UJA1069TW24/3V0-T NXP Semiconductors, UJA1069TW24/3V0-T Datasheet
UJA1069TW24/3V0-T
Specifications of UJA1069TW24/3V0-T
Related parts for UJA1069TW24/3V0-T
UJA1069TW24/3V0-T Summary of contents
Page 1
UJA1069 LIN fail-safe system basis chip Rev. 04 — 28 October 2009 1. General description The UJA1069 fail-safe System Basis Chip (SBC) replaces basic discrete components which are common in every Electronic Control Unit (ECU) with a Local Interconnect Network ...
Page 2
... NXP Semiconductors 2. Features 2.1 General I Contains a full set of LIN ECU functions: N LIN transceiver N Voltage regulator for the microcontroller (5 Enhanced window watchdog with on-chip oscillator N Serial Peripheral Interface (SPI) for the microcontroller N ECU power management system N Fully integrated autonomous fail-safe system I Designed for automotive applications: ...
Page 3
... NXP Semiconductors 2.4 Fail-safe features I Safe and predictable behavior under all conditions I Programmable fail-safe coded window and time-out watchdog with on-chip oscillator, guaranteeing autonomous fail-safe system supervision I Fail-safe coded 16-bit SPI interface for the microcontroller I Global enable pin for the control of safety-critical hardware ...
Page 4
... NXP Semiconductors 4. Block diagram 31 (23) SENSE 32 (24) BAT42 27 (19) BAT14 29 (21) SYSINH 30 (22 (13) INH/LIMP 7 (6) INTN 18 (14) WAKE WAKE 16 (12) TEST CHIP TEMPERATURE 11 (10) SCK 9 (8) SDI 10 (9) SDO 12 (11) SCS 26 (18) RTLIN 25 (17) LIN 3 (2) TXDL 5 (4) RXDL 23 (15) GND The pin numbers in parenthesis are for the UJA1069TW24 version ...
Page 5
... NXP Semiconductors 5. Pinning information 5.1 Pinning Fig 2. Fig 3. UJA1069_4 Product data sheet 1 n.c. n.c. 2 TXDL RXDL 5 RSTN 6 INTN UJA1069TW SDI 9 SDO 10 11 SCK 12 SCS n. n.c. TEST 16 Pin configuration (HTSSOP32) 1 n.c. TXDL RXDL RSTN 5 INTN 6 UJA1069TW24 SDI SDO 9 SCK ...
Page 6
... NXP Semiconductors 5.2 Pin description Table 2. Symbol n.c. n.c. TXDL V1 RXDL RSTN INTN EN SDI SDO SCK SCS n.c. n.c. n.c. TEST INH/LIMP WAKE n.c. n.c. n.c. n.c. GND n.c. LIN RTLIN BAT14 n.c. SYSINH UJA1069_4 Product data sheet Pin description Pin ...
Page 7
... NXP Semiconductors Table 2. Symbol V3 SENSE BAT42 The exposed die pad at the bottom of the package allows better dissipation of heat from the SBC via the printed-circuit board. The exposed die pad is not connected to any active part of the IC and can be left floating, or can be connected to GND for the best EMC performance ...
Page 8
... NXP Semiconductors mode change via SPI watchdog trigger Normal mode V1: ON SYSINH: HIGH flash entry enabled (111/001/111 mode sequence) LIN: all modes available OR mode change to Sleep with pending wake-up watchdog: window INH/LIMP: HIGH/LOW/float EN: HIGH/LOW init Normal mode via SPI successful init Normal mode ...
Page 9
... NXP Semiconductors 6.2.1 Start-up mode Start-up mode is the ‘home page’ of the SBC. This mode is entered when battery and ground are connected for the first time. Start-up mode is also entered after any event that results in a system reset. The reset source information is provided by the SBC to support different software initialization cycles that depend on the reset event ...
