UJA1069TW24/3V0,51 NXP Semiconductors, UJA1069TW24/3V0,51 Datasheet
UJA1069TW24/3V0,51
Specifications of UJA1069TW24/3V0,51
UJA1069TW24/3V0-T
UJA1069TW24/3V0-T
Related parts for UJA1069TW24/3V0,51
UJA1069TW24/3V0,51 Summary of contents
Page 1
UJA1069 LIN fail-safe system basis chip Rev. 03 — 10 September 2007 1. General description The UJA1069 fail-safe System Basis Chip (SBC) replaces basic discrete components which are common in every Electronic Control Unit (ECU) with a Local Interconnect Network ...
Page 2
... NXP Semiconductors 2. Features 2.1 General I Contains a full set of LIN ECU functions: N LIN transceiver N Voltage regulator for the microcontroller (3 Enhanced window watchdog with on-chip oscillator N Serial Peripheral Interface (SPI) for the microcontroller N ECU power management system N Fully integrated autonomous fail-safe system ...
Page 3
... NXP Semiconductors 2.4 Fail-safe features I Safe and predictable behavior under all conditions I Programmable fail-safe coded window and time-out watchdog with on-chip oscillator, guaranteeing autonomous fail-safe system supervision I Fail-safe coded 16-bit SPI interface for the microcontroller I Global enable pin for the control of safety-critical hardware ...
Page 4
... NXP Semiconductors 4. Block diagram 31 (23) SENSE 32 (24) BAT42 27 (19) BAT14 29 (21) SYSINH 30 (22 (13) INH/LIMP 7 (6) INTN 18 (14) WAKE WAKE 16 (12) TEST CHIP TEMPERATURE 11 (10) SCK 9 (8) SDI 10 (9) SDO 12 (11) SCS 26 (18) RTLIN 25 (17) LIN 3 (2) TXDL 5 (4) RXDL 23 (15) GND The pin numbers in parenthesis are for the UJA1069TW24 version ...
Page 5
... NXP Semiconductors 5. Pinning information 5.1 Pinning Fig 2. Pin configuration (HTSSOP32) Fig 3. Pin configuration (HTSSOP24) UJA1069_3 Product data sheet 1 n.c. n.c. 2 TXDL RXDL RSTN 6 INTN UJA1069TW SDI 9 SDO 10 SCK 11 12 SCS n. n.c. TEST 16 001aad676 1 n.c. TXDL RXDL RSTN ...
Page 6
... NXP Semiconductors 5.2 Pin description Table 2. Symbol n.c. n.c. TXDL V1 RXDL RSTN INTN EN SDI SDO SCK SCS n.c. n.c. n.c. TEST INH/LIMP WAKE n.c. n.c. n.c. n.c. GND n.c. LIN RTLIN BAT14 n.c. SYSINH UJA1069_3 Product data sheet Pin description Pin ...
Page 7
... NXP Semiconductors Table 2. Symbol V3 SENSE BAT42 The exposed die pad at the bottom of the package allows better dissipation of heat from the SBC via the printed-circuit board. The exposed die pad is not connected to any active part of the IC and can be left floating, or can be connected to GND for the best EMC performance ...
Page 8
... NXP Semiconductors mode change via SPI watchdog trigger Normal mode V1: ON SYSINH: HIGH flash entry enabled (111/001/111 mode sequence) LIN: all modes available OR mode change to Sleep with pending wake-up watchdog: window INH/LIMP: HIGH/LOW/float EN: HIGH/LOW init Normal mode via SPI successful init Normal mode ...
Page 9
... NXP Semiconductors 6.2.1 Start-up mode Start-up mode is the ‘home page’ of the SBC. This mode is entered when battery and ground are connected for the first time. Start-up mode is also entered after any event that results in a system reset. The reset source information is provided by the SBC to support different software initialization cycles that depend on the reset event ...
Page 10
... NXP Semiconductors Interrupts from SBC to the host microcontroller are also monitored. A system reset is performed if the host microcontroller does not respond within t mode does not activate the LIN transceiver automatically. The LIN Mode Control (LMC) bit must be used to activate the LIN medium if required, allowing local cyclic wake-up scenarios to be implemented without affecting the LIN-bus ...
