b 0100b
D4.6 DVDD_OV DVDD overvoltage comparator 011b 0101b
D4.7 RSV Reserved 011b 0110b
D4.8 VS_TRK_MODE VSOUT1 in track-mode indication 011b 0111b
D4.9 VMON_TRIM_ERR VMON trim error 011b 1000b
D4.10-16 RSV Reserved 011b 1001b-1111b

Table 5-9 Digital MUX Selection Table – Group 5

SIGNAL NUMBER SIGNAL NAME DESCRIPTION CHANNEL GROUP
DIAG_MUX_SEL
[6:4]
CHANNEL NUMBER
DIAG_MUX_SEL
[3:0]
D5.1 RSV Reserved, logic 0 111b 0000b
D5.2 TI_TEST_MODE TI production test mode indication 111b 0001b
D5.3-16 DFT Signal reserved for production test 111b 0010b-1111b

A diagnostic check at the SDO digital-output pin is also possible in DMUX mode. For this diagnostic check, the following sequence is required:

  1. The MUX_CFG[1:0] configuration must be set to 01b for DIGITAL MUX mode.
  2. The SPI NCS must be kept HIGH.
  3. The state of the SDO pin is controlled by the SPI_SDO bit (bit D6 in the DIAG_CFG_CTRL register).

During this SDO check at the SDO pin, the DIAG_OUT pin is kept low if no signal from the Digital MUX Selection table is selected.

Diagnostic MUX Output State (by MUX_OUT bit)

For a diagnostic interconnect check between the DIAG_OUT pin and the MCU analog-digital input pin, the state of the DIAG_OUT pin is controlled with the SPI bit, MUX_OUT, in the DIAG_CFG_CTRL register. To use this mode, the MUX_CFG[1:0] bits must be set to 00b in the DIAG_CFG_CTRL register.

MUX Interconnect Check

For performing a diagnostic interconnect check at the digital input pins (ERROR/WDI, NCS, SDI, and SCLK), the MUX_CFG[1:0] bits in the DIAG_CFG_CTRL register must be set to 11b. The INT_CON[2:0] bits in the DIAG_CFG_CTRL register can select which of these digital inputs to be multiplexed to the DIAG_OUT pin (see the description of DIAG_CFG_CTRL register in Section 5.5.1).

Watchdog Timer (WD)

The watchdog monitors the correct operation of the MCU. This watchdog requires specific triggers, or messages, from the MCU in specific time intervals to detect correct operation of the MCU. The MCU can control the logic level of the ENDRV pin with the ENABLE_DRV bit when the watchdog detects correct operation of the MCU. When the watchdog detects incorrect operation of the MCU, the device pulls the ENDRV pin low. This ENDRV pin can be used in the application as a control signal to deactivate the power output stages, for example a motor driver, in case of incorrect operation of the MCU. This function is consequently referred to as the watchdog-enabled function.

The watchdog has two different modes, which are defined as follows:

    Trigger mode: In trigger mode, the MCU applies a trigger (pulse) on the ERROR/WDI pin to send the required watchdog event for trigger mode. The watchdog operates in trigger mode as the default mode when the device goes from the RESET state to the DIAGNOSTIC state. The MCU error signal monitor (ESM) should not be used when the watchdog operates in trigger mode.
    Question-answer mode (Q&A mode): In Q&A mode, the MCU sends watchdog answers through SPI.

To select the Q&A mode, the MCU must set the WD_CFG bit (bit 5) in the safety-function configuration register (SAFETY_FUNC_CFG) while in the DIAGNOSTIC state. When the watchdog operates in Q&A mode, the MCU error signal monitor (ESM) may be used.

Watchdog Fail Counter, Status, and Fail Event

The watchdog includes a watchdog fail counter (WD_FAIL_CNT[2:0]) which increments because of bad events or decrements because of good events. When the value of the watchdog fail counter is 5 or more, the watchdog status is out-of-range and the ENDRV pin is low (the watchdog-enabled function is disabled).

When the watchdog fail counter is 4 or less, the watchdog status is in-range and the watchdog no longer disables the watchdog-enabled function. In this case, the device pulls up the ENDRV pin when the ENABLE_DRV control bit (in the SAFETY_CHECK_CTRL register) is set and when the device detects no other errors that impact the level of the ENDRV pin.

The watchdog fail counter operates independently of the state of the watchdog reset configuration bit (bit 3), WD_RST_EN, in the SAFETY_FUNC_CFG register.

The watchdog fail counter responds as follows:

  • A good event decrements the fail counter by one, down to the minimum of zero.
  • A bad event increments the fail counter by one, up to the maximum of seven.
  • A time-out event increases the fail counter by one, up to the maximum of seven, and sets the TIME_OUT flag (WD_STATUS register, bit 1).

The definitions of good event, bad event and time-out event are listed Section 5.4.14 and Section 5.4.15.

TPS65381A-Q1 Watch_En_lvsbc4.gif Figure 5-5 Watchdog Impact on ENDRV and RESET

Table 5-10 Watchdog Status for Range of the Watchdog Fail Counter Value

WATCHDOG FAIL COUNTER
WD_FAIL_CNT[2:0]
000b THROUGH 100b 101b THROUGH 111b 111b
The watchdog status is based on the WD_FAIL_CNT[2:0] value. Watchdog in-range Watchdog is out-of-range If the WD_RST_EN bit is set to 1, the NRES pin is pulled low, the device is in the RESET state on next "bad" or "time-out" event to the watchdog

The watchdog fail counter is initialized to a count of 5 when the device enters the DIAGNOSTIC state (after going through the RESET state) and when the device transitions from the DIAGNOSTIC state to the ACTIVE state.

When the watchdog fail counter reaches a count of 7, another bad event does not change the counter: the counter remains at 7. However, if the watchdog reset is enabled (WD_RST_EN bit in the SAFETY_FUNC_CFG register is set to 1), on the next bad event or time-out event (7 + 1) the device enters the RESET state and resets the MCU by pulling the NRES pin low. In the RESET state, the watchdog fail counter reinitializes to 5. If the watchdog fail counter is at seven when the WD_RST_EN bit is set to 1, the device immediately enters the RESET state without requiring another bad event or time-out event.

Watchdog Sequence

Each watchdog sequence begins with a Window 1 followed by a Window 2. The MCU can program the time periods of Window 1 (tWIN1) and Window 2 (tWIN2) with the WD_WIN1_CFG and WD_WIN2_CFG registers respectively when the device is in the DIAGNOSTIC state. When the device goes from the RESET state to the DIAGNOSTIC state, the watchdog sequence begins with the default tWIN1 and tWIN2 time periods.

Use Equation 1 and Equation 2 to calculate the minimum and maximum values for the tWIN1 time period. Use Equation 3 and Equation 4 to calculate the minimum and maximum values for the tWIN2 time period.

Equation 1. tWIN1_MIN = [(RT[6:0] – 1) × 0.55 × 0.95] ms

where

  • The bits RT[6:0] are located in the WD_WIN1_CFG SPI register.
Equation 2. tWIN1_MAX = (RT [6:0] × 0.55 × 1.05) ms

where

  • The bits RT[6:0] are located in the WD_WIN1_CFG SPI register.
Equation 3. tWIN2_MIN = [(RW[4:0] + 1) × 0.55 × 0.95] ms

where

  • The bits RW[4:0] are located in the WD_WIN2_CFG SPI register.
Equation 4. tWIN2_MAX = [(RW[4:0] + 1) × 0.55 × 1.05] ms

where

  • The bits RW[4:0] are located in the WD_WIN2_CFG SPI register.

If the MCU stops sending events, or stops feeding the watchdog during the watchdog sequence, the watchdog considers this lack of response from the MCU a time-out event (no response event). This sets the TIME_OUT status bit (bit 1 in the WD_STATUS register) and increments the watchdog fail counter. Immediately following a time-out event the next watchdog sequence is started.

Based on the Window 1 and Window 2 time periods, the watchdog sequence and time-out time periods are calculated as follows:

Equation 5. tSEQUENCE_MIN = tTIMEOUT_MIN = tWIN1_MIN + tWIN2_MIN
Equation 6. tSEQUENCE_MAX = tTIMEOUT_MAX = tWIN1_MAX + tWIN2_MAX

The watchdog uses the internal system clock of the device (±5% accuracy) as a time reference for creating the 0.55-ms watchdog time step. WINDOW 1 may be up to one 0.55-ms watchdog time step shorter than programmed as indicated by Equation 1.

NOTE

Because of the uncertainty in the Window 1 and Window 2 time periods, TI recommends using settings for Window 1 and Window 2 of two or higher. Window 2 could be set as low as one, assuming Window 1 is set to six or lower. The response from the MCU should be targeted to the mid point of known timing for Window 2. As Window 1 setting is increased above six, the device system-clock tolerance (±5%) becomes large compared to a setting of one in Window 2 not allowing for a known time range for a response in Window 2, so Window 2 setting must be scaled with Window 1 to allow timing margin.

MCU to Watchdog Synchronization

To synchronize the MCU with the watchdog sequence, the MCU can write to either the WIN1_CFG or WIN2_CFG registers to start a new watchdog sequence. After a write access to the WIN1_CFG or WIN2_CFG register by the MCU (even when these registers are locked or when the device is in the ACTIVE or the SAFE state), the device immediately starts a new watchdog sequence and increments the watchdog fail counter. Therefore a write access to the WD_WIN1_CFG or WD_WIN2_CFG register only takes effect in this new watchdog sequence.

When the MCU is synchronized with the watchdog sequence, a good event from the MCU immediately starts a new watchdog sequence. In this way, the MCU stays synchronized with the watchdog sequence.

See Figure 6-11 for an example software flowchart of how to synchronize the MCU with the TPS65381A-Q1 watchdog.

Trigger Mode (Default Mode)

When the device goes from the RESET state to the DIAGNOSTIC state, the watchdog operates in trigger mode (default). The first watchdog sequence begins with the default tWIN1 and tWIN2 time periods. The watchdog receives the triggers from the MCU on the ERROR/WDI pin. A rising edge on the ERROR/WDI pin, followed by a falling edge on the ERROR/WDI pin after more than the required pulse time, tWD_pulse(max) (32 μs), is a trigger. Even a waveform with a longer duration high than low is counted as a trigger if the rising and falling edges meet this requirement.

Window 1, called a CLOSE window, is the first window in the watchdog sequence. A trigger received in Window 1 is a bad event and ends Window 1, starts a new watchdog sequence and sets ANSWER_EARLY flag.

Window 2, called an OPEN window, follows Window 1. At a minimum, Window 2 lasts until a trigger is received. At a maximum, Window 2 lasts until the programmed tWIN2 time. A trigger received in Window 2 (OPEN) is a good event. A new watchdog sequence begins immediately after the watchdog receives a trigger in Window 2.

If the MCU stops sending triggers during the watchdog sequence, the watchdog considers this lack of response from the MCU a time-out event (no response event). This sets the TIME_OUT status bit (bit 1 in the WD_STATUS register) and increments the watchdog fail counter. Immediately following a time-out event a new watchdog sequence is started.

The TIME_OUT flag can be useful for the MCU software to resynchronize the watchdog trigger pulse events to the required device watchdog timing. When resynchronizing in this way, the MCU detects the TIME_OUT flag being set. The TIME_OUT flag being set indicates the time-out event and the start of a new watchdog sequence. The MCU should send the trigger with timing so the trigger is in Window 2 (OPEN) of this new watchdog sequence.

NOTE

If an active SPI frame (nCS is low) is present when the time-out event occurs, the TIME_OUT flag is not latched (set) in the WD_STATUS register, but the watchdog fail counter still increments. Because the TIME_OUT flag is not latched, this impacts the resynchronization ability of the MCU and status monitoring. It is recommended to use the synchronization procedure outlined in section Section 5.4.13.

In trigger mode, the watchdog uses a deglitch filter with the tWD_pulse filter time and an internal system clock to create the internally generated watchdog pulse (see Figure 5-6 and Figure 5-7).

The rising edge of the trigger on the ERROR/WDI pin must occur at least the tWD_pulse(max) time before the end of Window 2 (OPEN) to generate a good event.

The window duration times of Window 1 (CLOSE) and Window 2 (OPEN) are programmed through the WD_WIN1_CFG and WD_WIN2_CFG registers when the device is in the DIAGNOSTIC state. In trigger mode, the window duration time are as follows:

Equation 7. tWCW_MIN (Trigger mode) = tWIN1_MIN

where

  • WCW is a watchdog CLOSE window
Equation 8. tWCW_MAX (Trigger mode) = tWIN1_MAX

where

  • WCW is a watchdog CLOSE window
Equation 9. tWOW_MIN (Trigger mode) = tWIN2_MIN

where

  • WOW is a watchdog OPEN window
Equation 10. tWOW_MIN (Trigger mode) = tWIN2_MIN

where

  • WOW is a watchdog OPEN window

Use Equation 1 and Equation 2 to calculate the minimum and maximum values for the tWIN1 = tWCW time period. Use Equation 3 and Equation 4 to calculate the minimum and maximum values for the tWIN2 = tWOW time period.

Writing a new Window 1 or Window 2 time to the WD_WIN1_CFG or WD_WIN2_CFG register immediately begins a new watchdog sequence and increments the watchdog fail counter. A new watchdog sequence is started by a write even when WD_WIN1_CFG register and the WD_WIN2_CFG SPI register are locked because the device is not in DIAGOSTIC state or the SPI command SW_LOCK is blocking a write update to the register values.

The watchdog trigger event is considered a good-event if received during a Window 2 (OPEN) window, and is considered a bad-event if received during Window 1 (CLOSE) window. A good-event ends the current watchdog sequence and starts a new watchdog sequence, therefore the MCU and device watchdog timing stay synchronized.

A good-event, bad-event, time-out event, power-up event, or power-down event ends the current watchdog sequence and starts a new watchdog sequence.

TPS65381A-Q1 Watch_Seq_Tim1_A_lvsbc4.gif
When a good event is received in Window 2, 1 system clock-cycle (250 ns, typical) later the next watchdog sequence begins. Therefore the actual length of Window 2 depends on when the MCU sends the good event.
Figure 5-6 Example Cases for Good-Events in Trigger Mode
TPS65381A-Q1 Watch_Seq_Tim1_B_lvsbc4.gif
When a time-out event occurs, 1 system clock-cycle (250 ns, typical) later, the next watchdog sequence begins.
WD_RST_EN = 0 per default. To enable a reset from the watchdog once WD_FAIL_CNT[2:0] = 7 +1, WD_RST_EN must be set to 1. The notation WD_FAIL_CNT[2:0] = 7 +1 means the next (+ 1) bad event or time-out event if WD_FAIL_CNT[2:0] = 7 while WD_RST_EN = 1 will cause a transition to the RESET state. However, when WD_RST_EN = 0, the WD_FAIL_CNT[2:0] counter does not increment past 7 and the watchdog does not cause a transition to the RESET state.
When a bad event is received in Window 1, 1 system clock-cycle (250 ns, typical) later the next watchdog sequence begins. Therefore the actual length of Window 1 depends on when the MCU sends the bad event.
Figure 5-7 Example Cases for Bad-Event and Time-out Events in Trigger Mode

Q&A Mode

Setting the WD_CFG bit in the SAFETY_FUNC_REG register to 1 when the device is in the DIAGNOSTIC state configures the watchdog for Q&A (question and answer) mode. In Q&A mode, the device provides a question (or TOKEN) for the MCU in the WD_TOKEN_VALUE register. The MCU performs a fixed series of arithmetic operations on the question to calculate the required 32-bit answer. This answer is split into four answer bytes or responses. The MCU writes these answer bytes through SPI one byte at a time into the WD_ANSWER register. The device verifies that the MCU returned the answer bytes within the specified timing windows, and that the answer bytes are correct.

