Automobile fault detection system and method

Abstract

Fail-safe and fail-operational behavior may be achieved by providing two fully redundant execution channels including at least a first chiplet die and a second chiplet die located on a single SoC that communicate with each other via a D2D interface. At least a first instance and a second instance of a first automotive safety integrity level (ASIL) domain circuit disposed on at least a first chiplet die and a second chiplet die, respectively, perform at least a first ASIL domain process on one or more automotive sensor output signals to produce a first output signal and a second output signal, respectively. A fault monitoring system monitors at least a first chiplet die for a fault, and assigns a first value to a selector signal if the fault monitoring system detects a fault in the first chiplet die. The selector circuit outputs a second output signal from the system if the selector signal has the first value.

Description

[0001] Related technical description

[0002] Computing devices and their components may experience operational failures that may result in undesirable outcomes. In some types of computing devices, such as safety-critical systems used in vehicle automated driving systems, unexpected failures may result in dangerous conditions for the driver or others. One of the key foundations of automated driving systems, especially for Level 3 (L3) and higher levels of autonomy defined by the Society of Automotive Engineers (SAE) in SAE J3016, is their ability to continue operating when an advanced driver assistance system (ADAS) or automated driving system (ADS) has detected an electrical / electronic (E / E) fault in the software or other failure. The electronic control unit (ECU) is the heart of the ADAS / ADS system and fuses together a large amount of information about the surrounding environment acquired from various sensors (such as stereo cameras, radars, and other sensors) to perform complex and computationally intensive problems that are critical to ensuring the availability of the system while continuously detecting and managing faults during mission mode.

[0003] Different manufacturers are approaching this problem differently depending on the operational design domain (ODD) they want to achieve with their autonomous vehicles and the cost trade-offs for developing such systems. There are generally two different types of automotive safety systems, namely fail-safe systems and fail-operable systems. At a high level, a fail-safe system puts the autonomous driving system into a state upon detection of a fault such that an overall safe state (as defined by the vehicle manufacturer's safety policy) is achieved. A simple example of a fail-safe system is a system that shuts down safely after detecting a fault and notifies the driver that they should not rely on the vehicle's driver assistance features. In a fail-operable system, at a high level, upon detection of a fault, the system is put into a state such that the overall continued operation of the system is maintained. Depending on the level of autonomy, driver intervention may be required, but the system should be able to continue to provide some autonomous driving functionality.

[0004] There is a need for systems and methods that are better at maintaining the operational safety level for which they have been designed while continuously monitoring and managing faults. Summary of the Invention

[0005] Systems, methods, and other examples are disclosed for automotive fault detection and recovery.

[0006] An exemplary system for an automotive fault detection and recovery system includes at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a system-on-chip (SoC) integrated circuit (IC) package and communicating with each other via a die-to-die interface. The first chiplet die and the second chiplet die respectively include at least a first instance and a second instance of a first automotive safety integrity level (ASIL) domain circuit. The first instance and the second instance of the first ASIL domain circuit are configured to perform at least a first ASIL domain process on one or more ASIL input signals to generate first and second output signals, respectively, output from the first instance and the second instance of the first ASIL domain circuit. A selector circuit of the system is configured to select one of the first and second output signals based on a value assigned to a selector signal received by the selector circuit. A fault monitoring system of the system is configured to monitor the first chiplet die and the second chiplet die and assign a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die. Assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

[0007] An exemplary method for performing automotive fault detection and recovery includes: performing at least a first ASIL domain process on one or more ASIL input signals in first and second instances of a first ASIL domain circuit of a first chiplet die and a second chiplet die, respectively, disposed in a SoC IC package, to generate first and second output signals, respectively, output from the first and second instances of the first ASIL domain circuit. The first chiplet die and the second chiplet die are interfaced with each other via a die-to-die interface so that the first chiplet die and the second chiplet die can communicate with each other. The method also includes: monitoring at least the first chiplet die for a fault using a fault monitoring system, and assigning a first value to a selector signal if the fault monitoring system detects a fault in the first chiplet die. The method also includes: outputting a second output signal from the automotive fault detection and recovery system using a selector circuit that receives the selector signal and the first and second output signals if the selector signal has been assigned the first value.

[0008] An exemplary non-transitory computer-readable medium includes computer instructions for execution by at least a first chiplet die and a second chiplet die in a SoC IC package of an automotive fault detection and recovery system. The first chiplet die and the second chiplet die communicate with each other via a die-to-die interface. The computer instructions include a first set of computer instructions and a second set of computer instructions, the first set of computer instructions and the second set of computer instructions being executed by the first chiplet die and the second chiplet die, respectively, to perform a first ASIL domain process on one or more ASIL input signals to generate first output signals and second output signals, respectively, output from the first chiplet die and the second chiplet die. The computer instructions also include a third set of computer instructions for causing a selector circuit to select one of the first output signal and the second output signal to be output from the automotive fault detection and recovery system based on a value assigned to a selector signal received by the selector circuit. The computer instructions also include a fourth set of computer instructions for monitoring the first chiplet die and the second chiplet die for a fault and for assigning a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die. Assigning the first value to the selector signal causes the selector circuit to output a second output signal from the automotive fault detection and recovery system.

[0009] Another exemplary automotive fault detection and recovery system includes at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a SoC IC package and communicating with each other via a die-to-die interface. The first chiplet die and the second chiplet die include at least a first component and a second component for performing at least a first ASIL domain process on one or more ASIL input signals to generate a first output signal and a second output signal, respectively. The system also includes: a component for selecting, the component for selecting selecting one of the first output signal and the second output signal to be output from the automotive fault detection and recovery system based on a value assigned to a selector signal received by the component for selecting. The system also includes: a component for monitoring, the component for monitoring monitoring the first chiplet die and the second chiplet die and for assigning a first value to the selector signal if the component for monitoring detects a fault in the first chiplet die. Assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

[0010] These and other features and advantages will become apparent from the following description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In the drawings, like reference numerals refer to like parts throughout the various views unless otherwise indicated. For reference numerals with alphabetic designations, such as "101a" or "101b," the alphabetic designations may distinguish between two similar parts or elements in the same figure. The alphabetic designations may be omitted when the intention is that a reference numeral encompass all parts having the same reference numeral in all figures.

[0012] Figure 1 is a block diagram of an automotive fault detection and recovery system according to an embodiment that achieves at least one of fail-safe behavior and fail-operational behavior depending on how the system is designed and implemented.

[0013] Figure 2 is a flow chart of an automobile fault monitoring and recovery method according to an exemplary embodiment.

[0014] Figure 3 is a block diagram of an automotive fault detection and recovery system according to another exemplary embodiment that achieves at least one of fail-safe behavior and fail-operational behavior depending on how the system is designed and implemented.

[0015] Figure 4 is a block diagram of an automotive fault detection and recovery system according to an exemplary embodiment that achieves at least one of fail-safe behavior and fail-operational behavior depending on how the system is designed and implemented.

[0016] Figure 5 is a block diagram of an automotive fault detection and recovery system according to an exemplary embodiment, wherein a first set and a second set of sensors are used to generate sensor output signals to achieve fail-safe behavior using a degraded operating mode to perform advanced minimum risk maneuvers (MRMs) in the event of a failure in one of the sets of sensors, in a corresponding chiplet die interface, or in a corresponding chiplet die.

[0017] Figure 6 is a flow chart of an automobile fault monitoring and recovery method according to an exemplary embodiment, wherein either channel can serve as a primary channel or a backup channel and both channels are monitored for faults.

[0018] Figure 7 is a flow chart of an automotive fault monitoring and recovery method according to an exemplary embodiment, wherein a first chiplet die and a second chiplet die each include ASIL B domain circuitry and ASIL D domain circuitry, such as Figure 4 and Figure 5 As depicted, the main channel includes a first chiplet die.

[0019] Figure 8is a flow chart of an automotive fault monitoring and recovery method according to an exemplary embodiment, wherein ASIL decomposition is performed by comparing outputs of corresponding first ASIL B domain circuits and second ASIL B domain circuits of a first chiplet die and a second chiplet die and using the comparison results to evaluate the overall correctness of the output of the fault detection and recovery system.

[0020] Figure 9 is a diagrammatic image of a vehicle, where Figure 2 、 Figure 6 、 Figure 7 or Figure 8 Any of the methods shown in or their combination Figure 1 、 Figure 3 、 Figure 4 and Figure 5 Any of the systems shown in are incorporated as part of the vehicle's ADAS / ADS system. DETAILED DESCRIPTION

[0021] According to the inventive principles and concepts of the present disclosure, a fault detection and recovery system achieves fail-safe and fail-operational behavior by providing at least two fully redundant execution channels on a single system-on-chip (SoC) integrated circuit package, the at least two fully redundant execution channels including at least a first chiplet die and a second chiplet die. The chiplet die communicate with each other via a die-to-die interface. At least a first instance and a second instance of a first automotive safety integrity level (ASIL) domain circuit, respectively disposed on the first chiplet die and the second chiplet die, execute at least a first ASIL domain process on one or more ASIL input signals (e.g., automotive sensor output signals) to generate a first output signal and a second output signal, respectively, for use by an external system monitor. The fault monitoring system monitors at least the first chiplet die for a fault, and assigns a first value to a selector signal if the fault monitoring system detects a fault in the first chiplet die. The selector circuit outputs the second output signal to the external system monitor if the selector signal has the first value.

[0022] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." The word "representative" is used herein synonymously with the word "exemplary." Any aspect described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects.

