Power & Clock Supervision

Because almost every other safety mechanism assumes them. A lockstep core pair, an end-to-end protected bus frame, a plausibility check on a torque command and a memory protection unit keeping a quality-managed task out of a safety partition all need supply conditions inside the characterized limits and a time base consistent with the timing design. Digital logic outside its specified operating conditions is not guaranteed to fail cleanly: it may reset, stop, corrupt state, or continue with reduced margins, and a wrong result produced during an excursion carries no built-in indication. Hardware monitors are the usual answer, but their thresholds, filters and reactions count as safety mechanisms only when the full path is specified and verified.

Not better regulation. What separates it is a set of documented monitoring, reaction and self-test functions whose dependencies can be assessed: undervoltage and overvoltage comparators on specified outputs, a question-answer watchdog, an error input that judges the companion microcontroller, clock monitoring, reset and safe-state control, and self-test engines, with the judging functions referenced separately from the regulating ones. That separation is an architectural feature rather than a proof of independence, since shared supply paths, pins, configuration and external connections still belong in dependent failure analysis. The guide also compares the integrated device against a system basis chip and a discrete supervisor arrangement.

A monitor can fail silently while the supervised function stays healthy, because on a healthy system a correct monitor output and a stuck monitor output are identical. The fault sits latent until the day the rail genuinely sags, and on that day the system discovers it has been unprotected for months. In ISO 26262 terms a constituent fault is latent when it is neither detected by a safety mechanism nor perceived by the driver within the relevant multiple-point fault detection interval, and Part 5 sets latent fault metric targets of 60, 80 and 90 percent for ASIL B, C and D, subject to the classification and evaluation provisions of the standard. Self-test does not prevent the fault; it bounds how long the fault can hide, which is why the interval claimed in the FMEDA has to match when the test actually runs in the vehicle.

Only under its stated conditions. A coverage figure has a supply chain: the supplier analysis produced it, the safety manual publishes it wrapped in assumptions of use, and detailed supporting material may be public, access-controlled or unavailable. The integrator normally does not recreate transistor-level statistics, but must satisfy or replace each relevant assumption and provide evidence for the pieces only the integrator can see: the board, the configuration, the reaction chain and the timing. An unmet assumption invalidates the associated claim unless an alternative analysis and evidence establish equivalent coverage, which is why the guide treats the assumptions-of-use matrix as a tracked requirement set with owners, status and evidence.

As a decomposition you have to write down. The interval runs from a fault occurring until a hazardous event could occur if the safety mechanisms did not act, and the credited path spends it on sensing, filtering, decision and reaction. The guide shows why the deglitch filter is squeezed from three sides at once, since it must reject legitimate transients, still detect a real fault within the remaining budget, and for supply-loss cases fit inside the available stored energy. It also shows why a watchdog period chosen for comfortable software scheduling can quietly be the largest number in the entire budget, and why reset assertion and rebooted-software recovery are different reactions with very different costs.

The course has 14 chapters: the silent assumptions and the six failure families that move them, the power tree and how each stage fails, inside a safety PMIC, voltage supervision, sequencing and power-good, reset and escalation, watchdogs, clock supervision, the independence argument, the fault tolerant time interval and the supervision timing budget, latent faults and monitor self-test, demonstrating diagnostic coverage, the FMEDA and safety case, and a closing chapter that runs two faults end to end and folds the material into patterns, pitfalls and a review checklist. Device behaviour is illustrated from public manufacturer documentation, and all thresholds, timings and coverage figures are teaching values rather than requirements.