Page 11
... NXP Semiconductors When an interrupt event occurs the application software has to read the Interrupt register within t RSTN(INT) entered. If the application has read out the Interrupt register within the specified time, it can decide whether to switch into Normal mode via an SPI access or to stay in Standby mode ...
Page 12
... NXP Semiconductors operating mode codes 111, 001 and 111 respectively result of this sequence, the SBC will enter Start-up mode and perform a system reset with the related reset source information (bits RSS[3:0] = 0110). From Start-up mode the application software now has to enter Flash mode within t by writing Operating Mode code 011 to the Mode register ...
Page 13
... NXP Semiconductors Any microcontroller driven mode change is synchronized with a watchdog access by reading the mode information and the watchdog period information from the same register. This enables an easy software flow control with defined watchdog behavior when switching between different software modules. 6.4.1 Watchdog start-up behavior Following any reset event the watchdog is used to monitor the ECU start-up procedure ...
Page 14
... NXP Semiconductors 6.4.3 Watchdog time-out behavior Whenever the SBC operates in Standby mode, in Sleep mode or in Flash mode, the active watchdog operates in Time-out mode. The watchdog has to be triggered within the actual programmed period time; see wake-up events to the host microcontroller from Standby mode and Sleep mode. ...
Page 15
... NXP Semiconductors 6.5 System reset The reset function of the UJA1069 offers two signals to deal with reset events: • RSTN; the global ECU system reset • EN; a fail-safe global enable signal 6.5.1 RSTN pin The system reset pin (RSTN bidirectional input / output. Pin RSTN is active LOW with selectable pulse length upon the following events ...
Page 16
... NXP Semiconductors V1 V RSTN Fig 7. Reset pin behavior Fig 8. Reset timing diagram Pin RSTN is monitored for a continuously clamped LOW situation. Once the SBC pulls pin RSTN HIGH but pin RSTN level remains LOW for longer than t immediately enters Fail-safe mode since this indicates an application failure. ...
Page 17
... NXP Semiconductors The SBC also detects if pin RSTN is clamped HIGH. If the HIGH-level remains on the pin for longer than t the SBC falls back immediately to Fail-safe mode since the microcontroller cannot be reset any more. By entering Fail-safe mode, the V1 voltage regulator shuts down and the microcontroller stops ...
Page 18
... NXP Semiconductors 6.6.4 Switched battery output high-side switched BAT42-related output which is used to drive external loads such as wake-up switches or relays. The features of V3 are as follows: • Three application controlled modes of operation; ON, OFF or Cyclic mode. • Two different cyclic modes allow the supply of external wake-up switches; these switches are powered intermittently, thus reducing the system’ ...
Page 19
... NXP Semiconductors Fig 9. States LIN transceiver 6.7.1.1 Active mode In Active mode the LIN transceiver can transmit data to and receive data from the LIN bus. To enter Active mode the LMC bit must be set in the Physical Layer register and the SBC must be in Normal mode or Flash mode. ...
Page 20
... NXP Semiconductors Fig 10. LIN wake-up timing diagram 6.7.3 Termination control The RTLIN pin is in one of 3 different states: RTLIN = on, RTLIN = off or RTLIN = 75 A; see Figure RTLIN = ON supplied directly out of BAT42 mode change to Active mode Fig 11. States of the RTLIN pin During Active mode, with no short-circuit between the LIN-bus and GND, pin RTLIN provides an internal switch to BAT42 ...
Page 21
... NXP Semiconductors 6.7.5 LIN driver capability Setting the LDC bit in the Physical Layer Control register will increase the driver capability of the LIN output stage. This feature is used in auto-addressing systems, where the standard LIN 2.0 drive capability is insufficient. 6.7.6 Bus and TXDL failure detection The SBC handles and reports the following LIN-bus related failures: • ...