A good event occurs when the MCU sends the correct answer bytes calculated for the current question within the correct watchdog window and in the correct order.

A bad event occurs when one of the events that follows occur:

  • The MCU sends the correct answer bytes, but not in the correct watchdog window.
  • The MCU sends incorrectly calculated answer bytes.
  • The MCU returns correct answer bytes in the wrong order (sequence).

If the MCU stops sending answer bytes during the watchdog sequence, the watchdog considers this lack of response from the MCU a time-out event (no response event). This sets the TIME_OUT status bit (bit 1 in the WD_STATUS register) and increments the watchdog fail counter. Immediately following a time-out event a new watchdog sequence is started.

The TIME_OUT flag can be useful for the MCU software to resynchronize the watchdog answer timing to the required device watchdog timing. When resynchronizing in this way, the MCU detects the TIME_OUT flag being set. The TIME_OUT flag being set indicates the time-out event and the start of a new watchdog sequence. The MCU should send the answer bytes with timing so they will be in the correct windows of the new watchdog sequence.

NOTE

If an active SPI frame (nCS is low) is present when the time-out event occurs, the TIME_OUT flag is not latched (set) in the WD_STATUS register, but the watchdog fail counter is still incremented. Because the TIME_OUT flag is not latched this impacts the resynchronization ability of the MCU and status monitoring. It is recommended to use the synchronization procedure outlined in section Section 5.4.13.

NOTE

In Q&A mode, each watchdog sequence starts with Window 1 (OPEN) followed by Window 2 (CLOSE). The OPEN and CLOSE references for Q&A mode are reversed with respect to those of trigger mode, but the order of the Window 1 and Window 2 is the same as are the registers containing the setting for each window, WD_WIN1_CFG and WD_WIN2_CFG.

Watchdog Q&A Related Definitions

The Q&A mode definitions are:

    Question (Token) The question (token) is a 4-bit word (see Section 5.4.15.3).

    The watchdog provides the question (token) to the MCU when the MCU reads the question (TOKEN[3:0]) from the WD_TOKEN_VALUE register.

    The MCU can request each new question (token) at the start of the watchdog sequence, but this is not required to calculate the answer. The MCU can also generate the question by implementing the question generation circuit as shown in Figure 5-9. Nevertheless, the answer and, therefore the answer bytes, are always based on the question generated inside the watchdog of the device. So, if the MCU generates a wrong question and gives answer bytes calculated from a wrong question, the watchdog detects a bad event.

    A new question (token) is generated only when a good event occurred in the previous watchdog sequence causing the token counter (internal counter) to increment and generate a new question (token) as shown in figure Figure 5-9.

    Answer (Response) The answer (response) is a 32-bit word that is split into four answer bytes or responses: Answer-3 (WD_TOKEN_RESP_3), Answer-2 (WD_TOKEN_RESP_2), Answer-1 (WD_TOKEN_RESP_1), and Answer-0 (WD_TOKEN_RESP_0).

    The watchdog receives an answer byte when the MCU writes to the watchdog answer register (the WD_ANSW[7:0] bits in the WD_ANSWER register).

    For each question, the watchdog requires four correct answer bytes from the MCU in the correct timing and order (sequence). Answer-3, Answer-2, and Answer-1 can be in Window 1 or Window 2 in the correct order, and Answer-0 must be in Window 2 to be detected as a good event.

Watchdog Sequence in Q&A Mode

The watchdog sequence in Q&A mode ends after the MCU writes the fourth answer byte, Answer-0 (WD_TOKEN_RESP_0), or after a time-out event. A new watchdog sequence starts after the previous watchdog sequence ends.

The window duration times of Window 1 (OPEN) and Window 2 (CLOSE) are programmed through the WD_WIN1_CFG and WD_WIN2_CFG registers when the device is in the DIAGNOSTIC state. In Q&A mode, the window duration time are as follows:

Equation 11. tWOW_MIN (Q&A mode) = tWIN1_MIN

where

  • WOW is a watchdog OPEN window
Equation 12. tWOW_MAX (Q&A mode) = tWIN1_MAX

where

  • WOW is a watchdog OPEN window
Equation 13. tWCW_MIN (Q&A mode) = tWIN2_MIN

where

  • WCW is a watchdog CLOSE window
Equation 14. tWCW_MIN (Q&A mode) = tWIN2_MIN

where

  • WCW is a watchdog CLOSE window

Use Equation 1 and Equation 2 to calculate the minimum and maximum values for the tWIN1 = tWOW time period. Use Equation 3 and Equation 4 to calculate the minimum and maximum values for the tWIN2 = tWCW time period.

Writing a new Window 1 or Window 2 time to the WD_WIN1_CFG or WD_WIN2_CFG register immediately begins a new watchdog sequence and increments the watchdog fail counter. A new watchdog sequence is started by a write even when WD_WIN1_CFG register and the WD_WIN2_CFG SPI register are locked because the device is not in DIAGOSTIC state or the SPI command SW_LOCK is blocking a write update to the register values.

TPS65381A-Q1 WDT_Token_Source_lvsbc4.gif
The MCU is not required to read the question (token). The MCU can begin giving the correct answer bytes Answer-3, Answer-2, Answer-1, anywhere in Window 1 or Window 2. The new question (token) is generated and a new watchdog sequence started within 1 system clock cycle after the final Answer-0 as long as the answer was a good event. A bad event or time-out event causes a new watchdog sequence to start, however a new question (token) is not generated.
The MCU can put other SPI commands in-between the WR_WD_ANSWER commands (even rerequesting the question). These SPI commands have no influence on the detection of a good event, as long as the four correct answer bytes are in the correct order, and the fourth correct answer byte is provided in Window 2.
Figure 5-8 Watchdog Sequence in Q&A Mode

Question (Token) Generation

The watchdog uses a 4-bit token counter (TOKEN_CNT[3:0] bits in Figure 5-9), and a 4-bit Markov chain to generate a 4-bit question (token). The MCU can read this question in the WD_TOKEN_VALUE register, TOKEN[3:0] bits. The watchdog generates a new question when the token counter increments, which only occurs when the watchdog detects a good event. The watchdog does not generate a new question when it detects a bad event or a time-out event. The watchdog does not generate a new question for a watchdog sequence that starts after the MCU writes to the WD_WIN1_CFG or WD_WIN2_CFG registers.

The token counter provides a clock pulse to the Markov chain when it transitions from 1111b to 0000b. The question counter and the Markov chain are set to the singular default value of 0000b when the device completes the LBIST (either a manual LBIST run or the automotive LBIST run initiated on the transition from the RESET to DIAGNOSTIC state). To leave the singular point, the feedback logic combination is implemented.

Figure 5-9 shows the logic combination for the question (token) generation. The question is in the WD_TOKEN_VALUE register, TOKEN[3:0] bits.

The logic combination of the token counter with the WD_ANSW_CNT[1:0] status bits (in the WD_STATUS register) generates the reference answer bytes as shown in Figure 5-9.

TPS65381A-Q1 Watchdog_Token_Gen_SLVSBC4.gif
A value of 0000b is a special seed and equates to 0001b, including the default loading of 0000b during power up.
Figure 5-9 Watchdog Question (Token) Generation
TPS65381A-Q1 Watchdog_Token_Calc_lvsbc4.gif Figure 5-10 Watchdog Answer Calculation

Answer Comparison and Reference Answer

The 2-bit, watchdog-answer counter, WD_ANSW_CNT[1:0], in the WD_STATUS register counts the number of received answer bytes and controls the generation of the reference Answer-x byte as shown in Figure 5-10. At the start of each watchdog sequence, the default value of the WD_ANSW_CNT[1:0] is 11b to indicate that the watchdog expects the MCU to write Answer-3 (WD_RESP_3) in the WD_ANSWER register.

Sequence of the 2-bit Watchdog Answer Counter

The sequence of the 2-bit, watchdog answer counter, WD_ANSW[1:0], is as follows for each counter value:

  • WD_ANSW_CNT[1:0] = 11b:
    • The watchdog calculates reference Answer-3
    • A write access occurs: the MCU writes Answer-3 (WD_TOKEN_RESP_3) byte in the WD_ANSWER register.
    • The watchdog compares the reference Answer-3 with the Answer-3 byte in the WD_ANSWER register.
    • The watchdog decrements the WD_ANSW_CNT[1:0] bits to 10b and updates the ANSWER_ERR flag bit.
  • WD_ANSW_CNT[1:0] = 10b:
    • The watchdog calculates reference Answer-2
    • A write access occurs: the MCU writes Answer-2 (WD_TOKEN_RESP_2) byte in the WD_ANSWER register.
    • The watchdog compares the reference Answer-2 with the Answer-2 byte in the WD_ANSWER register.
    • The watchdog decrements the WD_ANSW_CNT[1:0] bits to 01b and updates the ANSWER_ERR flag bit.
  • WD_ANSW_CNT[1:0] = 01b:
    • The watchdog calculates reference Answer-1
    • A write access occurs: the MCU writes Answer-1 (WD_TOKEN_RESP_1) byte in the WD_ANSWER register.
    • The watchdog compares the reference Answer-1 with the Answer-1 byte in the WD_ANSWER register.
    • The watchdog decrements the WD_ANSW_CNT[1:0] bits to 00b and updates the ANSWER_ERR flag bit.
  • WD_ANSW_CNT[1:0] = 00b:
    • The watchdog calculates reference Answer-0
    • A write access occurs: the MCU writes Answer-0 (WD_TOKEN_RESP_0) byte in the WD_ANSWER register.
    • The watchdog compares the reference Answer-0 with the Answer-0 byte in the WD_ANSWER register.
    • The watchdog updates the ANSWER_ERR flag bit.
    • The watchdog starts a new watchdog sequence and sets the WD_ANSW_CNT[1:0] to 11b.

Table 5-11 Set of Questions (Tokens) and Corresponding Answer Bytes Using Default Setting of WD_TOKEN_FDBK Register

QUESTION (TOKEN) IN WD_TOKEN_VALUE REGISTER WD ANSWER (TO BE WRITTEN INTO WD_ANSW REGISTER)
Answer-3 (WD_TOKEN_ RESP_3) Answer-2 (WD_TOKEN_ RESP_2) Answer-1 (WD_TOKEN_ RESP_1) Answer-0 (WD_TOKEN_ RESP_0)
TOKEN [3:0] WD_ANSW_CNT
[1:0] = 11b
WD_ANSW_CNT
[1:0] = 10b
WD_ANSW_CNT
[1:0] = 01b
WD_ANSW_CNT
[1:0] = 00b
0h FFh 0Fh F0h 00h
1h B0h 40h BFh 4Fh
2h E9h 19h E6h 16h
3h A6h 56h A9h 59h
4h 75h 85h 7Ah 8Ah
5h 3Ah CAh 35h C5h
6h 63h 93h 6Ch 9Ch
7h 2Ch DCh 23h D3h
8h D2h 22h DDh 2Dh
9h 9Dh 6Dh 92h 62h
Ah C4h 34h CBh 3Bh
Bh 8Bh 7Bh 84h 74h
Ch 58h A8h 57h A7h
Dh 17h E7h 18h E8h
Eh 4Eh BEh 41h B1h
Fh 01h F1h 0Eh FEh

Watchdog Q&A Mode Sequence Events and WD_STATUS Register Updates

The watchdog sequence events are as follows for the different scenarios listed:

  • A good event occurs when all answer bytes are correct in value (the ANSWER_ERR bit is cleared to 0) and timing. For such a good event, then the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], decrements by one.
    • The token counter increments by one, causing a new question (token) to be generated.
    • The SEQ_ERR bit resets.
    • The ANSWER_EARLY bit resets.
  • A bad event occurs when all answer bytes are correct in value (the ANSWER_ERR bit is cleared to 0) but not in correct timing. For such a bad event, then the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], increments by one.
    • The token counter does not change, thus the question (token) does not change.
    • The SEQ_ERR bit is set.
    • The ANSWER_EARLY bit is set.
  • A bad event occurs when one or more of the answer bytes are not correct in value (the ANSWER_ERR bit is set to 1) but in correct timing. For such a bad event, then the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], increments by one.
    • The token counter does not change, thus the question (token) does not change.
    • The SEQ_ERR bit is set
    • The ANSWER_EARLY bit is reset
  • A bad event occurs when one or more of the answer bytes are not correct in value (the ANSWER_ERR status bit is set to 1) and not in correct timing. For such a bad event, then the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], increments by one
    • The token counter does not change, thus the question (token) does not change.
    • The SEQ_ERR bit is set.
    • The ANSWER_EARLY bit is set.
  • In case a time-out event occurs, then the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], increments by one.
    • The token counter does not change, thus the question (token) does not change.
    • The TIME_OUT bit is set.
  • In case the MCU writes to registers WD_WIN1_CFG or WD_WIN2_CFG, the events that follow occur:
    • The watchdog fail counter, WD_FAIL_CNT[2:0], increments by one.
    • The WD_CFG_CHG bit is set.

Table 5-12 WD_STATUS Bits Versus Possible Watchdog Sequence Events

WATCHDOG SEQUENCE EVENTS WD_STATUS REGISTER BITS
All MCU Answer Bytes Correct? Answer-0 Arrived During WINDOW 2 (CLOSE) Answer-0 Arrived During WINDOW 1 (OPEN) Time-out Occurred While Waiting for Answer? WINDOW 1 or WINDOW 2 Duration Changed? WD_CFG_CHG SEQ_ERR TIME_OUT ANSWER_EARLY
Yes Yes No No No 0 0 0 0
Yes No Yes No No 0 0 0 1
No Yes No No No 0 1 0 0
No No Yes No No 0 1 0 1
Yes (first 3 Answer-x) No No Yes No 0 0 1 0
No No No Yes No 0 1 1 0
Yes 1 0 0 0

MCU Error Signal Monitor (MCU ESM)

This block monitors the external MCU error conditions signaled from the MCU to the device through the ERROR/WDI input pin. The MCU ESM is configurable to monitor two different signaling options depending which functional safety architecture MCU family is being monitored and how the specific MCU family indicates on the error or fault output pin improper operation. The MCU ESM mode is selected through the ERROR_CFG bit in the SAFETY_FUNC_CFG register.

In TMS570 mode the ESM detects a low-pulse signal with a programmable low-pulse duration threshold (see Section 5.4.16.1). This mode is selected when the ERROR_CFG bit is set to 1. In PWM mode the ESM detecting a PWM signal with a programmable frequency and duty cycle (see Section 5.4.16.2). This mode is selected when the ERROR_CFG bit is cleared to 0 (default). PWM mode can be used as an external clock-monitor function.

