Independent secure isolated area with integrated protection for power and signal lines

Abstract

Disclosed herein are independent safety isolation regions with integrated protection for power and signal lines. A single integrated circuit chip with a main logic that operates a vehicle component such as a valve driver. Isolated from the main logic within the chip is a safety region that is used to verify proper operation of the main logic. The safety region is internally powered by an internal regulated voltage generated by an internal voltage regulator that generates the internal regulated voltage from an external voltage while preventing shorting of external lines that carry the external voltage. The safety region includes protection circuitry that moves voltage levels of external analog signals down for monitoring within the safety region, the protection circuitry used to prevent shorting of external lines that carry the external analog signals.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of testing circuits and, in particular, to testing circuits within a dedicated "safety region" within an integrated circuit chip, powered by a protected internal integrated voltage supply and having protection circuits to protect input signal lines from shorting to high voltages. BACKGROUND

[0002] Modern vehicles are increasingly equipped with various safety systems, particularly given the fact that such modern vehicles increasingly utilize drive-by-wire controls to receive driver input. For example, instead of a vehicle's steering wheel, brake pedal, and accelerator pedal being mechanically connected to hydraulic or cable systems for controlling the vehicle, one or more of such controls can be connected to a sensing device that communicates the driver's intent to a controller, which in turn implements the driver's intent, potentially with modifications to safety.

[0003] For example, when a driver depresses an accelerator pedal to request that rotational torque be applied to the vehicle's drive wheels, instead of a cable that mechanically operates a component of the vehicle's engine (e.g., a throttle blade) in response to the accelerator pedal's operation, the accelerator pedal can cooperate with a sensor device to generate an electrical output that is ultimately provided to a transmission controller and a throttle blade controller. The transmission controller, in turn, controls the vehicle's transmission, for example, by actuating valve drivers that control shifting of transmission gears. Since the transmission controller actually controls the transmission rather than the driver, it is desirable to perform fault detection to determine whether the controller is operating correctly.

[0004] Due to this requirement for safety in drive-by-wire vehicle controls, the ISO 26262 standard was developed to include an Automotive Safety Integrity Level (ASIL) risk classification scheme. The ASIL levels range from ASIL-A (lowest) to ASIL-D (highest). The ASIL level is determined by three factors, namely, the severity of the fault, the probability of the fault occurring, and the ability to control the effects of the fault.

[0005] For vehicle components that directly control the motion of the vehicle, such as the drive train and braking systems, ASIL-D applies and not only must faults be carefully detected, but also the circuits and components used to check for these faults must be checked and verified to be operating properly.

[0006] One of the most common requirements for a transmission controller under ASIL-D is to guarantee a safe shutdown of the power stage, such as can include a failsafe pre-driver and a valve driver. The shutdown is to be guaranteed even in the event that the common shutdown path, which is usually implemented via interaction between a logic core in the power stage and an analog driver block, does not work due to a fault. To this end, redundant shutdown paths and redundant shutdown circuits are usually implemented. Such redundant shutdown paths are usually integrated within a protected area isolated by deep trench isolation. This protected area is usually referred to as a "safety area".

[0007] In Figure 1 One such arrangement can be seen in Figure 1. Here, a vehicle system 10 comprises a main logic 11, such as a transmission controller, in communication with safety circuits 13 within a safety area 12. The safety circuits 13 determine whether the main logic 11 is operating correctly and provide an alternative shutdown path in the event that a fault is detected.

[0008] The safety circuits 13 within the safety area 12 are to operate completely independently of the main logic 11 and other functions within the integrated circuit chip 10, and as such, their design includes, amongst other features, an independent isolated voltage. Current designs achieve this by completely isolating the supply line into the safety area 12 from the rest of the integrated circuit chip 10, thus requiring a separate isolated power pin to avoid a fault that could affect both the safety area 12 and the blocks driven by the safety area 12, and involving a large die area for isolating the supply line. While this does solve the problem, the disadvantage for certain applications is undesirable, and thus additional development in this area is required. SUMMARY