[0023] The term "ASIL input signal" is used herein to mean any signal processed by an ASIL domain circuit, including but not limited to, for example, automotive sensor output signals, such as camera output signals, lidar output signals, and radar output signals. The term "ASIL input signal" may also mean a signal read from a memory that will be processed by an ASIL domain circuit to generate some type of ASIL domain output signal. For example, a data signal may be read from a non-volatile memory and processed by an ASIL domain circuit to generate a high-precision (HD) map as an output of the ASIL domain circuit. The term "ASIL domain process" as used herein may mean a process that processes one or more automotive sensor output signals to generate one or more ASIL domain output signals, as well as a process that processes other types of ASIL domain circuit inputs, such as a process that processes data read from a memory or data transmitted to the ASIL domain circuit from some source other than an automotive sensor.

[0024] Figure 1 is a block diagram of an automotive fault detection and recovery system 100 according to an embodiment that achieves at least one of fail-safe behavior and fail-operational behavior depending on how the system 100 is designed and implemented. The SoC 101 of the system 100 includes a first chiplet die 102 and a second chiplet die 110, respectively, that communicate with each other via a die-to-die interface 122. The first chiplet die 102 includes at least a first Automotive Safety Integrity Level (ASIL) domain circuit 103a configured to execute a first ASIL algorithm or process. The first chiplet die 102 preferably operates in a first clock and power domain defined by a first clock signal and a first supply voltage generated by a first clock and power domain circuit 104. The first clock signal operates at a first clock frequency.

[0025] First ASIL domain circuitry 103a receives ASIL input signals (e.g., sensor output signals from one or more vehicle sensors indicating conditions sensed by the vehicle sensors, HD map data signals, etc.) and executes a first ASIL domain process that processes the ASIL input signals to generate output signals 105 that can be used by an external system monitor 106, typically implemented using one or more microcontrollers, which further checks and validates signal 105 or propagates it as is to another ECU that can use signal 105 to control vehicle motion. External system monitor 106, which may or may not be implemented on the same ECU / box as SoC 101, can locally decide how to manage faults / errors received from chiplet dies 102 and 110 or from SoC 101. Error outputs from external system monitor 106 can be propagated as needed via the vehicle bus to other ECUs, such as vehicle motion control unit (MCU) 107, to cause the vehicle to execute fail-safe or fail-operational behavior, depending on how system 100 is designed and implemented. It should be noted that in some embodiments, the MCU 107 may be directly connected to the output of the selector circuit 121 .

[0026] The first ASIL domain circuit 103a and the first clock and power domain circuit 104 correspond to a first redundant execution path of the system 100, although Figure 1 Additional elements or components not shown in FIG. 1 may be included in the first redundant execution channel, either internally or externally to the first chiplet die 102 .

[0027] The first power and clock domain circuitry 104 is typically external to the SoC 101 and typically includes a power management IC (PMIC) and clock generation circuitry (i.e., a crystal and associated circuitry), respectively. Alternatively, the circuitry 104 may include one or more other chiplet dies of the SoC 101 or one or more IP blocks of the SoC 101. For example, the first power and clock domain circuitry 104 may include a separate PMIC integrated onto a separate chiplet die of the SoC 101 that communicates with the first chiplet die 102 via a D2D interface. Similarly, the first power and clock domain circuitry 104 may include a separate clock generation chiplet die of the SoC 101 having its own oscillator that generates the first clock signal and communicates with the first chiplet die 102 via the D2D interface.

[0028] The ASIL domain circuit 103a can have a variety of configurations, which will largely depend on the safety behavior that the vehicle manufacturer has designed the vehicle to have. The International Organization for Standardization (ISO) 26262 standard defines four ASILs, namely ASIL A to ASIL D, which establish the safety requirements that electrical / electronic (EE) automotive components must meet in order to comply with the standard. The level is based on the probability of occurrence, the severity of the injury, and the possibility of controllability in the event of failure of the EE automotive component. ASIL A and ASIL D represent the lowest and highest levels of strictness applied to safety assurance, respectively. For example, components used in airbag systems, anti-lock braking systems, and power steering systems require ASIL D levels due to the high risk of injury associated with their failure, while components used in satellite / digital radio systems and navigation systems only require ASIL A levels due to the low risk of injury associated with their failure. Headlights and brake lights will typically require ASIL B levels, while cruise control will require ASIL C levels.

[0029] The ASIL domain monitored and controlled by the first ASIL domain circuitry 103 a can be ASIL A, ASIL B, ASIL C, or ASIL D domain circuitry. Most fail-safe and fail-operational behaviors fall into the ASIL B and ASIL D domains, and therefore the first ASIL domain circuitry 103 a will typically be configured to perform operations associated with achieving ASIL B and / or ASIL D performance, as will be described in more detail below.

[0030] The second chiplet die 110 of the SoC 101 includes at least a second instance 103b of the first ASIL domain circuitry 103a, which preferably operates in a second clock and power domain generated by a second clock and power domain circuitry 113, which is independent of the first power and clock domain generated by the first power and clock domain circuitry 104. The second clock and power domain circuitry 113 generates a second supply voltage and a second clock signal, which are provided to the second instance 103b of the first ASIL domain circuitry 103a. The second clock signal operates at a second clock frequency. The first and second clock frequencies can be the same but generated independently. Similarly, the first and second supply voltages can be the same but generated independently. Therefore, a fault or failure in the first power and clock domain circuitry 104 will not affect the second clock and power domain circuitry 113, and vice versa.

[0031] Second power and clock domain circuitry 113 is typically external to SoC 101 and typically includes a PMIC and clock generation circuitry, respectively. Alternatively, circuitry 113 may include one or more other chiplet dies of SoC 101 or one or more IP blocks of SoC 101.

[0032] As used herein, the terms "first instance" and "second instance" mean that ASIL domain circuits 103a and 103b are configured identically or nearly identically so that they execute the same or nearly identical algorithms. In some cases, the configurations may be intentionally made slightly different so that a flaw in the design of one configuration will not necessarily be repeated in the other configuration. This type of intentional difference in configuration is often used with redundant circuits and is sometimes referred to as implementation diversity. Despite this difference, if circuits 103a and 103b receive the same input, they will produce the same output in the absence of a fault due to their identical or nearly identical configuration. In other words, in the absence of a fault, they perform the same or equivalent operations (although possibly in different ways) to achieve the same result.

[0033] A second instance 103b of the first ASIL domain circuitry receives an ASIL input signal (e.g., a vehicle sensor output signal indicative of a condition sensed by a vehicle sensor) and executes a first ASIL domain process or algorithm that processes the ASIL input signal to produce an output signal 115, which is received and processed by the external system monitor 106 and potentially by other downstream circuitry (as discussed above) to cause the vehicle to perform a fail-safe operation or a fail-safe operation, depending on the specific implementation.

[0034] The second instance of the first ASIL domain circuit 103 b and the second clock and power domain circuit 113 correspond to a second redundant execution path of the system 100 , although additional elements or components not shown may be included in the second redundant execution path, either internally or externally to the second chiplet die 110 .

[0035] As will be described in more detail below, the sensor output signals received by the first instance 103a and the second instance 103b of the first ASIL domain circuit, respectively, can be output signals from the same set of sensors or from different sets of sensors depending on the manner in which the system 100 is implemented and the ASIL targets that the system 100 is intended to achieve, as will be described in more detail below.

[0036] The fault monitoring system 120 of the system 100 monitors the first redundant execution channel and the second redundant execution channel for faults or failures that may affect the fail-safe and / or fail-operational behavior, depending on the type of behavior that the system 100 is designed and configured to achieve. If the fault monitoring system 120 detects an EE or software fault or failure in the first redundant execution channel, the fault monitoring system causes the selector circuit 121 to select the output signal 115 to be input to the external system monitor 106.

[0037] As will be described in more detail below, in some embodiments, the first channel can act as a backup channel for the second channel such that if the fault monitoring system 120 detects a fault or failure in the second redundant execution channel, the fault monitoring system causes the selector circuit 121 to select the output signal 105 to be input to the external system monitor 106, which then causes appropriate action to be taken to achieve fail-safe or fail-operational behavior.

[0038] It should be noted that although the fault monitoring system 120 is shown as being external to the first chiplet die 102 and the second chiplet die 110, respectively, it can be instantiated in one or both of the dies 102 and 110. Furthermore, in embodiments where the fault monitoring system 120 is instantiated in one or both of the chiplet dies 102 and 110, the system 100 can include additional external fault monitoring circuitry to provide additional fault monitoring redundancy. In embodiments where the fault monitoring system 120 is instantiated in both the chiplet dies 102 and 110, the fault monitoring circuits can communicate with each other so that the circuits can make each other aware of any faults detected in either of the chiplet dies 102 and 110.

[0039] Although the first chiplet die 102 and the second chiplet die 110 communicate with each other via the D2D interface 122, respectively, they are preferably electrically isolated from each other. The term "electrical isolation" as used in this disclosure means that the chiplet die 102 and 110 operate on different power rails or different PMICs, and a power level error affecting the ASIL domain circuit of one of the dies 102, 110 may not affect the ASIL domain circuit of the other die, thereby allowing the ASIL domain circuit to continue to operate in a degraded operating mode and with higher redundant availability. In addition, this may mean, for example, preventing power level, power surge, or related errors in the first chiplet die 102 from cascading to the second chiplet die 110, and vice versa.