The MCU ESM is deactivated by default. To activate it, clear the NO_ERROR bit to 0 in the SAFETY_CHECK_CTRL register.

NOTE

Activating the MCU ESM is only recommended when the watchdog is configured in Q&A mode, otherwise the ERROR/WDI pin is used both for watchdog trigger input and MCU error signaling.

The low-signaling duration threshold (for TMS570 mode) or the expected PWM low-pulse duration (for PWM mode) is set through the SAFETY_ERR_PWM_L register. The expected PWM high-pulse duration (for PWM mode) is set through the SAFETY_ERR_PWM_H register. A detected MCU signaling error is indicated when the ERROR_PIN_FAIL bit in the SAFETY_ERR_STAT register is set to 1.

NOTE

An update to a SAFETY_ERR_PWM_x register (only possible in the DIAGNOSTIC state) has an immediate effect. Therefore, if the MCU writes a new value to the SAFETY_ERR_PWM_x register which is less than the value of the current pulse-duration counter value, the MCU ESM immediately detects an error condition on the ERROR/WDI pin. The pulse duration counter then reinitializes to 0 and sets the ERROR_PIN_FAIL bit to 1.

When the TPS65381A-Q1 device is in the DIAGNOSTIC state, the MCU can emulate a signaling error (emulated fault-injection) for a diagnostic check of the error-signal monitor by checking the status of the ERROR_PIN_FAIL bit while the NO_ERROR bit is cleard to 0 (MCU ESM enabled) without a transition to the SAFE state.

NOTE

To perform an MCU ESM diagnostic check of the pin while in the DIAGNOSTIC state the following procedure can be used. The ERROR/WDI pin is edge triggered.

  1. Clear the ERROR_PIN_FAIL bit by clearing it to 0 in the SAFETY_ERR_STAT register.
  2. Verify the ERROR_PIN_FAIL bit is not reset to 1 when the MCU ESM is enabled.
  3. Inject a failure on the ERROR/WDI pin specific to the MCU ESM mode of operation.
  4. Verify the ERROR_PIN_FAIL bit is set to 1 and the ENDRV pin is low even if the ENABLE_DRV bit is set to 1.
  5. Remove the injected failure.
  6. Write 0 to clear the ERROR_PIN_FAIL bit.
  7. Confirm the ERROR_PIN_FAIL bit was cleared by reading back the SAFETY_ERR_STAT register.
  8. Confirm the ENDRV pin returned HIGH when the ENABLE_DRV bit is set to 1, assuming no other conditions exist that block ENDRV from being HIGH (see Figure 5-14).

When the TPS65381A-Q1 device is in the ACTIVE state, a detected MCU signaling error causes a transition to the SAFE state. A dedicated 4-bit error counter, the DEV_ERR_CNT[3:0] bits in the SAFETY_ERR_STAT register, counts the transitions from the ACTIVE state to the SAFE state.

The module is covered by the logic BIST (LBIST).

TMS570 Mode

An error condition is detected when the ERROR/WDI pin remains low longer than the programmed amount of time set by the SAFETY_ERR_PWM_L register. The programmable time range is 5 µs to 1.28 ms (typical), with 5-µs steps (±5%).

The SAFETY_ERR_PWM_L register must be set to the desired value based on the maximum required time for the TMS570 MCU to detect an error or fault and to potentially recover from or correct the error or fault.

The LOW duration time is as follows:

Equation 15. tTMS570_LOW_MIN = (PWML[7:0]) × 5 µs × 0.95
Equation 16. tTMS570_LOW_MAX= (PWML[7:0] + 1) × 5 µs × 1.05

Use Equation 15 and Equation 16 to calculate the minimum and maximum values for the LOW duration, tTMS570_LOW. Figure 5-11 shows the error-detection case scenarios.

NOTE

The SAFETY_ERR_PWM_L register (PWML[7:0]) should be configured with a minimum of 1 (01h) in the register.

The low-pulse monitoring on the ERROR/WDI pin is implemented as follows:

  • When the NO_ERROR bit is cleared to 0, every falling edge on the ERROR/WDI pin reinitializes the low-pulse duration counter to 0 within one system clock-cycle (250 ns ±5%).
  • After reinitialization, the low-pulse counter restarts one system clock-cycle (250 ns ±5%).
  • The low-pulse duration counter increases every 5 µs (with ±5% accuracy) as long as the ERROR/WDI pin is low. A rising edge on the ERROR/WDI pin stops the low-pulse duration counter.
  • When low-pulse duration counter is equal to the SAFETY_ERR_PWM_L register setting, an error is detected.

The ERROR_PIN_FAIL bit in the SAFETY_ERR_STAT register is set within one system clock cycle (250 ns ± 5%) after detecting an MCU signaling error. When the device is in the ACTIVE state, a transition to the SAFE state occurs after one more system clock-cycle.

TPS65381A-Q1 Error_Det_MCU_lvsbc4.gif Figure 5-11 Error Detection Case Scenarios in TMS570 Mode

PWM Mode

An error condition is detected when one of the following occurs on the ERROR/WDI pin:

  • The ERROR/WDI pin high-pulse duration exceeds the threshold value programmed by the PWM_H register.
  • The ERROR/WDI pin low-pulse duration exceeds the threshold value programmed by the PWM_L register.

The MCU ESM does NOT detect an MCU signaling error on the ERROR/WDI pin if both of the following occurs:

  • The ERROR pin high-pulse duration is less than the threshold value programmed by the PWM_H register.
  • The ERROR pin low-pulse duration is less than the threshold value programmed by the PWM_L register.

The programmable time range for the expected HIGH and LOW pulse duration is 15 µs to 3.8 ms (typical), with 15-µs resolution steps (±5%). The HIGH and LOW pulse duration times are programmed through the SAFETY_ERR_PWM_H and SAFETY_ERR_PWM_L registers when the device is in the DIAGNOSTIC state. The pulse duration time are as follows:

Equation 17. tPWM_HIGH_MIN = (PWMH[7:0]) × 15 µs × 0.95
Equation 18. tPWM_HIGH_MAX = (PWMH[7:0] + 1) × 15 µs × 1.05
Equation 19. tPWM_LOW_MIN = (PWML[7:0]) × 15 µs × 0.95
Equation 20. tPWM_LOW_MAX= (PWML[7:0] + 1) × 15 µs × 1.05

Use Equation 17 and Equation 18 to calculate the minimum and maximum values for the HIGH pulse duration, tPWM_HIGH. Use Equation 19 and Equation 20 to calculate the minimum and maximum values for the LOW pulse duration, tPWM_LOW.

NOTE

The SAFETY_ERR_PWM_H (PWMH[7:0]) and SAFETY_ERR_PWM_L (PWML[7:0]) register should be configured with a minimum of 1 (01h) in the registers.

The monitoring of the high-pulse duration and low-pulse duration is implemented as follows:

LOW pulse monitoring:

  • Every falling edge on the ERROR/WDI pin, or setting the NO_ERROR bit from 1 to 0 when the ERROR/WDI pin is low, reinitializes the low-pulse duration counter to 0 within one system clock-cycle (250 ns ±5%).
  • After reinitialization, the low-pulse counter restarts after one system clock-cycle (250 ns ±5%).
  • The low-pulse duration counter increases every 15 µs (±5%) while the ERROR/WDI pin remains low.
  • When the low-pulse duration counter is equal to the SAFETY_ERR_PWM_L register setting, an error is detected.

HIGH pulse monitoring:

  • Every rising edge on the ERROR/WDI pin, or setting the NO_ERROR bit from 1 to 0 when the ERROR/WDI pin is high, reinitializes the high-pulse duration counter to 0 within one system clock-cycle (250 ns ±5%).
  • After reinitialization, the high-pulse counter restarts after one system clock-cycle (250 ns ±5%).
  • The high-pulse duration counter increases every 15 µs (with ± 5% accuracy) while the ERROR/WDI pin remains high.
  • When the high-pulse duration counter is equal to the SAFETY_ERR_PWM_H register setting, an error is detected.

NOTE

The ERROR/WDI pin is edge triggered, to synchronize the MCU to the MCU ESM module, while in the DIAGNOSTIC state the MCU should start sending the desired PWM signal. On the first falling or rising edge the MCU ESM detects the edge and starts the internal timers in sync with the edge so the MCU and MCU ESM are synchronized. The MCU ESM resynchronizes to the MCU on every rising and falling edge. While in the DIAGNOSTIC state, when synchronization has occurred the ERROR_PIN_FAIL flag should be cleared.

The ERROR_PIN_FAIL bit in the SAFETY_ERR_STAT register is set within one system clock cycle (250 ns ±5%) after detecting an MCU signaling error. When the device is in the ACTIVE state, a transition to the SAFE state occurs after one more system clock-cycle.

TPS65381A-Q1 ERROR_Pin_lvsbc4.gif Figure 5-12 Error Detection Case Scenarios in PWM Mode

Device Configuration Register Protection

This function offers a mechanism to help protect safety SPI-mapped registers by means of SPI write-access protection and CRC check.

The register access protection includes two distinctive features:

  • A register cannot be written after write-access lock protection is set. The lock is cleared by software or by a power-on reset.
  • CRC protection for configuration registers.

A CRC occurs on safety data after a SPI write updates to verify the SPI register contents are correctly programmed. The CRC controller is a diagnostic module, which performs the CRC to verify the integrity of the SPI-mapped register space. A signature representing the content of the safety registers is obtained when the content is read into the CRC controller. The responsibility of the CRC controller is to calculate the signature for a set of data and then compare the calculated signature value against a predetermined good-signature value. The predetermined CRC signature value is stored in the SAFETY_CFG_CRC register. The external MCU uses the SAFETY_CHECK_CTRL register to enable a CRC check and the SAFETY_STAT_2 register to monitor the status. When enabled, a CRC check on the configuration registers is performed. In case of a detected signature error, the CFG_CRC_ERR flag is set in the SAFETY_STAT_2 SPI register. The device state and the ENDRV pin state remain unchanged. In case of a detected checksum error with the TPS65381A-Q1 device in the DIAGNOSTIC state, clearing the CFG_CRC_EN bit to 0 brings the TPS65381A-Q1 device into the SAFE state (the ENDRV pin is pulled low).

A standard CRC-8 polynomial is used: X8 + X2 + X1 + 1

The CRC monitor test is covered by a logic BIST.

A 64-bit string is protected by CRC. The following registers are protected:

  • SAFETY_FUNC_CFG
  • DEV_REV
  • SAFETY_PWD_THR_CFG
  • SAFETY_ERR_CFG
  • WD_TOKEN_FDBK
  • WD_WIN2_CFG
  • WD_WIN1_CFG
  • SAFETY_ERR_PWM_L
  • DEV_CFG2
  • DEV_CFG1 (only bit number 6)

Table 5-13 lists the CRC bus structure.

Table 5-13 CRC Bus Structure

REGISTER NAME 64-BIT BUS ORDERING
SAFETY_FUNC_CFG [6:0] [63:57]
DEV_REV [7:0] [56:49]
SAFETY_PWD_THR_CFG [3:0] [48:45]
SAFETY_ERR_CFG [7:0] [44:37]
WD_TOKEN_FDBK [7:0] [36:29]
WD_WIN2_CFG [4:0] [28:24]
WD_WIN1_CFG [6:0] [23:17]
SAFETY_ERR_PWM_L [7:0] [16:9]
DEV_CFG2 [7:0] [8:1]
DEV_CFG1 [6] 0

In the external MCU, the CRC calculation must be performed byte-wise, starting with the lowest byte of the 64-bit bus ordering value. The most significant bit is first in the bit order. The resulting CRC of one calculation is the seed value for the next calculation. The initial seed value is FFh. The CRC result of the eighth byte-wise calculation is the CRC signature value, which must be stored in the SAFETY_CFG_CRC register (see Figure 5-13).

TPS65381A-Q1 64-bit_bus_slvsbc4.gif Figure 5-13 CRC Calculation Logic

Table 5-14 lists some CRC calculation examples.

Table 5-14 CRC Calculation Examples

64-BIT BUS ORDERING VALUE CRC-8 RESULT
0000 0000 0000 0000h DBh
FFFF FFFF FFFF FFFFh 0Ch
0A0A 0505 0A0A 0505h D4h
0505 0A0A 0505 0A0Ah 17h
A0A0 5050 A0A0 5050h 2Bh
0A23 E000 18FE 7B80h 1Bh

In case the CRC controller detects a signature error on the configuration registers, care must be used when performing an EEPROM CRC afterwards. In case of a detected signature error in the configuration registers, the device reports an EEPROM signature error when the CFG_CRC_EN bit in the SAFETY_CHECK_CTRL register is cleared to 0 first before performing the EEPROM CRC by setting the EE_CRC_CHK bit in the SAFETY_BIST_CTRL register to 1, even when the EEPROM bits do not have an error. Therefore, when performing an EEPROM CRC after a CRC on the configuration registers, the steps must always occur in the following order:

  1. Calculate CRC8 in the MCU and store it in the SAFETY_CFG_CRC register.
  2. Set the CFG_CRC_EN bit in the SAFETY_CHECK_CTRL register to 1 to perform a CRC on the configuration registers.
  3. After the SPI command sets the CFG_CRC_EN bit to 1 (for example, after rising edge on NCS), wait at least 2.1 µs for the configuration register to complete the CRC.
  4. Read the results of the configuration register CRC in the SAFETY_STAT_2 register, bit CFG_CRC_ERR. If continuous CRC on the configuration register must be performed, clear the CFG_CRC_EN bit in the SAFETY_CHECK_CTRL register to 0 and repeat beginning with Step 1. If the CRC on the EEPROM registers must be performed, proceed to Step 5.
  5. NOTE

    A correct EEPROM CRC afterwards (as described in Step 5) clears this CFG_CRC_ERR bit. Therefore, TI recommends reading out this CFG_CRC_ERR bit before performing the EEPROM CRC.

  6. Set the EE_CRC_CHK bit in the SAFETY_BIST_CTRL register to 1 to perform the CRC on the EEPROM registers.
  7. After the SPI command sets the EE_CRC_CHK bit to 1 (for example, after rising edge on NCS), wait at least 811 µs for the EEPROM CRC to finish.
  8. Completion of the EERPOM CRC is observed by reading the EE_CRC_CHK bit. When the EEPROM CRC is complete, this EE_CRC_CHK bit is cleared to 0.
  9. Clear the CFG_CRC_EN bit in the SAFETY_CHECK_CTRL register to 0
  10. Read the results of the EEPROM CRC in the SAFETY_STAT_2 register, bit EE_CRC_ERR.
  11. Go back to Step 1.
  12. NOTE

    Returning to Step 1 is not required; returning to Step 2 is also an option.