Page 10
... NXP Semiconductors Interrupts from SBC to the host microcontroller are also monitored. A system reset is performed if the host microcontroller does not respond within t mode does not activate the LIN transceiver automatically. The LIN Mode Control (LMC) bit must be used to activate the LIN medium if required, allowing local cyclic wake-up scenarios to be implemented without affecting the LIN-bus ...
Page 11
... NXP Semiconductors The following operations are possible from Standby mode: • Cyclic wake-up by the watchdog via an interrupt signal to the microcontroller (the microcontroller is triggered periodically and checked for the correct response) • Cyclic wake-up by the watchdog via a reset signal (a reset is performed periodically; ...
Page 12
... NXP Semiconductors From Start-up mode the application software now has to enter Flash mode within t by writing Operating Mode code 011 to the Mode register. This feeds back a successfully received hardware reset (handshake between the SBC and the microcontroller). The transition from Start-up mode to Flash mode is possible only once after completing the Flash entry sequence ...
Page 13
... NXP Semiconductors 6.4.1 Watchdog start-up behavior Following any reset event the watchdog is used to monitor the ECU start-up procedure. It observes the behavior of the RSTN pin for any clamping condition or interrupted reset wire. In case the watchdog is not properly served within t and the monitoring procedure is restarted. In case the watchdog is again not properly served, the system enters Fail-safe mode (see also mode) ...
Page 14
... NXP Semiconductors 6.4.3 Watchdog time-out behavior Whenever the SBC operates in Standby mode, in Sleep mode or in Flash mode, the active watchdog operates in Time-out mode. The watchdog has to be triggered within the actual programmed period time; see wake-up events to the host microcontroller from Standby mode and Sleep mode. ...
Page 15
... NXP Semiconductors 6.5 System reset The reset function of the UJA1069 offers two signals to deal with reset events: • RSTN; the global ECU system reset • EN; a fail-safe global enable signal 6.5.1 RSTN pin The system reset pin (RSTN bidirectional input / output. Pin RSTN is active LOW with selectable pulse length upon the following events ...
Page 16
... NXP Semiconductors V1 V RSTN Fig 7. Fig 8. Pin RSTN is monitored for a continuously clamped LOW situation. Once the SBC pulls pin RSTN HIGH but pin RSTN level remains LOW for longer than t immediately enters Fail-safe mode since this indicates an application failure. UJA1069_4 Product data sheet ...
Page 17
... NXP Semiconductors The SBC also detects if pin RSTN is clamped HIGH. If the HIGH-level remains on the pin for longer than t the SBC falls back immediately to Fail-safe mode since the microcontroller cannot be reset any more. By entering Fail-safe mode, the V1 voltage regulator shuts down and the microcontroller stops ...
Page 18
... NXP Semiconductors 6.6.4 Switched battery output high-side switched BAT42-related output which is used to drive external loads such as wake-up switches or relays. The features of V3 are as follows: • Three application controlled modes of operation; ON, OFF or Cyclic mode. • Two different cyclic modes allow the supply of external wake-up switches; these switches are powered intermittently, thus reducing the system’ ...
Page 19
... NXP Semiconductors Fig 9. 6.7.1.1 Active mode In Active mode the LIN transceiver can transmit data to and receive data from the LIN bus. To enter Active mode the LMC bit must be set in the Physical Layer register and the SBC must be in Normal mode or Flash mode. ...
Page 20
... NXP Semiconductors Fig 10. LIN wake-up timing diagram 6.7.3 Termination control The RTLIN pin is in one of 3 different states: RTLIN = on, RTLIN = off or RTLIN = 75 A; see Figure RTLIN = ON supplied directly out of BAT42 mode change to Active mode Fig 11. States of the RTLIN pin During Active mode, with no short-circuit between the LIN-bus and GND, pin RTLIN provides an internal switch to BAT42 ...
Page 21
... NXP Semiconductors 6.7.5 LIN driver capability Setting the LDC bit in the Physical Layer Control register will increase the driver capability of the LIN output stage. This feature is used in auto-addressing systems, where the standard LIN 2.0 drive capability is insufficient. 6.7.6 Bus and TXDL failure detection The SBC handles and reports the following LIN-bus related failures: • ...
