Specia Fail-safe IC

Features • • • • • Digital Self-supervising Watchdog with Hysteresis One 250-mA Output Driver for Relay Enable Output Open Collector 8 mA Over/Undervoltage Detection ENABLE and RELAY Outputs Protected Against Standard Transients and 40V Load Dump • ESD Protection According to MIL-STD-883 D Test Method 3015.7 – Human Body Model: ±2 kV (100 pF, 1.5 kΩ) – Machine Model: ±200 V (200 pF, 0Ω) Special Fail-safe IC U6808B 1. Description The U6808B is designed to support the fail-safe function of a safety critical system (e.g., ABS). It includes a relay driver, a watchdog controlled by an external R/C-network and a reset circuit initiated by an over and undervoltage condition of the 5-V supply providing a low-level reset signal. Figure 1-1. Block Diagram VS VS Bandgap reference 2.44 V Power-on reset www.DataSheet4U.com + - RESET Reset debounce Reset delay + RELAY Under/ overvoltage detection ENABLE RIN + + - Internal oscillator Watchdog RC oscillator Current limitation WDI GND WDC Rev. 4707B–AUTO–10/05 2. Pin Configuration Figure 2-1. Pinning SO8 RELAY 1 8 VS GND 2 7 RIN ENABLE 3 6 WDI WDC 4 5 RESET Table 2-1. Pin 1 2 3 4 5 6 7 8 Pin Description Symbol RELAY GND ENABLE WDC RESET WDI RIN VS Type Open collector driver output Supply Digital output Analog input Digital output Digital input Digital input Supply Function Fail-safe relay driver Standard ground Negative reset signal External RC for watchdog timer Negative reset signal Watchdog trigger signal Activation of relay driver 5-V supply Logic No signal: driver off Low: driver on No signal Low: reset No signal Low: reset Pulse sequence High: driver on Low: driver off – 2 U6808B 4707B–AUTO–10/05 U6808B 3. Fail-safe Functions A fail-safe IC has to maintain its monitoring function even if there is a fault condition at one of the pins (e.g., short circuit). This ensures that a microcontroller system is not brought into a critical status. A critical status is reached if the system is not able to switch off the relay and to give a signal to the microcontroller via the ENABLE and RESET outputs. The following table shows the fault conditions for the pins. Table 3-1. Pin RIN Table of Fault Conditions Function Digital input to activate the fail-safe relay Short to VS Relay on Short to VBat Relay on Short to GND Relay off Open Circuit Relay off WDI Watchdog trigger Watchdog reset input Capacitor and resistor of watchdog Driver of the failsafe relay Watchdog reset Watchdog reset Watchdog reset Watchdog reset OSC Watchdog reset Watchdog reset Watchdog reset RELAY Relay on Relay off 4. Truth Tables Table 4-1. Truth Table for Over and Undervoltage Conditions RESET Output (RESET) High High Low Low Low Low Enable Output Driver (ENABLE) Off Off On On On On Relay Output Driver Supply Voltage Relay Input (RIN) (RELAY) (VS) Normal Too low Too high Low High Low High Low High Off On Off Off Off Off Table 4-2. Truth Table for Watchdog Failures (Reset Output Do Not Care) Relay Input (RIN) Low High Low High Low High Relay Output Driver (RELAY) Off On Off Off Off Off Enable Output Driver (ENABLE) Off Off On On On On Watchdog Input (WDI) Normal Too slow Too fast 3 4707B–AUTO–10/05 5. Description of the Watchdog Figure 5-1. Watchdog Block Diagram RCOSC Binary counter Dual MUX WDI Slope detector Up/down counter RS-FF WD-OK RESET OSCERR 5.1 Abstract The microcontroller is monitored by a digital window watchdog which accepts an incoming trigger signal of a constant frequency for correct operation. The frequency of the trigger signal can be varied in a broad range as the watchdog's time window is determined by external R/C components. The following description refers to the block diagram, see Figure 5-1. 5.2 WDI Input The microcontroller has to provide a trigger signal with the frequency fWDI which is fed to the WDI input. A positive edge of fWDI detected by a slope detector resets the binary counter and clocks the up/down counter additionally. The latter one counts only from 0 to 3 or reverse. Each correct trigger increments the up/down counter by 1, each wrong trigger decrements it by 1. As soon as the counter reaches status 3 the RS flip-flop is set (see Figure 5-2). A missing incoming trigger signal is detected after 250 clocks of the internal watchdog frequency fRC (see section “WD-OK Output”) and resets the up/down counter directly. 5.3 RCOSC Input With an external R/C circuitry the IC generates a time base (frequency fWDC) independent from the microcontroller. The watchdog's time window refers to a frequency of fWDC = 100 × fWDI 5.4 OSCERR Input A smart watchdog has to ensure that internal problems with its own time base are detected and do not lead to an undesired status of the complete system. If the RC oscillator stops oscillating a signal is fed to the OSCERR input after a time-out delay. It resets the up/down counter and disables the WD-OK output. Without this reset function the watchdog would freeze in its current status when fRC stops. 