    NOTE

    While in the DIAGNOSTIC state, a check can be performed to confirm the CFG_CRC_ERR bit is set to 1 on a mismatch between the value stored in the SAFETY_CFG_CRC register and the value that is calculated from the configuration registers covered by the CRC8. If the CFG_CRC_EN is cleared while the CFG_CRC_ERR bit is set to 1, then the device transitions to the SAFE state, set the EE_CRC_ERR bit and clear the CFG_CRC_EN bit. To avoid this transition to the SAFE state, the CFG_CRC_ERR bit must be cleared by running the EEPROM CRC by setting the EE_CRC_CHK bit. While the EPPROM CRC is running, the EE_CRC_ERR bit is set. Assuming the EEPROM CRC was good, both the EE_CRC_ERR and CFG_CRC_ERR bits are cleared. To check if the CFG_CRC_ERR bit is 0 for a matching CRC, the matching CRC value should be stored in the SAFETY_CFG_CRC register. Then the CFG_CRC_EN bit must be cleared to 0 and set again to 1 which reruns the CRC on the configuration registers, resulting in the CFG_CRC_ERR bit being 0.

Enable and Reset Driver Circuit

Figure 5-14 shows the reset and enable circuit.

TPS65381A-Q1 Reset_En_Circ_SLVSBC4.gif Figure 5-14 Reset and Enable Circuit

The ENDRV pin features a read-back circuit to compare the external ENDRV level with the internally applied ENDRV level. This feature detects any possible failure in the ENDRV pullup or pulldown components. A failure is detected by the MCU through the ENDRV_ERR bit (bit 1 in the SAFETY_STAT_4 register).

The ENDRV pin is pulled low for the ABIST duration time (approximately 300 µs) when activating the ABIST function after the ENDRV output is turned on and driven high. This is part of ENDRV diagnostics to validate all monitoring functions that disable the ENDDRV output and confirm that the ENDRV output is controllable by using the ENDRV read-back path.

The NRES pin features a readback of the external NRES level. The value is read on the DIAG_OUT pin and NRES_ERR bit (bit 5 in the SAFETY_STAT_3 register)..

For both the ENDRV pin and the NRES pin, the logic read-back threshold level is typically 400 mV.

Figure 5-15 shows the timing-response diagram for the NRES and ENDRV pins to any VDDx undervoltage or overvoltage condition.

TPS65381A-Q1 Tim-Resp_A_SLVSBC4.gif
The signal deglitch time is defined for each undervoltage or overvoltage condition as given in Section 4.
The NRES extension time is defined by the external resistor value as given in Section 4.
Figure 5-15 Timing-Response Diagram for NRES and ENDRV Pins to any VDDx Undervoltage or Overvoltage Condition

Device Operating States

TPS65381A-Q1 Dev_Ctl_St_Diag_SLVSBC4.gif
RESET State: SPI, Watchdog and MCU ESM are in reset; see Section 5.4.21 section for conditions that prevent the wake up from the STANDBY state to the RESET state.
DIAGNOSTIC State: BIST (LBIST with ABIST) is initiated on the transition into the DIAGNOSTIC state. See Section 5.4.22 for options to disable automatic BIST run, the DIAGNOSTIC state time-out and diagnostics the MCU may perform on safety functions. WD_FAIL_CNT reinitializes to 5 on transition into the DIAGNOSTIC state.
ACTIVE State: WD_FAIL_CNT reinitializes to 5 during transition into the ACTIVE state. During the ACTIVE state the MCU may perform diagnostics of some safety functions, see Section 5.4.23 for more details.
SAFE State: DEV_ERR_CNT[3:0] increments on any transition to the SAFE state. See Section 5.4.24 for details on SAFE state time-out.
The ENDRV pin level is dependent on the ENABLE_DRV bit, WD_FAIL_CNT[2:0] counter value, and VDDx_OV as shown in Figure 5-14 in the DIAGNOSTIC and ACTIVE states.
The VDD5 and VSOUT1 regulators may be enabled or disabled in the DIAGNOSTIC, ACTIVE, and SAFE states.
Figure 5-16 Device Controller State Diagram

STANDBY State

The STANDBY state is the default state when the device is supplied by the VBATP and VBAT_SAFING supplies. This state has the characteristics that follow:

  • All regulators are disabled
  • The NRES and ENDRV pins are low.
  • The device transitions to the STANDBY state from any state because of the following:
    • Internal power-on reset event (NPOR = 0)
    • VBATP undervoltage event (VBATP_UV)
    • Deglitched IGN = 0 and IGN_PWRL = 0 (cleared IGN power-latch control bit) and CANWU_L = 0
    • Loss-of-clock detection (LOCLK)
    • VDD3/5 overtemperature event (VDD3/5_OT) while NMASK_VDD3/5_OT = 1
    • DVDD undervoltage event (DVDD_UV)
    • DVDD overvoltage event (DVDD_OV)
    • AVDD_VMON overvoltage or undervoltage event (AVDD_VMON_ERR)
    • VCP12 overvoltage event (VCP12_OV)
    • VCP17 overvoltage event (VCP17_OV)
    • Error with band gaps: BG_ERR1 or BG_ERR2
    • EEPROM check fails during run after exit from NPOR event (EE_CRC_ERR = 1 when EE_CRC_CHK is run on exit from NPOR)
    • The device error count (DEV_ERR_CNT[3:0]) is greater than or equal to the programmed power-down threshold, PWD_THR[3:0]

RESET State

The RESET state has the characteristics that follow:

  • This state is entered from the STANDBY state after a wake-up request from ignition (IGN pin = high, deglitched IGN bit = 1) or CANWU pin (CANWU pin = high, deglitched and latched CANWU_L bit = 1). The following conditions would prevent the transition from the STANDBY state to the RESET state even if a wake-up request occurred:
    • BG_ERR1
    • BG_ERR2
    • VCP17_OV
    • VCP12_OV
    • AVDD_VMON_ERR
    • EE_CRC_CHK fails
  • This state is entered from the SAFE state after a SAFE state time-out occurs and the DEV_ERR_CNT[3:0] counter is less than the programmed SAFE_LOCK_THR[3:0] + 1. See Section 5.4.24 for details on the SAFE state time-out duration which is set by the SAFE_TO[2:0] and NO_SAFE_TO bits.
  • The device transitions to the RESET state from any other state because of the following:
    • VDD3/5 undervoltage event (VDD3/5_UV)
    • VDD5 overtemperature event (VDD5_OT) when NMASK_VDD5_OT = 1
    • VDD1 undervoltage event (VDD1_UV) when NMASK_VDD1_UV_OV = 1 (not default)
    • VBATP overvoltage event (VBATP_OV) when MASK_VBATP_OV = 0 (default)
    • Watchdog reset. A watchdog reset occurs after the watchdog fail counter (WD_FAIL_CNT[2:0]) has reached a value of 7 and another bad event occurs (7+1) which sets the WD_FAIL flag when WD_RST_EN = 1 (not default)
    • POST_RUN_RST = 1 and IGN_PWRL = 1 and a recrank (LOW followed by a valid HIGH) on IGN pin
  • The VDDx regulators are powered on.
  • The NRES and ENDRV pins are low.
  • The SPI, watchdog, and MCU ESM are in reset.

DIAGNOSTIC State

The DIAGNOSTIC state has the characteristics that follow:

  • The DIAGNOSTIC state is entered from the RESET state after the VDDx regulators have ramped-up and the reset extension is complete
  • The VDD5 (enabled by default) regulator can be disabled by the VDD5_EN bit, and the VSOUT1 regulator can be enabled (disabled by default) by the VSOUT1_EN bit.
  • The NRES pin is HIGH.
  • The state of the ENDRV pin is determined by the ENABLE_DRV bit, WD_FAIL_CNT[2:0] counter value, and the overvoltage monitoring for the VDDx regulators (VDDx_OV) as shown in Figure 5-14.
  • The watchdog and MCU error signal monitoring (ESM) functions can be configured and operated. The MCU ESM module does not cause a transition to the SAFE state from the DIAGNOSTIC state when an emulated failure on the ERROR/WDI pin is detected. This allows the MCU to run diagnostics on the MCU ESM and ERROR/WDI pin during the DIAGNOSTIC state.
  • This state is where the MCU should perform all device self-tests and diagnostics (failures are induced to emulate internal failures and confirm detection).
  • Upon entry of the DIAGNOSTIC state, the watchdog fail counter is reinitialized to 5.
  • The BIST (LBIST with ABIST) is activated with the transition out of the RESET state into the DIAGNOSTIC including a power up event from the STANDBY state. This automatic BIST run can be disabled with the AUTO_BIST_DIS bit for cases when the RESET state was entered from the DIAGNOSTIC, ACTIVE, or SAFE state, but cannot be disabled when the RESET state was entered from the STANDBY state at power up.
  • The BIST (LBIST with ABIST) is initiated on the transition to the DIAGNOSTIC state.
  • During the DIAGNOSTIC state, the MCU can perform diagnostics of any safety function such as watchdog, MCU ESM, ERROR/WDI pin, DIAG_MUX pin, and CRC on registers. Ti recommends running diagnostic checks at least every power-up cycle while in the DIAGNOSTIC state.
  • NOTE

    DIAGNOSTIC state time-out: When the DIAGNOSTIC state is entered, if the DIAG_EXIT_MASK or DIAG_EXIT bit is not set to 1 within 512 ms (typical), the DIAGNOSTIC state time-out interval expires, causing a transition to the SAFE state. This also sets both the ERROR_PIN_FAIL and WD_FAIL bits in the SAFETY_ERR_STAT register and sets the mirror bits, MCU_ERR and WD_ERR, in the SAFETY_STAT_4 register. The device error count (DEV_ERR_CNT[3:0]) is incremented. Only the DIAG_EXIT_MASK or DIAG_EXIT bit should be set in a single SPI write command to the SAFETY_CHECK_CTRL register. Setting the DIAG_EXIT bit to 1 causes a transition to the ACTIVE state. Setting the DIAG_EXIT_MASK bit to 1 causes the device to remain in the DIAGNOSTIC state (only recommended for software debug).

    NOTE

    DIAG_EXIT_MASK for software debug: When the DIAG_EXIT_MASK bit is set to 1 before the DIAGNOSTIC state time-out interval expires, the device stays in the DIAGNOSTIC state until the bit is cleared. The DIAGNOSTIC state time-out timer remains free running in the background, but does not cause a state transition. When the DIAGNOSTIC state time-out interval has expired, the DIAG_EXIT bit is set automatically (in addition to the DIAG_EXIT_MASK bit remaining set) and the device remains in the DIAGNOSTIC state. For a controlled transition to the ACTIVE state, TI recommends clearing the DIAG_EXIT_MASK bit and setting the DIAG_EXIT bit with a single SPI write command to the SAFETY_CHECK_CTRL register. If both the DIAG_EXIT_MASK bit and DIAG_EXIT bits are cleared at the same time, the device remains in the DIAGNOSTIC state until either the next DIAGNOSTIC state time-out interval expires causing a transition to the SAFE state or if the DIAG_EXIT bit is set to 1, prior to the DIAGNOSTIC state time-out, transitioning the device to ACTIVE state.

    NOTE

    In the DIAGNOSTIC state the following considerations must be considered if a manual run of the LBIST is initiated by setting the LBIST_EN bit to 1. Setting the LBIST_EN bit to 1 clears the DIAG_EXIT_MASK bit to 0. If the DIAG_EXIT_MASK bit is being used to hold the device in the DIAGNOSTIC state for software debug, it must be set again to 1 after LBIST completion to stay in the DIAGNOSTIC state. The DIAGNOSTIC state time-out counter stops only during the running of LBIST. After the LBIST completes, the time-out counter continues from the last value. For a transition from the DIAGNOSTIC state to the ACTIVE state, the DIAG_EXIT bit must be set to 1.

ACTIVE State

The ACTIVE state has the characteristics that follow:

  • The device enters from the DIAGNOSTIC state after the MCU sets the DIAG_EXIT bit after clearing the ERROR_PIN_FAIL and WD_FAIL bits.
  • NOTE

    While in the DIAGNOSTIC state, the MCU must clear by writing a 0 to the ERROR_PIN_FAIL bit and the WD_FAIL bit in the SAFETY_ERR_STAT register before setting the DIAG_EXIT bit. Clearing these bits also clears their mirror bits, MCU_ERR and WD_ERR. Otherwise, a transition to the SAFE state occurs.

  • The NRES pin is high.
  • The state of the ENDRV pin is determined by the ENABLE_DRV bit, WD_FAIL_CNT[2:0] counter value, and and the overvoltage monitoring for the VDDx regulators (VDDx_OV) as shown in Figure 5-14;
  • The VDDx regulators are on, the VDD5 regulator can be enabled or disabled through the VDD5_EN bit. The VSOUT1 regulator can be enabled or disabled through the VSOUT1_EN bit.
  • The WD_FAIL_CNT[2:0] counter reinitializes to 5 during a transition from the DIAGNOSTIC state to the ACTIVE state.
  • The watchdog and MCU ESM monitoring functions are operated as configured but cannot be reconfigured.
  • During the ACTIVE state, the MCU can perform diagnostics of some safety function such as watchdog, DIAG_MUX pin, ABIST (approximately 300 µs, ENDRV pin will be low), LBIST (approximately 21 ms, ENDRV pin will be low), and CRC on registers depending on the system safety requirements.

NOTE

In the ACTIVE state the following considerations must be considered if a manual run of the LBIST is initiated by setting the LBIST_EN bit to 1. The LBIST should only be run in the ACTIVE state if the system-safety timing requirements can allow the total 21-ms BIST time and the ENDRV pin being low for the 21-ms.

See Section 5.4.7 for additional system considerations if LBIST is run in the ACTIVE state.

SAFE State

The SAFE state has the characteristics that follow:

  • The SAFE state is entered from:
    • The ACTIVE state by:
      • An error in the signal on the ERROR/WDI pin detected by the MCU ESM while enabled.. This transition is because of an error in the MCU and sets the ERROR_PIN_FAIL flag.
      • A detected read-back error on the NRES pin which sets the NRES_ERR flag while DIS_NRES_MON is cleared to 0 (1 in default state).
    • The DIAGNOSTIC state by:
      • After a DIAGNOSTIC state time-out event happens before the DIAG_EXIT_MASK bit is set to 1, keeping the device in the DIAGNOSTIC state or before the DIAG_EXIT bit is set to 1 transitioning the device to ACTIVE.
    • CFG_CRC_ERR = 1 AND CFG_CRC_EN is cleared to 0
    • An EE_CRC_ERR is detected in the DIAGNOSTIC state.
    • An ABIST_ERR or LBIST_ERR is detected in the DIAGNOSTIC state.
    • The WD_FAIL and ERROR_PIN_FAIL flags were not cleared to 0 before setting the DIAG_EXIT bit while exiting the DIAGNOSTIC state.
  • Every transition to the SAFE state increments the device error count, DEV_ERR_CNT[3:0].
  • The device stays in the SAFE state when the NO_SAFE_TO bit is set to 1 (default state) and DEV_ERR_CNT[3:0] = SAFE_LOCK_THR[3:0] + 1. This allows for programming the MCU without causing a reset and transition to the RESET state because of the SAFE state time-out.
  • The NRES pin is high.
  • The ENDRV pin is low.
  • The VDDx regulators are on, the VDD5 regulator can be enabled or disabled with the VDD5_EN bit. The VSOUT1 regulator can be enabled or disabled with the VSOUT1_EN bit.

