On-chip inspector for on-chip security areas

Abstract

Embodiments of this disclosure relate to on-chip checkers for on-chip security regions. This document discloses a single integrated circuit chip including main logic that operates vehicle components such as valve actuators. Isolated from the main logic within the chip is a security region used to verify the correct operation of the main logic. On-chip checker circuitry, located outside the security region, is used to verify the correct operation of the checker circuitry. The checker circuitry receives signals from the security circuitry and uses combinational logic circuitry to verify from these signals whether the checker circuitry is functioning correctly.

Description

Technical Field

[0001] This invention relates to the field of test circuit devices, and more particularly to test circuits for testing the correct operation of circuits within a dedicated "safe area" within an integrated circuit chip. Background Technology

[0002] Modern vehicles are increasingly equipped with various safety systems, especially given the growing use of drive-by-wire controls to receive driver input. For example, instead of the vehicle's steering wheel, brake pedal, and accelerator pedal are mechanically connected to a hydraulic or cable system for controlling the vehicle. One or more such controllers can be connected to sensing devices that transmit the driver's intentions to the controllers, which in turn execute those intentions, potentially modifying safety features.

[0003] For example, when a driver presses the accelerator pedal to request rotational torque to be applied to the vehicle's drive wheels, instead of operating the cables that mechanically operate components of the vehicle's engine (e.g., throttle vanes), the accelerator pedal can cooperate with sensor devices to generate the electrical output ultimately provided to the transmission controller and throttle vane controller. The transmission controller, for example, controls the vehicle's transmission by actuating valve actuators that control the shifting of gears. Since the transmission controller is actually in the control of the transmission rather than in the actuators, it is desirable to perform fault detection to determine if the controller is functioning correctly.

[0004] Therefore, considering the safety requirements of drive-by-wire vehicles, the ISO 26262 standard was developed to include a vehicle safety integrity level (ASIL) risk classification scheme. ASIL levels range from ASIL-A (lowest) to ASIL-D (highest). ASIL levels are determined by three factors: the severity of the fault, the probability of the fault occurring, and the ability to control the impact of the fault.

[0005] For vehicle components that directly control vehicle movement, such as transmissions and braking systems, ASIL-D is applied, and not only should faults be carefully detected, but the circuits and components used to detect these faults should also be inspected and verified to ensure proper operation.

[0006] One of the most common requirements for transmission controllers under ASIL-D is ensuring the safe shutdown of the power stage, which may include fail-safe pre-drives and valve drives. Shutdown must be guaranteed even if a common shutdown path, typically implemented via interaction between the logic core and analog drive blocks in the power stage, fails due to a fault. To this end, redundant shutdown paths and redundant disconnect circuits are typically implemented. These redundant shutdown paths are usually integrated into a protected area isolated by deep trench isolation. This protected area is often referred to as the "safe area."

[0007] exist Figure 1A One such arrangement can be seen. Here, vehicle system 10 includes main logic 11, such as a transmission controller, that communicates with safety circuitry 13 within safety zone 12. Safety circuitry 13 determines whether main logic 11 is operating correctly and provides an alternative shutdown path in the event of a detected fault.

[0008] As mentioned above, it may be desirable to check the proper operation of the safety circuit 13 itself. Figure 1B One such arrangement is shown in vehicle system 10'. Here, excitation circuit 14 generates a known input to be provided to safety circuit 13, and result checker 16 checks whether safety circuit 13 has generated the expected result in response to the excitation provided to safety circuit 13 by excitation circuit 14. If safety circuit 13 does not generate the expected result, it can be assumed that safety circuit 13 has failed, and main logic 11 can take action to help ensure vehicle safety. However, the problem with this arrangement is that excitation circuit 14 may be complex and consume excessive area, both of which are undesirable in design.

[0009] Figure 1C Another configuration for checking security circuit 13 is shown. Here, the security circuit is duplicated, thus there are two security regions 12a, 12b, each with its own security circuit 13a, 13b. Security circuits 13a, 13b each receive the same input from main logic 11. Digital comparison circuit 15 compares the outputs of security circuits 13a, 13b with each other and provides the outputs of these comparisons to result checker 16. If the outputs of security circuits 13a, 13b are the same, it can be assumed that security circuits 13a, 13b are functioning correctly. If the outputs of security circuits 13a, 13b are different, it can be assumed that one or both of security circuits 13a, 13b are malfunctioning. The problem with this arrangement is that the security regions and security circuits are duplicated, and therefore this arrangement also consumes an undesirable amount of area.

