Features • • • • • • • • • • • • Digital Self-supervising Watchdog with Hysteresis Three 250-mA Output Drivers One Relay Driver, Two Lamp Drivers Lamp Drivers with Auxiliary Ground Lamp Drivers Short-circuit Protected Lamp Drivers with Status Feedback Enable Output Over-/Undervoltage Detection and Reset All Power Outputs Protected Against Standard Transients All Power Outputs Protected Against 40-V Load Dump Automatically Activated Lamp Drivers if VS is Disconnected Automatically Activated Lamp Drivers Via AUX GND if Standard Ground is Disconnected Fail-safe IC with Relay Driver and Lamp Driver Description The U6809B is designed to support the fail-safe function of safety-critical systems such as ABS. It includes a relay driver, two independent short-circuit-protected lamp drivers which are supplied by redundant ground lines, two monitoring circuits for the lamp driver output voltage and output current, a watchdog controlled by an external RC network and a reset circuit initiated by an over- and undervoltage condition of the 5-V supply providing a positive and a negative reset signal. U6809B Rev. 4764A–AUTO–10/03 Figure 1. Block Diagram VS LA1I LA2I RELI WDI Microcontroller FBLA1 FBLA2 PRES NRES Digital input lamp 1 Open-collector 250 mA lamp driver 1 Logic Digital input lamp 2 Short-circuit detection and temperature monitor Digital input relay LA1O Temperature Digital input wd Watchdog Open-collector 250 mA lamp driver 2 Debouncing of over- and undervoltage detection Open-collector 250 mA relay driver Oscillator monitoring RC-oscillator Open-collector 25 mA enable driver LA2O Loads Feedback lamp 1 Feedback lamp 2 p reset n reset OSC GND RELO ENO AUX GND Pin Configuration Figure 2. Pinning SO20 2 REL1 1 20 LA1I 2 19 VS LA2I 3 18 LA1O RELO 4 17 GND GND 5 16 GND GND 6 FBLA1 7 14 LA2O NRES 8 13 AUX GND PRES 9 12 ENO FBLA2 10 11 OSC U6809B WDI 15 GND U6809B 4764A–AUTO–10/03 U6809B Pin Description Pin Name Type Function Logic 1 RELI Digital input Activation of relay driver Driver on: L Driver off: H 2 LA1I Digital input Activation of lamp driver 1 Driver off: L Driver on: H 3 LA2I Digital input Activation of lamp driver 2 Driver off: L Driver on: H 4 RELO Open-collector driver output Fail-safe relay driver Driver off:--Driver on: L 5, 6 GND Supply Standard ground 7 FBLA1 Digital output Feedback lamp1 See Table 1 on page 5 and Table 2 on page 5 8 NRES Digital output Negative reset signal Reset: L No reset: H 9 PRES Digital output Positive reset signal Reset: H No reset: L 10 FBLA2 Digital output Feedback lamp 2 See Table 1 on page 5 and Table 2 on page 5 11 OSC Analog input External RC for watchdog timer 12 ENO Open-collector output Watchdog disable output 13 AUX, GND Supply Auxiliary ground of lamp drivers 14 LA2O Open-collector driver output Warning lamp driver 15, 16, 17 GND Supply Standard ground 18 LA1O Open-collector driver output Warning lamp driver 19 VS 20 WDI Supply 5 V supply Digital input Watchdog trigger signal Watchdog ok: --Watchdog n ok: L Driver off: --Driver on: L Driver off: --Driver on: L Pulse sequence 3 4764A–AUTO–10/03 Detailed Block Diagram with External Components Figure 3. Detailed Block Diagram VS Push pull R+ Reset debouncing 19 V Ref 4 + - Push pull R- Reset delay 8 Temperature shut down 1 RELO Push pull L1 + - 7 VS + - V Ref2 + - 18 LA1O V Ref 1 Failure detection lamp 2 + - V Ref2 + - C B 14 D V Ref3 Ground