L9965P-FP

L9965P STM | Alldatasheet

Document overview

• Manufacturer or author: Provided By alldatasheet.com(free datasheet download site)
• PDF pages: 104

Technical content

Datasheet sections

• 1 Block diagram and pin description
• 1.1 Block diagram
• 1.2 Pin description
• 2 Product ratings
• 2.1 Thermal ratings
• 2.2 Electrical ratings
• 2.2.1 Absolute maximum ratings
• 2.3 ESD ratings
• 3 Functional description
• 3.1 Device functional states (FSM)
• 3.1.1 SPI SLEEP commands
• 3.1.2 Diagnostics summary
• 3.2 Power management
• 3.2.1 Power management electrical parameters
• 3.3 Power supply section
• 3.3.1 Main supply (ERBST)
• 3.3.2 Power stage supply (PS)
• 3.3.3 IO output buffer supply (VIO)
• 3.4 Wake-up sources
• 3.4.1 Wake-up from cyclic wake-up pin (CWUP)
• 3.4.2 Wake-up from fire enable inputs (FENH/FENL)
• 3.4.3 Wake-up via peripheral SPI
• 3.5 Fault notification (FAULTN)
• 3.5.1 FAULTN integrity check
• 3.5.2 FAULTN electrical parameters
• 3.6 Pyro-fuse deployment stage
• 3.6.1 Signal stage (FENH/FENL/SPI)
• 3.6.2 Power stage (PS/PF/PR/PGND)
• 3.7 Diagnostic routine
• 3.7.1 Routine execution modes
• 3.7.2 Routine steps
• 3.7.3 Diagnostic routine electrical parameters
• 3.8 Voltage ADC
• 3.8.1 Measurement trigger modes
• 3.8.2 Voltage ADC electrical parameters

Features

• AEC-Q100 grade 1 qualified
• Full ISO26262 compliant, ASIL-D systems ready
• Very low power consumption: – Less than 10 μA in deep-sleep mode (only trigger detection enabled) – Less than 4 mA in low-power mode (trigger detection enabled, ER boost recharge active, cyclic diagnostics every 100 ms)
• Boost regulator to charge Energy Reserve (ER) with bang-bang control to reduce consumption
• FENH/FENL digital input triggers, compatible to level or PWM signals (16 kHz and 125 kHz), with line integrity check feature
• Autonomous cyclic diagnostic routine to ensure detection of all failures which may prevent safe deployment and/or cause inadvertent deployment
• Programmable deployment profile: current value and time duration can be adapted to different pyro-fuse igniters
• Firing strategy supporting multiple retry attempts based on user-selectable FIRE_GOOD signal
• Embedded NVM for configuration parameters storage and runtime configuration integrity check
• Easy integration with L9965C companion CSA, implementing many of the safety mechanisms needed to achieve ASIL targets, thus allowing easy L9965P plug and play in the system
• Pyro-fuse deployment available down to a minimum operating battery voltage of 6 V
• 24-bit peripheral SPI for direct MCU/L9965C interface
• Compatible with pyro-fuses certified according LV-16 and USCAR-28 Application
• High voltage battery packs for BEVs and PHEVs
• Backup energy storage systems and UPS

Description

L9965P is an automotive-grade single channel pyro-fuse driver capable to break high voltage battery line quickly and reliably in case of short circuit or car crash. To accomplish this function, the device features a dual FET output stage made of a HS and a LS powerMOS. The stage is equipped with a closed loop current feedback and can be configured to deliver controlled firing profiles programming both current value and time duration. Moreover, the power stage is able to perform a defined number of auto-retry attempts based on the success or not of the deployment. The device embeds a programmable firing logic allowing to generate the trigger signal from two SPI commands or from two digital inputs (FENH/FENL). VFQFN32+4L 5x5x0.9 mm TQFP32L 7x7x1 mm Product status link L9965P Product summary Order code Package Packing L9965P‑FN VFQFN32 Tray L9965P‑FN‑TR Tape and reel L9965P‑FP TQFP32L Tray L9965P‑FP‑TR Tape and reel Product labels Automotive single channel pyro-fuse driver L9965P Datasheet DS14702 - Rev 4 - June 2025 For further information, contact your local STMicroelectronics sales office.

The digital input triggers are compatible with both level and PWM encoding, supporting 16 kHz and 125 kHz encoded signals. The device supports the charging of an external capacitor to be used as tank capacitor or as energy reserve (ER) in case of battery loss. An internal boost regulator can be used to control the ER cap voltage around a programmable setpoint. Boosting the input battery voltage allows using smaller ER capacitor values to store the energy needed for firing, even in case of ECU battery loss. The device has been designed to deliver maximum safety and performance while still being energy efficient. A low-power operation strategy allows minimizing the idle consumption, keeping the device in an ultra low power state while still performing all the diagnostic sweeps needed for achieving the ASIL targets. The periodicity of the diagnostic sweeps can be programmed in order to comply with any FTTI. During such ultra low power state, the device is still sensitive to wake-up/trigger sources in order to be ready to fire. Operation in conjunction with L9965C companion chip allows simplifying the software development, as many safety mechanisms are already implemented by L9965C. L9965P DS14702 - Rev 4 page 2/104

1 Block diagram and pin description

1.1 Block diagram

Figure 1. Block diagram

1.2 Pin description

Figure 2. Pinout (top view)

Table 1. Pin function

1 CWUP Cyclic wake-up input PD Local

2 GND2 Ground pin - Global

3 FAULTN Open-drain fault output pin - Local

4 AUX1 Short to ground in application - Local

5 NCS SPI chip select PU Local

6 SCLK SPI clock PD Local

7 SDI SPI data in (MOSI) PD Local

8 SDO SPI data out (MISO) - Local

9 VIO Digital output buffer supply input - Local

10 AUX2 Short to ground in application - Local

11 TM ST test mode pin, short to ground in application PD Local

12 GND1 Ground pin - Global

13 AUX3 Open in application PD Local

14 FENH Fire enable high-side PU/PD (configurable) Local

15 AUX4 Open in application PD Local

16 FENL Fire enable low-side PU/PD (configurable) Local

17 PGND Pyro-fuse driver low-side ground - Local

18 NC No connection - Local

19 PR Pyro-fuse driver low-side output - Global

20 NC No connection - Local

21 PF Pyro-fuse driver high-side output - Global

22 NC No connection - Local

23 PS Pyro-fuse driver high-side supply - Global

24 NC No connection - Local

25 ERDCHSW Energy reserve discharge switch - Local

26 NC No connection - Local

27 ERBST Main supply/energy reserve boost output - Global

28 NC No connection - Local

29 BSTGND Energy reserve boost ground - Local

30 ERBSTSW Energy reserve boost switching node - Local

31 NC No connection - Local

32 VBATMON Input battery monitor pin - Global

33 EP Exposed pad: connect to GND - -

2 Product ratings

2.1 Thermal ratings

Table 2. Thermal ratings

2.2 Electrical ratings

The following section describes the different operational ranges.

• Operating range (OR): within this range functions operate as specified and without parameter deviations. All the device electrical parameters are tested and guaranteed in this range and are valid in the whole TJ operating range, unless otherwise specified.
• Absolute maximum rating range (AMR): within this range functions may not operate properly. However, the IC will not be damaged. Exposure to AMR conditions for extended periods may affect device reliability. Exceeding any AMR may cause permanent damage to the integrated circuit. Note: • Currents are noted with a positive sign when flowing into a pin.
• Integrated protections and diagnostics are designed to prevent device destruction under the fault conditions described in the specification. Fault conditions are considered to be out of normal operating range. Protection functions are not designed for continuous repetitive operation. L9965P Product ratings DS14702 - Rev 4 page 6/104

Table 3. Pin electrical ratings

2.2.1 Absolute maximum ratings

Table 4. Absolute maximum ratings

2.3 ESD ratings

Table 5. ESD ratings all ground pins connected together).

3 Functional description

unwanted modification (see the Section 3.15: Configuration Lock).

3.1 Device functional states (FSM)

The L9965P operates according to the FSM shown in the Figure 3. Figure 3. Device FSM

Table 6. Device FSM

3.1.1 SPI SLEEP commands

1. MCU writes 0x77 into the SPECIAL_KEY register to enter partial go-to-sleep;
2. MCU writes 0xCC into the SPECIAL_KEY register to confirm go-to-sleep.

3.1.2 Diagnostics summary

according to the functional state. all diagnostics have been enabled in the device configuration. Table 7. Diagnostics summary

• OD → Diagnostic available on-demand
• CYC → Diagnostic cyclically activated by internal timer
• OFF → Diagnostic disabled/masked

3.2 Power management

The IC is supplied by ERBST pin, which is then used to generate all the internal regulated supplies. alternatively by an isolated DC/DC converter from the HV battery pack.

3.2.1 Power management electrical parameters

according to the Table 3; TJ according to the Table 2.

Table 8. Device current consumption

3.3 Power supply section

3.3.1 Main supply (ERBST)

• Feeds the internal VANA LDO used for biasing the analog circuitry.
• Feeds the internal VDIG LDO used for biasing the digital circuitry.
• Feeds the internal VSTBY LDO used for biasing the circuitry in DEEP-SLEEP. The boost regulator is disabled by default and can be enabled via NVM setting the ERBST_EN bit to 1. Once the boost regulator is enabled via NVM, it can be turned-off via the ERBST_DIS bit. Once VERBST > VVBATMON - VERBST_DIS for t > tERBST_READY_FLT, the initial charge phase is over, the ERBST_RDY bit in the ERBOOST register is set to 1 and the switching operation starts. This ensures the presence of the external diode between VBATMON pin and ERBST pin. If VERBST < VVBATMON - VERBST_DIS after tERBST_READY_FLT, the ERBST regulator is turned-off and the ERBST_RDY bit is set to 0. Once started, the boost operates according to a bang-bang strategy, as shown in the Figure 4:
• The controller is enabled and boosts the battery voltage whenever VERBST falls below the VER_WKUP_THX voltage programmed in the VER_WKUP_TH bit field for an interval longer than tER_WKUP_FLT. While in the duty phase, the IC is kept in NORMAL and any transition to DEEP-SLEEP is delayed until the setpoint has been reached.
• The controller is disabled whenever VERBST reaches the target VERBST_XXX setpoint. This strategy guarantees high energy efficiency meantime the ER cap voltage is always charged for firing the pyro-fuse. In fact, considering the typical range for CERBST capacitor, the boost controller spends most of the time in the disabled state.