[0010] Therefore, further development is needed. Summary of the Invention

[0011] This document discloses an integrated circuit chip, comprising: an integrated circuit substrate; main logic within the integrated circuit substrate, the main logic being configured to control at least one external component, the main logic being further configured to generate at least one digital signal capable of determining correct operation of the main logic therefrom, at least one analog signal capable of determining correct operation of the main logic therefrom, and at least one other signal; and a secure region within the integrated circuit substrate and isolated from the main logic.

[0012] The safety zone is configured to: generate at least one analog fault signal from the at least one analog signal, the analog fault signal indicating whether an incorrect operation of the main logic has occurred; generate at least one digital fault signal from the at least one digital signal indicating whether an incorrect operation of the main logic has occurred; and generate an output signal and a feedback signal based on the at least one analog fault signal, the at least one digital fault signal, and the at least one other signal, the output signal causing the at least one external component to perform a desired function in response to an incorrect operation of the main logic, the feedback signal indicating that an incorrect operation of the main logic has not yet occurred.

[0013] A security area checker circuit is located within the integrated circuit substrate and outside the security area. The security area checker circuit includes: first logic receiving at least one analog fault signal and at least one digital fault signal as inputs, the first logic generating a first logic output indicating that either the at least one analog fault signal or the at least one digital fault signal indicates that an incorrect operation of the main logic has occurred; second logic receiving the first logic output and at least one other signal as inputs, the second logic generating a second logic output; a first comparator circuit receiving the second logic output and either the output signal or the feedback signal as inputs, the first comparator circuit asserting a first check signal in response to a logic level mismatch between the inputs of the first comparator circuit; a second comparator circuit receiving the first logic output and either the output signal or the feedback signal as inputs, the second comparator circuit asserting a second check signal in response to a logic level mismatch between the inputs of the second comparator circuit; and an OR circuit receiving the first and second check signals as inputs, and generating an error check signal in response to either the first or second check signal being asserted.

[0014] A secure area can be isolated by at least one deep trench.

[0015] The safe zone can be isolated by two concentric deep trenches.

[0016] The security area inspector circuit may also include a synchronization circuit, through which the at least one analog fault signal is passed before being coupled to the first logic.

[0017] The first logic can include AND gates.

[0018] The filter can be configured to filter the error checking signal.

[0019] This document also discloses an integrated circuit chip, comprising: an integrated circuit substrate; main logic within the integrated circuit substrate, the main logic being configured to control at least one external component, the main logic being further configured to generate a plurality of signals from which correct operation of the main logic can be determined, and to generate at least one other signal; and a plurality of security regions within the integrated circuit substrate and isolated from the main logic.

[0020] Each security zone can be configured to: generate multiple fault signals from some of the multiple signals indicating whether an incorrect operation of the main logic has occurred; and generate an output signal and a feedback signal based on the multiple fault signals and the at least one other signal, wherein the output signal causes the at least one external component to perform a desired function in response to an incorrect operation of the main logic, and the feedback signal indicates that an incorrect operation of the main logic has not yet occurred.

[0021] Multiple security area checker circuits are located within the integrated circuit substrate and outside the security areas. Each security area checker circuit is associated with one of the multiple security areas, which includes: first logic receiving the multiple fault signals as inputs, the first logic generating a first logic output indicating whether the multiple fault signals indicate that an incorrect operation of the main logic has occurred; second logic receiving the first logic output and the at least one other signal as inputs, the second logic generating a second logic output; a first comparator circuit receiving the second logic output and the output signal or the feedback signal as inputs, the first comparator circuit asserting a first check signal in response to a logic level mismatch between the inputs of the first comparator circuit; a second comparator circuit receiving the first logic output and the output signal or the feedback signal as inputs, the second comparator circuit asserting a second check signal in response to a logic level mismatch between the inputs of the second comparator circuit; or an OR circuit receiving the first and second check signals as inputs and generating an error check signal in response to either the first or second check signal being asserted.