NOTE

The SAFE state time-out and device configuration settings are used by the device state machine to determine what the device does after a transition to the SAFE state. Depending on the NO_SAFE_TO, PWD_THR[3:0], SAFE_LOCK_THR[3:0], and DEV_ERR_CNT[3:0] bits, the device stays locked in the SAFE state, transitions to the RESET state, or transitions to STANDBY state. The SAFE state time-out duration is programable through SAFE_TO[2:0].

NO_SAFE_TO = 1 (Default)

  • While DEV_ERR_CNT[3:0] < (SAFE_LOCK_THR[3:0] + 1) the time delay for the SAFE state time-out is programmed by the SAFE_TO[2:0] bit. The delay is calculated by [(SAFE_TO[2:0] × 2) + 1] × 22 ms.
  • The device remains locked in the SAFE state when DEV_ERR_CNT[3:0] ≥ SAFE_LOCK_THR[3:0] + 1.

NO_SAFE_TO = 0

  • While DEV_ERR_CNT[3:0] < (SAFE_LOCK_THR[3:0] + 1) the time delay for the SAFE state time-out is programmed by the SAFE_TO[2:0] bits. The delay is calculated by [(SAFE_TO[2:0] × 2) + 1] × 22 ms.
  • When DEV_ERR_CNT[3:0] ≥ SAFE_LOCK_THR[3:0] + 1, the SAFE state time-out duration changes and the device transitions to the RESET state after approximately 680 ms.

If the PWD_THR[3:0] threshold is used, the device transitions from the SAFE state to the STANDBY state when DEV_ERR_CNT[3:0] ≥ PWD_THR[3:0]. This transition has higher priority (PRIORITY I) than the path from the SAFE state to the RESET state (PRIORITY II) so if PWD_THR[3:0] = SAFE_LOCK_THR[3:0] + 1 the device transitions to the STANDBY state not the RESET state.

State Transition Priorities

For all global or possible double-state transitions, the following priorities hold true:

  1. Priority I: all conditions for STANDBY state transition
  2. Priority II: all conditions for RESET state transition
  3. Priority III: all conditions for SAFE state transition

All other state transitions have a lower priority compared to any of the state transitions listed with priority numbers.

Power on Reset (NPOR)

The device goes through a power on reset (NPOR) which reinitializes all registers. The events that cause an NPOR are:

  • Analog power on reset:
    • Loss-of-clock detection (LOCLK)
    • AVDD_VMON overvoltage or undervoltage event (AVDD_VMON_ERR)
    • DVDD undervoltage event (DVDD_UV)
    • DVDD overvoltage event (DVDD_OV)
  • Digital power on reset. These errors can cause a NPOR. If the detected fault duration is less than 6 ms, an NPOR may not occur. When the CANWU or IGN state is kept high, the device transitions to the RESET state because of the wake-up request. The registers on the post-BIST reinitialization list are reinitialized after BIST runs on the transition from the RESET state to the DIAGNOSTIC state (unless AUTO_BIST_DIS = 1, not default).
    • VBATP undervoltage event (VBATP_UV)
    • VDD3/5 overtemperature event (VDD3/5_OT) while NMASK_VDD3/5_OT = 1
    • AVDD undervoltage event (AVDD_UV)
    • Error with the device VMON trim settings (VMON_TRIM_ERROR)
    • Error with band gaps: BG_ERR1 or BG_ERR2
    • VCP12 overvoltage event (VCP12_OV)
    • VCP17 overvoltage event (VCP17_OV)

Register Maps

Serial Peripheral Interface (SPI)

The primary communication between the device and the external the MCU is through a SPI bus which provides full-duplex communications in a master-slave configuration. The external MCU is always a SPI master, which sends command requests on the SDI pin and receives device responses on the SDO pin. The TPS65381A-Q1 device is always a SPI slave device, which receives command requests and sends responses (status, measured values) to the external MCU over the SDO line.

  • The SPI is a 4-pin interface.
    • NCS—SPI chip select (active-low)
    • SCLK—SPI clock
    • SDI—SPI slave-in and master-out (SIMO)
    • SDO—SPI slave-out and master-in (SOMI, three-state output)
  • The SPI frame size is 16 bits.
  • Speed is up to 6 Mbit/s.
  • Commands and data are shifted MSB first, LSB last.
  • The SDI line is sampled on the falling edge of SCLK.
  • The SDO line is shifted out on the rising edge of SCLK.

The SPI communication starts with the NCS falling edge, and ends with the NCS rising edge. The NCS high level keeps the SPI slave interface in the reset state, and the SDO output is in the tri-state.

SPI Command Transfer Phase

Table 5-15 shows the transfer frame format of SPI data during a command (write or read command)..

Table 5-15 SPI Command Transfer Phase

BIT D7 D6 D5 D4 D3 D2 D1 D0
FUNCTION CMD6 CMD5 CMD4 CMD3 CMD2 CMD1 CMD0 PARITY
    CMD[6:0] Register write (WR) or read (RD) command
    PARITY Parity bit for 7-bit command field

The SPI does not support back-to-back SPI frame operation. After each SPI command or read access, the NCS pin must transition from low-to-high before the next SPI transfer can start. The minimum time (thlcs) between two SPI commands during which the NCS pin must remain high is 788 ns.

SPI Data-Transfer Phase

Table 5-16 shows the transfer frame format of SPI data during a write access.

Table 5-16 SPI Data-Transfer Phase

BIT D7 D6 D5 D4 D3 D2 D1 D0
FUNCTION DATA7 DATA6 DATA5 DATA4 DATA3 DATA2 DATA1 DATA0
    DATA[7:0] Data value for write access (8-bit)

The SPI does not support back-to-back SPI frame operation. After each SPI transfer, the NCS pin must go from low to high before the next SPI transfer can start. The minimum time (thlcs) between two SPI commands during which the NCS pin must remain high is 788 ns.

Device Status Flag Byte Response

Table 5-17 shows the response frame format of the SPI data status during a command (write or read access).

Table 5-17 Device Status Flag Byte Response

BIT R7 R6 R5 R4 R3 R2 R1 R0
FUNCTION STAT[7] STAT[6] STAT[5] STAT[4] STAT[3] STAT[2] STAT[1] STAT[0]
    STAT[7] 1
    STAT[6] 0
    STAT[5] 1
    STAT[4] 0
    STAT[3] SPI WR access (during previous SPI frame-command phase)
    STAT[2] SPI SDO error (during previous SPI frame)
    STAT[1] 0
    STAT[0] SPI errors including truncated SPI frames, SPI transfers with more than 16 bits, SPI transfers with undefined commands or SPI transfers with incorrect command parity (during previous SPI frame)

The status bits sent during the current SPI command are reflecting the status of the previous SPI command.

NOTE

If a reset to the MCU is asserted during a SPI frame transfer (causing a truncated SPI frame), these SPI error status bits are not cleared, but maintain the status according to the truncated previous SPI frame until a SPI read access.

NOTE

The SPI SDO error bit, STAT[2], may be inadvertently set when the NCS pin is high, the SDO pin is high, and a falling edge occurs on the SPICLK pin. This combination occurs most often when the device is used in a SPI bus with multiple SPI slaves. If all three of these conditions are met, the SDO error flag is set to 1 in the second SPI flag byte response of the following SPI communication with the TPS65381A-Q1. The application software should mask out the SDO error flag if the device is used under these conditions. If a SPI SDO error is detected, the device accepts the SPI transfer because the detected error is on the output not the input for the SPI.

NOTE

For additional diagnostic coverage for SPI write transfers, the system software could perform a read of the register written and compare the returned value to the value that is expected after the write. Be aware some bits in some registers are not writable.

Device SPI Data Response

Table 5-18 shows the response frame format of the SPI device data during a write or read access.

Table 5-18 Device SPI Data Response

BIT R7 R6 R5 R4 R3 R2 R1 R0
FUNCTION R7 R6 R5 R4 R3 R2 R1 R0
    R[7:0] Internal register value. All unused bits are cleared to 0.

SPI Frame Overview

Figure 5-17 shows an overview of a complete 16-bit SPI Frame:

TPS65381A-Q1 16-Bit_SPI_lvsbc4.gif
The SPI master (MCU) and SPI slave (TPS65381A-Q1) sample receive data on the falling SCLK edge and transmit data on the rising SCLK edge.
Figure 5-17 16-Bit SPI Frame

SPI Register Write Access Lock (SW_LOCK command)

The SW_LOCK command protects the SPI registers against write update access through MCU control. When the SW_LOCK command with data AAh is sent to the device, the listed registers are locked from updates through a write access. To unlock the SPI registers, the SW_UNLOCK command with data 55h is sent to the device.

NOTE

The SW_LOCK command is in addition to the automatic locking of specific SPI registers against write update access except while the device is in DIAGNOSTIC state. Please see the SPI Command Table and the register descriptions to determine if SW_LOCK and automatic locking except in DIAGNOSTIC state apply to specific write access registers.

SPI Registers (SPI Mapped Response)

The following sections list the SPI registers. For each SPI register, the bit names are given along with the initialized values (values after internal logic reset).

The values are initialized after each wake-up from the STANDBY state or after any other power-on reset (NPOR) event.

After a LBIST run is complete, including the LBIST run on the transition out of RESET state, the following functions and registers re-initialize:

  • DEV_STAT
  • SAFETY_STAT_2
  • SAFETY_STAT_4
  • SAFETY_STAT_5 (but FSM[2:0] immediately updates to reflect the current device state)
  • WD_TOKEN_VALUE
  • WD_STATUS
  • SAFETY_CHECK_CTRL
  • DIAG_CFG_CTRL
  • DIAG_MUX_SEL

The initialized value of the reserved bits (RSV) is indicated, however some of these bits are used for internal device operation and the application software should mask them as they may not remain at their initialized value.

The following sections also list an explanation of each bit function.

Table 5-19 SPI Command Table

8-BIT HEX COMMAND CODE (WITH PARITY) 7-BIT HEX
COMMAND CODE
(WITHOUT PARITY)
7-BIT BINARY
COMMAND CODE
(WITHOUT PARITY)
PARITY WR SW
LOCK PROTECT
REGISTER COMMAND NAME(1)
BDh 5Eh 1011 110b 1 N/A SW_LOCK with data AAh (to lock SPI WR access to listed registers)
BBh 5Dh 1011 101b 1 N/A SW_UNLOCK with data 55h (to unlock SPI WR access to listed registers)
06h 03h 0000 011b 0 N/A RD_DEV_ID
0Ch 06h 0000 110b 0 N/A RD_DEV_REV
B7h 5Bh 1011 011b 1 YES WR_DEV_CFG1 (SPI WR update can occur only in the DIAGNOSTIC state)
AFh 57h 1010 111b 1 N/A RD_DEV_CFG1
95h 4Ah 1001 010b 1 YES WR_DEV_CFG2 (SPI WR update can occur only in the DIAGNOSTIC state)
48h 24h 0100 100b 0 N/A RD_DEV_CFG2
7Dh 3Eh 0111 110b 1 NO WR_CAN_STBY (only valid with data 00h)
24h 12h 0010 010b 0 N/A RD_SAFETY_STAT_1
C5h 62h 1100 010b 1 N/A RD_SAFETY_STAT_2
A3h 51h 1010 001b 1 N/A RD_SAFETY_STAT_3
A5h 52h 1010 010b 1 N/A RD_SAFETY_STAT_4
C0h 60h 1100 000b 0 N/A RD_SAFETY_STAT_5
30h 18h 0011 000b 0 N/A RD_SAFETY_ERR_CFG
DBh 6Dh 1101 101b 1 YES WR_SAFETY_ERR_CFG (SPI WR update can occur only in the DIAGNOSTIC state)
A9h 54h 1010 100b 1 YES WR_SAFETY_ERR_STAT (SPI WR update can occur only in the DIAGNOSTIC state)
AAh 55h 1010 101b 0 N/A RD_SAFETY_ERR_STAT
39h 1Ch 0011 100b 1 N/A RD_SAFETY_PWD_THR_CFG
99h 4Ch 1001 100b 1 YES WR_SAFETY_PWD_THR_CFG (SPI WR update can occur only in the DIAGNOSTIC state)
44h 22h 0100 010b 0 N/A RD_SAFETY_CHECK_CTRL
93h 49h 1001 001b 1 NO WR_SAFETY_CHECK_CTRL
3Ch 1Eh 0011 110b 0 N/A RD_SAFETY_BIST_CTRL
9Fh 4Fh 1001 111b 1 YES WR_SAFETY_BIST_CTRL
2Eh 17h 0010 111b 0 N/A RD_WD_WIN1_CFG
EDh 76h 1110 110b 1 YES WR_WD_WIN1_CFG (SPI WR update can occur only in the DIAGNOSTIC state)
05h 02h 0000 010b 1 N/A RD_WD_WIN2_CFG
09h 04h 0000 100b 1 YES WR_WD_WIN2_CFG (SPI WR update can occur only in the DIAGNOSTIC state)
36h 1Bh 0011 011b 0 N/A RD_WD_TOKEN_VALUE
4Eh 27h 0100 111b 0 N/A RD_WD_STATUS
E1h 70h 1110 000b 1 NO WR_WD_ANSWER
11h 08h 0001 000b 1 N/A RD_DEV_STAT
12h 09h 0001 001b 0 N/A RD_VMON_STAT_1
A6h 53h 1010 011b 0 N/A RD_VMON_STAT_2
56h 2Bh 0101 011b 0 N/A RD_SENS_CTRL
7Bh 3Dh 0111 101b 1 N/A WR_SENS_CTRL
3Ah 1Dh 0011 101b 0 N/A RD_SAFETY_FUNC_CFG
35h 1Ah 0011 010b 1 YES WR_SAFETY_FUNC_CFG (SPI WR update can occur only in the DIAGNOSTIC state)
5Ah 2Dh 0101 101b 0 N/A RD_SAFETY_CFG_CRC
63h 31h 0110 001b 1 YES WR_SAFETY_CFG_CRC (SPI WR update can occur only in the DIAGNOSTIC state)
DDh 6Eh 1101 110b 1 N/A RD_DIAG_CFG_CTRL
CCh 66h 1100 110b 0 NO WR_DIAG_CFG_CTRL
ACh 56h 1010 110b 0 N/A RD_DIAG_MUX_SEL
C9h 64h 1100 100b 1 NO WR_DIAG_MUX_SEL
D7h 6Bh 1101 011b 1 N/A RD_SAFETY_ERR_PWM_H
D8h 6Ch 1101 100b 0 YES WR_SAFETY_ERR_PWM_H (SPI WR update can occur only in the DIAGNOSTIC state)
59h 2Ch 0101 100b 1 N/A RD_SAFETY_ERR_PWM_L
7Eh 3Fh 0111 111b 0 YES WR_SAFETY_ERR_PWM_L (SPI WR update can occur only in the DIAGNOSTIC state)
78h 3Ch 0111 100b 0 N/A RD_WD_TOKEN_FDBK
77h 3Bh 0111 011b 1 YES WR_WD_TOKEN_FDBK (SPI WR update can occur only in the DIAGNOSTIC state)
All commands have even parity.