Page 22
... NXP Semiconductors INH/LIMP: HIGH ILEN = 1 ILC = 1 state change via SPI Fig 12. States of the INH/LIMP pin When pin INH/LIMP is used as inhibit output, a pull-down resistor to GND ensures a default LOW level. The pin can be set to HIGH according to the state diagram. When pin INH/LIMP is used as limp-home output, a pull-up resistor to V default HIGH level ...
Page 23
... NXP Semiconductors t on(CS su(CS) sample active signal already HIGH V WAKE due to biasing (history) flip flop V INTN Fig 13. Pin WAKE, cyclic sampling via V3 6.10 Interrupt output Pin INTN is an open-drain interrupt output forced LOW whenever at least one bit in the Interrupt register is set. By reading the Interrupt register all bits are cleared. The Interrupt register will also be cleared during a system reset (RSTN LOW) ...
Page 24
... NXP Semiconductors 6.12 SPI interface The Serial Peripheral Interface (SPI) provides the communication link with the microcontroller, supporting multi-slave and multi-master operation. The SPI is configured for full duplex data transfer, so status information is returned when new control data is shifted in. The interface also offers a read-only access option, allowing registers to be read back by the application without changing the register content ...
Page 25
... NXP Semiconductors 6.12.1 SPI register mapping Any control bit which can be set by software is readable by the application. This allows software debugging as well as control algorithms to be implemented. Watchdog serving and mode setting is performed within the same access cycle; this only allows an SBC mode change whilst serving the watchdog. ...
Page 26
... NXP Semiconductors Table 4. Mode register bit description (bits and Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only NWP[5:0] see Table OM[2:0] Operating Mode 2 SDM Software Development Mode 1 EN Enable 0 - reserved [1] Flash mode can be entered only with the watchdog service sequence ‘Normal mode to Flash mode to Normal mode to Flash mode’, while observing the watchdog trigger rules. With the last command of this sequence the SBC forces a system reset, and enters Start-up mode to prepare the microcontroller for fl ...
Page 27
... NXP Semiconductors Table 5. Mode register bit description (bits Bit Symbol Description NWP[5:0] Nominal Watchdog Period WDPRE = 00 (as set in the Special Mode register) Nominal Watchdog Period WDPRE = 01 (as set in the Special Mode register) Nominal Watchdog Period WDPRE = 10 (as set in the Special Mode register) ...
Page 28
... NXP Semiconductors Table 5. Mode register bit description (bits Bit Symbol Description NWP[5:0] Nominal Watchdog Period WDPRE = 11 (as set in the Special Mode register) [1] The nominal watchdog periods are directly related to the SBC internal oscillator. The given values are valid for f [2] See Section 6 ...
Page 29
... NXP Semiconductors Table 6. System Status register bit description Bit Symbol Description RSS[3:0] Reset Source 7 - reserved 6 LWS LIN Wake-up Status 5 EWS Edge Wake-up Status 4 WLS WAKE Level Status 3 TWS Temperature Warning Status 2 SDMS Software Development Mode Status 1 ENS Enable Status 0 PWONS Power-on reset Status [1] The RSS bits are updated with each reset event and not cleared ...
Page 30
... NXP Semiconductors Table 7. System Diagnosis register bit description Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only reserved 6 and 5 LINFD[1:0] LIN failure diagnosis 4 V3D V3 diagnosis 3 - reserved 2 V1D V1 diagnosis 1 and 0 - reserved 6.12.6 Interrupt Enable register and Interrupt Enable Feedback register These registers allow setting, clearing and reading back the interrupt enable bits of the SBC ...
Page 31
... NXP Semiconductors Table 8. Interrupt Enable and Interrupt Enable Feedback register bit description Bit Symbol Description 7 BATFIE BAT Failure Interrupt Enable 6 VFIE Voltage Failure Interrupt Enable 5 - reserved 4 LINFIE LIN Failure Interrupt Enable 3 WIE WAKE Interrupt Enable 2 WDRIE Watchdog Restart Interrupt Enable 1 - reserved ...