[0022] The first master OR circuit receives error check signals as input from each of the multiple security zone checker circuits and generates an intermediate error check signal based on the error check signals. The second master OR circuit receives the intermediate error check signal and the final error check output as input. The flip-flop receives the output from the second master OR circuit as input and generates the final error check output as output.

[0023] There can be a filter through which the error checking signal is passed before being coupled to the second master or circuit.

[0024] Each security zone can be isolated by at least one deep trench.

[0025] Each secure zone can be isolated by two concentric deep trenches.

[0026] Each security zone checker circuit may also include a synchronization circuit through which some of the multiple fault signals are passed before being coupled to the first logic.

[0027] The first logic can include AND gates.

[0028] The filter can be configured to filter the error checking signal. Attached Figure Description

[0029] Figure 1A It is a block diagram of a first vehicle system including a safety zone that provides an alternative bypass for the vehicle circuitry within the main logic circuitry.

[0030] Figure 1B This is a block diagram of a second vehicle system that can use an excitation generation circuit and a result checker to check the safety circuit itself.

[0031] Figure 1C This is a block diagram of a third vehicle system that can check the safety circuit itself by copying the safety area and safety circuit and comparing the outputs of those safety circuits to see if they are the same.

[0032] Figure 2 This is a block diagram of a safe area outside the alternative path for vehicle circuits within the main logic circuit, as described in this article.

[0033] Figure 3 It is used for inspection Figure 2 A block diagram of the circuit for checking the correct operation of the safety zone.

[0034] Figure 4 It utilizes multiple checker circuits (e.g.) Figure 3 A block diagram of a checker system (with checker circuitry) to provide additional error detection for multiple different security zones.

[0035] Figure 5 yes Figure 4 A block diagram of a variant of the inspector system.

[0036] Figure 6 This is a block diagram of a safe area outside the alternative path for vehicle circuits within the main logic circuit, as described in this article.

[0037] Figure 7 It is used for Figure 6 Block diagram of the inspector circuit for the safe area. Detailed Implementation

[0038] The following disclosure enables those skilled in the art to make and use the subject matter disclosed herein. The general principles described herein can be applied to embodiments and applications other than those detailed above, without departing from the spirit and scope of this disclosure. This disclosure is not intended to be limited to the embodiments shown, but is consistent with the widest scope of the principles and features disclosed or suggested herein.

[0039] Now for reference Figure 2 and Figure 3 The vehicle system is described, comprising main logic 11, a safety zone 12', and a safety checker 16' located within a single integrated circuit chip 20. The safety checker 16' receives inputs from the safety zone 12' and is used to determine, based on these inputs, whether the safety zone 12' is operating correctly. The output of the safety checker 16', labeled CHECK_ERR, indicates whether the safety zone 12' is operating correctly. Vehicle components 18, such as transmission components, are located outside the single integrated circuit chip 20.

[0040] The safety region 12' is located within the region of the silicon substrate surrounded on all sides by two concentric deep trench isolations 27a and 27b, and the safety circuit 13' is located within the region surrounded by the deep trench isolation 27b, with the deep trench isolation 27a surrounding the deep trench isolation 27b.

[0041] Safety circuit 13' is located within safety area 12', thereby protecting signals propagating within safety circuit 13' from short circuits to ground and to the vehicle's battery voltage. Therefore, nested deep trench isolations 27a and 27b prevent external faults from propagating within safety area 12' and affecting safety circuit 13'.

[0042] The security inspector 16' can be used with any security area containing any security circuit 13'. Therefore, a general case is described first to illustrate the scope of this disclosure, followed by specific examples.

[0043] Safety circuit 13' includes, for example, a cascade stage 13a' and a fine stage 13b'. Cascade stage 13a' receives input from outside safety zone 12'. Fine stage 13b' receives input from cascade stage 13a' and can also receive input from outside safety zone 12'. Fine stage 13b' can output one or more feedback signals FBK to main logic 11 to indicate whether an error related to the operation of main logic 11 has been detected. If the feedback signal FBK indicates that an error has been detected, main logic 11 can take action, for example, by resetting or shutting down vehicle component 18 or sub-components within vehicle component 18, such as valve actuators.