Page 22
... NXP Semiconductors INH/LIMP: HIGH ILEN = 1 ILC = 1 state change via SPI Fig 12. States of the INH/LIMP pin When pin INH/LIMP is used as inhibit output, a pull-down resistor to GND ensures a default LOW level. The pin can be set to HIGH according to the state diagram. When pin INH/LIMP is used as limp-home output, a pull-up resistor to V default HIGH level ...
Page 23
... NXP Semiconductors t on(CS su(CS) sample active signal already HIGH V WAKE due to biasing (history) flip flop V INTN Fig 13. Pin WAKE, cyclic sampling via V3 6.10 Interrupt output Pin INTN is an open-drain interrupt output forced LOW whenever at least one bit in the Interrupt register is set. By reading the Interrupt register all bits are cleared. The Interrupt register will also be cleared during a system reset (RSTN LOW) ...
Page 24
... NXP Semiconductors 6.12 SPI interface The Serial Peripheral Interface (SPI) provides the communication link with the microcontroller, supporting multi-slave and multi-master operation. The SPI is configured for full duplex data transfer, so status information is returned when new control data is shifted in. The interface also offers a read-only access option, allowing registers to be read back by the application without changing the register content ...
Page 25
... NXP Semiconductors 6.12.1 SPI register mapping Any control bit which can be set by software is readable by the application. This allows software debugging as well as control algorithms to be implemented. Watchdog serving and mode setting is performed within the same access cycle; this only allows an SBC mode change whilst serving the watchdog. ...
Page 26
... NXP Semiconductors Table 4. Mode register bit description (bits and Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only NWP[5:0] see Table OM[2:0] Operating Mode 2 SDM Software Development Mode 1 EN Enable 0 - reserved [1] Flash mode can be entered only with the watchdog service sequence ‘Normal mode to Flash mode to Normal mode to Flash mode’, while observing the watchdog trigger rules. With the last command of this sequence the SBC forces a system reset, and enters Start-up mode to prepare the microcontroller for fl ...
Page 27
... NXP Semiconductors Table 5. Mode register bit description (bits Bit Symbol Description NWP[5:0] Nominal Watchdog Period WDPRE = 00 (as set in the Special Mode register) Nominal Watchdog Period WDPRE = 01 (as set in the Special Mode register) Nominal Watchdog Period WDPRE = 10 (as set in the Special Mode register) ...
Page 28
... NXP Semiconductors Table 5. Mode register bit description (bits Bit Symbol Description NWP[5:0] Nominal Watchdog Period WDPRE = 11 (as set in the Special Mode register) [1] The nominal watchdog periods are directly related to the SBC internal oscillator. The given values are valid for f [2] See Section 6 ...
Page 29
... NXP Semiconductors Table 6. System Status register bit description Bit Symbol Description RSS[3:0] Reset Source 7 - reserved 6 LWS LIN Wake-up Status 5 EWS Edge Wake-up Status 4 WLS WAKE Level Status 3 TWS Temperature Warning Status 2 SDMS Software Development Mode Status 1 ENS Enable Status 0 PWONS Power-on reset Status [1] The RSS bits are updated with each reset event and not cleared ...
Page 30
... NXP Semiconductors Table 7. System Diagnosis register bit description Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only reserved 6 and 5 LINFD[1:0] LIN failure diagnosis 4 V3D V3 diagnosis 3 - reserved 2 V1D V1 diagnosis 1 and 0 - reserved 6.12.6 Interrupt Enable register and Interrupt Enable Feedback register These registers allow setting, clearing and reading back the interrupt enable bits of the SBC ...
