Redundancy ensures critical loads retain power during faults or brownouts. A primary rail supports performance domains, while a backup rail preserves minimum safe functionality for sensors or the safety MCU. PG logic and switchover thresholds are specified so the ECU can enter a defined safe state within the FTTI.

Aggregate rail-level PGs using AND/OR logic and programmable delays to release RESET in a defined order. Document polarity, debounce, and timeout per rail, then route a single PG_OK to the reset controller. Log all edges so software can correlate PG timing with start-up and fault injection tests.

PMICs publish voltage, current, and temperature, plus sticky fault flags and counters. Status registers are protected by CRC and may be mirrored. Polling cadence and interrupt usage should be defined, with timestamps persisted in logs to verify detect→report→decide→act intervals against the FTTI budget.

CRC detects corrupted frames on SPI/I²C, preventing silent misreads of safety-relevant status. Specify the polynomial and frame format, enforce retries on CRC errors, and record counts. During fault injection, verify that CRC failures are handled deterministically and do not mask genuine PG or thermal events.

Sweep the rail through programmable steps and dwell at thresholds to exercise debounce and comparators. Capture PG transitions, rail settling, and ECU interrupts. For each case, log Δt_detect and Δt_report, then confirm that the ECU action closes within the remaining FTTI. Repeat under cold/hot corners.

When die temperature exceeds TSD, the PMIC throttles or disables affected rails. Recovery occurs after hysteresis lowers temperature. Define whether restart is automatic or latched, and ensure software records a thermal event, checks loads for shorts, and resumes only when the application can safely continue.

A windowed watchdog supervises ECU activity with minimum and maximum service times. Violations trigger reset or controlled degradation. Align the watchdog period with control loop timing, and include a power-on self-test to prove the WD path. Log each event to support coverage metrics and audits.

Map each failure mode—UV/OV, short, open, thermal—to a safety mechanism and observable evidence. Use the vendor’s safety manual and FMEDA template, add system fallbacks where gaps exist, and quantify detection rates with fault injection statistics. Coverage must be reproducible across operating corners.

Allocate time for comparator/filter delay, PG/IRQ propagation, software decision, and hardware action like current limiting or switchover. Include worst-case bus latency and ISR load. Demonstrate that total latency is below the FTTI under voltage, temperature, and processing extremes.

Store timestamped rail V/I/T samples, PG/IRQ edges, status snapshots with CRC, retry counts, and watchdog results. Each test entry should reference thresholds and expected outcomes, enabling auditors to reconstruct detect→report→decide→act sequences and confirm compliance with stated ASIL goals.

Tune soft-start and dV/dt, increase debounce, and sequence dependent rails with appropriate delays. Validate across cold crank and load transients. Ensure software distinguishes transient flags from persistent faults before initiating shutdown or switchover, reducing unnecessary resets in the field.

Many PMICs provide safety mechanisms and documentation rather than a standalone certification. Compliance is demonstrated at the system level using the vendor’s safety manual, FMEDA, and test evidence. Select devices with mature collateral to simplify assessments for ASIL-B/C/D targets.

High-ASIL domains often use devices like TI TPS6594-Q1 or Renesas RAA series for multi-rail sequencing, PG aggregation, and watchdog. Camera and gateway designs may adopt NXP PF5020 or ST L5965 families. Always verify timing, diagnostics, and documentation against your safety concept.