[0044] Cascade stage 13a' receives one or more signals as input from outside safe zone 12'. The input signals may include one or more digital signals DIGITAL_IN, one or more analog signals ANALOG_IN, one or more power signals PWR_IN, and one or more control signals CTRL_IN. Cascade stage 13a' processes the input signals to generate intermediate signals. The intermediate signals include one or more digital signals DIGITAL_INT, one or more digital representations of the analog signals ANALOG_INT, one or more power signals PWR_INT, and one or more control signals CTRL_INT. The analog signals ANALOG_IN may have a high voltage, such as approximately 40V, and cascade stage 13a' converts the analog signals ANALOG_IN into diagnostic digital signals before its evaluation, for example, by using a comparator to convert the analog signals ANALOG_IN into the diagnostic digital signals ANALOG_INT. The analog signals ANALOG_IN may be passed through a resistor divider and / or a cascode circuit before being input to safe zone 12'.

[0045] For example, when an input signal indicates an error has occurred within main logic 11, cascade stage 13a' can, for example, assert certain intermediate signals (to activate high or low levels). For instance, if the corresponding analog input signal ANALOG_IN indicates a fault has occurred within main logic 11, then safety circuit 13a' can assert one or more of the digital representations of the analog input signal ANALOG_INT, and if the corresponding digital input signal DIGITAL_IN indicates a fault has occurred within main logic 11, then fine stage 13b' can assert one or more of the digital input signal DIGITAL_INT.

[0046] The fine-level 13b' receives the intermediate signal and thereby generates a feedback signal FBK to the main logic 11, and thereby generates an output OUT to the vehicle component 18, which can, for example, directly reset or shut down the vehicle component 18 or its sub-components in response to a fault detection within the main logic 11.

[0047] As described above, the safety checker 16' verifies the correct operation of the safety circuit 13'. The safety checker 16' includes an input AND gate 62 that performs a logical AND operation on the intermediate signals DIGITAL_INT and ANALOG_INT, which are asserted (or not asserted) by the cascade stage 13a', when a fault is detected within the main logic 11. Note that the digital representation of the analog intermediate signal ANALOG_INT is passed through synchronizer 61 (e.g., each is a pair of daisy-chain flip-flops) before being input to AND gate 62. Also note that, although not shown, any digital representation of the analog intermediate signal ANALOG_INT or the digital intermediate signal DIGITAL_INT at a low level is passed through an inverter before being input to AND gate 62.

[0048] Optional combinational logic circuits 63 and 64 can receive the internal control signal CTRL_INT, perform combinational logic on the output of AND gate 62 and the internal control signal CTRL_INT, and provide the output to comparator circuits 67 and 68; when one or both combinational logic circuits 63 and 64 are not present, the output of AND gate 62 is directly provided to the relevant comparator circuit 67 or 68.

[0049] In some instances, input AND gate 62 can receive one or more of the digital representations of the analog input signal ANALOG_IN or the digital input signal DIGITAL_IN. Furthermore, in some cases, one or both of logic circuits 63 and 64 can additionally or alternatively receive one or more control signals CTRL as inputs.

[0050] Comparator circuit 67 receives the feedback signal FBK synchronized by synchronization circuit 65 and the output of combinational logic circuit 63 (or the output of AND gate 62) as input; if the signals do not have the same logic state, comparator circuit 67 asserts the check signal CHECK_1. Comparator circuit 68 receives the output signal OUT synchronized by synchronization circuit 66 and the output of combinational logic circuit 63 (or the output of AND gate 62) as input; if the signals do not have the same logic state, comparator circuit 68 asserts the check signal CHECK_2.

[0051] The logic OR gate 69 performs a logical OR operation on the check signals CHECK_1 and CHECK_2, and provides the result to the filter 70 to generate the error check signal CHECK_ERR. If the error check signal CHECK_ERR is asserted, it means that a fault has been detected in the safety circuit 13', and the main logic 11 can take action accordingly.

