The device goes into the SAFE state from the DIAGNOSTIC state or the ACTIVE state when one of the global SAFE state conditions is met or when the MCU_ESM_FC failure counter accumulates to the threshold levels defined in the SAFETY_CFG4 register. The device goes from the RESET state to the SAFE state if the device error counter (DEV_ERR_CNT) reaches the threshold level for the SAFE state lock defined by the SAFE_LOCK_TH[3:0] bits in the SAFETY_CFG1 register. The device goes from the SAFE sate and to the DIAGNOSTIC state when the system MCU sends the SAFE_EXIT command.

When the device goes into the SAFE state, the following occurs:

• The device error counter (DEV_ERR_CNT) increments (except when the device goes from the RESET state).
• The WD_RST_EN bit is masked (no watchdog RESET event is generated if the WD_RST_EN bit is set to 1b and the WD failure counter reaches the reset threshold). After SAFE_EXIT SPI command device transitions to RESET state if WD_RST_EN bit is set to 1b and the WD failure counter reached the WD reset threshold value WD_FC_RST_TH.
• The ENDRV_EN control bit is cleared.
• The ENDRV/nIRQ output is driven low, which functions as an interrupt to the system MCU, as a way to disable external safing paths or peripherals, or both.
• The NRES stays driven high.

The SAFE state time-out is a protection feature against an unresponsive MCU that would keep the device locked in the SAFE state (SAFE LOCK condition). The SAFE state time-out duration is configurable through the SAFE_TO_CFG[1:0] configuration bits in the SAFETY_CFG1 register. To support customer software development, the SAFE state time-out protection feature can be disabled. Disabling this feature is done through the SAFE_TO_DIS bit in addition to the programmed SAFE state device error counter lock threshold value, SAFE_LOCK_TH. The SAFE state time-out is disabled when the SAFE_TO_DIS bit is set to 1b and the accumulated device error counter is greater than the SAFE state device error counter lock threshold value, SAFE_LOCK_TH.

During a SAFE LOCK condition, the device could go to the RESET state because of a global RESET event. When a global RESET condition is removed and the NRES extension is complete (and the NRES pin driven high), the device goes back to the SAFE state because the SAFE LOCK condition still occurs.

By default, the SAFE state time-out feature is disabled (the SAFE_TO_DIS bit is set to 1b) and the SAFE_LOCK_TH[3:0] bit is set to 0b. Disabling the SAFE state time-out enables easier system-software development because the system starts-up with the unprogrammed MCU. The SAFE_TO_DIS bit and the SAFE_LOCK_TH bits can only be changed when the device is in the DIAGNOSTIC state.

While the device is in the SAFE state, the system MCU can activate either a full ABIST run or an individual ABIST diagnostic test through the SPI.

While the device is in SAFE state the WD TIME_OUT event can be used by the MCU application software (SW) to establish synchronization between the device and MCU SW and HW processes. Each WD TIME_OUT event is followed by the start of a new WD Q&A sequence run. Default setting for WD_RST_EN bit is 1b.