Page 32
... NXP Semiconductors Table 9. Interrupt register bit description Bit Symbol Description 15 and 14 A1, A0 register address 13 RRS Read Register Select 12 RO Read Only 11 WTI Watchdog Time-out Interrupt 10 OTI OverTemperature Interrupt 9 - reserved 8 SPIFI SPI clock count Failure Interrupt 7 BATFI BAT Failure Interrupt 6 VFI Voltage Failure Interrupt 1 ...
Page 33
... NXP Semiconductors Table 10. System Configuration and System Configuration Feedback register bit description Bit Symbol Description 12 RO Read Only 11 and 10 - reserved 9 - reserved 8 RLC Reset Length Control 7 and 6 V3C[1:0] V3 Control 5 - reserved 4 V1CMC V1 Current Monitor Control 3 WEN Wake Enable 2 WSC Wake Sample Control ...
Page 34
... NXP Semiconductors Table 11. Physical Layer Control and Physical Layer Control Feedback register bit description Bit Symbol Description 12 RO Read Only reserved 4 LMC LIN Mode Control 3 LSC LIN Slope Control 2 LDC LIN Driver Control 1 - reserved 0 LTC LIN Transmitter Control [1] In case of an RXDL / TXDL interfacing failure the LIN transmitter is disabled without setting LTC. Recovery from such a failure is automatic when LIN communication (with correct interfacing levels) is received ...
Page 35
... NXP Semiconductors Table 12. Special Mode register and Special Mode Feedback register bit description Bit Symbol Description 4 and 3 V1RTHC[1:0] V1 Reset Threshold Control reserved [1] See Section 6.13.1. [2] Not supported for the UJA1069TW/3V0 and UJA1069TW/3V3 version. [3] Not supported for the UJA1069TW/3V0 version. 6.12.11 General Purpose registers and General Purpose Feedback registers The UJA1069 offers two 12-bit General Purpose registers (and accompanying General Purpose Feedback registers) with no predefi ...
Page 36
... NXP Semiconductors Table 14. General Purpose register 1 and General Purpose Feedback register 1 bit description Bit Symbol Description 12 RO Read Only GP1[11:0] General Purpose bits 6.12.12 Register configurations at reset At Power-on, Start-up and Restart mode the setting of the SBC registers is predefined. Table 15. ...
Page 37
... NXP Semiconductors Table 19. System Configuration register and System Configuration Feedback register: status at reset Symbol Name RLC Reset Length Control V3C V3 Control V1CMC V1 Current Monitor Control WEN Wake Enable WSC Wake Sample Control ILEN INH/LIMP Enable ILC INH/LIMP Control Table 20. ...
Page 38
... NXP Semiconductors 6.13 Test modes 6.13.1 Software development mode The Software development mode is intended to support software developers in writing and pretesting application software without having to work around watchdog triggering and without unwanted jumps to Fail-safe mode. In Software development mode the following events do not force a system reset: • ...
Page 39
... NXP Semiconductors 6.13.2 Forced normal mode For system evaluation purposes the UJA1069 offers the Forced normal mode. This mode is strictly for evaluation purposes only. In this mode the characteristics as defined in Section 9 In Forced normal mode the SBC behaves as follows: • SPI access (writing and reading) is blocked • ...
Page 40
... ESD performance according to IEC 61000-4 150 pF 330 ) of pins LIN, RTLIN, WAKE, BAT42 and V3 with respect to GND was verifi external test house. Following results were obtained: a) Equal or better than 4 kV (unaided) b) Equal or better than 20 kV for pin LIN (using external ESD protection: NXP Semiconductors PESD1LIN diode) [5] Machine Model (MM 200 pF 0. ...
Page 41
... NXP Semiconductors 8. Thermal characteristics Fig 15. Thermal model of the HTSSOP32 package Fig 16. Thermal model of the HTSSOP24 package UJA1069_3 Product data sheet V1 dissipation V3 dissipation 6 K/W 23 K/W 6 K/W T (heat sink) case R th(c-a) T amb 001aad671 V1 dissipation V3 dissipation 6 K/W 17 K/W 6 K/W T (heat sink) case R th(c-a) T amb Rev. 03 — ...