Figure 4. ERBST controller working principle guarantee a maximum tERBST_STARTUP startup time in the worst-case application scenario. to enable this function through the PIN_LIMIT bit in NVM. drive a GPIO to short the resistor RCHG. It is possible to kept disabled the ERBST regulator setting ERBST_DIS=1 in the ERBOOST register.

3.3.1.1 ERBST diagnostics

Table 9. ERBST diagnostics

3.3.1.2 ERBST electrical parameters

according to the Table 3; TJ according to the Table 2. Table 10. ERBST supply electrical parameters

Symbol Parameter Test condition Min Typ Max Unit Pin VERBST_OV_HYS ERBST overvoltage hysteresis Max slew rate = 2.3 V/ms 150 - 250 mV ERBST tERBST_OV_FLT ERBST overvoltage filter time Tested by SCAN 17 20 21 us ERBST VERBST_000 ERBST regulated voltage ERBST_SET = 000 All operating lines and loads 16.92 18 19.08 V ERBST VERBST_001 ERBST_SET = 001 All operating lines and loads 17.86 19 20.14 V ERBST VERBST_010 ERBST_SET = 010 All operating lines and loads 18.80 20 21.20 V ERBST VERBST_011 ERBST_SET = 011 All operating lines and loads 19.74 21 22.26 V ERBST VERBST_100 ERBST_SET = 100 All operating lines and loads 20.68 22 23.32 V ERBST VERBST_101 ERBST_SET = 101 All operating lines and loads 21.62 23 24.38 V ERBST VERBST_110 ERBST_SET = 110 All operating lines and loads 22.56 24 25.44 V ERBST VERBST_111 ERBST_SET = 111 All operating lines and loads NA NA NA V ERBST VER_WKUP_TH0 ERBST cap discharge threshold (in tracking with VERBST_XXX setpoint) VER_WKUP_TH = 000 15.04 16 16.96 V ERBST VER_WKUP_TH1 VER_WKUP_TH = 001 15.98 17 18.02 V ERBST VER_WKUP_TH2 VER_WKUP_TH = 010 16.92 18 19.08 V ERBST VER_WKUP_TH3 VER_WKUP_TH = 011 17.86 19 20.14 V ERBST VER_WKUP_TH4 VER_WKUP_TH = 100 18.80 20 21.20 V ERBST VER_WKUP_TH5 VER_WKUP_TH = 101 19.74 21 22.26 V ERBST VER_WKUP_TH6 VER_WKUP_TH = 110 20.68 22 23.32 V ERBST VER_WKUP_TH7 VER_WKUP_TH = 111 NA NA NA V ERBST tERBST_WKUP_FLT ERBST discharge comparator deglitch Guaranteed by SCAN 17 20 21 µs ERBST PIN_ERBST Boost input peak power Input power limitation to guarantee tERBST_STARTUP in VIN = 6 V to 18 V range 1.8 - 2.6 W ERBST ηERBST Boost efficiency PIN_ERBST = PIN_ERBSTmax VIN = 6 V Guaranteed by design 0.6 - - W/W ERBST, ERBSTSW fERBST Switching frequency Design info, taking in consideration temperature and external competent variations 1.6 - 2.4 MHz ERBST tERBST_ON_MIN Minimum ON-time Design info 80 - ns ERBSTSW CERBST External output capacitor Application info, including component tolerance 0.1 - 1.2 mF ERBST CERBST_ESR External output capacitor ESR Application info, including component tolerance 100 - 500 mΩ ERBST L9965P Functional description DS14702 - Rev 4 page 16/104

Symbol Parameter Test condition Min Typ Max Unit Pin LERBST External output inductor ISAT >> IERBST_PEAK_LIM Application info -20% 33 +20% µH ERBST LERBST_DCR External inductor DCR Application info - 1.5 Ω ERBST VDFW External diode forward voltage Application info - 1.2 V ERBST VERBST_DIS ERBST disable threshold during power- up Voltage difference between VBATMON pin and ERBST pin 1.5 2.2 2.7 V VBATMON, ERBST tERBST_READY_FLT ERBST ready filter time Tested by SCAN 10 20 25 µs VBATMON, ERBST tERBST_STARTUP ERBST startup time From VERBST = 5.3 V to 90% of VERBST_110 CERBST = CERBSTmax VIN = 6 V - 220 ms ERBST TERBSTSW_SD Thermal shutdown threshold Guaranteed by design 150 - 190 °C ERBST TERBSTSW_SD_HYS Thermal shutdown threshold hysteresis Guaranteed by design 5 - 15 °C ERBST tERBST_SD_FLT Thermal shutdown filter time Guaranteed by design 7 8.5 10 µs ERBST IERBST_PEAK_LIM_0 ERBSTSW peak current limitation PIN_LIMIT = 0 330 - 480 mA ERBSTSW IERBST_PEAK_LIM_1 ERBSTSW peak current limitation PIN_LIMIT = 1 VIN = 6 V 300 - 440 mA ERBSTSW IERBST_OC ERBSTSW overcurrent threshold 460 - 700 mA ERBSTSW NERBST_OC_COUNT Number of counts before turn-off Overcurrent events - 5 - # ERBSTSW RDSON_ERBSTSW Boost switch ON resistance - - 1 Ω ERBSTSW VERBST_DLOSS_TH ERBST diode loss detection threshold Voltage difference between ERBSTSW pin and ERBST pin 2.3 3.3 4.0 V ERBST, ERBSTSW VERBSTSW_CLAMP ERBSTSW pin clamping voltage Diode loss 33 - 40 V ERBSTSW NERBST_DLOSS_COUNT Number of counts before turn-off Diode loss clamping events - 3 - # ERBSTSW tRISE_ERBSTSW ERBSTSW rise time From 10% to 90% of VERBSTSW_max Min IERDCHSW peak current Application info - - 15 ns ERBSTSW tFALL_ERBSTSW ERBSTSW fall time From 90% to 10% of VERBSTSW_max Max IERDCHSW peak current Application info - - 20 ns ERBSTSW L9965P Functional description DS14702 - Rev 4 page 17/104

3.3.2 Power stage supply (PS)

• Feeds the level shifters between the signal stage and the power stage.
• Feeds the HS circuitry of the power stage.

3.3.2.1 PS diagnostics

Table 11. PS diagnostics

3.3.2.2 PS electrical parameters

according to the Table 3; TJ according to the Table 2. Table 12. PS supply electrical parameters

3.3.3 IO output buffer supply (VIO)

bypass ceramic capacitor near the VIO pin. The VIO shall be supplied externally and it enables compatibility with both 3.3 V and 5 V controllers. There is no diagnostic on the VIO supply.

3.4 Wake-up sources

The following section lists the available wake-up sources and their behavior. tWAKEUP_TIMEOUT. Otherwise, the IC returns to the previously held low power state. Table 13. Wake-up sources electrical parameters

3.4.1 Wake-up from cyclic wake-up pin (CWUP)

• Triggering cyclic wakeups and diagnostics in low-power strategies.
• Keep the device constantly in NORMAL state in full-power strategies. When the CWUP pin is set high for longer than tCWUP_POWERUP_PULSE (tCWUP_FLT filter time is applied), a wake- up condition is acknowledged and latched in the CWUP_WAKEUP bit in INTERNAL_STATUS register. The IC completes the power-up phase after tCWUP_POWERUP_TIME since the CWUP signal is set high. This wake-up source is always available.

3.4.1.1 CWUP electrical parameters

according to the Table 3; TJ according to the Table 2. Table 14. CWUP electrical parameters

3.4.2 Wake-up from fire enable inputs (FENH/FENL)

acknowledged and latched in the FENX_WAKEUP bit in the INTERNAL_STATUS register. tFENx_WAKEUP_WAIT before returning in DEEP-SLEEP state. These wake-up sources can be enabled setting FENH_EN = 1 and FENL_EN = 1 in NVM. The active levels can also be programmed through FENH_LEVEL and FENL_LEVEL. are locked (neither download nor upload). A transition to DEEP-SLEEP is needed to unlock NVM.

3.4.2.1 FENH/FENL wake-up electrical parameters

according to the Table 3; TJ according to the Table 2. Table 15. Wake-up sources electrical parameters

3.4.3 Wake-up via peripheral SPI

1. A NCS high to low transition
2. A NCS low to high transition

expiration, otherwise it is discarded. Wake-up frames are not decoded, so their content may be arbitrary.

• The tSPI_COMM_TIMEOUT is reset and restarted in case a valid frame is received (no CRC error and correct number of SCK pulses).
• The tSPI_COMM_TIMEOUT is reset and stopped in case a high level is detected on CWUP. From that moment on, moving the device to a low power state requires setting CWUP low.

Figure 5. Wake-up condition by peripheral SPI

3.4.3.1 SPI wake-up electrical parameters

according to the Table 3; TJ according to the Table 2. Table 16. SPI electrical parameters

3.5 Fault notification (FAULTN)

‘1’ indicates the IC has not detected a failure. when every latched fault has been cleared. also be masked. Refer to the diagnostic tables for the specific masking conditions. it is still present when the CWUP input level is set low, the tFAULT_HANDLING_TIMEOUT does not start.

3.5.1 FAULTN integrity check

Table 17. FAULTN configuration according to different power management strategies FAULTN_CYCLIC_PULSE = 1, it is a fault injection.