[0052] like Figure 4As shown, multiple such security inspectors 16a' and 16b' can be used within a single integrated circuit chip for additional redundancy, or different security inspectors 16a' and 16b' can be used within a single integrated circuit chip to inspect different security areas 12' within the single integrated circuit chip. In summary, Figure 4 The diagram illustrates a multi-checker arrangement 80, in which the outputs CHECK_ERR_1 and CHECK_ERR_2 of safety checkers 16a' and 16b' are passed to OR gate 51 as input. The output of OR gate 51 is passed to OR gate 53 as input, and OR gate 53 also receives an output error flag ERR_FLAG as input. The output of OR gate 53 is passed as input to flip-flop 54, which generates the output error flag ERR_FLAG as output. By using this multi-checker arrangement 80, a single error flag ERR_FLAG can be used to indicate whether a fault has occurred within one or more safety zones 12'.

[0053] Figure 5 A similar arrangement is shown, but it can be seen that the output of OR gate 51 is filtered by filter (FLT) 52 before being passed as input to OR gate 53. Due to the presence of filter 52, filter 70 can be removed from security checkers 16a' and 16b'.

[0054] The benefits provided by security checker 16' are obvious. For example, security checker 16' provides a complete inspection of security circuit 13' without needing to replicate security region 12' and without needing excitation generation circuitry that generates known inputs to security circuit 13', allowing outputs to be checked against known outputs, thereby reducing complexity and area consumption within chip 20. Instead, as explained, security checker 16' includes circuitry configured to generate the same outputs to security circuit 13' if it operates correctly, given certain inputs identical to those of security circuit 13'.

[0055] Also due to this design, the safety inspector 16' can operate continuously during operation, generating near-immediate real-time fault detection. Furthermore, the safety inspector 16' can include built-in self-test (BIST) logic to verify the correct operation of the safety circuit 13' upon chip 20 startup. Additionally, the safety inspector 16' itself can be designed for testing, allowing it to be tested during back-end manufacturing processes using scanning techniques by an automated test equipment (ATE), or by automated test pattern generation (ATPG) techniques. Moreover, the safety inspector 16' allows the ATE to test the safety region 12' without requiring the ATE to apply a signal to the safety region 12'—once the ATE has verified that the safety inspector 16' is operating correctly, the safety inspector 16' can then be used to test the safety region 12'.

[0056] Now refer to Figure 6 and Figure 7 The specific examples of security area 12' and security inspector 16' described are for illustrative purposes only, and this disclosure is by no means intended to be limited to these specific embodiments.

[0057] The safety circuit is located within the safety area 12', thereby protecting signals propagating within the safety circuit 13' from ground short circuits and vehicle battery voltage short circuits. Therefore, nested deep trench isolations 27a and 27b prevent external faults from propagating within the safety area 12' and affecting the safety circuit 13'.

[0058] The safety circuit 13' includes an internally isolated voltage source 40 that generates an internal power supply voltage Vsupp (e.g., 3.3V), a separate bandgap voltage generator 39 that generates a bandgap voltage Bgap for an internal monitor within the safety zone 12', and a voltage regulator 38 that generates an regulated voltage Vreg (e.g., 5V).

[0059] Internal integrated logic circuit 33 receives externally generated digital fault signals FAULT_DIGITAL_1 and FAULT_DIGITAL_2, thereby determining whether a fault has occurred within the individual integrated circuit chip 20 outside the safety region 12'. The first digital fault signal FAULT_DIGITAL_1 can be a watchdog signal from the main logic, whose assertion can indicate a fault. The second digital fault signal FAULT_DIGITAL_2 can be an overcurrent detection signal from the main logic, whose deassertion can indicate a fault.

[0060] The first internal independent monitoring circuit 31 can be an undervoltage monitor, and monitors the main regulation voltage Vmreg from the main logic within the single integrated circuit chip 20. If the main regulation voltage Vmreg is lower than its expected value, it releases the assertion of the first analog fault signal FAULT_ANALOG_1. The second internal independent monitoring circuit 32 can be an overvoltage monitor, and monitors the main regulation voltage Vmreg from the main logic within the single integrated circuit chip 20. If the main regulation voltage Vmreg exceeds its expected value, it asserts the second analog fault signal FAULT_ANALOG_2. The internal integrated logic circuit 33 receives the first analog fault signal FAULT_ANALOG_1 and the second analog fault signal FAULT_ANALOG_2.