Page 42
... NXP Semiconductors 9. Static characteristics Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Supply; pin BAT42 I BAT42 supply BAT42 current I additional BAT42 BAT42(add) supply current V BAT42 voltage level POR(BAT42) for power-on reset status bit change Supply ...
Page 43
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Battery supply monitor input; pin SENSE V input threshold low th(SENSE) battery voltage I HIGH-level input IH(SENSE) current [2] Voltage source; pin V1 ; see also ...
Page 44
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I output current V1 capability Z regulator impedance ds(on) between pins BAT14 and V1 Voltage source; pin BAT42-V3(drop) BAT42 V3 drop I overload current det(OL)(V3) detection threshold ...
Page 45
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I input leakage current SDI at pin SDI Serial peripheral interface data output; pin SDO I HIGH-level output OH current I LOW-level output OL current I OFF-state output ...
Page 46
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter V LIN dominant output o(dom) voltage I HIGH-level input LIH leakage current I LOW-level input LIL leakage current I short-circuit output o(sc) current V receiver dominant ...
Page 47
... NXP Semiconductors Table 25. Static characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter I RTLIN pull-up RTLIN(pu) current I LOW-level leakage LL current TEST input; pin TEST V input threshold th(TEST) voltage R pull-down resistor (pd)TEST Temperature detection T high junction ...
Page 48
... NXP Semiconductors Fig 17. V1 output voltage (dropout function of battery voltage UJA1069_3 Product data sheet 100 120 mA 250 100 120 mA 250 150 C. j Rev. 03 — 10 September 2007 UJA1069 LIN fail-safe system basis chip 001aaf215 type 5V0 type 3V3 type 3V0 (V) BAT14 001aaf244 ...
Page 49
... NXP Semiconductors I BAT14 (mA) (1) Types 5V0, 3V3 and 3V0. (2) Type 5V0 only BAT14 (mA) (1) Types 5V0, 3V3 and 3V0. (2) Types 3V3 and 3V0 Fig 18. V1 quiescent current as a function of output current UJA1069_3 Product data sheet ( BAT14 2 (2) 5 100 = 40 C, +25 C and +150 C. ...
Page 50
... NXP Semiconductors V (V) Fig 19. V1 output voltage as a function of output current PSRR (dB) (1) Type 5V0 only. Fig 20. V1 power supply ripple rejection as a function of frequency UJA1069_3 Product data sheet 6 type 5V0 V1 4 type 3V3 type 3V0 BAT14 125 C. j 160 BAT14 ...
Page 51
... NXP Semiconductors V BAT14 (V) a. Line transient response I (mA) b. Load transient response Fig 21. V1 transient response as a function of time UJA1069_3 Product data sheet 16 V BAT14 100 200 mA ESR = 0. 100 200 ESR = 0. BAT14 Rev. 03 — 10 September 2007 UJA1069 LIN fail-safe system basis chip ...
Page 52
... NXP Semiconductors ESR ( ) Fig 22. V1 output stability related to ESR value of output capacitor UJA1069_3 Product data sheet stable operation area 2 10 unstable operation area Rev. 03 — 10 September 2007 UJA1069 LIN fail-safe system basis chip 001aaf249 80 120 I (mA) V1 © NXP B.V. 2007. All rights reserved. ...
Page 53
... NXP Semiconductors a. Test circuit V (V) b. Behavior (V) c. Behavior at T Fig 23. Switch-on behavior of V UJA1069_3 Product data sheet BAT42 BAT14 100 F/ V BAT 0.1 100 BAT V = 5.5 V BAT BAT 0 0 0.4 0 BAT 5.5 V BAT BAT 0 0 0.4 0 Rev. 03 — 10 September 2007 UJA1069 ...
Page 54
... NXP Semiconductors 10. Dynamic characteristics Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Serial peripheral interface timing; pins SCS, SCK, SDI and SDO (see T clock cycle time cyc t enable lead time lead ...