backup GND AUX GND + - E Oscillator OSC D Integrated oscillator Internal timing C Push pull L2 5 6 15 16 17 GND E 10 FBLA2 Short-circuit protection B 4 E LA2O Watchdog 11 V Batt D A VS VS + - + Debouncing WDI V Ref3 3 20 FBLA1 V Batt Debouncing Failure detection lamp 1 2 C LA2I - NRES 4 A V Ref 5 LA1I + PRES V Batt + - RELI 9 12 ENO 13 AUX GND U6809B 4764A–AUTO–10/03 U6809B Table 1. Truth Table for Lamp Drivers and Lamp Feedback Inputs Outputs Lamp (I) Lamp Voltage Lamp Current Lamp Driver Current Lamp Current Feedback Lamp 0 1 0 off off 1 Output ok or open (internal pull-up) or shorted to VBatt 0 1 1 on off 1 Output shorted to VBatt and faulty input level 0 0 1 on on 0 Internal driver activated due to internal failure 0 0 0 off on 0 Output shorted to GND 1 0 1 on on 0 Output ok 1 1 1 on off 1 Output shorted to VBatt 1 1 0 off off 1 Internal driver deactivated due to internal failure or thermal shutdown 1 0 0 off on/off 1 Output shorted to GND or open Explanation Comment Lamp voltage is logic 1 if output voltage > threshold voltage detection Lamp voltage is logic 0 if output voltage < threshold voltage detection Lamp current is logic 1 if output current > threshold current detection Lamp current is logic 0 if output current < threshold current detection Table 2. Table of Fault Detection Feedback Lamp Condition Lamp Input is 0 (Lamp off) Lamp Input is 1 (Lamp on) Normal operation 1 0 Lamp output shorted to GND 0 (= detection) 1 (= detection) Lamp output shorted to VBatt 1 (= no detection) 1 (= detection) Lamp output open 1 (= no detection) 1 (= detection) Feedback shorted to GND 0 (= detection) 0 (= no detection) Feedback shorted to VS 1 (= no detection) 1 (= detection) Lamp input shorted to GND 1 (= no detection) 1 (= detection) Lamp input shorted to VS 0 (= detection) 0 (= no detection) Fail-safe Functions A fail-safe IC has to maintain its monitoring function even if there is a fault condition at one of the pins (e.g., short circuit). This ensures that a microcontroller system would not be brought into a critical status. A critical status is reached if the system is not able to actuate a warning lamp and switch off the relay. The following table shows fault conditions for different pins during which the IC still works as a fail-safe device. 5 4764A–AUTO–10/03 Table 3. Table of Fault Condition Pin Function LA2O Short to VS Short to VBatt Short to GND Open Circuit Short-circuit proof LA2O partly on driver for warning lamp LA2O off LA2O on LA2O off LA2I Digital input to activate LA2O on warning lamp LA2O on LA2O off LA2O on FBLA2 Digital feedback of warning lamp Faulty feedback Faulty feedback Faulty feedback LA1O Short-circuit proof LA1O partly on driver for warning lamp LA1O off LA1O on LA1O off LA1I Digital input to activate LA1O on warning lamp LA1O on LA1O off LA1O on FBLA1 Digital feedback of warning lamp Faulty feedback Faulty feedback Faulty feedback RELI Digital input to activate Relay off the fail safe relay Relay off Relay on Relay off WDI Watchdog trigger input Watchdog reset Watchdog reset Watchdog reset Watchdog reset OSC Capacitor and resistor Watchdog reset of watchdog Watchdog reset Watchdog reset Watchdog reset Faulty feedback Faulty feedback Description of the Watchdog Abstract The microcontroller is monitored by a digital window watchdog which accepts an incomming trigger signal of a constant frequency for correct