• Continuously in full power mode (refer to the Figure 6) – This diagnostic requires FAULTN_CYCLIC_PULSE = 1. Pulse generation starts tFAULTN_PERIOD after such a bit is written high (see the Figure 7). – If a failure occurs and FAULTN is held active low for fault signaling, the tFAULTN_PERIOD timer is kept under reset. It restarts once all faults have been cleared and FAULTN returns to its inactive high state. L9965P Functional description DS14702 - Rev 4 page 22/104

Figure 9. FAULTN integrity check in low power mode (example of fault detected by L9965P)

3.5.2 FAULTN electrical parameters

according to the Table 3; TJ according to the Table 2. Table 18. FAULTN electrical parameters

3.6 Pyro-fuse deployment stage

The Figure 10 shows the pyro-fuse deployment stage architecture. Figure 10. Pyro-fuse deployment stage architecture

• One via hardware through FENH and FENL pins.
• One via software through two SPI commands. Three substages are present:
• Signal stage – The FENH and FENL signals decoders are configured via SPI registers and their configuration is stored into NVM. – A delay stage on the FENx path enables fine-tuning of the trigger output propagation delay for applications where several L9965P pyro-fuse drivers need to be phase-shifted. – A parallel decoder stage for SPI arming commands is available.
• Control driver – The control driver translates the signal stage outputs into suitable commands for the power-stage output domain.
• Power stage – The LS and HS are turned on by a latch whose reset occurs whenever the fire attempt ends successfully or the deploy timer expires. – A HS current sensing is implemented to deploy the pyro-fuse with the programmed current profile and manage the deployment autoretry. – The power stage is inhibited by a “fire inhibit” signal in case a fault occurs. L9965P Functional description DS14702 - Rev 4 page 25/104

3.6.1 Signal stage (FENH/FENL/SPI)

The IC has two digital inputs, FENH and FENL, whose signals are treated by two different decoders to generate the driving stimulus for the HS and LS switches. Additionally, the switches can be triggered by dedicated SPI commands. The FENH/FENL/SPI decoders are only available in DIAG, NORMAL and ARM states, while in DEEP-SLEEP they are disabled, since FENH/FENL/SPI may only be used as wake-up sources.

3.6.1.1 FENH/FENL decoders configuration

The two decoders can be individually enabled by setting FENH_EN = 1 and FENL_EN = 1. When disabled, their output is always in the inactive state (no trigger). Before being input to the digital decoders, the FENH/FENL inputs are always pre-filtered by an analog stage (tFENx_FLT) to prevent noise from altering the decoding process. Each decoder can be configured in different modes:

• FENH_MODE/FENL_MODE = 0 sets the level-based decoding – A programmable deglitch filter tFENx_DEGLITCH helps to filter out unwanted spikes on the trigger inputs. The deglitch value is valid for both FENH and FENL inputs. – When the FENL/FENH deglitched signal holds the active level, an arming condition is acknowledged on the corresponding branch.
• FENH_MODE/FENL_MODE = 1 sets the PWM-based decoding. The PWM-based encoding allows the L9965P continuously monitoring the status of the trigger lines, being capable of detecting frequency drifts and stuck-at faults in real-time, as described in the Section 3.6.1.2: FENH/FENL integrity check. The decoder frequency can be selected between two options: – FENH_FREQ/FENL_FREQ = 0 sets the 125 kHz option – FENH_FREQ/FENL_FREQ = 1 sets the 16 kHz option The programmable NFENx_FAULT_PERIOD up/down counter is used to deglitch the PWM periods. The counter value is valid for both FENH and FENL inputs. The counter output behaves as follows: – In case it reaches the programmed threshold, it saturates and an arming condition is acknowledged on the corresponding branch. – In case the output value is less than the programmed threshold, the arming is released. The FENH/FENL active state is configured through FENH_LEVEL/FENL_LEVEL bits:
• FENH_LEVEL = FENL_LEVEL = 0 sets the active state to: – Low level in case of level-based decoding (FENx_MODE = 0) – tON_FAULT_0L low on-time in case of PWM-based decoding (FENx_MODE = 1) and high frequency selected (FENx_FREQ = 0) – tON_FAULT_1L low on-time in case of PWM-based decoding (FENx_MODE = 1) and low frequency selected (FENx_FREQ = 1)
• FENH_LEVEL = FENL_LEVEL = 1 sets the active state to: – High level in case of level-based decoding (FENx_MODE = 0) – tON_FAULT_0H high on-time in case of PWM-based decoding (FENx_MODE = 1) and high frequency selected (FENx_FREQ = 0) – tON_FAULT_1H high on-time in case of PWM-based (FENx_MODE = 1) decoding and low frequency selected (FENx_FREQ = 1) Note: To be robust against common cause failures, it is recommended to apply complementary active states to FENH and FENL. Having selected the active states, the FENH/FENL internal pull-up/pull-down resistors can be programmed accordingly to manage the Hi-Z input condition:
• FENH_PU_PD/FENL_PU_PD = 0 enables the internal pull-up to the 3.3 V internal regulator.
• FENH_PU_PD/FENL_PU_PD = 1 enables the internal pull-down to GND. Note: To prevent inadvertent trigger generation in case of pin loss, it is recommended to select the internal pull-up/pull- down configuration which leads the input signal to the inactive state in case of FENH/FENL pin loss. The decoder output normally holds the inactive level. The block generates an active output level (delayed if delay is set) whenever the switches need to be turned ON in response to a valid trigger detected on FENH/FENL. L9965P Functional description DS14702 - Rev 4 page 26/104

and FENL are detected as valid, the deployment takes place as both HS and LS switches are closed. Table 19. FENx decoder output behavior

0 X X X Low

3.6.1.2 FENH/FENL integrity check

The IC provides diagnostics embedded in the decoder stage aimed at verifying the integrity of the trigger input signals. Their behavior depends on the corresponding signaling mode and configuration:

• In PWM mode (FENx_MODE = 1), the signal integrity is continuously monitored by an internal timer measuring the time interval between rising edges – Signals whose frequency lies within fFENx_PWM_FREQ_TH_xL/fFENx_PWM_FREQ_TH_xH limits are considered valid and their duty-cycle is furtherly evaluated by the decoder to determine whether the pulse corresponds to a fire/no-fire/invalid command (see the Figure 11). – Signals whose frequency is higher than fFENx_PWM_FREQ_TH_xH are considered invalid and the corresponding FENH_HIGH_FREQ / FENL_HIGH_FREQ latch in FENX_INTEGRITY_STATUS register is set (see the Figure 12). – Signals whose frequency is lower than fFENx_PWM_FREQ_TH_xL but still higher than fFENx_PWM_FREQ_TH_xT are considered invalid and the corresponding FENH_LOW_FREQ / FENL_LOW_FREQ latch in FENX_INTEGRITY_STATUS register is set (see the Figure 12). – If the signals frequency drops below fFENx_PWM_FREQ_TH_xT, a timeout condition is acknowledged and the corresponding FENH_PWM_TIMEOUT / FENL_PWM_TIMEOUT latch in FENX_INTEGRITY_STATUS register is set (see the Figure 11). – The above requirements on frequency can be seen also as requirements on times, as shown in the Figure 13. – The internal timeout to check the PWM frequency starts as soon as the FENx_MODE bit is set to 1 and is reset on each rising edge (see the Figure 11 and Figure 12). – “No-fire” and “invalid” signals decrement the NFENx_FAULT_PERIOD fault counter by 1, while “fire” signals increment the NFENx_FAULT_PERIOD by 1. In case of “timeout”, the NFENx_FAULT_PERIOD counter is reset and restarts from 0.
• When in level mode (FENx_MODE = 0), the signal integrity check can be enabled by setting FENH_INT_CHECK_EN = 1/FENL_INT_CHECK_EN = 1 – In this scenario, the IC locks to the FAULTN signal to perform the FENH/FENL integrity check. An internal tFENx_TIMEOUT is started upon FAULTN rising edge and reset after two consecutive edges on the corresponding FENx line. – If the timeout expires, the corresponding FENH_LEV_TIMEOUT/FENL_LEV_TIMEOUT latch in the FENX_INTEGRITY_STATUS register is set (see the Figure 14). Once latched, the fault is cleared, and the correspondent timeout is reset, when the FENH_LEV_TIMEOUT/FENL_LEV_TIMEOUT bit is read. – When the low power strategy is implemented, to detect a possible fault due to timeout expiration, the IC shall be kept awake for a time greater than tFENx_TIMEOUT. This could be done simply by keeping the CWUP pin high for more than tFENx_TIMEOUT, and/or enabling VRCM check and pyro outputs leakage test.
• Alternatively, a manual integrity check can be performed by the MCU, toggling the FENH and FENL input signals and looking at the FENH_ECHO and FENL_ECHO status bits in the FENX_INTEGRITY_STATUS register. L9965P Functional description DS14702 - Rev 4 page 28/104

Figure 14. FENx line integrity check in level mode (example of timeout on FENH)

3.6.1.3 Programmable delay

deployment (see example in the Figure 15). deployment procedure (when both arming conditions are set). The delay is programmed through the FENx_DLY_CFG bit. managed by MCU timers in case of deployment triggered via SPI. Figure 15. Example of two pyro-drivers in a system

3.6.1.4 Pyro-fuse trigger via SPI

• Writing the 0x155 command in the HS_CMD register
• Writing the 0x2AA command in the LS_CMD register HS_CMD and LS_CMD are located at different addresses of the SPI register map so that a sequence of two commands is needed to perform a deployment. The two commands are intentionally different to prevent inadvertent deployment. L9965P Functional description DS14702 - Rev 4 page 31/104

3.6.1.5 FENH/FENL diagnostics

Table 20. FENH/FENL diagnostics

3.6.1.6 FENH/FENL electrical parameters

according to the Table 3; TJ according to the Table 2. Table 21. FENH/FENL decoder electrical parameters

3.6.2 Power stage (PS/PF/PR/PGND)

considered when performing power stage diagnostics and deployment simulations. Figure 16. Pyro-fuse input model

3.6.2.1 Active pull-down on LS

down generator using the PR_PD_DIS bit located in the INTERNAL_CFG register.