Page 55
... NXP Semiconductors Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter t TXDL permanent dominant TXDL(dom)(dis) disable time Battery monitoring t BAT42 LOW time for BAT42(L) setting PWONS t BAT42 LOW time for SENSE(L) setting BATFI Power supply V1 ...
Page 56
... NXP Semiconductors Table 26. Dynamic characteristics +150 5 BAT42 voltages are defined with respect to ground. Positive currents flow into the IC. Symbol Parameter Interrupt output; pin INTN t interrupt release INTN Oscillator f oscillator frequency osc [1] All parameters are guaranteed over the virtual junction temperature range by design. Products are 100 % tested at 125 C ambient temperature on wafer level (pretesting). Cased products are 100 % tested ambient temperature (fi ...
Page 57
... NXP Semiconductors Fig 25. Timing test circuit for LIN transceiver t bit V TXDL V BAT42 LIN BUS signal V RXDL1 receiving node 1 t p(rx)f V RXDL2 receiving node 2 Fig 26. Timing diagram LIN transceiver 11. Test information Immunity against automotive transients (malfunction and damage) in accordance with LIN EMC Test Specification / Version 1.0; August 1, 2004. ...
Page 58
... NXP Semiconductors 12. Package outline HTSSOP32: plastic thermal enhanced thin shrink small outline package; 32 leads; body width 6.1 mm; lead pitch 0.65 mm; exposed die pad y exposed die pad side pin 1 index 1 e DIMENSIONS (mm are the original dimensions). A UNIT max. 0.15 0.95 mm 1.1 0.25 ...
Page 59
... NXP Semiconductors HTSSOP24: plastic thermal enhanced thin shrink small outline package; 24 leads; body width 4.4 mm; lead pitch 0.65 mm; exposed die pad y exposed die pad Z 24 pin 1 index 1 e DIMENSIONS (mm are the original dimensions) A UNIT max 0.15 0.95 0.30 mm 1.1 0.25 0.05 ...
Page 60
... NXP Semiconductors 13. Soldering This text provides a very brief insight into a complex technology. A more in-depth account of soldering ICs can be found in Application Note AN10365 “Surface mount reflow soldering description” . 13.1 Introduction to soldering Soldering is one of the most common methods through which packages are attached to Printed Circuit Boards (PCBs), to form electrical circuits ...
Page 61
... NXP Semiconductors 13.4 Reflow soldering Key characteristics in reflow soldering are: • Lead-free versus SnPb soldering; note that a lead-free reflow process usually leads to higher minimum peak temperatures (see reducing the process window • Solder paste printing issues including smearing, release, and adjusting the process window for a mix of large and small components on one board • ...
Page 62
... NXP Semiconductors Fig 29. Temperature profiles for large and small components For further information on temperature profiles, refer to Application Note AN10365 “Surface mount reflow soldering description” . 14. Revision history Table 29. Revision history Document ID Release date UJA1069_3 20070910 • Modifications: The symbols LWEN and ERREM have been removed from • ...
Page 63
... For detailed and full information see the relevant full data sheet, which is available on request via the local NXP Semiconductors sales office. In case of any inconsistency or conflict with the short data sheet, the full data sheet shall prevail ...
Page 64
... NXP Semiconductors 17. Contents 1 General description . . . . . . . . . . . . . . . . . . . . . . 1 2 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.1 General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.2 LIN transceiver . . . . . . . . . . . . . . . . . . . . . . . . . 2 2.3 Power management . . . . . . . . . . . . . . . . . . . . . 2 2.4 Fail-safe features . . . . . . . . . . . . . . . . . . . . . . . 3 3 Ordering information . . . . . . . . . . . . . . . . . . . . . 3 4 Block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5 Pinning information . . . . . . . . . . . . . . . . . . . . . . 5 5.1 Pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5.2 Pin description . . . . . . . . . . . . . . . . . . . . . . . . . 6 6 Functional description . . . . . . . . . . . . . . . . . . . 7 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 6.2 Fail-safe system controller . . . . . . . . . . . . . . . . 7 6 ...