SLVA528D September   2012  – August 2021 TPS65381-Q1 , TPS65381A-Q1

 

  1.   Trademarks
  2. 1Introduction
  3. 2Product Overview
    1. 2.1 Safety Functions and Diagnostics Overview
    2. 2.2 Target Applications
    3. 2.3 Product Safety Constraints
  4. 3Development Process for Management of Systematic Faults
    1. 3.1 TI New-Product Development Process
  5. 4TPS65381x-Q1 Product Architecture for Management of Random Faults
    1. 4.1 Device Operating States
    2.     Device Operating States (continued)
    3. 4.2 NRES (MCU Reset) Driver and ENDRV (SAFING Path Enable) Driver
  6. 5TPS65381x-Q1 Architecture Safety Mechanisms and Assumptions of Use
    1. 5.1 Power Supply
    2. 5.2 Regulated Supplies
      1. 5.2.1 VDD6 Buck Switch-Mode Supply
      2. 5.2.2 VDD5 Linear Supply
      3. 5.2.3 VDD3/5 Linear Supply
      4. 5.2.4 VDD1 Linear Supply
      5. 5.2.5 VSOUT1 Linear Supply
      6. 5.2.6 Charge Pump
    3. 5.3 Diagnostic, Monitoring, and Protection Functions
      1. 5.3.1 External MCU Fault Detection and Management
        1. 5.3.1.1 External MCU Error Signal Monitor (MCU ESM)
        2. 5.3.1.2 Watchdog Timer
      2. 5.3.2 Voltage Monitor (VMON)
      3. 5.3.3 Loss-of-Clock Monitor (LCMON)
      4. 5.3.4 Junction Temperature Monitoring and Current Limiting
      5. 5.3.5 Analog and Digital MUX (AMUX and DMUX) and Diagnostic Output Pin (DIAG_OUT)
      6. 5.3.6 Analog Built-In Self-Test (ABIST)
      7. 5.3.7 Logic Built-In Self-Test (LBIST)
      8. 5.3.8 Device Configuration Register Protection
  7. 6Application Diagrams
    1. 6.1 TPS65381x-Q1 With TMS570
    2. 6.2 TPS65381x-Q1 With C2000
    3. 6.3 TPS65381x-Q1 With TMS470
  8. 7TPS65381x-Q1 as Safety Element out of Context (SEooC)
    1. 7.1 TPS65381x-Q1 Used in an EV/HEV Inverter System
    2. 7.2 SPI Note
  9. 8Revision History

5.3.1.2 Watchdog Timer

The watchdog timer monitors proper function of the external MCU. The watchdog has two modes of operation: trigger mode or question and answer (Q&A) mode.

    Trigger modeThe MCU indicates normal operation by periodically sending a watchdog trigger (pulse) on the ERROR/WDI pin, which a window watchdog must receive within a defined time windows.
    Q&A modeThe MCU sends the watchdog information through SPI. The MCU reads or calculates the next question and provides four answer bytes for each question. The fourth answer byte must be in the Window 2 and all answer bytes must be correct and provided in the correct order.

The watchdog configuration is controlled by the WD_CFG bit the SAFETY_FUNC_CFG register. The default configuration is trigger mode.

Actions are taken based on a watchdog failure counter, WD_FAIL_CNT[2:0]. Good events in both modes decrement the WD_FAIL_CNT[2:0] counter and bad events increment the counter. When the WD_FAIL_CNT[2:0] counter is less than five, the ENDRV pin can be asserted high by setting the ENABLE_DRV bit. If the MCU responds incorrectly or not at all, bad events, or time-out, are detected and the WD_FAIL_CNT[2:0] counter increment. When the WD_FAIL_CNT[2:0] counter is five or greater, the ENDRV pin is not able to be asserted high, even if the ENABLE_DRV bit is set high. If the MCU does not recover and the WD_FAIL_CNT[2:0] counter reaches 7 + 1 (the next bad or time-out event after the fail counter reaches 7) while the WD_RST_EN bit is 1 the device transitions to the RESET state and the NRES pin is pulled low. If the NRES pin is connected to the reset input circuits of the MCU, the MCU is also reset.

GUID-F8CB8FE7-9144-4CAD-93A5-8007F2076855-low.gif
When a good event is received in Window 2 (OPEN), 1 system clock-cycle (250 ns, typical) later the next watchdog sequence begins. Therefore the actual length of Window 2 (OPEN) depends on when the MCU sends the good event.
Figure 5-4 Example Cases for Good Events in Trigger Mode
GUID-8F46D3DE-1475-4C17-B137-43289D1F2931-low.gif
(1) The MCU is not required to read the question (token). The MCU can begin giving the correct answer bytes Answer-3, Answer-2, Answer-1, anywhere in Window 1 or Window 2. The new question (token) is generated and a new watchdog sequence started within 1 system clock cycle after the final Answer-0 as long as the answer was a good event. A bad event or time-out event causes a new watchdog sequence to start, however a new question (token) isl not generated.
(2) The MCU can put other SPI commands in-between the WR_WD_ANSWER commands (even rerequesting the question). These SPI commands have no influence on the detection of a good event, as long as the four correct answer bytes are in the correct order, and the fourth correct answer byte is provided in Window 2.
Figure 5-5 Watchdog Sequence in Q&A Mode