3.6.2.2 LS driver deactivation delay

• Limit the LS recirculation energy after fire to ELS_CLAMP;
• Protect the device pins against voltage spikes at the end of a deployment event, clamping the voltage to VLS_CLAMP. No equivalent delay is applied at deployment event start.

3.6.2.3 Pyro-fuse deployment profile

• The I_DEPLOY_CFG field selects the target deploy current level;
• The T_DEPLOY_CFG field selects the target deploy time. L9965P Functional description DS14702 - Rev 4 page 34/104

3.6.2.4 Deployment routine

As soon as the IC enters the ARM state, any ongoing diagnostic is interrupted. proportional to the programmed deployment current value IDEPLOY_xx. One digital current counter is present to count how much time the deployment current stays above IDEP_MON_TH. value of tDEP_MON_TH threshold. Note: If a deployment attempt ends successfully, the pyro-fuse resistance increases to values greater than 100 Ω. confirmation of the fire outcome (FIRE_GOOD bit set). and then the device returns in NORMAL state.

• Measured resistance value above resistance threshold (FIRE_GOOD_SEL = 00)
• Deployment current value above the current monitor threshold for the selected deployment current duration (FIRE_GOOD_SEL = 01)
• Measured resistance value above resistance threshold AND deployment current value above current monitor threshold for the selected deployment current duration (FIRE_GOOD_SEL = 10)
• Fire good signal is never set (FIRE_GOOD_SEL = 11)

Figure 17. Fire good signal selection FAULTN line. Any further deployment is not possible until latched bit is read (clear-on-read bit).

3.6.2.5 Safe operating area

There is no constraint on the selection between different IDEPLOY_XX and tDEPLOY, so it is under user's responsibility to prevent excessive thermal heating in the squib driver section by setting the deploy parameters carefully. The power stage has been sized according to the following recommended combinations:

• IDEPLOY_00 and tDEPLOY = 1050 µs Profile valid for 8.4 V ≤ VPS ≤ 27.3 V (VPS,min = 8.4 V considering max resistance contribute)
• IDEPLOY_01 and tDEPLOY = 750 µs Profile valid for 9.8 V ≤ VPS ≤ 27.3 V (VPS,min = 9.8 V considering max resistance contribute)
• IDEPLOY_10 and tDEPLOY = 550 µs Profile valid for 11.2 V ≤ VPS ≤ 27.3 V (VPS,min = 11.2 V considering max resistance contribute)
• IDEPLOY_11 and tDEPLOY = 250 µs Profile valid for 19.6 V ≤ VPS ≤ 27.3 V (VPS,min = 19.6 V considering max resistance contribute) The power stage is not sized to stand a deployment event with PF pin shorted to ground. So, if this scenario is expected, the maximum operating voltage on PS pin should be reduced accordingly to chosen deployment profile:
• IDEPLOY_00 and tDEPLOY = 1050 µs This profile is valid for 6 V ≤ VPS ≤ 23 V
• IDEPLOY_01 and tDEPLOY = 750 µs This profile is valid for 6 V ≤ VPS ≤ 23 V
• IDEPLOY_10 and tDEPLOY = 550 µs This profile is valid for 6 V ≤ VPS ≤ 22 V
• IDEPLOY_11 and tDEPLOY = 250 µs Not tolerated The effective deployment time tDEP_EFF (time interval in which the deployment current value is above 90% of the programmed target value IDEPLOY_xx) can be calculated as follows: t DE P _ E F F = t DE PL OY − t DE P _ D LY = DEP _ TIME _ x × t D EPL OY _ RES − t DE P _ D L Y (2) Where:
• DEP_TIME_x * tDEPLOY_RES is the equivalent time of the programmed deployment duration counter value.
• tDEP_DLY is the delay time between the actual receiving of the deployment start signal (SPI CS rising edge or FENH and FENL acknowledge) and the rising deployment current value reaching 90% of the programmed target value.

3.6.2.6 Deployment auto-retry

The IC offers the possibility of performing multiple fire attempts in case the first one fails:

• The HS_RET_CFG bit field configures the maximum number of deployment attempts.
• The HS_RET_DLY_CFG bit field configures the interval between consecutive retry attempts. If one of the following conditions occurs, the auto-retry is stopped:
• FIRE_GOOD is set following a successful deployment.
• The maximum number of attempts (configured by HS_RET_CFG bit field) is exceeded without a successful deployment. The FIRE_GOOD_SEL = 11 case is useful in test case scenario where the Pyro igniter is replaced by a dummy load: multiple deployments are performed and their number is limited by the configured maximum number of retries. Note: The time between two retries is the bigger between the resistance measurement time and the interval time defined by HS_RET_DLY_CFG bit field in NVM. If, once reached the maximum number of attempts, the deployment condition is still present (FENH and FENL signals still in active state), another retry routine is performed after a minimum delay time of tRET_ROUTINE_DLY. The number of performed deployments is readable in the DEPLOY_CNT bit field in the DEPLOY_STATUS register. L9965P Functional description DS14702 - Rev 4 page 36/104

3.6.2.7 Deployment electrical parameters

according to the Table 3; TJ according to the Table 2. Table 22. Deployment electrical parameters

Symbol Parameter Test condition Min Typ Max Unit Pin EHS_DEPLOY_2 High side switch deployment energy capability Single event, VPS = 27.3 V IDEP = 2.23 A, tON = 851 µs RdsON_LS = 0 Ω, RWIRE = 0.1 Ω RPYRO = 1.7 Ω, TJ,START = 135 - - 44.2 mJ PS, PF EHS_DEPLOY_3 Single event, VPS = 27.3 V IDEP = 2.55 A, tON = 630 µs RdsON_LS = 0 Ω, RWIRE = 0.1 Ω RPYRO = 1.7 Ω, TJ,START = 135 - - 36.5 mJ PS, PF EHS_DEPLOY_4 Single event, VPS = 27.3 V IDEP = 4.46 A, tON = 289 µs RdsON_LS = 0 Ω, RWIRE = 0.1 Ω RPYRO = 1.7 Ω, TJ,START = 135 - - 24.9 mJ PS, PF RdsON_HS HS switch ON resistance ISINK = 100 mA - - 1 Ω PS, PF RdsON_LS LS switch ON resistance ISOURCE = 100 mA - - 1 Ω PR, PGND LWIRE Pyro-fuse wire load inductance Application information - - 36 µH PF, PR LEMI Pyro-fuse input EMI filter Application information - - 7.7 µH PF, PR RWIRE Pyro-fuse wire load resistance Application information - - 1.1 Ω PF, PR CPYRO Pyro-fuse differential capacitance between input contacts Application information - - 100 nF PF, PR RPYRO Pyro-fuse igniter resistance Application information 1.7 - 2.5 Ω PF, PR RPYRO_POST_0 Pyro-fuse igniter resistance threshold post deployment VRES_POST_TH = 0 - 99 - Ω PF, PR RPYRO_POST_1 VRES_POST_TH = 1 - 49 - Ω PF, PR CESD PF/PR PCB connector input capacitance for ESD/EMI Application information 13 22 138 nF PF, PR NHS_RET_00 HS deployment attempts HS_RET_CFG = 00 - 1 - times PR, PGND NHS_RET_01 HS_RET_CFG = 01 - 2 - times PR, PGND NHS_RET_10 HS_RET_CFG = 10 - 3 - times PR, PGND NHS_RET_11 HS_RET_CFG = 11 - 4 - times PR, PGND tHS_RET_00 HS delay between retry attempts HS_RET_DLY_CFG = 00 0.46 0.5 0.54 ms PR, PGND tHS_RET_01 HS_RET_DLY_CFG = 01 0.92 1 1.08 ms PR, PGND tHS_RET_10 HS_RET_DLY_CFG = 10 1.38 1.5 1.62 ms PR, PGND L9965P Functional description DS14702 - Rev 4 page 38/104

3.7 Diagnostic routine

guaranteeing the ASIL targets on deployment and non-deployment. Figure 18. Diagnostic routine corresponding fault flag is set and the FAULTN line is asserted.

3.7.1 Routine execution modes

Every time the routine is triggered, the FSM moves to the DIAG state.

• On-demand: triggered by MCU
• Cyclic: autonomously triggered by an internal timer or triggered by an external CWUP pulse The two execution modes are mutually exclusive: on-demand triggers cannot interrupt cyclic executions and vice- versa.

3.7.1.1 On-demand

This strategy is available every time the IC is in a NORMAL state.

1. Writing ABIST = 1 enables the ABIST (analog built-in self-test).
2. Writing ADC_HWSC = 1 enables the HWSC (hardware self-check).
3. Writing VRCM_LEAK_TEST = 1 enables the VRCM check and the pyro outputs leakage test.
4. Writing PYRO_RES = 1 enables the pyro igniter resistance measurement.
5. Writing FET_TEST = 1 enables the pyro deployment FETs test. This test includes the VRCM check and the
6. Writing ER_CAP = 1 enables the ER capacitor diagnostic.

completed, the SPI_DIAG_END bit is set to 1. field in CYCLIC_DIAG_STATUS register.