[0040] The electrical isolation and separate power and clock domain circuits 104 and 113 better ensure ASIL implementation redundancy by preventing EE failures or faults on the first chiplet die 102 from causing EE failures or faults on the second chiplet die 110, and vice versa. Control signals and / or data can be exchanged between the chiplet dies 102 and 110 via the D2D interface 122. The D2D interface 122 can be any suitable interface for interfacing the chiplet dies to each other. A number of D2D interfaces suitable for this purpose are currently available on the market.

[0041] It should be noted that SoC 101 may include Figure 1 Various additional components not shown in the figure.

[0042] Figure 2 2 is a flow chart of an automotive fault monitoring and recovery method 200 according to an exemplary embodiment. In at least a first instance of a first ASIL domain circuit on a first chiplet die of a system-on-chip (SoC), an ASIL input signal (e.g., one or more automotive sensor output signals) is processed according to a first ASIL domain process or algorithm to generate a first output signal for use by a vehicle's MCU to control vehicle motion, as indicated by block 201. In at least a second instance of the first ASIL domain circuit on a second chiplet die of the first SoC, one or more ASIL input signals (e.g., one or more automotive sensor output signals) are processed according to the first ASIL domain process or algorithm to generate a second output signal for use by the MCU to control vehicle motion, as indicated by block 202.

[0043] In at least the first fault monitoring and detection system, at least the first chiplet die is monitored to determine whether a fault has occurred in the first chiplet die, as indicated by block 203. A determination is made at block 204 whether a fault is detected. If it is determined at block 204 that a fault has not been detected in the first chiplet die, the process returns to block 201 and repeats. If it is determined at block 204 that a fault has been detected in the first chiplet die, a selector signal is generated by the fault monitoring and detection system that causes the second output signal to be selected and transmitted to the MCU, as indicated by block 205. The process may then end or return to block 201 and repeat or restart.

[0044] Figure 2 Additional steps not shown may also occur, such as, for example, restarting or resetting the first chiplet die after a fault has been detected, the fault monitoring system 120 causing the vehicle to perform a minimum risk maneuver (MRM) after a fault has been detected, the system 120 providing a visual, tactile, and / or sound-based alert to the driver that a fault has been detected and temporarily disabling self-driving features, or the system causing some other fail-operational or fail-safe action to be performed after a fault has been detected.

[0045] Figure 3 is a block diagram of an automotive fault detection and recovery system 300 according to another exemplary embodiment, which achieves at least one of a fail-safe behavior and a fail-operational behavior depending on how the system 300 is designed and implemented. According to this embodiment, Figure 3 The first chiplet die 102 of the system 300 shown in FIG also includes at least a first instance 302 a of a second ASIL domain circuit that preferably operates in a third clock and power domain defined by a third supply voltage and a third clock signal generated by a third clock and power domain circuit 303. The third clock signal operates at a third clock frequency.

[0046] Figure 3 The second chiplet die 110 of the system 300 shown in FIG also includes at least a second instance 302 b of the second ASIL domain circuitry, which preferably operates in a fourth clock and power domain defined by a fourth supply voltage and a fourth clock signal generated by a fourth clock and power domain circuitry 304. The third clock signal and the fourth clock signal operate at a third clock frequency and a fourth clock frequency, respectively, which are typically the same but may be different. The first power and clock domain circuitry 104, the second power and clock domain circuitry 113, the third power and clock domain circuitry 303, and the fourth power and clock domain circuitry 304 are preferably each independent of one another so that a fault or failure of one of them does not adversely affect the other circuits.

[0047] In the first chiplet die 102, the first instance 302a of the second ASIL domain circuit is preferably electrically isolated from the first instance 103a of the first ASIL domain circuit. Similarly, in the second chiplet die 110, the second instance 302b of the second ASIL domain circuit is preferably electrically isolated from the second instance 103b of the first ASIL domain circuit. Figure 1 As indicated, the first chiplet die 102 and the second chiplet die 110 are preferably electrically isolated from each other. This electrical isolation and the use of separate power and clock domains help ensure that a fault or failure in one portion of the system 300 does not adversely affect other portions of the system 300.

[0048] According to this exemplary embodiment, in addition to the first chiplet die 102 and the second chiplet die 110 providing redundant ASIL execution paths for each other, the first instance 103a of the first ASIL domain circuit provides a redundant ASIL execution path for the first instance 302a of the second ASIL domain circuit. Similarly, the second instance 103b of the first ASIL domain circuit provides a redundant ASIL execution path for the second instance 302b of the second ASIL domain circuit.

[0049] According to this exemplary embodiment, ASIL domain circuits 103a and 103b are up-to-ASIL D domain circuits configured to perform ASIL A to ASIL D operations, and ASIL domain circuits 302a and 302b are up-to-ASIL B domain circuits configured to perform ASIL A to ASIL B operations. The sensor output signals received by up-to-ASIL D domain circuits 103a and 103b are from ASIL A to ASIL D domain sensors, while the sensor output signals received by up-to-ASIL B domain circuits 302a and 302b are from ASIL A to ASIL B domain sensors. Therefore, in system 300, there is redundancy in the sensor output signals of the ASIL A to ASIL B domain sensors.

[0050] In addition to being configured to perform ASIL D-domain processing of ASIL D-domain sensor output signals, up to ASIL D-domain circuits 103 a and 103 b may also be configured to perform ASIL B-domain processing of ASIL B-domain sensor output signals to verify that output signals 307 and 308 of up to ASIL B-domain circuits 302 a and 302 b , respectively, are valid, before respectively outputting those results as output signals 105 and 115 . In this manner, up to ASIL D-domain circuits 103 a and 103 b provide ASIL B-domain execution redundancy for up to ASIL B-domain circuits 302 a and 302 b , respectively.

[0051] Another benefit of this embodiment is that ASIL D-domain circuits 103a, 103b can also help enhance the overall ASIL rating of outputs 105 and 115 through ASIL decomposition. For example, ASIL B-domain circuit 302a performs ASIL B-domain processing and provides the corresponding output signal 307 to ASIL D-domain circuit 103a. ASIL D-domain circuit 103a performs additional independent processing of ASIL B-domain output signal 307 and then provides a higher or more robust ASIL D-rated output signal 105. In addition, because ASIL D-domain circuits 103a, 103b in this embodiment receive a separate set of independent sensor output signals, this facilitates higher ASIL level verification of ASIL B-domain output signals 307, 308, thereby enhancing the overall ASIL rating of output signals 105 and 115.

[0052] If the fault monitoring system 120 detects an EE or software fault or failure in the up to ASIL B domain circuitry 302a, the fault monitoring system notifies the up to ASIL D domain circuitry 103a, which then verifies that the output signal 307 is valid and outputs the signal 307 as the output signal 105, or determines that the validity of the output signal 307 cannot be verified. In the latter case, the value of the output signal 105 may depend on whether the system 300 is designed and configured to perform a fail-safe behavior or a fail-operational behavior. If the system 300 is designed and configured to perform a fail-safe behavior, the value of the output signal 105 may notify the external system monitor 106 that the output of the associated ASIL B domain sensor (e.g., a rear-facing camera) cannot be trusted, which may then result in a visual or audio signal notifying the vehicle driver that the sensor output cannot be trusted. If the system 300 is designed and configured to perform a fail-operational behavior, the up to ASIL D domain circuitry 103a may process the ASIL B domain sensor output signal to generate a correct value and output it as the output signal 105.

[0053] The second instance 103 b of the up to ASIL D domain circuitry processes the output signal 308 of the second instance 302 b of the up to ASIL B domain circuitry as described above to provide ASIL B domain execution redundancy for the second instance 302 b of the up to ASIL B domain circuitry. If the fault monitoring system 120 detects an EE or software fault or failure in the second instance 302 b of the up to ASIL B domain circuitry, the fault monitoring system notifies the second instance 103 b of the up to ASIL D domain circuitry, which then verifies that the output signal 308 is valid and outputs it as the output signal 115, or determines that the validity of the output signal 308 cannot be verified and takes appropriate steps to provide fail-safe or fail-operable performance based on the design and configuration of the system 300.

[0054] As indicated above, the first chiplet die 102 and the second chiplet die 110 are also each similar to the above referenced Figure 1 The described approach provides ASIL domain execution redundancy for each other. If the fault monitoring system 120 of the system 300 detects a fault in the first chiplet die 102, the fault monitoring system causes the selector circuit 121 to select the output signal 115 of the second instance 103b of the ASIL D domain circuit to be input to the external system monitor 106, which then takes appropriate action based on the design and configuration of the system 300 to achieve fail-safe or fail-operational behavior.

[0055] It should also be noted that in some embodiments, the system 300 can be designed such that if the fault monitoring system 120 has detected a fault in the first chiplet die 102, switches the selector circuit 121 so that the output signal 115 is transmitted to the external system monitor 106, and then a fault or failure is detected in the second chiplet die 110 while the output signal 115 is being transmitted to the external system monitor 106, the fault monitoring system 120 can then cause the selector circuit 121 to select the output signal 105 of the first instance 103a of the first up-to-ASIL D domain circuit to be input to the external system monitor 106. However, in this scenario, the first chiplet die 102 may need to be restarted or undergo any actions required to recover from the fault before switching back to using the output signal 105 as an input to the external system monitor 106. It should be noted that in this representative embodiment, the output signals 105 and 115 can be up-to-ASIL D domain processing results based on processing of the ASIL A to ASIL D domain input signals.