Page 31
... NXP Semiconductors Table 8. Interrupt Enable and Interrupt Enable Feedback register bit description Bit Symbol Description 7 BATFIE BAT Failure Interrupt Enable 6 VFIE Voltage Failure Interrupt Enable 5 - reserved 4 LINFIE LIN Failure Interrupt Enable 3 WIE WAKE Interrupt Enable 2 WDRIE Watchdog Restart Interrupt Enable 1 - reserved ...
Page 32
... NXP Semiconductors Table 9. Interrupt register bit description Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only 11 WTI Watchdog Time-out Interrupt 10 OTI OverTemperature Interrupt 9 - reserved 8 SPIFI SPI clock count Failure Interrupt 7 BATFI BAT Failure Interrupt 6 VFI Voltage Failure Interrupt 1 ...
Page 33
... NXP Semiconductors Table 10. System Configuration and System Configuration Feedback register bit description Bit Symbol Description 12 RO Read Only 11 and 10 - reserved 9 - reserved 8 RLC Reset Length Control 7 and 6 V3C[1:0] V3 Control 5 - reserved 4 V1CMC V1 Current Monitor Control 3 WEN Wake Enable 2 WSC Wake Sample Control ...
Page 34
... NXP Semiconductors Table 11. Physical Layer Control and Physical Layer Control Feedback register bit description Bit Symbol Description 12 RO Read Only reserved 4 LMC LIN Mode Control 3 LSC LIN Slope Control 2 LDC LIN Driver Control 1 - reserved 0 LTC LIN Transmitter Control [1] In case of an RXDL / TXDL interfacing failure the LIN transmitter is disabled without setting LTC. Recovery from such a failure is automatic when LIN communication (with correct interfacing levels) is received ...
Page 35
... NXP Semiconductors Table 12. Special Mode register and Special Mode Feedback register bit description Bit Symbol Description 4 and 3 V1RTHC[1:0] V1 Reset Threshold Control reserved [1] See Section 6.13.1. 6.12.11 General Purpose registers and General Purpose Feedback registers The UJA1069 offers two 12-bit General Purpose registers (and accompanying General Purpose Feedback registers) with no predefi ...
Page 36
... NXP Semiconductors Table 14. General Purpose register 1 and General Purpose Feedback register 1 bit description Bit Symbol Description 12 RO Read Only GP1[11:0] General Purpose bits 6.12.12 Register configurations at reset At Power-on, Start-up and Restart mode the setting of the SBC registers is predefined. Table 15. ...
Page 37
... NXP Semiconductors Table 19. System Configuration register and System Configuration Feedback register: status at reset Symbol Name RLC Reset Length Control V3C V3 Control V1CMC V1 Current Monitor Control WEN Wake Enable WSC Wake Sample Control ILEN INH/LIMP Enable ILC INH/LIMP Control Table 20. ...
Page 38
... NXP Semiconductors 6.13 Test modes 6.13.1 Software development mode The Software development mode is intended to support software developers in writing and pretesting application software without having to work around watchdog triggering and without unwanted jumps to Fail-safe mode. In Software development mode the following events do not force a system reset: • ...
Page 39
... NXP Semiconductors 6.13.2 Forced normal mode For system evaluation purposes the UJA1069 offers the Forced normal mode. This mode is strictly for evaluation purposes only. In this mode the characteristics as defined in Section 9 In Forced normal mode the SBC behaves as follows: • SPI access (writing and reading) is blocked • ...
Page 40
... BAT42 [5] ESD performance according to IEC 61000-4-2 (C was verifi external test house. The following results were obtained: a) Equal or better than 4 kV (unaided) b) Equal or better than 20 kV for pin LIN (using external ESD protection: NXP Semiconductors PESD1LIN diode). [6] Machine Model (MM 200 pF UJA1069_4 ...
Page 41
... NXP Semiconductors 8. Thermal characteristics Fig 15. Thermal model of the HTSSOP32 package Fig 16. Thermal model of the HTSSOP24 package UJA1069_4 Product data sheet V1 dissipation V3 dissipation 6 K/W 23 K/W 6 K/W T (heat sink) case R th(c-a) T amb 001aad671 V1 dissipation V3 dissipation 6 K/W 17 K/W 6 K/W T (heat sink) case R th(c-a) T amb Rev. 04 — ...