3.7.1.2 Cyclic

• When in full power mode (CWUP = 1, static), the periodicity can be configured programming the tDIAG_ROUTINE_PERIOD_XXX time.
• When in low power mode (periodic CWUP triggers), the periodicity is given by the CWUP signal. L9965P Functional description DS14702 - Rev 4 page 39/104

• ADC_HWSC_EN = 1 schedules the HWSC for cyclic execution – ADC_HWSC_NCYCLE field specifies the periodicity of execution
• LEAK_EN = 1 schedules the VRCM check and pyro outputs leakage test for cyclic execution – LEAK_NCYCLE field specifies the periodicity of execution
• PYRO_RES_EN = 1 schedules the pyro igniter resistance measurement for cyclic execution – PYRO_RES_NCYCLE field specifies the periodicity of execution
• FET_EN = 1 schedules the pyro deployment FETs test for cyclic execution – FET_NCYCLE field specifies the periodicity of execution
• ER_CAP_EN = 1 schedules the ER capacitor diagnostic for cyclic execution – ER_CAP_NCYCLE field specifies the periodicity of execution The NVM configuration guarantees the execution of the diagnostics (CYC_DIAG_RUNNING in CYCLIC_DIAG_STATUS register set to 1) even in the absence of MCU supervision. The routine is executed only after the NVM has been downloaded. When the device is in full power, a new routine is inhibited if a fail in integrity check occurs (CYC_CFG_CRC_FAIL bit set). The internal cycle counter CYC_DIAG_NCYCLE bit field is incremented at the end of each diagnostic sweep. In case it reaches saturation, it rolls over restarting from zero.

3.7.2 Routine steps

The following sections list all the diagnostic steps performed during the diagnostic routine.

3.7.2.1 ABIST (analog built-in self-test)

This step aims at verifying the proper behavior of analog comparators. In cyclic diagnostic it is not possible to disable the ABIST, so it runs at every cycle. In case of fault, the ABIST_FAIL bit in the INTERNAL_STATUS register is set and the FAULTN pin is asserted. The ABIST diagnostic step duration is tABIST. Note: In cyclic diagnostic the ABIST cannot be disabled, so it runs at every cycle.

3.7.2.2 HWSC (hardware self-check)

This step aims at verifying the integrity of conversion paths from an input to the ADCs.

• PF vs PR to check the integrity of differential measurement pre-deployment.
• PF vs PR to check the integrity of differential measurement post-deployment.
• VRCM vs PGND to check the integrity of VRCM measurement. This test does not require any previous diagnostic to be safely executed.

Figure 19. Differential ADC HWSC

error (vs VOFFSET_HWSC_TH) and ADC gain (vs VGAIN_HWSC_TH). The HWSC diagnostic step duration is tHWSC. Table 23. ADC HWSC diagnostics

3.7.2.3 VRCM check

This step aims at diagnosing the voltage regulator/current monitor (VRCM) works properly. out of range. To achieve safety targets, it is strongly recommended to apply such strategy before running this test. Figure 20. VRCM test

• STB check: – The IPF_PU generator is connected to PF pin. – The VRCM is connected to PF pin. – If the VRCM works properly the VRCM_STB_FAIL flag remains zero.
• STG check: – The IPR_PD generator is connected to PR pin. – The VRCM is connected to PR pin. – If the VRCM works properly the VRCM_STG_FAIL flag remains zero. This test allows to check the ILEAK_SOURCE_TH and ILEAK_SINK_TH current thresholds. The VRCM check diagnostic step duration is tVRCM_CHECK. L9965P Functional description DS14702 - Rev 4 page 42/104

Table 24. VRCM STB/STG diagnostics

3.7.2.4 Pyro outputs leakage test

This step aims at verifying that PF/PR pins are floating, with no parasitic leakage towards battery or ground. safety targets, it is strongly recommended to apply such a strategy before running this test. Figure 21. Pyro outputs leakage test

• PF leakage test: – The VRCM is connected to PF and starts charging the PF node to VVRCM_REF. – If no leakage is present, the voltage on PF pin is VVRCM_REF and no current is sunk or sourced by the VRCM. – If there is a leakage to battery, the VRCM sinks current trying to force VVRCM_REF. If the sunk current is greater than ILEAK_SINK_TH for tVRCM_LEAK_FLT, the PF_STB flag is set. – If there is a leakage to the ground, the VRCM sources current trying to force VVRCM_REF. If the sourced current is greater than ILEAK_SOURCE_TH for tVRCM_LEAK_FLT, the PF_STG flag is set.
• PR leakage test: – The VRCM is connected to the PR and starts charging the PR node to VVRCM_REF. – If no leakage is present, the voltage on PR pin is VVRCM_REF and no current is sunk or sourced by the VRCM. – If there is a leakage to battery, the VRCM sinks current trying to force VVRCM_REF. If the sunk current is greater than ILEAK_SINK_TH for tVRCM_LEAK_FLT, the PR_STB flag is set. – If there is a leakage to ground, the VRCM sources current trying to force VVRCM_REF. If the sourced current is greater than ILEAK_SOURCE_TH for tVRCM_LEAK_FLT, the PR_STG flag is set. The leakage test diagnostic step duration is tLEAK_TEST. L9965P Functional description DS14702 - Rev 4 page 44/104

Table 25. PR/PF leakage diagnostics

3.7.2.5 Pyro igniter resistance measurement

This step aims at measuring the pyro-fuse igniter circuit resistance and verifying that it lays within safety-limits. achieve safety targets, it is strongly recommended to apply such a strategy before running this test. Figure 22. Pyro igniter resistance measurement

• The IPF_PU and IPR_PD currents are enabled, so that a IPF_PU current flows through PF and PR.
• The IC waits for the differential voltage settling between PF and PR.
• The ADC converts the PF vs PR differential voltage and compares the obtained VPYRO result to the VRES_LOW_TH and VRES_HIGH_TH limits.
• The IPF_PU and IPR_PD currents are disabled. The pyro resistance sensitivity can be computed as follows: R PY RO = V PY RO I PF PU ∂ R P YRO ∂ V PYR O = 1 I PF PU = 25 Ω V ≅ 16.275 m Ω L SB (3) The VRES_LOW_TH and VRES_HIGH_TH thresholds can be programmed in NVM respectively in VRES_LOW_TH and VRES_HIGH_TH bit fields. The result is saved in the RES_MEAS_PRE register. The resistance measurement diagnostic step duration is tRES_MEAS. L9965P Functional description DS14702 - Rev 4 page 46/104

Table 26. Pyro igniter diagnostics

3.7.2.6 Pyro deployment FETs test

This step aims at verifying that HS and LS FETs can be switched ON/OFF. targets, it is strongly recommended to apply such a strategy before running this test. Figure 23. HS/LS deployment FETs test

• PF (HS) switch test: – The VRCM is connected to PF pin. – The HS FET is turned ON. – The VRCM sinks current trying to maintain VVRCM_REF. – If the FET is working properly, this current exceeds the threshold ILEAK_SINK_TH for the filter time tFET_TEST_FLT, the PF_FET_STB flag is set and the HS FET is turned off immediately.
• PR (LS) switch test: – The VRCM is connected to PR pin. – The LS FET is turned ON. – The VRCM sources current trying to maintain VVRCM_REF. – If the FET is working properly, this current exceeds the threshold ILEAK_SOURCE_TH for the filter time tFET_TEST_FLT, the PR_FET_STG flag is set and the LS FET is turned off immediately. The FETs test diagnostic step duration is tFET_TEST. In both tests the current on PF and PR pins will not exceed the VRCM current limits IVRCM_SOURCE_LIM or IVRCM_SINK_LIM. During FETs test, energy available to the load is limited to less than EFET_TEST. L9965P Functional description DS14702 - Rev 4 page 48/104

Table 27. HS/LS FETs diagnostics

Table 28. FETs test results

3.7.2.7 ER capacitor diagnostic

• Effective capacitance value of CERBST electrolytic capacitor.
• Equivalent series resistance (ESR) of CERBST electrolytic capacitor.

Figure 24. ER capacitor diagnostic measuring the voltage drop on ERBST pin and current flowing in RERDCHSW.

Figure 25. ER cap discharge path the current used during the discharge phase of the ER capacitor diagnostic.

• For the device itself when it enters the DEEP-SLEEP state.
• For deployment event when the IC enters ARM state.
• For ER cap diagnostic when the IC enters DIAG state. Note: There is no constraint between the ERBST enable and the ERDCHSW enable, so it is under the user's responsibility to prevent a possible conflict and avoid an excessive thermal heating in the integrated ER discharge switch. The ER discharge switch has an overcurrent protection feature performed through a voltage comparator that monitors the VDS voltage of the switch. When the voltage on ERDCHSW pin exceeds VERDCHSW_OV_H for a time longer than tERDCHSW_FLT, the switch is disabled, the FAULTN pin goes low and the ERDCHSW_OV bit in the ERCAP register is set to 1. The switch is reenabled if the voltage on ERDCHSW pin is lower than VERDCHSW_OV_L for a time longer than tERDCHSW_FLT (fault is considered as disappeared) and the ERDCHSW_OV bit is read and cleared. Referring to a simplified schematic of the Figure 25, typical VERBST and VERDCHSW discharge profiles are shown in the Figure 26. L9965P Functional description DS14702 - Rev 4 page 51/104

Figure 26. ER cap discharge pins voltage profiles measurement, one for current measurement.

• Capacitance threshold via ERCAP_C_THR[7:0] bit field in NVM, precalculated by the user using the following formula: C μF = "00"& E RC AP _ C _ T HR 7 : 0 & "0000 " × L SB C R E RDC HSW (4)
• ESR threshold via and ERCAP_ESR_THR[6:0] bit field in NVM, precalculated by the user using the following formula: E SR m Ω = E RC AP _ E SR _ THR 7 : 0 &"0000 " × LS B ES R × R ERD C HSW 1000 (5) To reduce the noise during the measurement step, the ERBST is automatically disabled during the ER capacitor diagnostic (see the Figure 27). L9965P Functional description DS14702 - Rev 4 page 52/104

Figure 27. ERBST management during ER cap diag CAP_VALUE[13:0] and ESR_VALUE[12:0] bit fields. ERCAP_DIAG_END_TO flag is set in the ERCAP register. ERCAP_DIAG_ESR_READ_1 registers. in NVM, respectively ERCAP_C_THR and ERCAP_ESR_THR.