[0061] The internal integrated logic circuit 33 generates an output signal to the Schmitt trigger 34, from which the Schmitt trigger 34 generates a safety state echo signal SAFE_STATE_ECHO. The safety state echo signal SAFE_STATE_ECHO can be used to notify the main logic when the safety circuit 13' has detected a fault in the main logic.

[0062] The output of the internal integrated logic circuit 33 is also applied to the buffer 35. When the safety circuit 13' detects a fault in the main logic, the buffer 35 generates a reset signal RESET to reset the appropriate external circuitry (outside the single integrated circuit chip 20). The Schmitt trigger 37 generates an echo of the reset signal RESET labeled RESET_ECHO, which can be provided to the main logic to notify it when a fault has occurred.

[0063] The output of the internal integrated logic circuit 33 is also provided to the integrated logic circuit 36, which receives the external control signal CTRL1 as input and generates an enable signal EN for vehicle components outside the single integrated circuit chip 20, such as a valve actuator in the transmission. Therefore, when a fault is detected, the enable signal EN is deasserted, causing the valve actuator to stop operating.

[0064] The safety checker 16' is now described. The safety checker 16' includes synchronization circuits 41 and 42, which synchronize analog fault signals FAULT_ANALOG_1 and FAULT_ANALOG_2, respectively, and provide synchronized versions of these signals to AND gate 43. AND gate 43 also receives digital fault signals FAULT_DIGITAL_1 and FAULT_DIGITAL_2. Since the digital fault signal FAULT_DIGITAL_2 and the analog fault signal FAULT_ANALOG_1 are active low signals, they are input to AND gate 43 via inverters (displayed as bubbles on those inputs of AND gate 43).

[0065] The reset echo signal RESET_ECHO and / or the safety status echo signal SAFE_STATE_ECHO are synchronized by the synchronization circuit 44 and provided to the comparator circuit 45. The output of AND gate 43 is also provided to the comparator circuit 45. If the logic level of the output of AND gate 43 matches the logic level of the output of the synchronization circuit 44, the first check signal CHECK_1 is asserted.

[0066] Logic circuit 46 receives the control signal CTRL1 and the output of AND gate 43, performs combinational logic functions on it, and provides its output to comparator circuit device 48. The enable signal EN is transmitted to comparator circuit device 48 via synchronization circuit 47. Comparator circuit device 48 compares the logic level of the enable signal EN with the logic level of the output of logic circuit 46. If the logic level of the output of logic circuit 46 matches the logic level of the enable signal EN, the second check signal CHECK_2 is asserted.

[0067] OR gate 49 performs a logical OR operation on the logic levels of the first check signal CHECK_1 and the second check signal CHECK_2, and asserts its output if either the first check signal CHECK_1 or the second check signal CHECK_2 is asserted. The output of OR gate 49 is filtered by filter 50 to generate an error signal CHECK_ERR. If the error signal CHECK_ERR is asserted, the safety circuit 13' within the safety area 12' has failed.

[0068] Obviously, modifications and changes can be made to the content described and shown herein without departing from the scope of this disclosure as defined by the appended claims.

[0069] Although the invention has been described with respect to a limited number of embodiments, those skilled in the art to which this invention pertains will understand that other embodiments may be conceived without departing from the scope of the invention disclosed herein. Therefore, the scope of this disclosure will be limited only by the appended claims.

