
9397 750 14409
Koninklijke Philips Electronics N.V. 2005. All rights reserved.
Objective data sheet
Rev. 01 — 10 August 2005
12 of 67
Philips Semiconductors
UJA1065
High-speed CAN/LIN fail-safe system basis chip
From Start-up mode the application software now has to enter Flash mode within t
WD(init)
by writing Operating Mode code 011 to the Mode register. This feeds back a successfully
received hardware reset (handshake between the SBC and the microcontroller). The
transition from Start-up mode to Flash mode is possible only once after completing the
Flash entry sequence.
The application can also decide not to enter Flash mode but to return to Normal mode by
using the Operating Mode code 101 for handshaking. This erases the Flash mode entry
sequence.
The watchdog behavior in Flash mode is similar to its time-out behavior in Standby mode,
but Operating Mode code 111 must be used for serving the watchdog. If this code is not
used or if the watchdog overflows, the SBC immediately forces a reset and enters Start-up
mode. Flash mode is properly exited using the Operating Mode code 110 (leave Flash
mode), which results in a system reset with the corresponding reset source information.
Other Mode register codes will cause a forced reset with reset source code ‘illegal Mode
register code’.
6.3 On-chip oscillator
The on-chip oscillator provides the clock signal for all digital functions and is the timing
reference for the on-chip watchdog and the internal timers.
If the on-chip oscillator frequency is too low or the oscillator is not running at all, there is
an immediate transition to Fail-safe mode. The SBC will stay in Fail-safe mode until the
oscillator has recovered to its normal frequency and the system receives a wake-up event.
6.4 Watchdog
The watchdog provides the following timing functions:
Start-up mode; needed to give the software the opportunity to initialize the system
Window mode; detects too early and too late accesses in Normal mode
Time-out mode; detects a too late access, can also be used to restart or interrupt the
microcontroller from time to time (cyclic wake-up function)
OFF mode; fail-safe shut-down during operation thus preventing any blind spots in the
system supervision
The watchdog is clocked directly by the on-chip oscillator.
To guarantee fail-safe control of the watchdog via the SPI, all watchdog accesses are
coded with redundant bits. Therefore, only certain codes are allowed for a proper
watchdog service.
The following corrupted watchdog accesses result in an immediate system reset:
Illegal watchdog period coding; only ten different codes are valid
Illegal operating mode coding; only six different codes are valid
Any microcontroller driven mode change is synchronized with a watchdog access by
reading the mode information and the watchdog period information from the same
register. This enables an easy software flow control with defined watchdog behavior when
switching between different software modules.