operation. The frequency of the trigger signal can be varied in a broad range as the watchdog's time window is determined by external RC components. The following description refers to Figure 1 on page 2. Figure 4. Watchdog Block Diagram Binary counter RCOSC Dual MUX WDI Slope detector Up/down counter RS-FF WD-OK RESET OSCERR 6 U6809B 4764A–AUTO–10/03 U6809B WDI Input (Pin 20) The microcontroller has to provide a trigger signal with the frequency fWDI which is fed to the WDI input. A positive edge of fWDI detected by a slope detector resets the binary and clocks the up/down counter additionally. The up/down counter only counts from 0 to 3 or reverse. Each correct trigger increments the up/down counter by 1, each wrong trigger decrements it by 1. As soon as the counter reaches the count of 3 the RS flip-flop is set (see Figure 5). A missing incoming trigger signal is detected after 250 clocks of the internal watchdog frequency f RC (see WD-OK output) and resets the up/down counter directly. RCOSC Input With an external RC circuitry the IC generates a time base (frequency fRC) independent from the microcontroller. The watchdog's time window refers to a frequency of RC = 100 ´ fWDI Reset Input During power-on and under-/overvoltage detection a reset signal is fed to this pin. It resets the watchdog timer and sets the initial state. WD - OK Output After the up/down counter has been incremented to the count of 3 (see Figure 5, WD state diagram), the RS flip-flop is set and the WD-OK output becomes logic "1". This information is available for the microcontroller at the open-collector output ENO. If, on the other hand, the up/down counter is decremented to 0 the RS flip flop is reset, the WD OK output and the ENO output are disabled. The WD OK output also controls a dual MUX stage which shifts the time window by one clock after a successful trigger, thus forming a hysteresis to provide stable conditions for the evaluation of the trigger signal "good or false". The WD OK signal is also reset in case the watchdog counter is not reset after 250 clocks (missing trigger signal). Watchdog State Diagram Figure 5. Watchdog State Diagram good Initial status 2/NF 1/NF bad bad bad good good bad O/F 3/NF bad good bad 1/F 2/F good good Explanation In each block, the first character represents the state of the counter. The second notation indicates the fault status of the counter. A fault status is indicated by an "F" and a no fault status is indicated by an "NF". When the watchdog is powered up initially, the counter starts at the 0/F block (initial state). "Good" indicates that a pulse has been received whose width resides within the timing window. "Bad" indicates that a pulse has been received whose width is either too short or too long. 7 4764A–AUTO–10/03 Watchdog Window Calculation Example with recommended values Cosc = 3.3 nF (should be preferably 10%, NPO) Rosc = 39 kW (may be 5%, Rosc < 100 kW due to leakage current and humidity) tWDC (s) = 10-3 ´ [Cosc (nF) ´ [(0.00078 ´ Rosc (kW)) + 0.0005]] RC Oscillator fWDC (Hz) = 1/(tWDC) fWDI (Hz) = 0.01 ´ fWDC Watchdog WDI tWDC = 100 µs -> fWDC = 10 kHz fWDI = 100 Hz -> tWDI = 10 ms WDI Pulse Width for Fault Detection After 3 Pulses Upper watchdog window Minimum: 169/fWDC = 16.9 ms -> fWDC/169 = 59.1 Hz Maximum: 170/ fWDC = 17.0 ms -> fWDC/170 = 58.8 Hz Lower watchdog window Minimum: 79/fWDC = 7.9 ms -> fWDC/79 = 126.6 Hz Maximum: 80/fWDC = 8.0 ms -> fWDC/80 = 125.0 Hz WDI Dropouts for Immediate Fault Detection Minimum: 250/fWDC = 25 ms Maximum: 251/fWDC = 25.1 ms Figure 6. Watchdog Timing Diagram with Tolerances Time/s 79/fWDC 80/fWDC 169/fWDC 170/fWDC 250/fWDC 251/fWDC Watchdog window update rate is good Update rate is too fast Update rate is either too fast or good Remark to Reset Delay 8 Update rate is either too slow or good Update rate is too slow Update rate is either too slow or pulse has dropped out Pulse has dropped out The duration of the over- or undervoltage pulses determines the enable and reset output. A pulse duration shorter than the debounce time has no effect on the outputs. A pulse longer than the debounce time results in the first reset delay. If a pulse appears during this delay, a 2nd delay time is triggered. Therefore, the total reset delay time can be longer than specified in the datasheet. U6809B 4764A–AUTO–10/03 U6809B Absolute Maximum Ratings Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other conditions beyond those indicated in the operational sections of this specification is not implied. Exposure to absolute maximum rating conditions for extended periods may affect device reliability. Parameters Symbol Value Unit VS -0.2 to +16 V AUX GND offset voltage to GND VAUX ±1.5 V AUX GND offset current to GND IAUX -600 mA Power dissipation VS = 5 V; Tamb = 125°C Ptot 700 mW Thermal resistance Rthjc 25 K/W Tj 150 °C Tamb -40 to +125 °C Tstg -55 to +155 °C Supply voltage range Junction temperature Ambient temperature range Storage temperature range Electrical Characteristics VS = 5 V, Tamb = -40 to +125°C; reference pin is GND; fintern = 100 kHz + 50% - 45%, fWDC = 10 kHz ±10%; fWDI = 100 Hz Parameters Test Conditions Symbol Min. Operation range general VS Operation range reset VS Typ. Max. Unit 4.5 5.5 V 1.5 16.0 V Supply Voltage Supply Current Lamp driver on, relay off Tamb = -40°C Tamb = 125°C 40 35 mA mA Lamp driver off, relay on Tamb = -40°C Tamb = 125°C 25 20 mA mA Lamp driver off, relay off Tamb = -40°C Tamb = 125°C 15 10 mA mA Auxiliary Ground (AUX GND) AUX GND offset voltage operation range Tamb = -40°C Tamb = 90°C Tamb = 125°C -1.2 -0.65 -0.5 1.2 1.0 0.8 V V V AUX GND offset voltage to GND IAUX = -600 mA -1.7 3.0 V Detection low -0.2 0.2 ´ VS V Detection high 0.7 ´ VS VS + 0.5 V V Digital Inputs (LA1I, LA2I, REL1 and WDI) 10 40 kW Input current low Input voltage = 0 V 100 550 µA Input current high Input voltage = VS -5 5 µA Resistance to VS 9 4764A–AUTO–10/03 Electrical Characteristics (Continued) VS = 5 V, Tamb = -40 to +125°C; reference pin is GND; fintern = 100 kHz + 50% - 45%, fWDC = 10 kHz ±10%; fWDI = 100 Hz Parameters Test Conditions Symbol Min. Typ. Max. Unit 0 0.5 V 0.8 ´ VS 0.7 ´ VS + 0.1 VS V Threshold voltage detection 0.4 ´ VS 0.5 ´ VS V Threshold current detection 10 50 mA Digital Outputs; Lamp Driver Feedbacks (FBLA1, FBLA2) Voltage low I £ 1.6 mA Voltage high I £ 10 A 10 A £ I £ 1.6 mA Digital Outputs (PRES and NRES) Voltage high I £ 100 A 0.7 ´ VS + 0.1 VS V Voltage low I £ 1 mA 0 0.3 V Digital Output (ENO) with Open Collector Saturation voltage low I £ 25 mA 0 0.3 V Clamping voltage 26 30 V Current limit low 25 Leakage current VENO = 5 V VENO = 16 V VENO = 26 V mA 20 100 200 µA µA µA Lamp Drivers (LA1O and LA2O) with Integrated Pull-up Resistor Saturation voltage I £ 125 mA; VS = 5 