[0056] It should be noted that although the fault monitoring system 120 Figure 3 10. The system 300 is shown as being external to the first chiplet die 102 and the second chiplet die 110, respectively, but may include fault monitoring circuitry as part of one or both of the chiplet dies 102 and 110 or distributed across both chiplet dies, as will be described in more detail below. Furthermore, the system 300 may include additional external fault monitoring circuitry to provide additional fault monitoring redundancy. Furthermore, in embodiments where the fault monitoring system 120 includes fault monitoring circuitry located in each of the dies 102 and 110, the fault monitoring circuitry of each die 102 and 110 may communicate with each other to make each aware of any faults detected in the other die.

[0057] It should be noted that ASIL compliance according to the ISO 26262 standard has two main aspects. The first aspect is to meet the hardware architecture metrics up to the ASIL level targeted as described in the ISO 26262 standard. This first aspect focuses on detecting random hardware failures within the various components of the target system and meets the metrics such as single point fault metric (SPFM) and latent fault metric (LFM) described and recommended in the ISO 26262 standard. The second aspect of ASIL compliance is to avoid system failures. This means that the development of the hardware and software components of the system follows the best-known industry practices, quality, and most importantly, follows the guidance and recommendations for system development provided in the ISO 26262 standard. In other words, this second aspect focuses on the hardware and software development process for avoiding vulnerabilities or system failures.

[0058] In the present disclosure and by way of specific example, from a system fault avoidance perspective, both chiplet dies 102 and 110 are preferably developed to the highest ASIL level, ASIL D. This means that from a system development and fault avoidance perspective, the processing circuits 103 b , 302 b , 103 a , and 302 a are preferably all developed to the highest ASIL level, ASIL D.

[0059] Driven by safety analysis and safety requirements, from the perspective of system development and fault avoidance, the power and clock domain circuits 104, 303, 113 and 304 that supply power and clock to these SOC circuits are preferably also developed to the highest ASIL level ASIL D.

[0060] In general, this means that even if certain processing circuits target ASIL B from a hardware architecture metrics perspective, from a system development perspective, they are preferably developed to the highest ASIL level, ASIL D. This approach allows for meeting certain ASIL decomposition guidelines in the ISO 26262 standard, where ASIL decomposition is applied to meet safety requirements using processing circuits of the SoC 101 and chiplet dies 102 and 110 that may be at a lower ASIL level (e.g., ASIL B) while the overall ASIL requirement is at a higher ASIL level (e.g., ASIL D).

[0061] Figure 4 is a block diagram of an automotive fault detection and recovery system 400 according to an exemplary embodiment that achieves fail-safe operation on a single SoC (not shown) using at least a first chiplet die 102 and a second chiplet die 110, respectively, wherein the first chiplet die 102 serves as a primary channel and the second chiplet die 110 serves as a fallback channel. According to this exemplary embodiment, the same set of sensor output signals are relayed to both chiplet dies 102 and 110. For exemplary purposes, the sensor output signals are represented by output signals of one or more cameras, one or more radar sensors, and one or more lidar sensors.

[0062] The camera's output signal is received by a serializer / deserializer (SERDES) device 401. The radar sensor and lidar sensor output signals are received by a switching device 402. The SoC's SERDES component 401 converts the camera output signal stream into first and second output signal streams suitable for processing by the first and second chiplet dies 102 and 110, respectively. The switching device 402 multiplexes the radar sensor output signal and lidar sensor output signal to the first and second chiplet dies 102 and 110, respectively. Thus, both chiplet dies 102 and 110 receive the same sensor output signal simultaneously. One of the main benefits of providing the same sensor signal to both chiplet dies 102 and 110 is that it allows the channel including the second chiplet die 110 to act as a fallback channel. The fallback channel receives all of the same sensor output signals received by the primary channel and performs all required processing, but its output signal 115 is not used / valid until an error is detected in the first chiplet die 102.

[0063] The outputs shown from the SERDES 401 for the camera and from the switch 402 for the radar / lidar make certain assumptions about the sensor type and specific implementation. It should be understood that this may vary depending on the sensor type, the sensor interface to the chiplet die 102, 110 and the connection / multiplexing requirements, etc. Therefore, Figure 4 Only one example of such a design / implementation is shown, and many others are possible and within the scope of this disclosure.

[0064] According to this exemplary embodiment, the first chiplet die 102 and the second chiplet die 110 each have their own dynamic random access memory (DRAM) devices 403 and 404, respectively, which store instructions for the ASIL domain processing algorithms executed by the ASIL domain processing circuits 103 a, 103 b, 302 a, 302 b. Therefore, the primary and backup paths also have redundancy in terms of the DRAM devices 403 and 404.

[0065] although Figure 4 It is not explicitly shown in the figure, but the main channel and fallback channel, including chiplet dies 102 and 110 respectively, can have their own non-volatile memory (e.g., external memory connected via UFS, eMMC, PCIe, etc.). Such memory space can be used by each chiplet die to load its boot software and for any other data storage needs, thereby providing further independence from a non-volatile memory perspective when needed.

[0066] This exemplary embodiment is similar to Figure 3 The exemplary embodiment shown in FIG, but Figure 4 The embodiment shown in FIG provides additional details regarding the components that may include ASIL processing circuits 103a, 103b, 302a, and 302b. According to this exemplary embodiment, up to ASIL D processing circuit 103a includes a data ingestion memory device 405a that stores digital representations of sensor output signals, data processing and validation circuitry 406a that performs up to ASIL D processing of the sensor output signals, and overall fault monitoring and handling program circuitry 407a that monitors ASIL processing circuit 103a and other ASIL processing circuits 103b, 302a, and 302b for EE and software faults. Data processing and validation circuitry 406a performs up to ASIL D processing of processing circuit 103a and also processes the output of up to ASIL B processing circuit 302a to verify the validity of the output before outputting the output as output signal 105 or as a component of output signal 105.

[0067] Similarly, up to ASIL B processing circuitry 302a includes a data ingestion memory device 411a that stores a digital representation of the sensor output signal, data processing circuitry 412a that performs up to ASIL B processing of the sensor output signal, and fault monitoring circuitry 413a that monitors processing circuitry 302a for EE and software faults. Data processing circuitry 412a performs up to ASIL B processing on processing circuitry 302a and generates output signal 307.

[0068] The up to ASIL D processing circuitry 103b and up to ASIL B processing circuitry 302b of the second chiplet die 110 are identical to the up to ASIL D processing circuitry 103a and up to ASIL B processing circuitry 302a of the first chiplet die 102, respectively, although there may or may not be minor differences for the purpose of achieving the aforementioned implementation diversity. For ease of discussion, it will be assumed herein that they are configured identically. Thus, components 405a-407a are identical to components 405b-407b, respectively, and components 411a-413a are identical to components 411b-413b, respectively.

[0069] Control signals and data can be exchanged between chiplet dies 102 and 110 via D2D interface 122. Overall fault monitoring and handling circuits 407a and 407b receive communications from fault monitoring circuits 413a and 413b, respectively. Furthermore, fault monitoring and handling circuits 407a and 407b communicate with each other via D2D interface 122 to transmit a software heartbeat signal from up to ASIL D processing circuit 103a to up to ASIL D processing circuit 103b. In the event of a failure in the primary channel including chiplet die 102, the heartbeat signal will not be detected by fault monitoring and handling circuit 407b, which will cause it to notify external fault monitoring circuit 415 that a backup channel is taking control. External fault monitoring circuit 415 will then cause switching circuit 121 to select the output signal 115 of ASIL D processing circuit 103b to be transmitted to the external system monitor 106. The spare channel including the second chiplet die 110 will then take over to provide fail-safe performance within the fault tolerant time interval (FTTI) of the system 400 .

[0070] Figure 5 is a block diagram of an automotive fault detection and recovery system 500 according to an exemplary embodiment, which is similar to Figure 4 , except that a first set and a second set of duplicate sensors are used to generate sensor output signals, which are then processed by the first chiplet die 102 and the second chiplet die 110, respectively, to achieve fail-safe performance. The first chiplet die 102 receives the output signals of the first set of cameras, radar sensors, and lidar sensors, while the chiplet die 110 receives the output signals of the second set of cameras, radar sensors, and lidar sensors. The cameras, lidar sensors, and radar sensors in the first set can be the same as or different from the cameras, lidar sensors, and radar sensors in the second set, respectively. It should be noted that the sensors shown are for exemplary purposes only, and other types of sensors and sensor configurations can be used within the scope of the present disclosure.

[0071] The output signals of the cameras in the first and second sets are received by SERDES devices 501a and 501b, respectively. The output signals of the radar sensors and lidar sensors in the first and second sets are received by switching devices 502a and 502b, respectively. The SERDES devices 501a and 501b convert the camera output signal streams into corresponding output signal streams suitable for processing by the first chiplet die 102 and the second chiplet die 110, respectively. The switching devices 502a and 502b multiplex the radar sensor output signals and lidar sensor output signals in the first and second sets to the first chiplet die 102 and the second chiplet die 110, respectively.

[0072] For this embodiment to achieve fail-safe performance, the sensors are distributed across two channels because, for exemplary purposes, it is assumed that both of the chiplet dies 102 and 110 are required to perform all sensor processing and execute any other autonomous driving algorithms that must be executed. Therefore, this embodiment takes advantage of the high computational power of the chiplet dies 102, 110. Another benefit of this embodiment is that if one of the chiplet dies 102, 110 fails, the other chiplet die can continue to execute to allow fail-safe behavior to be achieved while also allowing MRM to be executed (e.g., pulling over the vehicle to the side of the road and safely stopping the vehicle and / or providing some reasonable time frame for the driver to regain control of the vehicle).