Device Revision and ID

DEV_REV Register

Initialization source: NPOR
Controller access: Read only (RD_DEV_REV)

Figure 5-18 DEV_REV Register
D7 D6 D5 D4 D3 D2 D1 D0
REV[7] REV[6] REV[5] REV[4] REV[3] REV[2] REV[1] REV[0]
0b 0b 1b 1b 0b 0b 0b 0b
D[7:0] REV[7:0]: Device Revision
REV[3:0]: Device minor revision
REV[7:4]: Device major revision

DEV_ID Register

Initialization source: NPOR
Controller access: Read only (RD_DEV_ID)

Figure 5-19 DEV_ID Register
D7 D6 D5 D4 D3 D2 D1 D0
ID[7] ID[6] ID[5] ID[4] ID[3] ID[2] ID[1] ID[0]
0b 0b 0b 0b 0b 0b 0b 1b
D[7:0] ID[7:0]: Device ID

Device Status

DEV_STAT Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read only (RD_DEV_STAT)

Figure 5-20 DEV_STAT Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV RSV RSV RSV RSV CANWU_L IGN
0b 0b 0b 0b 0b 0b X X
D[7:2] RSV
D[1] CANWU_L: Latched CAN wake-up event
The initialized value depends on whether a device wake-up event occurrs through the CANWU or IGN pin.
This bit clears to 0 when a device wake-up occurrs through a CANWU, only a WR_CAN_STBY command, or any other global STANDBY condition
D[0] IGN: Deglitched IGN pin (7.5-ms to 22-ms deglitch time)
The initialized value depends on whether a device wake-up event occurrs through the CANWU or IGN pin. This bit follows the deglitched IGN signal, and therefore is only cleared to 0 when the deglitched IGN is low or by any other global STANDBY condition.

Device Configuration

DEV_CFG1 Register

Initialization source: NPOR
Controller access: Read (RD_DEV_CFG1)
Write (WR_DEV_CFG1). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-21 DEV_CFG1 Register
D7 D6 D5 D4 D3 D2 D1 D0
VDD_3_5_SEL NMASK_VDD1_UV_OV RSV RSV RSV RSV RSV RSV
X 0b 0b 0b 0b 0b 0b 0b
D[7] VDD_3_5_SEL: Status bit of VDD3/VDD5 selection at power up
SEL_VDD3/5 input pin is sampled and latched at power up
0b = 5-V setting (SEL_VDD3/5 pin to ground)
1b = 3.3-V setting (SEL_VDD3/5 pin not connected)
Value in the RESET state depends on state of SEL_VDD3/5 pin at first power up
This bit is read only
Note: This bit is the same as the SAFETY_FUNC_CFG bit, D0)
D[6] NMASK_VDD1_UV_OV
Cleared to 0 by default:
Masked VDD1_OV does not impact the ENDRV pin state
Masked VDD1_UV does not impact the NRES pin state
The default setting (0, masked) can be used in case the VDD1 regulator is not used in an application and the external power FET is not populated.
Note: If the VDD1 regulator is used in an application, TI recommends setting this bit to 1 when the device is in the DIAGNOSTIC state after the first start-up or power-up event.
Note: Even if this bit is set to 1, but the VDD1_SENSE pin is externally floating, the pin is pulled up. The pullup condition is detected but the VDD1_OV condition is masked and the ENDRV pin state is not impacted.
D[5:0] RSV

DEV_CFG2 Register

Initialization source: NPOR
Controller access: Read (RD_DEV_CFG2)
Write (WR_DEV_CFG2). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-22 DEV_CFG2 Register
D7 D6 D5 D4 D3 D2 D1 D0
NMASK_VDD3/5_OT NMASK_VDD5_OT MASK_VBATP_OV POST_RUN_RST RSV RSV RSV RSV
1b 1b 0b 0b 0b 0b 0b 0b
D[7] NMASK_VDD3/5_OT
When set to 1 (default), an overtemperature event on the VDD3/5 or VDD6 regulator disables the VDD3/5 regulator and the device goes to the STANDBY state. The VDD3/5_OT flag sets in the SAFETY_STAT_1 register while an overtemperature event is detected.
When cleared to 0, an overtemperature event on the VDD3/5 or VDD6 regulator disables the VDD3/5 regulator. When the VDD3/5 regulator reaches the UV level, the device goes to the RESET state. The VDD3/5_OT flag is still set in the SAFETY_STAT_1 register while an overtemperature event is detected.
D[6] NMASK_VDD5_OT
When set to 1 (default), an overtemperature event on the VDD5 regulator disables the VDD5 regulator and the device goes to the RESET state. The VDD5_OT flag is set in the SAFETY_STAT_1 register while an overtemperature event is detected.
When cleared to 0 the VDD5 overtemperature shutdown is disabled and the VDD5 regulator remains enabled. The VDD5_OT flag is still set in the SAFETY_STAT_1 register while an overtemperature event is detected.
D[5] MASK_VBATP_OV
Cleared to 0 by default.
When set to 1, the VBATP_OV bit is masked from the RESET condition.
D[4] POST_RUN_RST:
Cleared to 0 per default.
When set to 1, while using the IGN_PWRL function, a recracking on the IGN pin causes the device to go to the RESET state.
D[3:0] RSV (bits are readable and writable in the DIAGNOSTIC state with no impact to device state or the ENDRV and NRES output)

Device Safety Status and Control Registers

VMON_STAT_1 Register

Initialization source: NPOR
Controller access: Read only (RD_VMON_STAT_1)

Figure 5-23 VMON_STAT_1 Register
D7 D6 D5 D4 D3 D2 D1 D0
VBATP_OV VBATP_UV VCP17_OV VCP12_OV VCP12_UV AVDD_VMON_ERR BG_ERR2 BG_ERR1
0b 0b 0b 0b 0b 0b 0b 0b
D[7] VBATP_OV: VBATP overvoltage status bit
Set to 1 when a VBATP overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[6] VBATP_UV: VBATP undervoltage status bit
Set to 1 when a VBATP undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present
D[5] VCP17_OV: VCP17 overvoltage status bit
Set to 1 when a VCP17 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[4] VCP12_OV: VCP12 overvoltage status bit
Set to 1 when a VCP12 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[3] VCP12_UV: VCP12 undervoltage status bit
Set to 1 when a VCP12 undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present
D[2] AVDD_VMON_ERR: voltage-monitor power-supply power-good status
Set to 1 when voltage-monitor power supply is not OK.
Cleared to 0 if an error condition is no longer present
D[1] BG_ERR2: Reference band-gap 2 error
Set to 1 when the voltage monitor is less than the main band gap
Cleared to 0 if an error condition is no longer present
D[0] BG_ERR1: Reference band-gap 1 error
Set to 1 when the voltage monitor is greater than the main band gap
Cleared to 0 if an error condition is no longer present

VMON_STAT_2 Register

Initialization source: NPOR
Controller access: Read (RD_VMON_STAT_2)

Figure 5-24 VMON_STAT_2 Register
D7 D6 D5 D4 D3 D2 D1 D0
VDD6_OV VDD6_UV VDD5_OV VDD5_UV VDD3/5_OV VDD3/5_UV VDD1_OV VDD1_UV
0b 0b 0b 0b 0b 0b 0b 0b
D[7] VDD6_OV: VDD6 overvoltage status bit
Set to 1 when a VDD6 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[6] VDD6_UV: VDD6 undervoltage status bit
Set to 1 when a VDD6 undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present
D[5] VDD5_OV: VDD5 overvoltage status bit
Set to 1 when a VDD5 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[4] VDD5_UV: VDD5 undervoltage status bit
Set to 1 when a VDD5 undervoltage condition is detected.
Cleared to 0 if an undervoltage condition is no longer present
Note: This status bit reflects the undervoltage status even if the VDD5_EN bit in the SENS_CTRL register has been cleared to 0. If the VDD5 regulator is disabled, when the VDD5 regulator discharges and an undervoltage condition is detected, the VDD5_UV bit is set to 1.
D[3] VDD3/5_OV: VDD3/5 overvoltage status bit
Set to 1 when a VDD3/5 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[2] VDD3/5_UV: VDD3/5 undervoltage status bit
Set to 1 when a VDD3/5 undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present
D[1] VDD1_OV: VDD1 overvoltage status bit
Set to 1 when a VDD1 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[0] VDD1_UV: VDD1 undervoltage status bit
Set to 1 when a VDD1 undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present

SAFETY_STAT_1 Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_STAT_1)

Figure 5-25 SAFETY_STAT_1 Register
D7 D6 D5 D4 D3 D2 D1 D0
VDD5_ILIM VDD3/5_ILIM VSOUT1_UV VSOUT1_OV RSV VSOUT1_OT VDD5_OT VDD_3_5_OT
0b 0b 0b 0b 0b 0b 0b 0b
D[7] VDD5_ILIM: VDD5 current-limit status bit
Set to 1 when a VDD5 current-limit condition is exceeded
Cleared to 0 if a current-limit condition is no longer present
Note: This status bit is valid only when the VDD5_EN bit in SENS_CTRL register is set to 1. When the VDD5_EN bit is cleared to 0, this bit will be 1.
D[6] VDD3/5_ILIM: VDD3 current-limit status bit
Set to 1 when a VDD3 current-limit condition is exceeded
Cleared to 0 if a current-limit condition is no longer present
D[5] VSOUT1_UV: Sensor-supply undervoltage status bit
Set to 1 when a VSOUT1 undervoltage condition is detected
Cleared to 0 if an undervoltage condition is no longer present
D[4] VSOUT1_OV: Sensor-supply overvoltage status bit
Set to 1 when a VSOUT1 overvoltage condition is detected
Cleared to 0 if an overvoltage condition is no longer present
D[3] RSV
D[2] VSOUT1_OT: Sensor-supply overtemperature status bit
Set to 1 when the VSOUT1 overtemperature condition is exceeded. This bit keeps the VSOUT1 regulator disabled as long as this bit is set.
Cleared to 0 if an overtemperature condition is no longer present
D[1] VDD5_OT: VDD5 overtemperature status bit
Set to 1 when the VDD5 overtemperature condition is exceeded. When the NMASK_VDD5_OT bit is set 1, an overtemperature event disables the VDD5 regulator and clears the VDD5_EN bit to 0 (SENS_CTRL register). When the NMASK_VDD5_OT bit is 0, an overtemperature event sets the VDD5_OT bit to 1 but no other device action is taken.
Cleared to 0 if an overtemperature condition is no longer present
D[0] VDD_3_5_OT: VDD3/5 overtemperature status bit
Set to 1 when the VDD3/5 overtemperature condition is exceeded. This bit keeps VDD3/5 regulator disabled as long as this bit is set to 1.
Cleared to 0 if an overtemperature condition is no longer present

SAFETY_STAT_2 Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read only (RD_SAFETY_STAT_2)

Figure 5-26 SAFETY_STAT_2 Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV CFG_CRC_ERR EE_CRC_ERR RSV WD_FAIL_CNT[2] WD_FAIL_CNT[1] WD_FAIL_CNT[0]
0b 0b 0b 0b 0b 1b 0b 1b
D[7:6] RSV
D[5] CFG_CRC_ERR: CRC error status bit for the safety configuration registers
Safety configuration registers are protected by CRC8.
This bit is set to 1 when the calculated CRC8 value for the safety configuration registers does not match the expected CRC8 value stored in the SAFETY_CFG register.
Cleared to 0 when a CRC8 mismatch is no longer present.
Cleared to 0 when the EEPROM CRC performs without error (regardless of CFG_CRC check result)
D[4] EE_CRC_ERR: EPROM CRC error status bit
EEPROM content is protected by CRC8.
This bit is set to 1 when the calculated CRC8 value does not match the expected CRC8 value stored in the EEPROM DFT register. When this bit is set to 1 and device is in the DIAGNOSTIC state, the device transitions to the SAFE state.
Cleared to 0 when a CRC8 mismatch is no longer present.
D[3] RSV
D[2:0] WD_FAIL_CNT[2:0]: watchdog fail counter
The default value is 5, and is initialized to this value upon entering the DIAGNOSTIC and ACTIVE state
Watchdog fail counter increments every time the device watchdog detects a bad or time-out event and decrements each time a good event is received.
Watchdog fail counter must decrease below 5 to enable the ENDRV pin.
Watchdog fail is detected on the next bad or time-out event after the watchdog fail counter reached the count of 7 (that is 7+1) while the WD_RST_EN bit is set to 1. The WD_FAIL status bit is set to 1 in the SAFETY_ERR_STAT register (setting the WD_FAIL bit to 1 in the SAFETY_ERR_STAT register).

SAFETY_STAT_3 Register

Initialization source: NPOR
Controller access: Read only (RD_SAFETY_STAT_3)

Figure 5-27 SAFETY_STAT_3 Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV NRES_ERR LBIST_ERR ABIST_ERR ABIST_ERR LBIST_RUN ABIST_RUN
0b 0b 0b 0b 0b 0b 0b 0b
D[7:6] RSV
D[5] NRES_ERR: Reset error input status
This bit is set to 1 when a mismatch between the NRES pin output HIGH and the NRES pin input readback LOW is detected, regardless of the value of the DIS_RES_MON bit. Depending on the external RC loading of this pin and the timing to read this bit, it may be set to 1 briefly if the external RC delay slows a change in level that is longer than the internal deglitch time (120 µs typical).
Cleared to 0 if no failure is present anymore.
The DIS_NRES_MON bit in the SAFETY_FUNC_CFG register determines if this error causes a state transition from the ACTIVE state to the SAFE state.
D[4] LBIST_ERR: Logic BIST (LBIST) error-status bit
This bit is set to 1 when the LBIST fails
Cleared to 0 after a LBIST run is complete without failure
Only valid when the LBIST_RUN bit is 0
D[3] ABIST_ERR: Analog BIST (ABIST) error-status bit
This bit is set to 1 when the ABIST fails. If this bit is set to 1 and the device is in the DIAGNOSTIC state, the device transitions to the SAFE state.
Cleared to 0 after a ABIST run is complete without failure
Only valid when the ABIST_RUN bit is 0 (ABIST is not running)
D[2] ABIST_ERR: Analog BIST (ABIST) error-status bit (identical to D3)
This bit is set to 1 when the ABIST fails. If this bit is set to 1 and device is in the DIAGNOSTIC state, the device transitions to the SAFE state.
Cleared to 0 after a ABIST run is complete without failure
Only valid when the ABIST_RUN bit is 0 (ABIST is not running)
D[1] LBIST_RUN: Logic BIST (LBIST) run status bit
This bit is set to 1 when a LBIST is running.
Cleared to 0 when the LBIST is not running.
D[0] ABIST_RUN: Analog BIST (ABIST) run status bit
This bit is set to 1 when the ABIST is running.
Cleared to 0 when the ABIST is not running.