• If CAP_VALUE[13:0] < (“00” & ERCAP_C_THR[7:0] & “0000”), and ERCAP_LOW_C flag is set in the ERCAP register.
• If ESR_VALUE[12:0] > (ERCAP_ESR_THR[6:0] & “0000”), and ERCAP_HIGH_ESR flag is set in the ERCAP register. Note: A high threshold is defined for capacitance value and a low threshold for ESR since, due to aging and thermal stress, an electrolytic capacitor over the years shows a decrease of the capacitance value and an increase of the ESR. Knowing RERDCHSW, the MCU can check C and ESR calculation values as follows: C = C A P _ V A LU E 13 : 0 × L SB C × 1 R ERD CHS W (6) E SR = ESR _ V A LU E 12 : 0 × L SB ESR × R E RDC HSW (7) Once started, the ER capacitor diagnostic process can only be interrupted by a deployment request. Once a request is over, to proceed with a new one the ER_CAP bit must be left at 1 and the DIAG_START bit in the DIAG_CMD register must be set back to 1 (it returns automatically to 0). The ER capacitor diagnostic step duration is dependent on the capacitor value, as specified by tER_CAP_DIAG1 and tER_CAP_DIAG2. The possible results of ER capacitor diagnostics are reported in the Table 29. L9965P Functional description DS14702 - Rev 4 page 53/104

Table 29. ER capacitor diagnostics

3.7.3 Diagnostic routine electrical parameters

All parameters are tested and guaranteed in the following conditions, unless otherwise noted: all supplies according to the Table 3; TJ according to the Table 2. Table 30. Diagnostic routine electrical parameters

Application information

Detection is guaranteed below minimum No detection is guaranteed above maximum 15 - 48 kΩ PF, PR L9965P Functional description DS14702 - Rev 4 page 55/104

Symbol Parameter Test condition Min Typ Max Unit Pin tLEAK_TEST Leakage test time duration - - 1.6 ms PF, PR tRES_MEAS Pyro igniter resistance measurement time duration - - 0.6 ms PF, PR VRES_LOW_TH Pyro igniter resistance low threshold (7 bit) VRES_LOW_TH = 4 * VADC_LSB_0 * CODE Guaranteed by SCAN 0 - 1.21 V PF, PR VRES_HIGH_TH Pyro igniter resistance high threshold (7 bit) VRES_LOW_TH = 4 * VADC_LSB_0 * CODE Guaranteed by SCAN 0 - 1.21 V PF, PR ERRTOT_PRM Pyro igniter resistance measurement total error -8 - 8 % PF, PR tFET_TEST_FLT Deglitch filter time for STB/STG detection during FETs test 0.85 1 1.15 µs PF, PR tFET_TEST_TO LS/HS FET test timeout 190 200 210 µs PF, PR tFET_TEST FET test time duration - - 0.2 ms PF, PR EFET_TEST Energy transferred to load during FETs test Design info - - 170 µJ PF, PR RDSON_ERDCHSW ER discharge switch ON resistance IERDCHSW = 0.5 A 0.25 - 2.2 Ω ERDCHSW VERDCHSW_OV_H ER discharge switch VDS monitor overvoltage threshold Low to high 3.4 - 3.8 V ERDCHSW VERDCHSW_OV_L ER discharge switch VDS monitor overvoltage threshold High to low 3.0 - 3.4 V ERDCHSW tERDCHSW_FLT ER discharge switch filter time 8 10 12 µs ERDCHSW VDCH VERBST-VERDCHSW input differential measurement range ER cap diagnostic 15 - 30 V ERBST ERDCHSW VDCH_LSB VERBST-VERDCHSW input differential measurement LSB ER cap diagnostic - 8.8 - mV ERBST ERDCHSW VDCH_ACC VERBST-VERDCHSW voltage measurement accuracy

15 V < VERBST – VERDCHSW <

30 V -5 - 5 % ERBST

NDCH_INTG_BIT Integral of VERBST- VERDCHSW internal number of bits Design info - 12 - bit ERBST ERDCHSW ΔVER ER cap discharge voltage range during ER cap diagnostic Design info 0 - 1.15 V ERBST ΔVER_LSB ER cap discharge voltage LSB during ER cap diagnostic Dedicated 12-bit ADC to directly convert differential voltage - 352 - µV ERBST ΔVER_ACC ER cap discharge voltage measurement accuracy Dedicated 12-bit ADC to directly convert differential voltage -70 - +70 mV ERBST L9965P Functional description DS14702 - Rev 4 page 56/104

Symbol Parameter Test condition Min Typ Max Unit Pin ΔVER_CAP ER cap discharge voltage due to capacitance 0.4 - 0.7 V ERBST ΔVER_ESR ER cap discharge voltage due to ESR Design info 0.1 - 0.45 V ERBST tER_CAP_DIAG1 ER cap diag total running time Design info with 100 µF VERBST = 20 V, RDCHG = 62 Ω - 0.63 - ms ERBST ERDCHSW tER_CAP_DIAG2 ER cap diag total running time Design info with 1.2 mF VERBST = 20 V, RDCHG = 62 Ω - 2.3 - ms ERBST ERDCHSW LSBESR ESR/RERDCHSW Design info - 38.52 - m - LSBC RERDCHSW*CER Design info - 25.35 - mF*W - tS_ER_CAP Sample time of each conversion on voltage ADCs Design info - 64 - ms - tLOCK_ER Time needed for tSTART conversion Design info - 464 - ms - tER_MEAS_DELAY Time to reach steady state after ERDCHSW enabled Design info - 64 - ms - tER_CAP_DIAG_TO ER cap diag timeout Design info - - 25 ms -

3.8 Voltage ADC

The IC implements a multichannel, fully differential 10-bit ADC for internal and external voltage measurements. The ADC supports the following 7 inputs:

• PS, PF, PR, PGND, used for on-demand conversions and by the diagnostic routine
• VRCM, used by the diagnostic routine
• ERBST, used for on-demand conversions and by the diagnostic routine
• GND, used for on-demand conversions and by the diagnostic routine The ADC is designed to convert any of the following 7 paths:
• PS vs PGND
• PF vs PGND
• PR vs PGND
• PF vs PR in high resolution (pre-deployment), with IPF_PU and IPR_PD enabled
• PF vs PR in low resolution (post deployment), with IPF_PU and IPR_PD enabled
• ERBST vs GND
• VRCM vs GND (VRCM enabled) The ADC conversion formula is the following: V ADC = L SB × C OD E (8) Where LSB is VADC_LSB_x (according to conversion requested) and CODE is a 10-bit signed word. L9965P Functional description DS14702 - Rev 4 page 57/104

3.8.1 Measurement trigger modes

• On-Demand, triggered by MCU writing ADC_CONV_CMD bit equal to 1 and configuring the input channel with the AMUX_CONF bit field in the same command frame (see the Table 31): – This type of request does not move the FSM to DIAG state. – Results of the on-demand ADC conversions are available in the ADC_CONV_RESULT register when ADC_CONV_RDY bit is set to 1. – If the ADC is just busy, the ADC_BUSY bit is set to 1.
• Cyclically: – In full-power mode (CWUP = 1, static), the diagnostic routine runs every tDIAG_ROUTINE_PERIOD. The voltage ADC is involved in some diagnostic steps (if such steps are enabled). – In low-power mode (periodic CWUP pulses), the diagnostic routine is executed at every wake‑up. – These types of requests move the FSM to DIAG state.
• Asynchronously: – If the FSM moves to the ARM state, the ADC is used for post-deployment resistance measurement if selected as the FIRE_GOOD source. – The result of this conversion is reported in the RES_MEAS_POST register. Conflict between multiple triggers is managed as follows:
• If the FSM is in DIAG state (either triggered by CWUP in low-power mode or triggered by the MCU in full- power mode), on-demand triggers are discarded. Note: When in low-power mode, the FSM moves to DIAG upon cyclic powerups. Hence, the cyclic execution of the diagnostic routine is guaranteed by design.
• If an on-demand conversion is being performed, the cyclic execution of the diagnostic routine is skipped and it will be performed upon the next useful trigger period.
• In any case, if the FSM moves to the ARM state, any ongoing conversion is interrupted and the ADC will be set up for post-deployment resistance measurement. This deployment trigger has the highest priority.

Table 31. ADC input channel selection for on-demand conversions

000 PS vs PGND

001 PF vs PGND

010 PR vs PGND

011 PF vs PR (high resolution - pre deployment)

100 PF vs PR (low resolution - post deployment)

101 ERBST vs GNDx

110 VRCM vs PGND

111 Not used

The ADC LSB is rescaled according to the selected channel and to the diagnostic steps.

3.8.2 Voltage ADC electrical parameters

according to the Table 3; TJ according to the Table 2. Table 32. Voltage ADC electrical parameters

1. The min voltage for ERBST voltage measurement is 4.7 V (below the device is off).
2. Single shot samples are characterized by a superimposed Gaussian noise, with zero-mean and standard deviation.

3.9 Oscillators

This section describes the device oscillators.

3.9.1 Main oscillator and aux oscillator

The main oscillator operates at fMAIN_OSC and is disabled in DEEP-SLEEP state. The aux oscillator operates at fSTBY_OSC and is disabled in DEEP-SLEEP state.

3.9.1.1 Oscillators electrical parameters

according to the Table 3; TJ according to the Table 2. Table 33. Main oscillator electrical parameters

3.9.2 Oscillator monitor

INTERNAL_STATUS register is set and any pyro-fuse deployment is inhibited by the “fire inhibit” signal. moves to OFF state and then to DEEP-SLEEP.

3.9.2.1 Diagnostics

Table 34. Oscillator monitor diagnostics

3.9.2.2 Oscillators diagnostics electrical parameters

according to the Table 3; TJ according to the Table 2. Table 35. Oscillator monitor electrical parameters

3.10 GPIOs

• CWUP, FENH, FENL, SCK, NCS are digital inputs whose receivers are available in every device state.
• SDI is a digital input whose receiver is available in DIAG, NORMAL and ARM states.
• FAULTN is an open-drain whose output buffer is available in DIAG, NORMAL and ARM states.
• SDO is a push-pull whose output buffer is available in DIAG, NORMAL and ARM states.