[0073] and Figure 4 As with the embodiment described above, control signals and data can be exchanged between chiplet die 102 and 110 via D2D interface 122. Overall fault monitoring and handling circuits 407a and 407b receive communications from fault monitoring circuits 413a and 413b, respectively. Furthermore, fault monitoring and handling circuits 407a and 407b communicate with each other via D2D interface 122 to transmit software heartbeat signals from up to ASIL D processing circuit 103a to up to ASIL D processing circuit 103b, and vice versa. In the event of a failure in the primary channel including chiplet die 102, the heartbeat signal will not be detected by fault monitoring and handling circuit 407b, which will cause it to notify external fault monitoring circuit 415 that chiplet die 110 is taking control. External fault monitoring circuit 415 will then cause switching circuit 121 to select output signal 115 of ASIL D processing circuit 103b to be transmitted to external system monitor 106. The channel including the second chiplet die 110 will then take over within the FTTI of the system 500 to provide fail-safe performance.

[0074] If a fault detected in chiplet 102 causes chiplet 110 to take over, then in the event of a failure in the backup channel including chiplet die 110, its heartbeat signal will not be detected by fault monitoring and handling program circuit 407a, which will cause circuit 407a to notify external fault monitoring circuit 415 that chiplet die 102 is regaining control. Assuming chiplet 102 has been restarted or otherwise restored after the fault in the primary channel, external fault monitoring circuit 415 will then cause switching circuit 121 to select the output signal 105 of ASIL D processing circuit 103a to be transmitted to external system monitor 106. The channel including the first chiplet die 102 will then regain control within the FTTI of system 500 to provide fail-safe performance with the ability to perform MRM. Therefore, in some embodiments, the heartbeat signal is bidirectional and is used in a bidirectional manner, as a failure to detect the heartbeat signal in circuit 407b causes the backup channel to take control, and a failure to detect the heartbeat signal in circuit 407a can cause the primary channel to regain control.

[0075] Other scenarios are also possible. For example, assume that an error is detected in chiplet die 102 and chiplet die 110 takes over to provide fail-safe performance and MRM. At the same time, chiplet die 102 recovers from the error via a restart or other mechanism / process. Subsequently, both chiplet dies 102 and 110 are available for execution. For another example, in the case where an error is detected in chiplet die 102 and control is passed to chiplet die 110, if an error is detected in chiplet die 110, external system monitor 106 can be configured to take over control and provide the necessary or desired fail-safe performance.

[0076] Because the chiplet dies 102 and 110 receive sensor output signals from different sets of sensors, either channel can provide various different implementations of the safety function via ASIL decomposition. Utilizing ASIL decomposition, the ASIL B data processing circuits 412a and 412b redundantly process the sensor output signals according to the same ASIL B safety function. The ASIL decomposition guidelines in the ISO 26262 standard are followed to provide sufficient independence between the two redundant safety functions (e.g., hardware diversity, software implementation diversity, spatial separation, temporal separation, etc.). The outputs 307 of the data processing circuits 412a and 412b are then compared in the data processing and verification circuit 406a of the ASIL D domain processing circuit 103a to determine whether the outputs match or are sufficiently similar. If so, one of these outputs is used as the output signal 105 or as a component of the output signal 105.

[0077] For example, assuming the safety function is generating the vehicle's trajectory in ASIL B data processing circuits 412 a and 412 b (ASIL B algorithm / process), the data processing and validation circuit 406 a will compare these outputs and ensure that the outputs match or are similar within a certain expected range (this allows for detection of E / E faults, SW failures, etc. in either HW circuit in circuits 412 a and 412 b, thereby improving the overall ASIL rating of the final output 105). If so, one of these outputs is used as the output signal 105 or as a component of the output signal 105.

[0078] Figure 6 6 is a flow chart of an automotive fault monitoring and recovery method 600 according to an exemplary embodiment, wherein any channel can function as a primary channel or a backup channel, and both channels are monitored for faults. In at least a first instance of a first ASIL domain circuit on a first chiplet die of an SoC, one or more ASIL input signals are processed according to a first ASIL domain process to generate a first output signal for use by an external system monitor, as indicated by block 601. In at least a second instance of the first ASIL domain circuit disposed on a second chiplet die of the first SoC, one or more ASIL input signals are processed according to the first ASIL domain process to generate a second output signal for use by the external system monitor, as indicated by block 602.

[0079] In at least the first fault monitoring and detection system, the first chiplet die and the second chiplet die are monitored to determine whether a fault has occurred in the first chiplet die or the second chiplet die, as indicated at block 603. At block 604, a determination is made as to whether a fault has been detected in the first chiplet die or the second chiplet die. If not, the process proceeds to block 606, where the system continues selecting an output signal for the current channel to be transmitted to an external system monitor. The process can then return to block 601.

[0080] If it is determined at block 604 that a fault is detected in the first chiplet die or the second chiplet die, then the selector signal generated by the fault monitoring and detection system causes the output signal of the non-faulty channel to be selected and transmitted to the external system monitor, as indicated at block 605. The process may then end or return to block 601 and repeat, or the process may end or restart.

[0081] Figure 6 Additional steps not shown may also occur, such as, for example, restarting or resetting the first chiplet die or the second chiplet die after a fault has been detected, an external system monitor causing the vehicle to perform an MRM after a fault has been detected, the system displaying a message to the driver that a fault has been detected and temporarily disabling the self-driving feature, or the system causing some other fail-operation or fail-safe action to be performed after a fault has been detected.

[0082] Figure 7 is a flow chart of an automotive fault monitoring and recovery method 700 according to an exemplary embodiment, wherein a first chiplet die and a second chiplet die each include ASIL B domain circuitry and ASIL D domain circuitry, such as Figure 4 and Figure 5 As depicted, and the main channel includes a first chiplet die. In respective at least first and second instances of ASIL D domain circuitry of the first and second chiplet dies of the SoC, ASIL input signals (e.g., sensor output signals) are processed according to ASIL D domain procedures or algorithms to generate first and second ASIL D output signals for use by an external system monitor, as indicated by block 701. In respective at least first and second instances of ASIL B domain circuitry of the first and second chiplet dies, ASIL input signals (e.g., automotive sensor output signals) are processed according to ASIL B domain procedures or algorithms to generate first and second ASIL B output signals for use by an external system monitor, as indicated by block 702.

[0083] In at least a first fault monitoring and detection system, at least a first chiplet die is monitored to determine whether a fault has occurred in the first chiplet die, as indicated by block 703. At block 704, a determination is made as to whether a fault is detected in the first chiplet die. If not, an ASIL B output signal and an ASIL D output signal generated by ASIL B domain circuitry and ASIL D domain circuitry, respectively, of the first chiplet die are selected and transmitted to an external system monitor, as indicated by block 705. The process may then return to block 701 and repeat.

[0084] If it is determined at block 704 that a fault is detected in the first chiplet die, the process proceeds to block 706 and generates a selector signal that selects the ASIL B output signal and the ASIL D output signal of the second chiplet die and transmits these signals to the external system monitor. The process can then return to block 701 and repeat, or the process can end or restart.

[0085] Figure 8800 is a flow chart of an automotive fault monitoring and recovery method according to an exemplary embodiment, wherein ASIL decomposition is performed by comparing the outputs of the corresponding first ASIL B domain circuitry and the second ASIL B domain circuitry of a first chiplet die and a second chiplet die and using the comparison results to evaluate the overall correctness of the ASIL D output of the fault detection and recovery system. In the event that the outputs are not identical or similar to those defined by the expected system design constraints or specifications, the comparison results will contain errors that notify the fault detection and recovery system to take necessary actions. In the event that the outputs are identical or similar according to the system design constraints or specifications, the ASIL D output is considered correct for output to the next receiving entity in the system. Figure 8 The method shown in Figure 7 The method shown in is executed in parallel or as an extension thereof.

[0086] In at least first and second instances of ASIL B domain circuitry in respective first and second chiplet dies of an SoC, an ASIL input signal is processed according to an ASIL B domain process or algorithm to generate a first ASIL B domain output signal, as indicated by block 801. In a first instance of ASIL D domain circuitry in the first chiplet die, the first ASIL B domain output signal and the second ASIL B domain output signal are received, as indicated by block 802. In the first ASIL D domain circuitry, the first ASIL B domain output signal and the second ASIL B domain output signal are compared to each other to determine whether the signals match or are sufficiently similar, as indicated by block 803. If so, the first ASIL B domain circuitry output signal or the second ASIL B domain circuitry output signal is used as an output signal of the first instance of ASIL D domain circuitry in the first chiplet die or as a component of an output signal of the first instance of ASIL D domain circuitry, as indicated by block 804. The process may then return to block 801 and repeat, or the process may end. If it is determined at block 803 that the first ASIL B domain output signal and the second ASIL B domain output signal do not match or are not sufficiently similar, the fault detection and recovery system is notified that the correctness of the ASIL B domain circuit output signals cannot be verified, as indicated at block 805, in which case neither of the ASIL B domain circuit output signals is used as the output signal of the first instance of the ASIL D domain circuit.

[0087] With respect to block 804, depending on the specific implementation, one of the ASIL B-domain circuit output signals can be assigned as the final output signal of the ASIL D-domain circuit, as long as the ASIL B-domain circuit output signals match or are sufficiently similar. For example, assuming the system's high-level safety requirement is to determine the presence of an obstacle in the vehicle's path at an ASIL D level, and the task of two ASIL B-domain circuits running some obstacle detection algorithms is to determine the presence of an obstacle in front of the vehicle, the ASIL B-domain circuit will provide an output result at the ASIL B level. The role of the ASIL D-domain circuit is to perform the final comparison of the two ASIL B-domain circuit output signals to make a final determination as to whether an obstacle is indeed present in front of the vehicle, while avoiding false positives, false negatives, etc., and therefore whether the vehicle should apply the brakes.

