To achieve a system functional safety level of ASIL-B, the following PDN features are available:

• PMIC over voltage and under voltage monitoring on the power resource voltage outputs
• Over voltage and under voltage monitoring on discrete power resources
• Watchdog monitoring of safety processor
• MCU error monitoring
• MCU reset
• I²C communication
• Error indicator, EN_DRV, for driving external circuitry (optional)
• Read-back of EN_DRV pin

For functional safety applications, as an in-line, external power FET must be placed between the output of the 5V or 3.3V supply and the VCCA line. The voltage before and after the FET is monitored by the PMIC, and the PMIC controls the FET through the OVPGDRV pin. The FET can quickly isolate the PMIC when an over-voltage event greater than 6 V is detected on the input supply to protect the system from being damaged. This system protection includes all power rails sourced from the FET along the VCCA line. Any power connected upstream from the FET is not protected from over voltage events. In Figure 2-1 all power resources are connected after the FET to extend the over voltage protection to all processor domains and key discrete components. The only exceptions being the discrete LDOs for the SD card and 3.3 V USB.

The PMIC internal over voltage and under voltage monitoring and their respective monitoring threshold levels are enabled by default and can be updated through I²C after startup. PMIC power rails connected directly to the processor are monitored by default. Two TPS389006004 voltage monitors are used to monitor power resources not provided by the PMIC. Connect the interrupt signals of these voltage monitors to the PMIC as described in Section 2.2. The second voltage monitor SVS-B is not required if GPIO and DDR retention low power modes are not used.

The internal Q&A Watchdog is disabled on the TPS6594133A device by default and can be enabled after the powers up. Once the device is in ACTIVE state, the trigger or Q&A watchdog settings can be configured through I²C in the device. The I²C CRC is not enabled by default but must be enabled with the I2C_2 trigger described in Table 5-1. It is recommended to enable I²C CRC and wait a minimum of 2ms before starting the Q&A Watchdog. The steps for configuring and starting the watchdog can be found in the TPS6594-Q1 data sheet.

GPIO_7 of the TPS6594133A PMIC is configured as the MCU error signal monitor, and must be enabled though the ESM_MCU_EN register bit. MCU reset is supported through the connection between the PMIC nRSTOUT pin and the MCU_PORz of the processor. Lastly, there are two I2C ports between the TPS6594133A and the processor. The first is used for all non-watchdog communication, such as voltage level control, and the second allows the watchdog monitoring to be on an independent communication channel.

There is an option to use the EN_DRV of the TPS6594133A PMIC to indicate an error has been detected and the system is entering SAFE state. This signal can be utilized if the system has external circuitry that needs to be driven by an error event. In this PDN, the EN_DRV is not utilized, but available if needed.