Page 42
... NXP Semiconductors 9. Static characteristics Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Supply; pin BAT42 I BAT42 supply BAT42 current I additional BAT42 BAT42(add) supply current V BAT42 voltage level POR(BAT42) for power-on reset status bit change Supply ...
Page 43
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Battery supply monitor input; pin SENSE V input threshold low th(SENSE) battery voltage I HIGH-level input IH(SENSE) current Voltage source; pin V1; see also ...
Page 44
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I output current V1 capability Z regulator impedance ds(on) between pins BAT14 and V1 Voltage source; pin BAT42-V3(drop) BAT42 V3 drop I overload current det(OL)(V3) detection threshold ...
Page 45
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I input leakage current SDI at pin SDI Serial peripheral interface data output; pin SDO I HIGH-level output OH current I LOW-level output OL current I OFF-state output ...
Page 46
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter LIN-bus line; pin LIN V LIN dominant output o(dom) voltage I HIGH-level input LIH leakage current I LOW-level input LIL leakage current I short-circuit output ...
Page 47
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I RTLIN pull-up RTLIN(pu) current I LOW-level leakage LL current TEST input; pin TEST V input threshold th(TEST) voltage R pull-down resistor (pd)TEST Temperature detection T high junction ...
Page 48
... NXP Semiconductors Fig 17. V1 output voltage (dropout function of battery voltage UJA1069_4 Product data sheet 100 120 mA 250 100 120 mA 250 150 C. j Rev. 04 — 28 October 2009 UJA1069 LIN fail-safe system basis chip 015aaa089 (V) BAT14 015aaa090 (V) BAT14 © NXP B.V. 2009. All rights reserved. ...
Page 49
... NXP Semiconductors I BAT14 (mA BAT14 (mA Fig 18. V1 quiescent current as a function of output current UJA1069_4 Product data sheet BAT14 100 = 40 C, +25 C and +150 BAT14 100 = +150 C. j Rev. 04 — 28 October 2009 UJA1069 LIN fail-safe system basis chip 015aaa091 T = +150 +25 C +150 C +25 C ...
Page 50
... NXP Semiconductors V (V) Fig 19. V1 output voltage as a function of output current PSRR (dB) Fig 20. V1 power supply ripple rejection as a function of frequency UJA1069_4 Product data sheet BAT14 125 C. j 160 BAT14 120 150 150 C 5.5 V 150 120 mA. V1 Rev. 04 — 28 October 2009 ...
Page 51
... NXP Semiconductors V BAT14 (V) a. Line transient response I (mA) b. Load transient response Fig 21. V1 transient response as a function of time UJA1069_4 Product data sheet 16 V BAT14 100 200 mA ESR = 0. 100 200 ESR = 0. BAT14 Rev. 04 — 28 October 2009 UJA1069 LIN fail-safe system basis chip ...
Page 52
... NXP Semiconductors ESR ( ) Fig 22. V1 output stability related to ESR value of output capacitor UJA1069_4 Product data sheet stable operation area 2 10 unstable operation area Rev. 04 — 28 October 2009 UJA1069 LIN fail-safe system basis chip 001aaf249 80 120 I (mA) V1 © NXP B.V. 2009. All rights reserved. ...
Page 53
... NXP Semiconductors a. Test circuit V (V) b. Behavior (V) c. Behavior at T Fig 23. Switch-on behavior of V UJA1069_4 Product data sheet BAT42 BAT14 100 F/ V BAT 0.1 100 BAT V = 5.5 V BAT BAT 0 0 0.4 0 BAT 5.5 V BAT BAT 0 0 0.4 0 Rev. 04 — 28 October 2009 UJA1069 ...