3.10.1 GPIOs electrical parameters

according to the Table 3; TJ according to the Table 2. Table 36. GPIOs electrical parameters

3.11 Internal monitors

deployment is inhibited by the “fire inhibit” signal.

• In case an OV event occurs, FAULTN pin is asserted and the V3V3_SLEEP_OV bit in the INTERNAL_STATUS register is set, but the deployment is not inhibited.
• In case an UV event occurs, FAULTN pin is asserted and V3V3_SLEEP_UV bit in INTERNAL_STATUS register is set, but the deployment is not inhibited. In case there is a supply loss meanwhile the IC is in DEEP-SLEEP state, the NPOR_SLEEP_EVENT bit in the INTERNAL_STATUS register is set.

3.12 Die temperature (TJ) monitor

3.12.1 Die temperature monitor electrical parameters

according to the Table 3; TJ according to the Table 2. Table 37. Die temperature monitor electrical parameters

3.13 Ground loss monitor (GNDMON)

3.13.1 Ground loss monitor diagnostics

Table 38. Ground loss monitor diagnostics

3.13.2 Ground Loss monitor electrical parameters

according to the Table 3; TJ according to the Table 2. Table 39. Ground Loss monitor electrical parameters

3.14 Serial peripheral interface (SPI)

The IC integrates a Serial Peripheral Interface (SPI) to communicate with host controller. Internal pullup resistors address open failures on SDI, NCS and SCLK pins. Table 40. SPI quick look The protocol implements a Global Status Word (GSW) providing info on NVM status and FAULTN signal. The frame format is shown in the Table 41. Table 41. SPI frame format

• [23] bit: R/W flag selects if the current operation is a read (0) or write (1) operation
• [22-17] bit field: SPI register address
• [16-15] bit field: reserved, fixed to 00
• [14-5] bit field: data write
• [4-0] bit field: CRC checksum generated by SPI controller MISO frame:
• [23] bit: SPI error flag: the previous frame has an error due to length (long or short), stuck, wrong CRC, wrong command or wrong address
• [22-17] bit field: SPI register address feedback. Last received valid frame address feedback
• [16-15] bit field: global status word (GSW), provides information related to NVM status and IC high level error (NVM_BUSY on bit 16, FAULTN_ECHO on bit 15)
• [14-5] bit field: data read
• [4-0] bit field: CRC checksum generated by SPI The following errors can be detected and the correspondent error flag is set in SPI_STATUS register:
• Frame with less than 24 bits. The SPI_FRAME_SHORT bit is set.
• Frame with more than 24 bits. The SPI_FRAME_LONG bit is set.
• Frame with a wrong CRC. The SPI_CRC_ERROR bit is set.
• Frame with a wrong address. The SPI_ADDRESS_ERROR bit is set.
• Frame with an error (OR of previous errors). The SPI_FRAME_ERROR bit is set. L9965P Functional description DS14702 - Rev 4 page 64/104

3.14.1 SPI electrical parameters

according to the Table 3; TJ according to the Table 2. Figure 28. SPI timing diagram Table 42. SPI electrical parameters

3.14.2 SPI register map

Table 43. SPI register map

Register name Address Non volatile ADC_CONV_CMD 0x05 - ADC_CONV_RESULT 0x06 - CRC 0x07 - DEPLOY_STATUS 0x08 - DEPLOY_DIAG_STATUS_0 0x09 - DEPLOY_DIAG_STATUS_1 0x0A - ERCAP 0x0B - ERCAP_DIAG_CAP_READ_0 0x0C - ERCAP_DIAG_CAP_READ_1 0x0D - ERCAP_DIAG_ESR_READ_0 0x0E - ERCAP_DIAG_ESR_READ_1 0x0F - INTERNAL_STATUS 0x10 - SPI_STATUS 0x11 - FENX_INTEGRITY_STATUS 0x12 - CYCLIC_DIAG_STATUS 0x13 - ERBOOST 0x14 - INTERNAL_CFG 0x15 - RES_MEAS_PRE 0x16 - RES_MEAS_POST 0x17 - DEPLOY_CURRENT_MONITOR 0x18 - TEMPERATURE 0x19 - CLIENT_NVM_REG_0 0x20 x CLIENT_NVM_REG_1 0x21 x CLIENT_NVM_REG_2 0x22 x CLIENT_NVM_REG_3 0x23 x CLIENT_NVM_REG_4 0x24 x CLIENT_NVM_REG_5 0x25 x CLIENT_NVM_REG_6 0x26 x CLIENT_NVM_REG_7 0x27 x CLIENT_NVM_REG_8 0x28 x CLIENT_NVM_REG_9 0x29 x CLIENT_NVM_REG_10 0x2A x CLIENT_NVM_REG_11 0x2B x CLIENT_NVM_REG_12 0x2C x SPECIAL_KEY 0x30 NVM_OP_CMD 0x31 HS_CMD 0x32 LS_CMD 0x33 L9965P Functional description DS14702 - Rev 4 page 66/104

3.14.2.1 SPI read/write registers

Note: • nPOR_MAIN is asserted when the IC moves from ACTIVE to DEEP-SLEEP.

• nPOR_SLEEP is used to retain data in DEEP-SLEEP state, and it is asserted when the battery is removed.

Table 44. BMS_ID - 0x00 Table 45. CHIP_ID - 0x01 Table 46. FAULT_DIAG_CONFIG - 0x02 Table 47. FENH_L_CONFIG - 0x03

Table 48. DIAG_CMD - 0x04 Table 49. ADC_CONV_CMD - 0x05 Table 50. ADC_CONV_RESULT - 0x06

Table 51. CRC - 0x07 Table 52. DEPLOY_STATUS - 0x08

Table 53. DEPLOY_DIAG_STATUS_0 - 0x09 Table 54. DEPLOY_DIAG_STATUS_1 - 0x0A

Table 55. ERCAP - 0x0B Table 56. ERCAP_DIAG_CAP_READ_0 - 0x0C Table 57. ERCAP_DIAG_CAP_READ_1 - 0x0D Table 58. ERCAP_DIAG_ESR_READ_0 - 0x0E Table 59. ERCAP_DIAG_ESR_READ_1 - 0x0F

Table 60. INTERNAL_STATUS - 0x10 Table 61. SPI_STATUS - 0x11

Table 62. FENX_INTEGRITY_STATUS - 0x12 Table 63. CYCLIC_DIAG_STATUS - 0x13 cycle (restart after 64 cycles).

Table 64. ERBOOST - 0x14 Table 65. INTERNAL_CFG - 0x15 Table 66. RES_MEAS_PRE - 0x16 Table 67. RES_MEAS_POST - 0x17

Table 68. DEPLOY_CURRENT_MONITOR - 0x18 Table 69. TEMPERATURE - 0x19 Table 70. CLIENT_NVM_REG_0 - 0x20

Table 71. CLIENT_NVM_REG_1 - 0x21 Table 72. CLIENT_NVM_REG_2 - 0x22

Table 73. CLIENT_NVM_REG_3 - 0x23 Table 74. CLIENT_NVM_REG_4 - 0x24

Table 75. CLIENT_NVM_REG_5 - 0x25 Table 76. CLIENT_NVM_REG_6 - 0x26

Table 77. CLIENT_NVM_REG_7 - 0x27 Table 78. CLIENT_NVM_REG_8 - 0x28 Table 79. CLIENT_NVM_REG_9 - 0x29

Table 80. CLIENT_NVM_REG_10 - 0x2A Table 81. CLIENT_NVM_REG_11 - 0x2B Table 82. CLIENT_NVM_REG_12 - 0x2C Table 83. SPECIAL_KEY - 0x30

Table 84. NVM_OP_CMD - 0x031 Table 85. HS_CMD - 0x32 Table 86. LS_CMD - 0x33

3.15 Configuration Lock

bold in this document, such register map sectors are protected by a lock field. By default, SRR/SLR registers are locked.

1. MCU writes 0x55 in the SPECIAL_KEY register to enter in partial unlock.
2. MCU writes 0x33 in the SPECIAL_KEY register to confirm the full unlock.
3. MCU changes any configuration register within tCFG_TIMEOUT.
4. MCU reapplies the lock writing 0xAA in the SPECIAL_KEY.

If the tCFG_TIMEOUT expires, the lock is automatically reapplied. Trying to write a protected register (SRR or SLR) without unlocking will result in the data being discarded. non-volatile memory (NVM), as described in the dedicated section.

• For temporary modifications to the IC configuration, which do not need to be pushed in the non-volatile memory, it is recommended to disable the configuration integrity check (CONF_CRC).

3.15.1 Configuration lock electrical parameters

according to the Table 3; TJ according to the Table 2. Table 87. Configuration Lock electrical parameters

3.16 Software reset (SW_RST)

It is possible to reset the configuration of the device sending a SW_RST sequence. fault flags and lock protected bit fields.

1. MCU writes 0xE1 into the SPECIAL_KEY register to enter partial reset mode.
2. MCU writes 0x1E into the SPECIAL_KEY register to confirm the reset.

Frames must be sent exactly in this sequence, otherwise registers will not be reset. User software can eventually trigger a redownload of the configuration from the non-volatile memory (NVM). the memory with a “write” instruction. Otherwise, the old configuration will be restored at the next wake-up event.

3.17 Configuration integrity check (CONF_CRC)

tCONF_CRC_PERIOD, while no operation on the NVM is being performed (NVM circuit in reset state). The duration of the calculation is tCONF_CRC_TIME.