V I £ 125 mA; VS = 0 V 0.5 1.5 V V Saturation voltage 250 mA requires enhanced heat sink I £ 250 mA; VS = 5 V I £ 250 mA; VS = 0 V I £ 250 mA; no GND 1.0 2.0 3.0 V V V Maximum load current Tamb = 90°C Tamb = 125°C 250 180 Clamping voltage Leakage current 26 VLA1O, LA2O = 16 V VLA1O, LA2O = 26 V Threshold current limitation Pull-up resistor mA mA 30 V 1 3 mA mA 0.5 1.0 A 2 17 kW Relay Driver (RELO) Saturation voltage I £ 250 mA Maximum load current Tamb = 90°C Tamb = 125°C 0.5 250 200 Clamping voltage Leakage current 26 VBatt = 16 V VBatt = 26 V V mA mA 30 V 20 200 µA µA Reset and VS Control Lower reset level VS 4.5 4.8 V Upper reset level VS 5.2 5.5 V Hysteresis 25 Reset debounce time 120 10 mV 500 µs U6809B 4764A–AUTO–10/03 U6809B Electrical Characteristics (Continued) VS = 5 V, Tamb = -40 to +125°C; reference pin is GND; fintern = 100 kHz + 50% - 45%, fWDC = 10 kHz ±10%; fWDI = 100 Hz Parameters Test Conditions Symbol Reset delay Min. Typ. Max. Unit 20 80 ms 12.8 ms Watchdog Timing Feedback reaction time (FBLA1, FBLA2) No fault, edge at LA1I, LA2I tFB 2.56 Minimum lamp input toggle time for a secure feedback reaction No fault, pulse at LA1I, LA2I tP,FB 10.24 tPOR 34.3 103.1 ms tRCerror 81.9 246 ms Time interval for over-/undervoltage detection tD,OUV 0.16 0.64 ms Reaction time of NRES output on over-/undervoltage tR,OUV 0.187 0.72 ms Minimum toggle time for a secure broken ground detection tP,BGND 13.3 Maximum reaction time for broken ground detection tR,BGND Power-on-reset prolongation time Detection time for RC-oscillator fault VRC = constant ms µs 100 µs Nominal frequency for WDI fRC = 100 ´ fWDI fWDI 10 130 Hz Nominal frequency for RC fWDI = 1/100 ´ fRC fRC 1 13 kHz Minimum pulse duration for a secure WDI input pulse detection tP,WDI 182 Frequency range for a correct WDI signal fWDI 64.7 Number of incorrect WDI trigger counts for locking the outputs nlock 3 nrelease 3 Number of correct WDI trigger counts for releasing the outputs Detection time for a stuck WDI signal VWDI = constant tWDIerror µs 24.5 112.5 Hz 25.5 ms Watchdog Timing Relative to fRC Minimum pulse duration for a securely WDI input pulse detection 2 Frequency range for a correct WDI signal 80 Hysteresis range at the WDI ok margins Detection time for a stuck WDI signal cycles 170 1 VWDI = constant 250 cycles cycle 251 cycles 11 4764A–AUTO–10/03 Protection Against Transient Voltages According to ISO TR 7637-3 Level 4 (Except Pulse 5) Pulse Notes: Voltage Source Resistance(1) Rise Time Duration Amount 1 -110 V 10 W 100 V/s 2 ms 15.000 2 +110 V 10 W 100 V/s 0.05 ms 15.000 3a -160 V 50 W 30 V/ns 0.1 s 1h 3b +150 V 50 W 20 V/ns 0.1 s 1h 5 40 V 2W 10 V/ms 250 ms 20 1. Lamp drivers: 1.2 W lamps need to be added to the source resistance. Relay driver: relay coil with Rmin = 70 W need to be added to the source resistance. Application Hints a.) The lamp output pins LA1O and LA2O may need to be protected by external protection diodes against reversed battery (e.g., BAV 202) in order to avoid a reset during negative pulses. b.) If pilot lamps with a wattage of P > 1.2 W are connected, external Zener diodes are mandatory. Timing Diagrams Figure 7. Watchdog in Too Fast Condition Normal operation WDI too fast Normal operation 5V WDI 0V VBatt RELO 0V 5V ENO 0V VBatt LAXO 0V Don't care 12 U6809B 4764A–AUTO–10/03 U6809B Figure 8. Watchdog in Too Slow Condition Normal operation WDI