SLLA535 December   2022 TLIN1431-Q1

 

  1. 1Introduction
    1.     Trademarks
  2. 2TLIN1431x-Q1 Hardware Component Functional Safety Capability
  3. 3Development Process for Management of Systematic Faults
    1. 3.1 TI New-Product Development Process
    2. 3.2 TI Functional Safety Development Process
  4. 4TLIN1431x-Q1 Component Overview
    1. 4.1 Targeted Applications
    2. 4.2 Hardware Component Functional Safety Concept
    3. 4.3 Functional Safety Constraints and Assumptions
  5. 5Description of Hardware Component Parts
    1. 5.1 LIN Transceiver
    2. 5.2 Digital Core
    3. 5.3 Power Control IP
    4. 5.4 Digital Input/Output Pins and High-side Switch
  6. 6TLIN1431x-Q1 Management of Random Faults
    1. 6.1 Fault Reporting
    2. 6.2 Functional Safety Mechanism Categories
    3. 6.3 Description of Functional Safety Mechanisms
      1. 6.3.1 LIN Bus and Communication
        1. 6.3.1.1 SM-1: LIN TXD Pin Dominant State Timeout
        2. 6.3.1.2 SM-2: LIN Bus Stuck Dominant System Fault: False Wake Up Lockout
        3. 6.3.1.3 SM-3: LIN Bus Short Circuit Limiter
        4. 6.3.1.4 SM-20: LIN Internal pull-up to VSUP
        5. 6.3.1.5 SM-22: LIN Protocol
      2. 6.3.2 Voltage Rail Monitoring
        1. 6.3.2.1 SM-4: VCC and Transceiver Thermal Shutdown
        2. 6.3.2.2 SM-5: VCC Under-voltage
        3. 6.3.2.3 SM-6: VCC Over-voltage
        4. 6.3.2.4 SM-7: VCC Short to Ground
        5. 6.3.2.5 SM-8: VSUP Under-voltage
      3. 6.3.3 Processor Communication
        1. 6.3.3.1 SM-9 and SM-10: Watchdog
          1. 6.3.3.1.1 SM-9: Standby Mode Long Window Timeout Watchdog
          2. 6.3.3.1.2 SM-10: Normal Mode Watchdog
        2. 6.3.3.2 SM-11: SPI CRC
        3. 6.3.3.3 SM-12: SPI Communication Error; SPIERR
        4. 6.3.3.4 SM-13: Scratchpad Write/Read Register
        5. 6.3.3.5 SM-14: Sleep Wake Error Timer; tINACT_FS
      4. 6.3.4 Digital Input/Output Pins and High-side Switch
        1. 6.3.4.1 SM-15: CLK internal pull-up to VINT
        2. 6.3.4.2 SM-16: SDI internal pull-up to VINT
        3. 6.3.4.3 SM-17: nCS Internal pull-up to VINT
        4. 6.3.4.4 SM-18: DIV_ON Internal pull-down to GND
        5. 6.3.4.5 SM-19: TXD Internal pull-up to VINT
        6. 6.3.4.6 SM-21: nRST Internal pull-up to VINT
        7. 6.3.4.7 SM-23: HSS Over Current Detect
        8. 6.3.4.8 SM-24: HSS Open Load Detect
          1.        A Summary of Recommended Functional Safety Mechanism Usage
            1.         B Distributed Developments
              1.          B.1 How the Functional Safety Lifecycle Applies to TI Functional Safety Products
              2.          B.2 Activities Performed by Texas Instruments
              3.          B.3 Information Provided
                1.           C Revision History

SM-9 and SM-10: Watchdog

The TLIN1431x-Q1 has an integrated watchdog function and provides two watchdog types that can be set up when using SPI control: window watchdog or timeout watchdog. If more frequent (i.e. <16 ms) input trigger events are desired it is suggested to us the timeout watchdog. When using timeout watchdog, the input trigger can occur anywhere before the timeout and is not tied to an open window. The device defaults to window watchdog at power up but can be programmed to support timeout watchdog. The watchdog registers for input trigger and configuration are located at 8'h13 through 8'h16. WD_CONFIG_1 register 8'h13[7:4] and WD_CONFIG_2 register 8'h14[7:5] are used to set up timing. See Table 6-6 for available watchdog timing.

When using the window watchdog, it is important to understand the closed and open window aspects. The device is set up with a 50%/50% open and closed window and is based on an internal oscillator with a ± 10% accuracy range. To determine when to provide the input trigger, this variance needs to be considered. For example, using the 64 ms nominal total window provides a closed and open window that are each 32 ms. Taking the ±10% internal oscillator into account means the total window could range from 57.6 ms to 70.4 ms. The closed and open window could then range from 22.4 ms to 35.2 ms. From the 57.6 ms total window and 35.2 ms closed window, the total open window is 22.4 ms. The trigger event needs to happen at 46.4 ms ± 11.2 ms. See Figure 6-6 for when the initial window is needed and when the device would expect a watchdog input trigger for a window watchdog configuration. See Figure 6-7 and Figure 6-8 for state diagrams on how the WD behaves.

The TLIN1431x-Q1 has a watchdog error counter used in SPI control mode. This counter is an up down counter that increments for every missed window or incorrect input watchdog trigger event. In SPI control, the error counter is set at one by default. The counter decrements for every correct input trigger and increments on every incorrect input trigger, but it never drops below zero. When the programmed counter is reached, the device transitions to restart mode and pulls nRST pin low for tNRST_TOG. At the end of this time, the device transitions back to standby mode releasing the nRST pin to high. This counter can be changed to 1 (every error), 9, or 15 using 8'h16[7:6]. The error counter can be read at register 8'h14[4:1]. In pin control, nWDR is pulled low for every watchdog error.

If the watchdog error count is set at one, the first input failure causes the device to transition to restart. This allows the system to check the counter after the first input trigger to see if a valid input was sent. Every incorrect watchdog input causes the interrupt to be set and nINT is pulled low.

The LIMP pin provides a limp home capability when connected to external circuitry. When in sleep mode, the LIMP pin is off. When the error counter reaches the watchdog trigger event level, the LIMP pin turns on connecting VSUP to the pin as described in the LIMP pin section.

Table 6-6 Watchdog Window and Timeout Timer Configuration (ms)
WD_TIMER (ms)Register 8'h13[5:4] WD_PRE
Register 8'14[7:5]00011011
000481216
001326496128
010128256384512
011256384512768
100512102415362048
1012048409661448192
1101024020240RSVDRSVD
1111RSVDRSVDRSVDRSVD
Figure 6-6 Watchdog Timing Diagram
Figure 6-7 Watchdog state diagram in SPI mode; Standby Mode Enabled
Figure 6-8 Watchdog state diagram in SPI mode; Standby Mode Disabled
Note:
  • When the mode is changed while the timeout or window watchdog is running, it restarts once entering the new mode, fast, normal and standby.
  • If the watchdog configuration is changed on-the-fly while the watchdog is running, it resets the error counter to 1 and resets the watchdog timers.