[0088] In this example, the ASIL B domain circuitry is tasked with performing extensive computations to generate corresponding output signals, and the ASIL D domain circuitry is primarily tasked with comparisons, which are less computationally intensive but have a higher criticality in terms of avoiding incorrect comparisons of output signals that may result in erroneous final results.

[0089] Figures 3 to 5 The systems shown in the foregoing can be configured to perform decomposition in a variety of ways. The examples and embodiments described above are provided to illustrate several examples of how the fault detection and recovery systems disclosed herein can perform decomposition processes. Those skilled in the art will understand how these systems can perform various decomposition processes based on the description provided herein.

[0090] Figure 9 is a diagrammatic image of a car 900, wherein Figure 2 、 Figure 6 、 Figure 7 or Figure 8 Any of the methods 200, 600, 700, or 800 shown in FIG. 1 or a combination thereof Figure 1 、 Figure 3 、 Figure 4 and Figure 5Any of the systems 100, 300, 400, or 500 shown in the figures is incorporated as part of an ADAS / ADS system of an automobile 900. The output of the external system monitor 106 is used by the MCU 107 and / or by other components of the ADAS / ADS system downstream of the external system monitor 106 to control the behavior of the automobile while achieving either fail-safe performance or fail-operable performance depending on how the target system is implemented. However, it should be noted that the systems 100, 300, 400, or 500 that implement any one of the methods 200, 600, 700, or 800, or a combination thereof, can be incorporated into any type of self-propelled mobile platform (including, for example, automobiles, boats, ships, airplanes, jets, trains, drones, robots, etc.) in which fail-safe or fail-operable performance is desired or required.

[0091] Specific implementation examples are described in the following numbered clauses:

[0092] 1. A vehicle fault detection and recovery system, comprising:

[0093] at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a system-on-chip (SoC) integrated circuit (IC) package and communicating with each other via a die-to-die interface, the first chiplet die and the second chiplet die respectively comprising at least a first instance and a second instance of a first automotive safety integrity level (ASIL) domain circuit, the first instance and the second instance of the first ASIL domain circuit being configured to perform at least a first ASIL domain process on one or more ASIL input signals to generate first and second output signals, respectively, output from the first instance and the second instance of the first ASIL domain circuit;

[0094] a selector circuit configured to select one of the first output signal and the second output signal based on a value assigned to a selector signal received by the selector circuit; and

[0095] a fault monitoring system configured to monitor the first chiplet die and the second chiplet die and to assign a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

[0096] 2. The automotive fault detection and recovery system of clause 1, wherein the first chiplet die and the second chiplet die are configured to operate in separate clock and power domains independent of each other.

[0097] 3. An automotive fault detection and recovery system according to any one of clauses 1 and 2, wherein the fault monitoring system is further configured to assign a second value to the selector signal when the fault monitoring system detects a fault in the second chiplet die, wherein assigning the second value to the selector signal causes the first output signal to be output from the automotive fault detection and recovery system.

[0098] 4. An automotive fault detection and recovery system according to any one of clauses 1 to 3, wherein the first chiplet die and the second chiplet die further include at least a first instance and a second instance of a second ASIL domain circuit, respectively, and the first instance and the second instance of the second ASIL domain circuit are configured to perform at least a second ASIL domain process on one or more ASIL input signals to generate a third output signal and a fourth output signal, respectively.

[0099] 5. An automotive fault detection and recovery system according to any one of clauses 1 to 4, wherein the first instance and the second instance of the first ASIL domain circuit are configured to operate in a first clock and power domain and a second clock and power domain, respectively, that are independent of each other, and wherein the first instance and the second instance of the second ASIL domain circuit are configured to operate in a third clock and power domain and a fourth clock and power domain, respectively, that are independent of each other and independent of the first clock and power domain and the second clock and power domain.

[0100] 6. An automotive fault detection and recovery system according to any one of clauses 1 to 5, wherein the first instance of the first ASIL domain circuit and the first instance of the second ASIL domain circuit communicate with each other and are electrically isolated, and wherein the second instance of the first ASIL domain circuit and the second instance of the second ASIL domain circuit communicate with each other and are electrically isolated.

[0101] 7. An automotive fault detection and recovery system according to any one of clauses 1 to 6, wherein the first chiplet die and the second chiplet die are electrically isolated from each other so that a fault occurring in the first chiplet die does not cascade into the second chiplet die, and vice versa.

[0102] 8. An automotive fault detection and recovery system according to any one of clauses 1 to 4, wherein the first instance and the second instance of the first ASIL domain circuit are respectively the first instance and the second instance of the up to ASIL D domain circuit, the first ASIL domain process includes at least the up to ASIL D domain process, and wherein the first instance and the second instance of the second ASIL domain circuit are respectively the first instance and the second instance of the up to ASIL B domain circuit, the second ASIL domain process includes at least the up to ASIL B domain process.

[0103] 9. An automotive fault detection and recovery system according to claim 8, wherein the first instance of the up to ASIL D domain circuit compares the third output signal and the fourth output signal with each other to produce a comparison result, the comparison result is processed by the first instance of the up to ASIL D domain circuit to determine whether the correctness of the comparison result can be verified, and wherein if the first instance of the up to ASIL D domain circuit verifies the correctness of the comparison result, one of the third output signal and the fourth output signal is output by the first instance of the up to ASIL D domain circuit as the first output signal or as a component of the first output signal.

[0104] 10. An automotive fault detection and recovery system according to any one of clauses 8 and 9, wherein the first instance of the first up to ASIL D domain circuit is further configured to process the third output signal generated by the first instance of the up to ASIL B domain circuit to verify the validity of the third output signal.

[0105] 11. An automotive fault detection and recovery system according to any one of clauses 8 to 10, wherein the second instance of the first up to ASIL D domain circuit is further configured to process the fourth output signal generated by the second instance of the up to ASIL B domain circuit to verify the validity of the fourth output signal.

[0106] 12. The automotive fault detection and recovery system according to any one of clauses 1 to 4, wherein the fault monitoring system comprises:

[0107] A first fault monitoring circuit is disposed in the first chiplet die and is configured to detect a fault in the first instance of the first ASIL domain circuit and assign the first value to the selector signal if the first fault monitoring circuit detects a fault.

[0108] 13. The automobile fault detection and recovery system according to clause 12, wherein the fault monitoring system further comprises:

[0109] A second fault monitoring circuit is disposed in the second chiplet die and is configured to detect a fault in the second instance of the first ASIL domain circuit and forward the fault detected in the second instance of the first ASIL domain circuit to the first fault monitoring circuit.

[0110] 14. The automotive fault detection and recovery system of clauses 12 and 13, wherein the first fault monitoring circuit is further configured to forward a fault detected in the first instance of the first ASIL domain circuit to the second fault monitoring circuit.

[0111] 15. The automobile fault detection and recovery system according to any one of clauses 12 to 14, wherein the fault monitoring system further comprises:

[0112] a third fault monitoring circuit disposed in the first chiplet die and in communication with the first fault monitoring circuit, the third fault monitoring circuit configured to detect a fault in the first instance of the second ASIL domain circuit and to notify the first fault monitoring circuit if the third fault monitoring circuit detects a fault; and

[0113] a fourth fault monitoring circuit disposed in the second chiplet die and in communication with the second fault monitoring circuit, the fourth fault monitoring circuit being configured to detect a fault in the second instance of the second ASIL domain circuit and to notify the second fault monitoring circuit if the fourth fault monitoring circuit detects a fault.

[0114] 16. The automobile fault detection and recovery system according to any one of clauses 12 to 15, further comprising:

[0115] an external fault monitoring system in communication with the first chiplet die and the second chiplet die, and wherein the first fault monitoring circuit is further configured to send a heartbeat signal to the second fault monitoring circuit, and wherein in an event that the second fault monitoring circuit fails to detect the heartbeat signal, the second fault monitoring circuit notifies the external fault detection system of a failure in the first chiplet die, and wherein upon being notified of the failure in the first chiplet die, the external fault monitoring system assigns the first value to the selector signal to cause the second output signal to be output from the automotive fault detection and recovery system.

[0116] 17. A method for performing automobile fault detection and recovery in an automobile fault detection and recovery system, the method comprising:

[0117] performing at least a first ASIL domain process on one or more ASIL input signals in first and second instances of a first automotive safety integrity level (ASIL) domain circuit of a first chiplet die and a second chiplet die, respectively, disposed in a system-on-chip (SoC) integrated circuit (IC) package to generate first and second output signals, respectively, output from the first and second instances of the first ASIL domain circuit, the first chiplet die and the second chiplet die being interfaced with each other via a die-to-die interface to enable communication between the first chiplet die and the second chiplet die;

[0118] monitoring at least the first chiplet die for a fault with a fault monitoring system and assigning a first value to a selector signal if the fault monitoring system detects a fault in the first chiplet die; and

[0119] The second output signal is output from the automobile fault detection and recovery system when the selector signal has been assigned the first value, using a selector circuit that receives the selector signal and the first and second output signals.

[0120] 18. The method according to clause 17, further comprising:

[0121] monitoring, with the fault monitoring system, at least the second chiplet die for a fault, and assigning a second value to the selector signal if the fault monitoring system detects a fault in the second chiplet die; and

[0122] With the selector circuit, the first output signal is output from the automobile fault detection and recovery system in a case where the selector signal has been assigned the second value.

