6

4902A–AUTO–11/05

ATA6809

4.

Fail-safe Functions

A fail-safe IC has to maintain its monitoring function even if there is a fault condition at one of the

pins (for example, a short circuit). This ensures that a microcontroller system is not brought into

a critical status. A critical status is reached if the system is not able to actuate a warning lamp

and switch off the relay. The following table shows fault conditions for different pins during which

the IC still works as a fail-safe device.

5.

Description of the Watchdog

5.1

Abstract

The microcontroller is monitored by a digital window watchdog which accepts an incoming trig-

ger signal of a constant frequency for correct operation. The frequency of the trigger signal can

be varied in a broad range as the watchdog's time window is determined by external RC

components.

The following description refers to Figure 1-1 on page 2.

Figure 5-1.

Watchdog Block Diagram

Table 4-1.

Table of Fault Condition

Pin

Function

Short to V

S

Short to V

Batt

Short to GND

Open Circuit

LA2O

Short-circuit proof driver for warning lamp

LA2O partly on

LA2O off

LA2O on

LA2O off

LA2I

Digital input to activate warning lamp

LA2O on

LA2O on

LA2O off

LA2O on

FBLA2

Digital feedback of warning lamp

Faulty feedback

Faulty feedback

Faulty feedback

Faulty feedback

LA1O

Short-circuit proof driver for warning lamp

LA1O partly on

LA1O off

LA1O on

LA1O off

LA1I

Digital input to activate warning lamp

LA1O on

LA1O on

LA1O off

LA1O on

FBLA1

Digital feedback of warning lamp

Faulty feedback

Faulty feedback

Faulty feedback

Faulty feedback

RELI

Digital input to activate the fail safe relay

Relay off

Relay off

Relay on

Relay off

WDI

Watchdog trigger input

Watchdog reset

Watchdog reset

Watchdog reset

Watchdog reset

OSC

Capacitor and resistor of watchdog

Watchdog reset

Watchdog reset

Watchdog reset

Watchdog reset

Slope

detector

Up/down

counter

Dual MUX

Binary counter

RS-FF

RCOSC

WDI

RESET

OSCERR

WD-OK