SAFETY_STAT_4 Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read only (RD_SAFETY_STAT_4)

Figure 5-28 SAFETY_STAT_4 Register
D7 D6 D5 D4 D3 D2 D1 D0
SPI_ERR[1] SPI_ERR[0] LOCLK RSV MCU_ERR WD_ERR ENDRV_ERR TRIM_ERR_VMON
0b 0b 0b 0b 0b 0b 0b 0b
D[7:6] SPI_ERR[1:0]: SPI error-status bits
00b = No error
01b = SPI SDO error (mismatch on SDO output)
If both a SPI SDO error and another SPI error occur during the same SPI frame, 01b is shown in the SPI_ERR[1:0] bit because the SPI SDO error has priority.
10b = Reserved
11b = SPI errors including truncated SPI frames, SPI transfers with more than 16 bits, SPI transfers with undefined commands or SPI transfers with incorrect command parity
Cleared to 0 after a SPI read access or any SPI frame with no errors.
Note: If a reset to the MCU is asserted during a SPI frame transfer (causing a truncated SPI frame), these SPI error status bits are not cleared, but maintain the status according to the truncated previous SPI frame until SPI read access
D[5] LOCLK: Loss of clock-detection status bit
Set when a loss-of-clock failure is detected and also set after the ABIST is complete
Cleared to 0 after internal NPOR and clear on read (after ABIST)
D[4] RSV
D[3] MCU_ERR: MCU error signal monitor (MCU ESM) status bit
This bit is set to 1 when the MCU ESM module detects an error on the ERROR/WDI pin while MCU ESM monitoring is enabled.
This bit mirrors the ERROR_PIN_FAIL bit in the SAFETY_ERR_STAT register
D[2] WD_ERR: Watchdog error-status bit
This bit is set to 1 on the next bad or time-out event when the WD_FAIL_CNT[2:0] counter reaches a count of 7 (that is 7+1) when the WD_RST_EN bit (bit 3 in the SAFETY_FUNC_CFG) is set to 1. Also set to 1 when the DIAGNOSTIC state time-out occurs.
This bit mirrors the WD_FAIL bit in the SAFETY_ERR_STAT register
D[1] ENDRV_ERR: Enable driver error
This bit is set to 1 when a mismatch between the ENDRV pin output and the ENDRV input feedback is detected. Depending on the external RC loading of this pin and the timing to read this bit, it may be set to 1 briefly if the external RC delay slows a change in level that is longer than the internal deglitch time (32 µs typical).
Cleared to 0 if the failure is no longer present
D[0] TRIM_ERR_VMON: VMON trimming error-status bit
This bit is set to 1 when mismatch voltage-monitor trim error is detected.
Cleared to 0 after an internal NPOR and if failure is not present anymore.

SAFETY_STAT_5 Register

Initialization source: POR, post LBIST reinitialization
Controller access: Read only (RD_SAFETY_STAT_5)

Figure 5-29 SAFETY_STAT_5 Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV RSV RSV RSV FSM[2] FSM[1] FSM[0]
0b 0b 0b 0b 0b 0b 1b 1b
D[2:0] FSM[2:0]: Current device state
Reflects the current device state (the bits will immediately update to reflect the current device state after an NPOR or post LBIST reinitialization)
STANDBY state: 00h
RESET state: 03h
DIAGNOSTIC state: 07h
ACTIVE state: 05h
SAFE state: 04h

SAFETY_ERR_CFG Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_ERR_CFG)
Write (WR_SAFETY_ERR_CFG). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-30 Register
D7 D6 D5 D4 D3 D2 D1 D0
SAFE_TO
[2]
SAFE_TO
[1]
SAFE_TO
[0]
SAFE_LOCK_THR
[3]
SAFE_LOCK_THR
[2]
SAFE_LOCK_THR
[1]
SAFE_LOCK_THR
[0]
CFG_LOCK
0b 0b 0b 0b 0b 0b 0b 0b
D[7:5] SAFE_TO[2:0]: SAFE state time-out settings
Duration of the SAFE state is time-limited to protect against potential MCU locked state.
Time-out duration = (2 × SAFE_TO[2:0] + 1) × 22 ms
Minimum duration is 22 ms
Maximum duration is 330 ms
22-ms time reference has 5% accuracy coming from 4-MHz internal oscillator)
D[4:1] SAFE_LOCK_THR[3:0]
Sets the corresponding device DEV_ERR_CNT[3:0] threshold at which device remains in the SAFE state regardless of SAFE state time-out event
When the NO_SAFE_TO bit (SAFETY_FUNC_CFG register, bit 7) is set to 1:
While DEV_ERR_CNT[3:0] < SAFE_LOCK_THR[3:0] + 1, SAFE state time-out transition time from the SAFE-to-RESET state is controlled through the SAFE_TO[2:0] bit settings. SAFE state time-out duration is calculated (SAFE_TO[2:0] × 2 + 1) × 22 ms
Device remains locked in the SAFE state when the DEV_ERR_CNT[3:0] counter reaches SAFE_LOCK_THR[3:0] + 1 value.
When the NO_SAFE_TO bit (SAFETY_FUNC_CFG register, bit 7) is cleared to 0:
While DEV_ERR_CNT[3:0] < SAFE_LOCK_THR[3:0] + 1, time-out transition time from the SAFE-to-RESET state is controlled through the SAFE_TO[2:0] bit settings. Time-delay duration is calculated (SAFE_TO[2:0] × 2 + 1) × 22 ms
When the DEV_ERR_CNT[3:0] counter reaches SAFE_LOCK_THR[3:0] + 1 value, the device transitions to the RESET state after 680 ms.
Intended to support software debug and development and is NOT recommended for normal functional operation.
The 0000b setting is the default setting, and has same effect as the 1111b setting. Both settings give the minimum threshold.
D[0] CFG_LOCK
Register lock access control
When set to 1, the register content cannot be updated by SPI WR access.

SAFETY_BIST_CTRL Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_BIST_CTRL)
Write (WR_SAFETY_BIST_CTRL). Write access locked through SW_LOCK command.

Figure 5-31 SAFETY_BIST_CTRL Register
D7 D6 D5 D4 D3 D2 D1 D0
BIST_DEG_CNT[1] BIST_DEG_CNT[0] AUTO_BIST_DIS EE_CRC_CHK RSV LBIST_EN ABIST_EN ABIST_EN
0b 0b 0b 0b 0b 0b 0b 0b
D[7:6] BIST_DEG_CNT[1:0]: Deglitch filter duration setting during an active ABIST
This bit controls the deglitch filter duration for every safety monitored voltage.
Resolution is 15 µs (with the minimum setting at 15 µs and the maximum setting at 60 µs): bist_deglitch = (BIST_DEG_CNT[1:0] + 1) × 15 µs)
15-µs time reference has 5% accuracy coming from 4-MHz internal oscillator.
When the ABIST is run in the ACTIVE state, TI recommends to set this to the maximum deglitch time
D[5] AUTO_BIST_DIS
This bit controls the automatic BIST run on the transition from the RESET to the DIAGNOSTIC state ONLY when the device enters the RESET sate from the DIAGNOSTIC, ACTIVE, or SAFE state.
When set to 1, automatic BIST run is, except for the automatic BIST run on power up from the STANDBY state
D[4] EE_CRC_CHK: Recalculate EEPROM CRC8
This bit controls the EEPROM CRC8 check function
When set to 1, the EEPROM content is reloaded and CRC8 re-calculated and compared against expected value stored in EEPROM DFT register.
Note: With every power-up event, EEPROM content is reloaded and its CRC8 recalculated.
The self-test status is checked through bit 4 in the SAFETY_STAT_2 register.
D[3] RSV, readable and writable without effect
D[2] LBIST_EN: Enables LBIST run
This bit controls the LBIST run (which also runs the ABIST)
The self-test status is monitored through the D1 and D4 bits in the SAFETY_STAT_3 register.
The LBIST_EN bit clears the DIAG_EXIT_MASK bit to 0. The DIAGNOSTIC state time-out counter only stops during the running of the LBIST. After the LBIST is complete, the time-out counter continues from the last value. To stay in the DIAGNOSTIC state, the DIAG_EXIT_MASK bit must be set to 1 after LBIST completion. For a transition from the DIAGNOSTIC state to the ACTIVE state, the DIAG_EXIT bit must be set to 1.
D[1] ABIST_EN: Enable ABIST run (same as D[0])
This bit controls the analog UV,OV and LOC BIST run.
The self-test status is monitored through the D0, D2, and D3 bits in the SAFETY_STAT_3 register, and the D5 bit in the SAFETY_STAT4 register.
D[0] ABIST _EN: Enable analog BIST run (same as D[1])
The bit controls the analog UV, OV, and LOC BIST run.
The self-test status is monitored through the D0, D2, and D3 bits in the SAFETY_STAT_3 register, and the D5 bit in the SAFETY_STAT4 register.

SAFETY_CHECK_CTRL Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read (RD_SAFETY_CHECK_CTRL)
Write (WR_SAFETY_CHECK_CTRL). .

Figure 5-32 SAFETY_CHECK_CTRL Register
D7 D6 D5 D4 D3 D2 D1 D0
CFG_CRC_EN RSV ENABLE_DRV RSV RSV NO_ERROR DIAG_EXIT_MASK DIAG_EXIT
0b 0b 0b 1b 0b 1b 0b 0b
D[7] CFG_CRC_EN
This bit controls the enabling of CRC8 protection for the device configuration registers.
When set to 1, the CRC8 is calculated for all device configuration registers and compared with the CRC8 value stored in the SAFETY_CFG_CRC register.
TI recommends to first set the desired device configuration, followed by updating the SAFTY_CFG_CRC register before setting this bit to 1.
The following registers are protected:
SAFETY_FUNC_CFG register
DEV_REV (device revision) register
SAFETY_PWD_THR_CFG register
SAFETY_ERR_CFG register
WD_TOKEN_CFG register
WD_WIN1_CFG register
WD_WIN2_CFG register
SAFETY_ERR_PWM_L register
DEV_CFG2 register
DEV_CFG1 register (only the D6 bit)
D[6] RSV, readable and writeable with no impact to device state or the ENDRV, and NRES output
D[5] ENABLE_DRV
Controls the enabling of the ENDRV output
In addition to setting this bit to 1, the watchdog fail counter must be decremented below the default count value of 5 to enable the ENDRV output.
D[4:3] RSV, readable and writeable with no impact to device state or the ENDRV, and NRES output
D[2] NO_ERROR
This bit enables MCU ESM monitoring of the ERROR/WDI pin. When enabled the MCU ESM transitions the device from the ACTIVE state to the SAFE state when an error is detected.
0b = MCU ESM is enabled and the ERROR/WDI pin is monitored. A detected failure in the ACTIVE state causes a transition to the SAFE state, a detected failure in the DIAGNOSTIC state does not cause a transition to the SAFE state.
1b = MCU ESM is not enabled and the ERROR/WDI pin is not monitored and a failure in the ACTIVE state does not cause a transition to the SAFE state.
If a failure is detected when NO_ERROR = 0 (MCU ESM is enabled).
The ERROR_PIN_FAIL status bit in the SAFETY_ERR_STAT register is set
The MCU_ERR status bit in the SAFETY_STAT_4 register is set
D[1] DIAG_EXIT_MASK
Controls the exit from the DIAGNOSTIC state
When set to 1, exit from the DIAGNOSTIC state is disabled regardless if a DIAGNOSTIC state time-out event occurs or if the DIAG_EXIT bit is set.
This feature is only recommended for software debug and development and must not be activated in functional mode.
D[0] DIAG_EXIT
Controls exit from the DIAGNOSTIC state to the ACTIVE state
When set to 1 and the DIAG_EXIT_MASK bit is 0, the device transitions from the DIAGNOSTIC to the ACTIVE state.

SAFETY_FUNC_CFG Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_FUNC_CFG)
Write (WR_SAFETY_FUNC_CFG). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-33 SAFETY_FUNC_CFG Register
D7 D6 D5 D4 D3 D2 D1 D0
NO_SAFE_TO ERROR_CFG WD_CFG IGN_PWRL WD_RST_EN DIS_NRES_MON RSV VDD_3_5_SEL
1b 0b 0b 0b 0b 1b 0b X
D[7] NO_SAFE_TO
Controls the enabling and disabling of the SAFE state time-out function
– When set to 1: The SAFE state time-out is disabled. The device remains locked in the SAFE state when the DEV_ERR_CNT[3:0] counter reaches the SAFE_LOCK_THR[3:0] + 1 value.
– When cleared to 0: The SAFE state time-out is enabled. The device transitions to the RESET state after 680 ms when the DEV_ERR_CNT[3:0] counter reaches the SAFE_LOCK_THR[3:0] + 1 value.
D[6] ERROR_CFG: MCU ESM configuration bit
When cleared to 0: PWM Mode is selected (can be used as an external clock monitor). The expected ERROR/WDI pin LOW and HIGH durations are controlled by the SAFETY_ERR_PWM_H and SAFETY_ERR_PWM_L registers (see Section 5.5.4.13 and Section 5.5.4.14, respectively).
When set to 1: The TMS570 mode is selected. The ERROR pin low-duration threshold is set by the SAFETY_ERR_PWM_L register.
Use the NO_ERROR bit in the SAFETY_CHECK_CTRL register to enable the MCU ESM function
D[5] WD_CFG: Watchdog function configuration bit
When cleared to 0: Trigger mode (default) – watchdog trigger input through the ERROR/WDI pin
When set to 1: Q&A mode – watchdog answers input through SPI
D[4] IGN_PWRL: Ignition-power latch control bit
Controls the enabling of the ignition-power latch
Note: This bit can only be changed when the device is in the DIAGNOSTIC state
When cleared to 0: With the IGN pin LOW, the device enters the STANDBY state. Cleared by a CANWU event
When set to 1: The IGN pin can be pulled LOW, but the device remains powered up.
D[3] WD_RST_EN
1b = Enables a transition to the RESET state when a Watchdog failure is detected (the WD_FAIL_CNT[2:0] counter reaches the count of 7+1).
0b (default) = Disables a transition to the RESET state when watchdog failure events are detected (the WD_FAIL_CNT[2:0] counter reaches the count of 7 + 1).
D[2] DIS_NRES_MON
When cleared to 0: In the ACTIVE state, a difference between the read-back level on the NRES pin and the NRES pin output driver state causes a transition to the SAFE state and the NRES_ERR bit is set.
When set to 1 (default state): State transition because of a difference between the read-back NRES pin level and the NRES driver state is disabled. (default state) Note: The NRES_ERR bit is still set if a difference between the read-back NRES pin level and the NRES driver state is detected.
D[1] RSV, readable and writeable in the DIAGNOSTIC state with no impact to the device state or the ENDRV and NRES output
D[0] VDD_3_5_SEL: Status bit of VDD3/VDD5 selection at power up
The SEL_VDD3/5 input pin is sampled and latched at power up
0b = 5-V setting (pin SEL_VDD3/5 connected to ground)
1b = 3.3-V setting (the SEL_VDD3/5 pin is not connected)
Value in the RESET state depends on the state of the SEL_VDD3/5 pin at first power up
This bit is read only
Note: This bit is the same as the DEV_CFG1 bit, D7

SAFETY_ERR_STAT Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_ERR_STAT)
Write (WR_SAFETY_ERR_STAT). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-34 SAFETY_ERR_STAT Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV ERROR_PIN_FAIL WD_FAIL DEV_ERR_CNT[3] DEV_ERR_CNT[2] DEV_ERR_CNT[1] DEV_ERR_CNT[0]
0b 0b 0b 0b 0b 0b 0b 0b
D[7:6] RSV
D[5] ERROR_PIN_FAIL
Set to 1 when the MCU ESM Module detects a failure on the ERROR/WDI pin, only if NO_ERROR = 0 (bit D2 in SAFETY_CHECK_CTRL register). The device enters the SAFE state when this ERROR_PIN_FAIL bit is set to 1 while the device is in the ACTIVE state and NO_ERROR = 0. Also set to 1 when a DIAGNOSTIC state time-out occurs.
Cleared by using SPI to write a 0 to the bit or cleared to 0 during reset event. Note: in the DIAGNOSTIC state it is also possible to write this bit to 1, leaving it set at 1 will have the same device level impact as a detected failure on the ERROR/WDI pin.
D[4] WD_FAIL
This bit is set to 1 on the next bad event when the watchdog fail counter reaches a count of 7 (that is 7 + 1) (the WD_FAIL_CNT[2:0] bits in the SAFETY_STAT_2 register) when the WD_RST_EN bit (bit 3 in SAFETY_FUNC_CFG) is set to 1. Also set to 1 when the DIAGNOSTIC state time-out occurs.
Cleared by using the SPI to write a 0 to the bit when the watchdog fail counter is less than 7 or cleared to 0 during a reset event. Note: in the DIAGNOSTIC state, writing this bit to 1 is also possible, leaving it set at 1 when exiting the DIAGNOSTIC state causes a transition to the SAFE state.
D[3:0] DEV_ERR_CNT[3:0]
Tracks the current device error count.
Overwritten by SPI WR access, but ONLY in the DIAGNOSTIC mode.