[0123] 19. A method according to any one of clauses 17 and 18, wherein the first chiplet die and the second chiplet die further include at least a first instance and a second instance of a second ASIL domain circuit, respectively, and the first instance and the second instance of the second ASIL domain circuit are configured to perform at least a second ASIL domain process on one or more ASIL input signals to generate a third output signal and a fourth output signal, respectively.

[0124] 20. A method according to any of clauses 17 to 19, wherein the first instance and the second instance of the first ASIL domain circuit are respectively first and second instances of up to ASIL D domain circuitry, the first ASIL domain process comprising at least up to ASIL D domain processes, and wherein the first instance and the second instance of the second ASIL domain circuit are respectively first and second instances of up to ASIL B domain circuitry, the second ASIL domain process comprising at least up to ASIL B domain processes.

[0125] 21. The method according to any one of clauses 17 to 20, further comprising:

[0126] In the first example of the up to ASIL D domain circuit, decomposition is performed by:

[0127] comparing the third output signal and the fourth output signal with each other to generate a comparison result;

[0128] processing the comparison result to determine whether the correctness of the comparison result can be verified; and

[0129] In a case where the first instance of the up to ASIL D domain circuit verifies the correctness of the comparison result, one of the third output signal and the fourth output signal is output as the first output signal or as a component of the first output signal.

[0130] 22. The method according to any one of clauses 19 to 21, further comprising:

[0131] In the first instance of the first up to ASIL D domain circuit, the third output signal generated by the first instance of the up to ASIL B domain circuit is processed to verify validity of the third output signal.

[0132] 23. The method according to any one of clauses 19 to 22, further comprising:

[0133] In the second instance of the up to ASIL D domain circuitry, the fourth output signal generated by the second instance of the up to ASIL B domain circuitry is processed to verify validity of the fourth output signal.

[0134] 24. The method of any of clauses 17 to 23, wherein the fault monitoring system comprises a first fault monitoring circuit disposed in the first chiplet die, the method further comprising:

[0135] A fault in the first instance of the first ASIL domain circuit is detected with the first fault monitoring circuit, and the first value is assigned to the selector signal if the first fault monitoring circuit detects a fault in the first instance of the first ASIL domain circuit.

[0136] 25. The method of any of clauses 17 to 24, wherein the fault monitoring system further comprises a second fault monitoring circuit disposed in the second chiplet die, the method further comprising:

[0137] A fault in the second instance of the first ASIL domain circuit is detected using the second fault monitoring circuit, and the fault detected in the second instance of the first ASIL domain circuit is forwarded to the first fault monitoring circuit.

[0138] 26. The method according to any one of clauses 17 to 25, further comprising:

[0139] A fault detected in the first instance of the first ASIL domain circuit is forwarded to the second fault monitoring circuit using the first fault monitoring circuit.

[0140] 27. The method of any of clauses 24 to 26, wherein the fault monitoring system further comprises a third fault monitoring circuit disposed in the first chiplet die and in communication with the first fault monitoring circuit, the method further comprising:

[0141] detecting, using the third fault monitoring circuit, a fault in the first instance of the second ASIL domain circuit, and notifying the first fault monitoring circuit if the third fault monitoring circuit detects a fault; and

[0142] Detecting a fault in the second instance of the second ASIL domain circuit using a fourth fault monitoring circuit disposed in the second chiplet die and in communication with the second fault monitoring circuit and notifying the second fault monitoring circuit if the fourth fault monitoring circuit detects a fault.

[0143] 28. The method of any of clauses 25 to 27, further comprising an external fault monitoring system in communication with the first chiplet die and the second chiplet die, the method further comprising:

[0144] sending a bidirectional heartbeat signal between the first fault monitoring circuit and the second fault monitoring circuit;

[0145] determining, in the first fault monitoring circuit and the second fault monitoring circuit, whether there has been a failure to detect the bidirectional heartbeat signal, and if so, notifying the external fault detection system of the failure to detect the bidirectional heartbeat signal; and

[0146] Utilizing the external monitoring system, upon being notified of the failure, assigning the first value to the selector signal if the second fault monitoring circuit fails to detect the bidirectional heartbeat signal, and assigning the second value to the selector signal if the first fault monitoring circuit fails to detect the bidirectional heartbeat signal.

[0147] 29. A non-transitory computer-readable medium comprising computer instructions for execution by at least a first chiplet die and a second chiplet die disposed in a system-on-chip (SoC) integrated circuit (IC) package of an automotive fault detection and recovery system, the first chiplet die and the second chiplet die communicating with each other via a die-to-die interface, the computer instructions comprising:

[0148] a first set of computer instructions and a second set of computer instructions, the first set of computer instructions and the second set of computer instructions being executed by the first chiplet die and the second chiplet die, respectively, to perform a first Automotive Safety Integrity Level (ASIL) domain process on one or more ASIL input signals to generate first and second output signals, respectively, output from the first chiplet die and the second chiplet die, respectively;

[0149] a third set of computer instructions for causing a selector circuit to select one of the first output signal and the second output signal to be output from the automobile fault detection and recovery system based on a value assigned to a selector signal received by the selector circuit; and

[0150] a fourth set of computer instructions for monitoring the first chiplet die and the second chiplet die for faults and for assigning a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the selector circuit to output the second output signal from the automotive fault detection and recovery system.

[0151] 30. An automobile fault detection and recovery system, comprising:

[0152] at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a system-on-chip (SoC) integrated circuit (IC) package and communicating with each other via a die-to-die interface, the first chiplet die and the second chiplet die comprising at least first components and second components for performing at least a first ASIL domain process on one or more ASIL input signals to generate first and second output signals, respectively;

[0153] means for selecting, the means for selecting selecting one of the first output signal and the second output signal to be output from the automobile fault detection and recovery system based on a value assigned to a selector signal received by the means for selecting; and

[0154] A component for monitoring, the component for monitoring monitors the first chiplet die and the second chiplet die and is used to assign a first value to the selector signal if the component for monitoring detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

[0155] Alternative embodiments will become apparent to those skilled in the art to which the present invention pertains.Thus, while selected aspects have been illustrated and described in detail, it should be understood that various substitutions and changes can be made therein, and all such modifications are within the scope of this disclosure.

Claims

1. A vehicle fault detection and recovery system, comprising: at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a system-on-chip (SoC) integrated circuit (IC) package and communicating with each other via a die-to-die interface, the first chiplet die and the second chiplet die respectively comprising at least a first instance and a second instance of a first automotive safety integrity level (ASIL) domain circuit, the first instance and the second instance of the first ASIL domain circuit being configured to perform at least a first ASIL domain process on one or more ASIL input signals to generate first and second output signals, respectively, output from the first instance and the second instance of the first ASIL domain circuit; a selector circuit configured to select one of the first output signal and the second output signal based on a value assigned to a selector signal received by the selector circuit; and a fault monitoring system configured to monitor the first chiplet die and the second chiplet die and to assign a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

2. The automotive fault detection and recovery system of claim 1 , wherein the first chiplet die and the second chiplet die are configured to operate in separate clock and power domains independent of each other.

3. The automotive fault detection and recovery system of claim 1 , wherein the fault monitoring system is further configured to assign a second value to the selector signal if the fault monitoring system detects a fault in the second chiplet die, wherein assigning the second value to the selector signal causes the first output signal to be output from the automotive fault detection and recovery system.

4. The automotive fault detection and recovery system of claim 1 , wherein the first chiplet die and the second chiplet die further include at least a first instance and a second instance of a second ASIL domain circuit, respectively, the first instance and the second instance of the second ASIL domain circuit being configured to perform at least a second ASIL domain process on one or more ASIL input signals to generate a third output signal and a fourth output signal, respectively.

5. The automotive fault detection and recovery system of claim 4 , wherein the first instance and the second instance of the first ASIL domain circuit are configured to operate in a first clock and power domain and a second clock and power domain, respectively, that are independent of each other, and wherein the first instance and the second instance of the second ASIL domain circuit are configured to operate in a third clock and power domain and a fourth clock and power domain, respectively, that are independent of each other and independent of the first clock and power domain and the second clock and power domain.

6. The automotive fault detection and recovery system of claim 5 , wherein the first instance of the first ASIL domain circuit and the first instance of the second ASIL domain circuit communicate with each other and are electrically isolated, and wherein the second instance of the first ASIL domain circuit and the second instance of the second ASIL domain circuit communicate with each other and are electrically isolated.

7. The automotive fault detection and recovery system of claim 1 , wherein the first chiplet die and the second chiplet die are electrically isolated from each other such that a fault occurring in the first chiplet die does not cascade into the second chiplet die, and vice versa.

8. The automotive fault detection and recovery system of claim 4 , wherein the first instance and the second instance of the first ASIL domain circuit are respectively the first instance and the second instance of an up to ASIL D domain circuit, the first ASIL domain process at least including the up to ASIL D domain process, and wherein the first instance and the second instance of the second ASIL domain circuit are respectively the first instance and the second instance of an up to ASIL B domain circuit, the second ASIL domain process at least including the up to ASIL B domain process.

9. The automotive fault detection and recovery system of claim 8, wherein the first instance of the up to ASIL D-domain circuit compares the third output signal and the fourth output signal with each other to generate a comparison result, the comparison result being processed by the first instance of the up to ASIL D-domain circuit to determine whether correctness of the comparison result can be verified, and wherein, if the first instance of the up to ASIL D-domain circuit verifies the correctness of the comparison result, one of the third output signal and the fourth output signal is output by the first instance of the up to ASIL D-domain circuit as the first output signal or as a component of the first output signal.