Claims

1. An integrated circuit chip, comprising: Integrated circuit substrate; The main logic, within the integrated circuit substrate, is configured to control at least one external component, and is further configured to generate at least one digital signal, at least one analog signal, and at least one other signal, wherein correct operation of the main logic can be determined from the at least one digital signal, and correct operation of the main logic can be determined from the at least one analog signal. A secure region, located within the integrated circuit substrate and isolated from the main logic, is configured as follows: At least one analog fault signal is generated from the at least one analog signal, the at least one analog fault signal indicating whether an incorrect operation of the main logic has occurred; Generate at least one digital fault signal from the at least one digital signal to indicate whether an incorrect operation of the main logic has occurred; An output signal and a feedback signal are generated based on the at least one analog fault signal, the at least one digital fault signal, and the at least one other signal. The output signal causes the at least one external component to perform a desired function in response to an incorrect operation of the main logic, and the feedback signal indicates that the incorrect operation of the main logic has not yet occurred. as well as A security area inspector circuit, located within the integrated circuit substrate and outside the security area, the security area inspector circuit comprising: A first logic receives at least one analog fault signal and at least one digital fault signal as inputs, and generates a first logic output, wherein the first logic output indicates that either the at least one analog fault signal or the at least one digital fault signal indicates that an incorrect operation of the main logic has occurred. The second logic receives the output of the first logic and the at least one other signal as input, and generates a second logic output. A first comparison circuit receives the second logic output and the output signal or the feedback signal as inputs, and asserts a first check signal in response to a logic level mismatch between the inputs of the first comparison circuit. A second comparison circuit receives the first logic output and the output signal or the feedback signal as inputs, and asserts a second check signal in response to a logic level mismatch between its inputs; and Alternatively, a circuit may receive the first check signal and the second check signal as inputs, and generate an error check signal in response to an assertion of either the first check signal or the second check signal.

2. The integrated circuit chip of claim 1, wherein the security region is isolated by at least one deep trench isolation.

3. The integrated circuit chip according to claim 1, wherein the security region is isolated by two concentric deep trenches.

4. The integrated circuit chip of claim 1, wherein the security area checker circuit further includes a synchronization circuit, wherein the at least one analog fault signal is passed through the synchronization circuit before being coupled to the first logic.

5. The integrated circuit chip according to claim 1, wherein the first logic includes an AND gate.

6. The integrated circuit chip of claim 1, further comprising a filter configured to filter the error checking signal.

7. An integrated circuit chip, comprising: Integrated circuit substrate; The main logic, within the integrated circuit substrate, is configured to control at least one external component, and is further configured to generate multiple signals and at least one other signal, the correct operation of which can be determined from the multiple signals. Multiple security regions are located within the integrated circuit substrate and isolated from the main logic. Each security region is configured as follows: Generate multiple fault signals from some of the multiple signals to indicate whether an incorrect operation of the main logic has occurred; An output signal and a feedback signal are generated based on the plurality of fault signals and the at least one other signal. The output signal causes the at least one external component to perform a desired function in response to an incorrect operation of the main logic. The feedback signal indicates that the incorrect operation of the main logic has not occurred. Multiple security area inspector circuits are located within the integrated circuit substrate and outside the security areas. Each security area inspector circuit is associated with one of the multiple security areas and includes: The first logic receives the multiple fault signals as input, generates a first logic output, and the first logic output indicates whether the multiple fault signals indicate that an incorrect operation of the main logic has occurred. The second logic receives the output of the first logic and the at least one other signal as input, and generates a second logic output. A first comparison circuit receives the second logic output and the output signal or the feedback signal as inputs, and asserts a first check signal in response to a logic level mismatch between the inputs of the first comparison circuit. A second comparison circuit receives the first logic output and the output signal or the feedback signal as inputs, and asserts a second check signal in response to a logic level mismatch between its inputs; and Alternatively, a circuit may receive the first check signal and the second check signal as inputs, and generate an error check signal in response to either the first check signal or the second check signal being asserted. The first main OR circuit receives the error check signal from each of the plurality of security zone checker circuits as input, and generates an intermediate error check signal based on the error check signal. The second main or secondary circuit receives the intermediate error check signal and the final error check output as inputs; and The trigger receives the output from the second master OR circuit as input and generates the final error check output as output.

8. The integrated circuit chip of claim 7, further comprising: The intermediate error check signal is passed through the filter before being coupled to the second master OR circuit.

9. The integrated circuit chip of claim 7, wherein each security region is isolated by at least one deep trench isolation.

10. The integrated circuit chip of claim 7, wherein each security region is isolated by two concentric deep trenches.

11. The integrated circuit chip of claim 7, wherein each security area checker circuit further includes a synchronization circuit, wherein some of the plurality of fault signals are passed through the synchronization circuit before being coupled to the first logic.

12. The integrated circuit chip of claim 7, wherein the first logic comprises an AND gate.

13. The integrated circuit chip of claim 7, further comprising: A filter is configured to filter the error checking signal.

Images