SAFETY_ERR_PWM_H Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_ERR_PWM_H)
Write (WR_SAFETY_ERR_PWM_H). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-35 SAFETY_ERR_PWM_H Register
D7 D6 D5 D4 D3 D2 D1 D0
PWMH[7] PWMH[6] PWMH[5] PWMH[4] PWMH[3] PWMH[2] PWMH[1] PWMH[0]
1b 0b 1b 0b 1b 0b 0b 0b
D[7:0] PWMH[7:0]: The ERROR/WDI pin high-phase duration in PWM mode (15-µs resolution)
Controls the expected high-phase duration with 15-µs resolution
Use Equation 17 and Equation 18 to calculate the minimum and maximum values for the HIGH pulse duration, tPWM_HIGH.
(15-µs time reference has 5% accuracy coming from 4-MHz internal oscillator)

SAFETY_ERR_PWM_L Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_ERR_PWM_L)
Write (WR_SAFETY_ERR_PWM_L). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-36 SAFETY_ERR_PWM_L Register
D7 D6 D5 D4 D3 D2 D1 D0
PWML[7] PWML[6] PWML[5] PWML[4] PWML[3] PWML[2] PWML[1] PWML[0]
0b 0b 1b 1b 1b 1b 0b 1b
D[7:0] PWML[7:0]: The ERROR/WDI pin low-phase duration
Controls expected low-phase duration
When the ERR_CFG bit is 0 (in PWM mode): PWM low-phase duration with 15-µs resolution
Use Equation 19 and Equation 20 to calculate the minimum and maximum values for the LOW pulse duration, tPWM_LOW.
(15-µs time reference has 5% accuracy coming from 4-MHz internal oscillator)
When ERR_CFG bit is 1 (TMS570 mode): error low duration with 5-µs resolution
Use Equation 15 and Equation 16 to calculate the minimum and maximum values for the LOW duration, tTMS570_LOW.
(5-µs time reference has 5% accuracy coming from 4-MHz internal oscillator)

SAFETY_PWD_THR_CFG Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_PWD_THR_CFG)
Write (WR_SAFETY_PWD_THR_CFG). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-37 SAFETY_PWD_THR_CFG Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV RSV RSV PWD_THR[3] PWD_THR[2] PWD_THR[1] PWD_THR[0]
0b 0b 0b 0b 1b 1b 1b 1b
D[7:4] RSV
D[3:0] PWD_THR[3:0]: Device error-count threshold to power down the device
When the DEV_ERR_CNT[3:0] counter reaches the programmed threshold, the device powers down.
The device recovers with a new wake-up or ignition event.

SAFETY_CFG_CRC Register

Initialization source: NPOR
Controller access: Read (RD_SAFETY_CFG_CRC)
Write (WR_SAFETY_CFG_CRC). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-38 SAFETY_CFG_CRC Register
D7 D6 D5 D4 D3 D2 D1 D0
CFG_CRC[7] CFG_CRC[6] CFG_CRC[5] CFG_CRC[4] CFG_CRC[3] CFG_CRC[2] CFG_CRC[1] CFG_CRC[0]
0b 0b 0b 1b 0b 0b 0b 0b
D[7:0] CFG_CRC[7:0]: The CRC8 value for the safety configuration registers

Diagnostics

DIAG_CFG_CTRL Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read (RD_DIAG_CFG_CTRL)
Write (WR_DIAG_CFG_CTRL)

Figure 5-39 DIAG_CFG_CTRL Register
D7 D6 D5 D4 D3 D2 D1 D0
MUX_EN SPI_SDO MUX_OUT INT_CON[2] INT_CON[1] INT_CON[0] MUX_CFG[1] MUX_CFG[0]
0b 0b 0b 0b 0b 0b 0b 0b
D[7] MUX_EN: Enable diagnostic MUX output
0b = Disabled (tri-stated)
1b = Enabled
D[6] SPI_SDO: To control the SPI_SDO output-buffer state during an interconnect test
To check the SDO diagnostics use the following sequence:
MUX_CFG[1:0] configuration must be 01b (Digital MUX Mode)
SPI NCS must be kept HIGH
The state of the SDO pin is controlled by the SPI_SDO bit
D[5] MUX_OUT: Diagnostic MUX output-state control bit
Note: When the MUX_CFG bits are set to 00b and the MUX_EN bit is set to 1
D[4:2] INT_CON[2:0]: Device interconnect-test configuration bits
000b = No active interconnect test
001b = ERR input state observed on the diagnostic MUX output
010b = SPI_NCS input state observed on the diagnostic MUX output
011b = SPI_SDI input state observed on the diagnostic MUX output
100b = SPI_SCLK input observed on the diagnostic MUX output
101b = Not applicable
110b = Not applicable
111b = Not applicable
D[1:0] MUX_CFG[1:0]: Diagnostic MUX configuration
00b = The MUX output is controlled by MUX_OUT bit (bit 5 in DIAG_CFG_CTRL register)
01b = Digital MUX mode
10b = Analog MUX mode
11b = Device interconnect mode (input-pins interconnect test)

DIAG_MUX_SEL Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read (RD_DIAG_MUX_SEL )
Write (WR_DIAG_MUX_SEL)

Figure 5-40 DIAG_MUX_SEL Register
D7 D6 D5 D4 D3 D2 D1 D0
MUX_SEL[7] MUX_SEL[6] MUX_SEL[5] MUX_SEL[4] MUX_SEL[3] MUX_SEL[2] MUX_SEL[1] MUX_SEL[0]
0b 0b 0b 0b 0b 0b 0b 0b
D[7:0] MUX_SEL[7:0]: Diagnostic MUX channel select
Note: The MUX channel table is dependent on the MUX_CFG[1:0] bit settings in the DIAG_CFG_CTRL register (see Section 5.5.4.17.1)

Watchdog Timer

WD_TOKEN_FDBK Register

Initialization source: NPOR
Controller access: Read (RD_WD_TOKEN_FDBK)
Write (WR_WD_TOKEN_FDBK). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-41 WD_TOKEN_FDBK Register
D7 D6 D5 D4 D3 D2 D1 D0
FDBK[3] FDBK[2] FDBK[1] FDBK[0] TOKEN_SEED[3] TOKEN_SEED[2] TOKEN_SEED[1] TOKEN_SEED[0]
0b 0b 0b 0b 0b 0b 0b 0b
D[7:4] FDBK[3:0]: Watchdog question (token) FSM feedback configuration bits
FDBK [3:0] bits control the sequence of generated questions and Markov chain polynomial
The device has a set of 16 generated questions, repetition or sequence ordering can be adjusted by the FDBK[3:0] bits
FDBK[3:2] controls the question (TOKEN) generation for the watchdog in Q&A mode
FDBK[2:1] controls the LFSR configuration for the watchdog question (TOKEN) generation
FDBK[0] RSV
D[3:0] TOKEN_SEED[3:0]: Watchdog token seed value, used to generate a set of new questions (tokens)
The token seed value can be updated by the MCU only after watchdog is reinitialization in the DIAGNOSTIC state after RESET. The new TOKEN_SEED[3:0] value takes effect after another transition through the RESET state with AUTO_BIST_DIS = 1:
Only for Q&A Mode

WD_WIN1_CFG Register

Initialization source: NPOR
Controller access: Read (RD_WD_WIN1_CFG)
Write (WR_WD_WIN1_CFG). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-42 WD_WIN1_CFG Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RT[6] RT[5] RT[4] RT[3] RT[2] RT[1] RT[0]
0b 1b 1b 1b 1b 1b 1b 1b
D[7] RSV
D[6:0] RT[6:0]: Watchdog Window 1 duration setting
See Equation 1 and Equation 2 to calculate the minimum and maximum values for the tWIN1 time period.

WD_WIN2_CFG Register

Initialization source: NPOR
Controller access: Read (RD_WD_WIN2_CFG)
Write (WR_WD_WIN2_CFG). Write update can only occur in the DIAGNOSTIC state. Write access locked through SW_LOCK command.

Figure 5-43 WD_WIN2_CFG Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV RSV RW[4] RW[3] RW[2] RW[1] RW[0]
0b 0b 0b 1b 1b 0b 0b 0b
D[7:5] RSV
D[4:0] RW[4:0]: Watchdog Window 2 duration setting
See Equation 3 and Equation 4 to calculate the minimum and maximum values for the tWIN2 time period.

WD_TOKEN_VALUE Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read only (RD_WD_TOKEN_VALUE)

Figure 5-44 WD_TOKEN_VALUE Register
D7 D6 D5 D4 D3 D2 D1 D0
WD_FAIL_TH RSV RSV RSV TOKEN[3] TOKEN[2] TOKEN[1] TOKEN[0]
1b 0b 0b 0b 0b 0b 0b 0b
D[7] WD_FAIL_TH
Set to 1 when the watchdog fail counter reaches a count of 5 or higher (WD_FAIL_CNT[2:0] bits in the SAFETY_STAT_2 register)
Cleared to 0 when the watchdog fail counter reaches a count of less than 5 (WD_FAIL_CNT[2:0] bits in the SAFETY_STAT_2 register)
D[6:4] RSV
D[3:0] TOKEN[3:0]: watchdog question (token)
The MCU must read (or calculate) the current question (token) to generate a correct answer bytes.
Only for Q&A mode

WD_STATUS Register

Initialization source: NPOR, post LBIST reinitialization
Controller access: Read only (RD_WD_STATUS)

Figure 5-45 WD_STATUS Register
D7 D6 D5 D4 D3 D2 D1 D0
WD_ANSW_CNT
[1]
WD_ANSW_CNT
[0]
ANSWER_ERR WD_WRONG_CFG WD_CFG_CHG SEQ_ERR TIME_OUT ANSWER_EARLY
1b 1b 0b 0b 0b 0b 0b 0b
D[7:6] WD_ANSW_CNT[1:0]: Current watchdog answer count
Only for Q&A mode
D[5] ANSWER_ERR: Watchdog error-status bit to show the incorrect Answer-x byte (formerly TOKEN_ERR)
This bit is set to 1 as soon as an Answer-x byte (WD_TOKEN_RESPx) is not correct. This flag is cleared if the following answer is correct again or at the beginning of a new watchdog sequence. This bit is not cleared on SPI read-out.
Only for Q&A mode
D[4] WD_WRONG_CFG
Set to 1 when either the WD_WIN1_CFG or WD_WIN2_CFG bits are set to 00h.
D[3] WD_CFG_CHG: Watchdog configuration-change status bit
This bit is set to 1 when WD_WIN1_CFG or WD_WIN2_CFG setting is changed. This bit is cleared at the beginning of a new watchdog sequence.
D[2] SEQ_ERR: Any of the answer bytes are wrong
Incorrect timing or wrong answer
Only for Q&A mode
D[1] TIME_OUT: No watchdog event (trigger or four answer-x bytes) received within the watchdog sequence (time-out event)
In trigger mode (default): set to 1 when no trigger has been received on the ERROR/WDI pin during the watchdog sequence
In Q&A mode: set to 1 when less than four Answer-x bytes have been received during the watchdog sequence
This flag can be used to resynchronize the MCU timing to the device watchdog.
Cleared to 0 by SPI read access, cleared to 0 after a watchdog good event or bad event, or cleared to 0 during reset event. Note: In the DIAGNOSTIC state, writing this bit to 1 is possible, leaving it set at 1 has the same device level impact as a detected failure on the ERROR/WDI pin.
D[0] ANSWER_EARLY: Answer-x bytes completed too early or trigger too early (formerly TOKEN_EARLY)
Set to 1 if the four answer bytes are returned during Window 1 or the trigger occurs in Window 1

WD_ANSWER Register

Initialization source: NPOR
Controller access: Write only (WR_WD_ANSWER)

Figure 5-46 WD_ANSWER Register
D7 D6 D5 D4 D3 D2 D1 D0
WD_ANSW[7] WD_ANSW[6] WD_ANSW[5] WD_ANSW[4] WD_ANSW[3] WD_ANSW[2] WD_ANSW[1] WD_ANSW[0]
0b 0b 0b 0b 0b 0b 0b 0b
D[7:0] WD_ANSW[7:0]: answer bytes
See Section 5.4.15.4 for details on answer bytes
Only for Q&A mode

Sensor Supply

SENS_CTRL Register

Initialization source: NPOR
Controller access: Read (RD_SENS_CTRL)
Write (WR_SENS_CTRL)

Figure 5-47 SENS_CTRL Register
D7 D6 D5 D4 D3 D2 D1 D0
RSV RSV RSV VDD5_EN RSV RSV RSV VSOUT1_EN
0b 0b 0b 1b 0b 0b 0b 0b
D[7:5] RSV
D[4] VDD5_EN: If cleared to 0, the VDD5 regulator turns off.
This bit is set to 1 by default, and is cleared in case of the VDD5 over temperature condition (indicated by the VDD5_OT bit D1 in the SAFETY_STAT1 register).
Note: When the VDD5 regulator is disabled, the VDD5_ILIM bit (bit D7 in the SAFETY_STAT_1 register) is set to 1 and remains set to 1 as long as the VDD5 regulator is disabled (or the VDD5_EN bit is 0). However, the VDD5_OV and VDD5_UV bits reflect an overvoltage or undervoltage condition on the VDD5 regulator.
D[3:1] RSV
D[0] VSOUT1_EN: Sensor-supply enable bit (set this bit to 1 to enable the VSOUT1 sensor supply)
This bit is cleared to 0 by default, and must be set to 1 by the MCU to enable the VSOUT1 sensor supply. In case of a VSOUT1 overtemperature condition (indicated by the VSOUT1_OT bit D2 in the SAFETY_STAT1 regulator), the VSOUT1 regulator is disabled and this bit, VSOUT1_EN, is cleared to 0. When the overtemperature condition in the VSOUT1 sensor supply is no longer present, the VSOUT1 sensor supply must be reenabled.