too low Normal operation 5V WDI 0V VBatt RELO 0V 5V ENO 0V VBatt LAXO 0V Don't care Figure 9. Overvoltage Condition Overvoltage condition > 120 µs < 120 µs ≥ 5.5 V 5V ≥ 5.5 V VS 0V V Batt RELO 0V 5V ENO 0V 5V NRES 0V V Batt LAXO 0V Reset debounce time 3 good WDI pulses Don't care 1st Reset delay 2nd Reset delay 13 4764A–AUTO–10/03 Figure 10. Undervoltage Condition Undervoltage condition > 120 µs 5V VS ≤ 4.5 V < 120 µs ≤ 4.5 V 0V V Batt RELO 0V 5V ENO 0V 5V NRES 0V V Batt LAXO 0V Reset debounce time 3 good WDI pulses Don't care 1st Reset delay 2nd Reset delay 14 U6809B 4764A–AUTO–10/03 U6809B Ordering Information Extended Type Number Package U6809B Remarks SO20 special lead frame – Package Information 9.15 8.65 Package SO20 Dimensions in mm 12.95 12.70 7.5 7.3 2.35 0.25 0.25 0.10 0.4 10.50 10.20 1.27 11.43 20 11 technical drawings according to DIN specifications 1 10 15 4764A–AUTO–10/03 Atmel Corporation 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 487-2600 Regional Headquarters Europe Atmel Sarl Route des Arsenaux 41 Case Postale 80 CH-1705 Fribourg Switzerland Tel: (41) 26-426-5555 Fax: (41) 26-426-5500 Asia Room 1219 Chinachem Golden Plaza 77 Mody Road Tsimshatsui East Kowloon Hong Kong Tel: (852) 2721-9778 Fax: (852) 2722-1369 Japan 9F, Tonetsu Shinkawa Bldg. 1-24-8 Shinkawa Chuo-ku, Tokyo 104-0033 Japan Tel: (81) 3-3523-3551 Fax: (81) 3-3523-7581 Atmel Operations Memory 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 RF/Automotive Theresienstrasse 2 Postfach 3535 74025 Heilbronn, Germany Tel: (49) 71-31-67-0 Fax: (49) 71-31-67-2340 Microcontrollers 2325 Orchard Parkway San Jose, CA 95131, USA Tel: 1(408) 441-0311 Fax: 1(408) 436-4314 La Chantrerie BP 70602 44306 Nantes Cedex 3, France Tel: (33) 2-40-18-18-18 Fax: (33) 2-40-18-19-60 ASIC/ASSP/Smart Cards 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Biometrics/Imaging/Hi-Rel MPU/ High Speed Converters/RF Datacom Avenue de Rochepleine BP 123 38521 Saint-Egreve Cedex, France Tel: (33) 4-76-58-30-00 Fax: (33) 4-76-58-34-80 Zone Industrielle 13106 Rousset Cedex, France Tel: (33) 4-42-53-60-00 Fax: (33) 4-42-53-60-01 1150 East Cheyenne Mtn. Blvd. Colorado Springs, CO 80906, USA Tel: 1(719) 576-3300 Fax: 1(719) 540-1759 Scottish Enterprise Technology Park Maxwell Building East Kilbride G75 0QR, Scotland Tel: (44) 1355-803-000 Fax: (44) 1355-242-743 Literature Requests www.atmel.com/literature Disclaimer: Atmel Corporation makes no warranty for the use of its products, other than those expressly contained in the Company’s standard warranty which is detailed in Atmel’s Terms and Conditions located on the Company’s web site. The Company assumes no responsibility for any errors which may appear in this document, reserves the right to change devices or specifications detailed herein at any time without notice, and does not make any commitment to update the information contained herein. No licenses to patents or other intellectual property of Atmel are granted by the Company in connection with the sale of Atmel products, expressly or by implication. Atmel’s products are not authorized for use as critical components in life support devices or systems. © Atmel Corporation 2003. All rights reserved. Atmel ® and combinations thereof are the registered trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be the trademarks of others. Printed on recycled paper. 4764A–AUTO–10/03