4 U6808B 4707B–AUTO–10/05 U6808B 5.5 RESET Input During power-on and under/overvoltage detection a reset signal is fed to this pin. It resets the watchdog timer and sets the initial state. 5.6 WD-OK Output After the up/down counter is incremented to status 3 (see Figure 5-2) the RS flip-flop is set and the WD-OK output becomes logic 1. This information is available for the microcontroller at the open-collector output ENABLE. If on the other hand the up/down counter is decremented to 0 the RS flip-flop is reset, the WD-OK output and the ENABLE output are disabled. The WD-OK output also controls a dual MUX stage which shifts the time window by one clock after a successful trigger, thus forming a hysteresis to provide stable conditions for the evaluation of the trigger signal good or false. The WD-OK signal is also reset in case the watchdog counter is not reset after 250 clocks (missing trigger signal). 5.7 Watchdog State Diagram Figure 5-2. Watchdog State Diagram good Initial status bad bad O/F bad good 1/F good bad 2/F good 1/NF bad bad 3/NF 2/NF good good 5.8 Explanation In each block, the first character represents the state of the counter. The second notation indicates the fault status of the counter. A fault status is indicated by an F and a no fault status is indicated by an NF. When the watchdog is powered up initially, the counter starts out at the 0/F block (initial state). Good indicates that a pulse has been received whose width resides within the timing window. Bad indicates that a pulse has been received whose width is either too short or too long. 5 4707B–AUTO–10/05 5.9 5.9.1 Watchdog Window Calculation Example with Recommended Values Cosc = 3.3 nF (should be preferably 10%, NPO) Rosc = 39 kΩ (may be 5%, Rosc < 100 kΩ due to leakage current and humidity) 5.9.2 RC Oscillator tWDC(s) = 10-3 × [Cosc (nF) × [(0.00078 × Rosc (kΩ)) + 0.0005]] fWDC(Hz) = 1/(tWDC) 5.9.3 Watchdog WDI fWDI(Hz) =0.01 × fWDC tWDC = 100 µs → fWDC = 10 kHz fWDI = 100 Hz → tWDI = 10 ms 5.9.3.1 WDI Pulse Width for Fault Detection after 3 Pulses Upper watchdog window Minimum: 169/fWDC = 16.9 ms → fWDC/169 = 59.1 Hz Maximum: 170/fWDC = 17.0 ms → fWDC/170 = 58.8 Hz Lower watchdog window Minimum: 79/fWDC = 7.9 ms → fWDC/79 = 126.6 Hz Maximum: 80/fWDC = 8.0 ms → fWDC/80 = 125.0 Hz 5.9.3.2 WDI Dropouts for Immediate Fault Detection Minimum: 250/fWDC = 25 ms Maximum: 251/fWDC = 25.1 ms Watchdog Timing Diagram with Tolerances 79/fWDC 80/fWDC 169/fWDC 170/fWDC 250/fWDC 251/fWDC Figure 5-3. Time/s Watchdog window update rate is good Update rate is Update rate is too either too fast or fast good Update rate is Update rate is Update rate is too either too slow or Pulse has either too slow or slow pulse has dropped out good dropped out 5.9.3.3 Reset Delay The duration of the over or undervoltage pulses determines the enable and reset output. A pulse duration shorter than the debounce time has no effect on the outputs. A pulse longer than the debounce time results in the first reset delay. If a pulse appears during this delay, a second delay time is triggered. Therefore, the total reset delay time can be longer than specified in the data sheet. 6 U6808B 4707B–AUTO–10/05 U6808B 6. Absolute Maximum Ratings Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability. Parameters Supply-voltage range Power dissipation VS = 5V, Tamb = –40°C VS = 5V, Tamb = +125°C Thermal resistance Junction temperature Ambient temperature range Storage temperature range Symbol VS Ptot Ptot Rthja Tj Tamb Tstg Value –0.2 to +16 250 150 160 150 –40 to +125 –55 to +155 Unit V mW mW K/W °C °C °C 7. Electrical Characteristics VS = 5V, Tamb = –40 to +125°C, reference pin is GND, fintern = 100 kHz + 50% – 45%, fWDC = 10 kHz ±10%, fWDI = 100 Hz Parameters Supply Voltage Operation range general Operation range reset Supply Current Relay off Relay on Digital Input WDI Detection low Detection high Resistance to VS Input current low Input current high Zener clamping voltage Digital Input RIN Detection low Detection high Resistance to GND Input current low Input current high Zener clamping voltage Input voltage = 0V Input voltage = VS VZRIN –0.2 0.7 × VS 10 –5 100 20 0.2 × VS VS + 0.5 V 40 +5 550 24 V V kΩ µA µA V Input voltage = 0V Input voltage = VS VZWDI –0.2 0.7 × VS 10 100 –5 20 0.2 × VS VS + 0.5V 40 550 +5 24 V V kΩ µA µA V Tamb = –40°C Tamb = +125°C Tamb = –40°C Tamb = +125°C 6 15 mA mA VS VS 4.5 1.2 5.5 16.0 V V Test Conditions Symbol Min. Typ. Max. Unit 7 4707B–AU