
4.1 Achieving ASIL-B System Requirements
To achieve a system functional safety level of ASIL-B, the following PDN features are available:
• PMIC over voltage and under voltage monitoring on the power resource voltage outputs
• PMIC over-voltage monitoring and protection on the input to the PMIC (VCCA)
• Watchdog monitoring of safety processor
• MCU error monitoring
• MCU reset
• I2C communication
• Error indicator for driving external circuitry (optional)
The PDN has an in-line, external power FET, as shown in Figure 3-1, between the input supply and PMICs.
The voltage before and after the FET is monitored by the PMIC, and the PMIC controls the FET through the
OVPGDRV pin. The FET can quickly isolate the PMICs when an over-voltage event greater than 6 V is detected
on the input supply to protect the system from being damaged. This includes all power rails sourced from
the FET's output. Any power connected upstream from the FET is not protected from over voltage events. In
Figure 3-1 the load switches that supply power to the MCU and Main I/O domains, the discrete buck supplying
the DDR, and the discrete LDO supplying EFUSE are all connected after the FET to extend the over voltage
protection to these processor domains and discrete power resoures.
The PMIC internal over voltage and under voltage monitoring and their respective monitoring threshold levels
are enabled by default and can be updated through I2C after startup. PMIC power rails connected directly to
the processor are monitored by default. Rails supplied through the load switches are not monitored directly. To
monitor the load switch output voltage that supplies the MCU I/O of the processor, it is recommended to use the
processor's POK monitor built into the VDDSHV0_MCU voltage domain. The unused feedback pin of BUCK3 on
TPS65941212-Q1, FB_B3, is assigned to monitor the VDD_DDR_1V1 voltage supplied by the external BUCK
regulator. For monitoring the load switch voltage that supplies the Main I/O, an unused feedback pin of the
TPS65941111- Q1 (FB_B3 or FB_B4) can be configured through I2C and connected to the output of the load
switch to enable monitoring.
The PMIC's Internal Q&A Watchdog is enabled by default on the primary TPS6594-Q1 device. Once the device
is in ACTIVE state, the trigger or Q&A watchdog settings can be configured through the secondary I2C in the
device. The steps for configuring the watchdog settings can be found in the TPS6594-Q1 datasheet. Setting the
DISABLE_WDOG signal high on primary TPS6594-Q1 GPIO_8 will disable the watchdog timer if this feature
needs to be suspended during initial development or is not required in the system.
GPIO_7 of the primary TPS6594-Q1 PMIC is configured as the MCU error signal monitor, but will need to be
enabled though the ESM_MCU_EN register bit. MCU reset is supported through the connection between the
primary PMIC nRSTOUT pin and the MCU_PORz of the processor. Lastly, there are two I2C ports between the
TPS6594-Q1 and the processor. The first is used for all non-watchdog communication, such as voltage level
control, and the second allows the watchdog monitoring to be on an independent communication channel.
There is an option to use the TPS6594-Q1 PMIC's EN_DRV to indicate an error has been detected and the
system is entering SAFE state. This signal can be utilized if the system has some additional external circuitry
that needs to be driven by an error event. In this PDN, the EN_DRV is not utilized, but available if needed.
4.2 Achieving up to ASIL-D System Requirements
For ASIL-C or ASIL-D systems, the following features in addition to the ones described in Section 4.1 can be
used:
• PMIC current monitoring on all output power rails
• Isolation of processor MCU and Main power domains
• SoC error monitoring
• SoC reset
www.ti.com Supporting Functional Safety Systems
SLVUC32 – JUNE 2021
Submit Document Feedback
Dual TPS6594-Q1 PMIC User Guide for Jacinto 7 DRA829 and TDA4VM
Automotive PDN-0B
11
Copyright © 2021 Texas Instruments Incorporated