• In case trimming/calibration data has failed the CRC signature check, CYC_TRIM_CAL_CRC_FAIL latch is set (clear-upon-read).
• In case IC configuration data has failed the CRC signature check, CYC_CFG_CRC_FAIL latch is set (clear-upon-read).
• In both cases, the deployment is inhibited and FAULTN is asserted but there is no interruption/inhibition of other IC functionalities. In case of permanent data corruption, failure latch set pulse occurs every tCONF_CRC_PERIOD. The local register CRC signature is managed in the following way:
• Every time NVM data is downloaded into local registers (either automatically or user-driven), a CRC signature is refreshed as well and written in the CLIENT_CONFIG_CRC bit field.
• Every time the user changes the local register data, the corresponding CRC signature is not automatically updated, thus a CRC check failure is expected at the next execution cycle. By the way, as the user triggers the NVM upload and refresh operation, after the NVM sector CRC has been automatically updated, the local register CRC signature is updated accordingly and no further CRC check failure is expected. The integrity check can be disabled by setting CYC_CRC_DIS = 1. After the diagnostic has been disabled, it is still possible to clear-upon-read both CYC_TRIM_CAL_CRC_FAIL and CYC_CFG_CRC_FAIL. Disabling such diagnostic can be useful to mask systematic CRC failure detection when updating IC configurations. The deployment inhibition is removed. On the other hand, leaving it enabled while updating register configurations may be used as a fault injection strategy to assess the correct functionality of the diagnostics.

3.17.1 Configuration integrity check electrical parameters

according to the Table 3; TJ according to the Table 2. Table 88. Configuration integrity check characteristics

3.18 Non-volatile memory (NVM)

The IC allows saving key configuration parameters in the internal NVM.

3.18.1 NVM read/write operations

NVM data is automatically downloaded into local registers every time that the IC FSM transitions from the OFF state to the DEEP-SLEEP state. When the IC performs FSM transitions to DEEP-SLEEP state, a selected group of data stored in local registers is retained to guarantee IC correct operation (managed by nPOR_SLEEP), while all other data is lost (managed by nPOR_MAIN). Such data will be redownloaded in the next transition to NORMAL or DIAG state. When the IC performs FSM transitions to OFF state, all data stored in local registers is lost; NVM data will be redownloaded in the next transition to NORMAL or DIAG state. In NORMAL state, the following commands in NVM_OP_CMD register allow user interaction with the NVM:

• NVM_OPERATION = 0x3 triggers the NVM upload and refresh: this operation fetches the data previously written into configuration registers and writes it to the relative NVM sectors, then it automatically triggers a full NVM redownload to guarantee whole data consistency. The operation lasts tNVM_UPLOAD and during such time interval the MCU will not be able to perform R/W operations (any command will be discarded).
• NVM_OPERATION = 0x5 triggers the NVM refresh, fetching the data from NVM sectors and writing it to the configuration registers. The operation lasts tNVM_DOWNLOAD and during such time interval the MCU will not be able to perform R/W operations (any command will be discarded). During NVM upload/download operations, the NVM_BUSY flag indicates that NVM is busy. During such an interval, it is highly recommended to avoid triggering conversions or actuating loads, as the trimming and calibration data is being refreshed, and data through SPI are not available (read commands return all zeros). Once the task is complete, the NVM_BUSY bit is set low and the NVM circuit is kept under reset. In NVM upload operations, NVM_ERASE_VERIFY_ERROR flag indicates that an error has occurred during NVM erasing, NVM_PROGRAM_VERIFY_ERROR flag indicates that an error has occurred during NVM programming. Note: Before interacting with the NVM, the MCU shall hold CWUP high to prevent the IC moving back to DEEP- SLEEP due to communication timeout. Every time a write operation is performed, the IC automatically decrements by one the NVM write counter that starts from 31. The counter value is stored in the NVM as well and is user-accessible reading NVM_UPLOAD_COUNT bit (read-only). As the number of write operations reaches NNVM_WRITE_CYCLES limit, the counter has reached the zero value and it will be never be updated anymore. When such a limit is exceeded, data retention is not guaranteed anymore. By the way, the IC continues to accept and perform every write operation, even if it is beyond NNVM_WRITE_CYCLES count. L9965P Functional description DS14702 - Rev 4 page 83/104

3.18.2 NVM data integrity checks

individually protected by CRC. Trimming/calibration data and configuration data are in different sectors.

• The sector data that fails CRC check is not downloaded into the local registers and is replaced by all zeros. Hence, depending on the sector content, either function accuracy will not be guaranteed or IC expected configuration will not be applied.
• In case at least one of the trimming/calibration sectors has failed the CRC check, NVM_CRC_TRIM_CAL_FAIL latch is set (clear-upon-read). When NVM_CRC_FAIL_MSK is set to 1, this flag can always be cleared.
• In case at least one of the IC configuration sectors has failed the CRC check, NVM_CRC_CFG_FAIL latch is set (clear-upon-read). When NVM_CRC_FAIL_MSK is set to 1, this flag can always be cleared.
• The deployment is inhibited and FAULTN is asserted but there is no interruption/inhibition of other IC functionalities. It is possible to mask this behavior setting the NVM_CRC_FAIL_MSK bit. Every time the user triggers an NVM upload and refresh operation, the corresponding sector CRC is updated as well; this is done by IC automatically.

3.18.3 NVM electrical parameters

according to the Table 3; TJ according to the Table 2. Table 89. NVM electrical parameters

4 Application scenarios

4.1 Typical application circuit

interfaced with a generic MCU. Figure 29. Application circuit: 12 V battery with MCU and ERBST mounted current for the discharge phase. Note: See the dedicated Application Note.

regulator, using the ERBST regulator and interfaced with a generic MCU. Figure 30. Application circuit: 12 V DC-DC with MCU and ERBST mounted so the power required to the 12 V DC-DC regulator. current for the discharge phase. Note: See the dedicated Application Note.

regulator, using the ERBST regulator and interfaced with a L9965C companion chip. Figure 31. Application circuit: 12 V DC-DC with L9965C and ERBST mounted so the power required to the 12 V DC-DC regulator. current for the discharge phase. Note: See the dedicated Application Note.

interfaced with a generic MCU. Figure 32. Application circuit: 24 V DC-DC with MCU and ERBST not mounted to avoid back feeding to the DC-DC regulator. Note: See the dedicated Application Note.

4.1.5 Bill of materials (BOM)

Referring to the Figure 16, Figure 29, Figure 30 and Figure 32, the Table 90 reports the bill of materials. Table 90. Bill of materials (BOM)

1. These components, based on application circuit, could not be mounted.

4.2 Device positioning in BMS application

forwarding frames sent by MCU to L9965P. read the IC version in the CHIP_ID register. on the user’s hardware and limitations, if any. between L9965P and L9965C (Figure 33 configuration "a").

• Pros: – Possible to avoid usage of ER boost regulator and related external components. – Deployment trigger pins direct connection to L9965C. – L9965C acts as a SPI controller to route commands from the MCU.
• Cons: – SPI signals suffer a higher delay. Some pyro-fuse switches might not be compatible with the above solution and require the driving section to be in the LV ground domain (Figure 33 configuration "b").
• Pros: – Direct connections to MCU’s SPI. – Compatibility with all pyro-fuse switches.
• Cons: – Cannot avoid ER boost usage (unless minimum VBAT can be guaranteed). – Requires additional components (isolators to interface with L9965C).

Figure 33. Pyro-fuse driver positioning

5 Mission profile

Table 91. Mission profile

6 Package information

To meet environmental requirements, ST offers these devices in different grades of ECOPACK packages, depending on their level of environmental compliance. ECOPACK specifications, grade definitions, and product status are available at: www.st.com. ECOPACK is an ST trademark. 6.1 VFQFN32 (5x5x0.9 mm 32+4L WETT. FLANKS) package information Figure 34. VFQFN32 (5x5x0.9 mm 32+4L WETT. FLANKS) package outline

Package information

DS14702 - Rev 4 page 92/104

Table 92. VFQFN32 (5x5x0.9 mm 32+4L WETT. FLANKS) package mechanical data DS14702 - Rev 4 page 93/104

Figure 35. VFQFN32 (5x5x0.9 mm 32+4L WETT. FLANKS) footprint DS14702 - Rev 4 page 94/104

6.2 TQFP32L (7x7x1 mm 32+4L exposed pad down) package information

Figure 36. TQFP32L (7x7x1 mm 32+4L exposed pad down) package outline DS14702 - Rev 4 page 95/104

Table 93. TQFP32L (7x7x1 mm 32+4L exposed pad down) package mechanical data DS14702 - Rev 4 page 96/104

Figure 37. TQFP32L (7x7x1 mm 32+4L exposed pad down) pcb landpattern DS14702 - Rev 4 page 97/104

Revision history

Table 94. Document revision history 01-Aug-2024 1 Initial release. 12-Aug-2024 2 Minor text changes in Section 6.1: VFQFN32 (5x5x0.9 mm 32+4L WETT. FLANKS) package information. References to FOR removed from Section 2.2. Power cycle means CWUP toggle:Table 9 and Table 34 modified. Two notes added in Section 3.6.1.1. IDP_PR parameter changed in IACT_PD_PR and its description updated. Note added in Section 3.7.2.1. description of ER cap diag removed. Section 3.14.2.1: note added, DIAG_CMD description updated. Added references to nPOR_SLEEP and nPOR_MAIN in Section 3.18.1. Added references to Application Notes in Section 4.1.

Contents

DS14702 - Rev 4 page 100/104

IMPORTANT NOTICE – READ CAREFULLY STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order acknowledgment. Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or the design of purchasers’ products. No license, express or implied, to any intellectual property right is granted by ST herein. Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product. ST and the ST logo are trademarks of ST. For additional information about ST trademarks, refer to www.st.com/trademarks. All other product or service names are the property of their respective owners. Information in this document supersedes and replaces information previously supplied in any prior versions of this document. © 2025 STMicroelectronics – All rights reserved L9965P DS14702 - Rev 4 page 104/104