Page 54
... NXP Semiconductors 10. Dynamic characteristics Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Serial peripheral interface timing; pins SCS, SCK, SDI and SDO (see T clock cycle time cyc t enable lead time lead ...
Page 55
... NXP Semiconductors Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter t TXDL permanent dominant TXDL(dom)(dis) disable time Battery monitoring t BAT42 LOW time for BAT42(L) setting PWONS t BAT42 LOW time for SENSE(L) setting BATFI Power supply V1 ...
Page 56
... NXP Semiconductors Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Interrupt output; pin INTN t interrupt release INTN Oscillator f oscillator frequency osc [1] All parameters are guaranteed over the virtual junction temperature range by design. Products are 100 % tested at 125 C ambient temperature on wafer level (pretesting). Cased products are 100 % tested ambient temperature (fi ...
Page 57
... NXP Semiconductors Fig 25. Timing test circuit for LIN transceiver t bit V TXDL V BAT42 LIN BUS signal V RXDL1 receiving node 1 t p(rx)f V RXDL2 receiving node 2 Fig 26. Timing diagram LIN transceiver 11. Test information Immunity against automotive transients (malfunction and damage) in accordance with LIN EMC Test Specification / Version 1.0; August 1, 2004. ...
Page 58
... NXP Semiconductors 12. Package outline HTSSOP32: plastic thermal enhanced thin shrink small outline package; 32 leads; body width 6.1 mm; lead pitch 0.65 mm; exposed die pad y exposed die pad side pin 1 index 1 e DIMENSIONS (mm are the original dimensions). A UNIT max. 0.15 0.95 mm 1.1 0.25 ...
Page 59
... NXP Semiconductors HTSSOP24: plastic thermal enhanced thin shrink small outline package; 24 leads; body width 4.4 mm; lead pitch 0.65 mm; exposed die pad y exposed die pad Z 24 pin 1 index 1 e DIMENSIONS (mm are the original dimensions) A UNIT max 0.15 0.95 0.30 mm 1.1 0.25 0.05 ...
Page 60
... NXP Semiconductors 13. Soldering of SMD packages This text provides a very brief insight into a complex technology. A more in-depth account of soldering ICs can be found in Application Note AN10365 “Surface mount reflow soldering description” . 13.1 Introduction to soldering Soldering is one of the most common methods through which packages are attached to Printed Circuit Boards (PCBs), to form electrical circuits ...
Page 61
... NXP Semiconductors 13.4 Reflow soldering Key characteristics in reflow soldering are: • Lead-free versus SnPb soldering; note that a lead-free reflow process usually leads to higher minimum peak temperatures (see reducing the process window • Solder paste printing issues including smearing, release, and adjusting the process window for a mix of large and small components on one board • ...
Page 62
... Revision history Document ID Release date UJA1069_4 20091028 • Modifications: 3.3 V versions (UJA1069TW/3V3 and UJA1069TW24/3V3) discontinued • 3.0 V versions (UJA1069TW/3V0 and UJA1069TW24/3V0) discontinued • Table 24: table note section revised • Section 6.2.5: text of third paragraph revised • Table 10: text of bit 4, V1CMC, revised • ...
Page 63
... Right to make changes — NXP Semiconductors reserves the right to make changes to information published in this document, including without limitation specifications and product descriptions, at any time and without notice ...
Page 64
... NXP Semiconductors 17. Contents 1 General description . . . . . . . . . . . . . . . . . . . . . . 1 2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2 LIN transceiver . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.3 Power management . . . . . . . . . . . . . . . . . . . . . 2 2.4 Fail-safe features . . . . . . . . . . . . . . . . . . . . . . . 3 3 Ordering information . . . . . . . . . . . . . . . . . . . . . 3 4 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5 Pinning information . . . . . . . . . . . . . . . . . . . . . . 5 5.1 Pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5.2 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 6 6 Functional description . . . . . . . . . . . . . . . . . . . 7 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 6.2 Fail-safe system controller . . . . . . . . . . . . . . . . 7 6 ...