10. The automotive fault detection and recovery system of claim 8, wherein the first instance of the first up to ASIL D domain circuit is further configured to process the third output signal generated by the first instance of the up to ASIL B domain circuit to verify validity of the third output signal.

11. The automotive fault detection and recovery system of claim 10 , wherein the second instance of the first up to ASIL D domain circuit is further configured to process the fourth output signal generated by the second instance of the up to ASIL B domain circuit to verify validity of the fourth output signal.

12. The automobile fault detection and recovery system according to claim 4, wherein the fault monitoring system comprises: A first fault monitoring circuit is disposed in the first chiplet die and is configured to detect a fault in the first instance of the first ASIL domain circuit and assign the first value to the selector signal if the first fault monitoring circuit detects a fault.

13. The automobile fault detection and recovery system according to claim 12, wherein the fault monitoring system further comprises: A second fault monitoring circuit is disposed in the second chiplet die and is configured to detect a fault in the second instance of the first ASIL domain circuit and forward the fault detected in the second instance of the first ASIL domain circuit to the first fault monitoring circuit. 14 . The automotive fault detection and recovery system of claim 13 , wherein the first fault monitoring circuit is further configured to forward a fault detected in the first instance of the first ASIL domain circuit to the second fault monitoring circuit.

15. The automobile fault detection and recovery system according to claim 14, wherein the fault monitoring system further comprises: a third fault monitoring circuit disposed in the first chiplet die and in communication with the first fault monitoring circuit, the third fault monitoring circuit configured to detect a fault in the first instance of the second ASIL domain circuit and to notify the first fault monitoring circuit if the third fault monitoring circuit detects a fault; and a fourth fault monitoring circuit disposed in the second chiplet die and in communication with the second fault monitoring circuit, the fourth fault monitoring circuit being configured to detect a fault in the second instance of the second ASIL domain circuit and to notify the second fault monitoring circuit if the fourth fault monitoring circuit detects a fault.

16. The automobile fault detection and recovery system according to claim 15, further comprising: an external fault monitoring system in communication with the first chiplet die and the second chiplet die, and wherein the first fault monitoring circuit is further configured to send a heartbeat signal to the second fault monitoring circuit, and wherein in an event that the second fault monitoring circuit fails to detect the heartbeat signal, the second fault monitoring circuit notifies the external fault detection system of a failure in the first chiplet die, and wherein upon being notified of the failure in the first chiplet die, the external fault monitoring system assigns the first value to the selector signal to cause the second output signal to be output from the automotive fault detection and recovery system.

17. A method for performing automobile fault detection and recovery in an automobile fault detection and recovery system, the method comprising: performing at least a first ASIL domain process on one or more ASIL input signals in first and second instances of a first automotive safety integrity level (ASIL) domain circuit of a first chiplet die and a second chiplet die, respectively, disposed in a system-on-chip (SoC) integrated circuit (IC) package to generate first and second output signals, respectively, output from the first and second instances of the first ASIL domain circuit, the first chiplet die and the second chiplet die being interfaced with each other via a die-to-die interface to enable communication between the first chiplet die and the second chiplet die; monitoring at least the first chiplet die for a fault with a fault monitoring system, and assigning a first value to a selector signal if the fault monitoring system detects a fault in the first chiplet die; as well as The second output signal is output from the automobile fault detection and recovery system when the selector signal has been assigned the first value, using a selector circuit that receives the selector signal and the first and second output signals.

18. The method according to claim 17, further comprising: monitoring, with the fault monitoring system, at least the second chiplet die for a fault, and assigning a second value to the selector signal if the fault monitoring system detects a fault in the second chiplet die; as well as With the selector circuit, the first output signal is output from the automobile fault detection and recovery system in a case where the selector signal has been assigned the second value.

19. The method of claim 17 , wherein the first chiplet die and the second chiplet die further comprise at least a first instance and a second instance of a second ASIL domain circuit, respectively, the first instance and the second instance of the second ASIL domain circuit being configured to perform at least a second ASIL domain process on one or more ASIL input signals to generate a third output signal and a fourth output signal, respectively.

20. The method of claim 19, wherein the first instance and the second instance of the first ASIL domain circuit are first and second instances, respectively, of an up to ASIL D domain circuit, the first ASIL domain process comprising at least an up to ASIL D domain process, and wherein the first instance and the second instance of the second ASIL domain circuit are first and second instances, respectively, of an up to ASIL B domain circuit, the second ASIL domain process comprising at least an up to ASIL B domain process.

21. The method according to claim 20, further comprising: In the first example of the up to ASIL D domain circuit, decomposition is performed by: comparing the third output signal and the fourth output signal with each other to generate a comparison result; processing the comparison result to determine whether the correctness of the comparison result can be verified; as well as In a case where the first instance of the up to ASIL D domain circuit verifies the correctness of the comparison result, one of the third output signal and the fourth output signal is output as the first output signal or as a component of the first output signal.

22. The method according to claim 20, further comprising: In the first instance of the first up to ASIL D domain circuit, the third output signal generated by the first instance of the up to ASIL B domain circuit is processed to verify validity of the third output signal.

23. The method according to claim 22, further comprising: In the second instance of the up to ASIL D domain circuitry, the fourth output signal generated by the second instance of the up to ASIL B domain circuitry is processed to verify validity of the fourth output signal.

24. The method of claim 17, wherein the fault monitoring system comprises a first fault monitoring circuit disposed in the first chiplet die, the method further comprising: A fault in the first instance of the first ASIL domain circuit is detected with the first fault monitoring circuit, and the first value is assigned to the selector signal if the first fault monitoring circuit detects the fault in the first instance of the first ASIL domain circuit.

25. The method of claim 24, wherein the fault monitoring system further comprises a second fault monitoring circuit disposed in the second chiplet die, the method further comprising: A fault in the second instance of the first ASIL domain circuit is detected using the second fault monitoring circuit, and the fault detected in the second instance of the first ASIL domain circuit is forwarded to the first fault monitoring circuit.

26. The method according to claim 25, further comprising: A fault detected in the first instance of the first ASIL domain circuit is forwarded to the second fault monitoring circuit using the first fault monitoring circuit.

27. The method of claim 24, wherein the fault monitoring system further comprises a third fault monitoring circuit disposed in the first chiplet die and in communication with the first fault monitoring circuit, the method further comprising: detecting, using the third fault monitoring circuit, a fault in the first instance of the second ASIL domain circuit, and notifying the first fault monitoring circuit if the third fault monitoring circuit detects a fault; as well as Detecting a fault in the second instance of the second ASIL domain circuit using a fourth fault monitoring circuit disposed in the second chiplet die and in communication with the second fault monitoring circuit and notifying the second fault monitoring circuit if the fourth fault monitoring circuit detects a fault.

28. The method of claim 25, further comprising an external fault monitoring system in communication with the first chiplet die and the second chiplet die, the method further comprising: sending a bidirectional heartbeat signal between the first fault monitoring circuit and the second fault monitoring circuit; determining, in the first fault monitoring circuit and the second fault monitoring circuit, whether there has been a failure to detect the bidirectional heartbeat signal, and if so, notifying the external fault detection system of the failure to detect the bidirectional heartbeat signal; as well as Utilizing the external monitoring system, upon being notified of the failure, assigning the first value to the selector signal if the second fault monitoring circuit fails to detect the bidirectional heartbeat signal, and assigning the second value to the selector signal if the first fault monitoring circuit fails to detect the bidirectional heartbeat signal.

29. A non-transitory computer-readable medium comprising computer instructions for execution by at least a first chiplet die and a second chiplet die disposed in a system-on-chip (SoC) integrated circuit (IC) package of an automotive fault detection and recovery system, the first chiplet die and the second chiplet die communicating with each other via a die-to-die interface, the computer instructions comprising: a first set of computer instructions and a second set of computer instructions, the first set of computer instructions and the second set of computer instructions being executed by the first chiplet die and the second chiplet die, respectively, to perform a first Automotive Safety Integrity Level (ASIL) domain process on one or more ASIL input signals to generate first and second output signals, respectively, output from the first chiplet die and the second chiplet die, respectively; a third set of computer instructions for causing a selector circuit to select one of the first output signal and the second output signal to be output from the automobile fault detection and recovery system based on a value of a selector signal received by the selector circuit; and a fourth set of computer instructions for monitoring the first chiplet die and the second chiplet die for faults and for assigning a first value to the selector signal if the fault monitoring system detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the selector circuit to output the second output signal from the automotive fault detection and recovery system.

30. An automobile fault detection and recovery system, comprising: at least a first chiplet die and a second chiplet die, at least the first chiplet die and the second chiplet die being disposed in a system-on-chip (SoC) integrated circuit (IC) package and communicating with each other via a die-to-die interface, the first chiplet die and the second chiplet die comprising at least first components and second components for performing at least a first ASIL domain process on one or more ASIL input signals to generate first and second output signals, respectively; means for selecting, the means for selecting selecting one of the first output signal and the second output signal to be output from the automobile fault detection and recovery system based on a value of a selector signal received by the means for selecting; and A component for monitoring, the component for monitoring monitors the first chiplet die and the second chiplet die and is used to assign a first value to the selector signal if the component for monitoring detects a fault in the first chiplet die, wherein assigning the first value to the selector signal causes the second output signal to be output from the automotive fault detection and recovery system.

Images