[0009] Disclosed herein is an integrated circuit chip comprising: an integrated circuit substrate; a main logic within the integrated circuit substrate, the main logic configured to control at least one external component, the main logic further configured to generate at least one digital signal that can determine proper operation of the main logic and at least one analog signal that can determine proper operation of the main logic; and a secure region within the integrated circuit substrate and isolated from the main logic. The secure region comprises: an internal voltage regulator configured to receive an external supply voltage via an external supply voltage line and generate an internal regulated voltage from the external supply voltage, the internal voltage regulator configured to protect circuits within the secure region from a short of the external supply voltage line to other voltages; and a protection circuit configured to receive the at least one analog signal through an external analog input line and generate at least one analog fault signal from the at least one analog signal by down-level shifting a voltage of the at least one analog signal to produce the at least one analog fault signal, the protection circuit configured to protect circuits within the secure region from a short of the external analog input line to other voltages. The secure region further comprises a secure circuit powered by the internal regulated voltage and configured to: generate at least one analog internal signal from the at least one analog fault signal that indicates whether an improper operation of the main logic has occurred; generate at least one digital fault signal from the at least one digital signal that indicates whether the improper operation of the main logic has occurred; and generate, based on the at least one analog internal signal and the at least one digital fault signal, an output signal that causes the at least one external component to perform a desired function in response to the improper operation of the main logic and a feedback signal that indicates that the improper operation of the main logic has not occurred.

[0010] The protection circuit can comprise an input resistor coupled to a level shifter, wherein a cathode of the avalanche diode is coupled to a tap between the input resistor and the level shifter, and an anode of the avalanche diode is coupled to ground, wherein the level shifter is configured to move a voltage of the at least one analog signal down to produce the at least one analog fault signal.

[0011] The avalanche diode can be a Zener diode.

[0012] The internal voltage regulator can comprise: a reference voltage generator connected between an internal node and ground, the internal node coupled to the external supply voltage line, the reference voltage generator configured to generate a reference voltage from the external supply voltage on the external supply voltage line; an avalanche diode coupled between the internal node and ground, the avalanche diode configured to protect the internal voltage regulator from a short of the external supply voltage line to other voltages; and a cascode circuit coupled to the reference voltage as an input and configured to generate the internal regulated voltage from the external supply voltage.

[0013] The internal voltage regulator can further include a voltage divider coupled between the external supply voltage line and ground, wherein a tap of the voltage divider is coupled to the internal node.

[0014] The internal voltage regulator can further include a first resistor coupled between the external supply voltage line and the internal node, and a second resistor coupled between the internal node and ground.

[0015] The cascode circuit can include a first transistor having a first conductive terminal coupled to the external supply voltage line, a second conductive terminal, and a control terminal coupled to the internal node, and a second transistor having a first conductive terminal coupled to the second conductive terminal of the first transistor, a second conductive terminal generating the internal regulated voltage, and a control terminal coupled to the internal node.

[0016] The cascode circuit can include a first n-channel transistor having a drain coupled to the external supply voltage, a source, and a gate coupled to the internal node, and a second n-channel transistor having a drain coupled to the source of the first n-channel transistor, a source coupled to ground, and a gate coupled to the internal node.

[0017] The reference voltage generator can include a plurality of diode-connected transistors connected between the internal node and ground.

[0018] The reference voltage generator can include a first n-channel transistor having a drain coupled to the internal node, a source, and a gate coupled to the internal node, a second n-channel transistor having a drain coupled to the source of the first n-channel transistor, a source, and a gate coupled to the source of the first n-channel transistor, and a third n-channel transistor having a drain coupled to the source of the second n-channel transistor, a source coupled to ground, and a gate coupled to the source of the second n-channel transistor.

[0019] The safe region can be isolated by at least one deep trench isolation.

[0020] The safe region can be isolated by two concentric deep trench isolations.

[0021] Disclosed herein is an integrated circuit chip comprising: an integrated circuit substrate; a main logic within the integrated circuit substrate, the main logic configured to control at least one external component; and a secure region within the integrated circuit substrate and surrounded by at least one deep trench isolation. The secure region can comprise: an internal voltage regulator having: a reference voltage generator connected between an internal node and ground, the internal node coupled to an external supply voltage line to receive an external supply voltage, the reference voltage generator configured to generate a reference voltage from the external supply voltage on the external supply voltage line; an avalanche diode coupled between the internal node and ground, the avalanche diode configured to protect the internal voltage regulator from a short of the external supply voltage line to other voltages; and a common-source common-gate circuit coupled to the reference voltage as an input and configured to generate an internal regulated voltage from the external supply voltage. A protection circuit comprises an input resistor coupled to a level shifter, wherein a cathode of the avalanche diode is coupled to a tap between the input resistor and the level shifter, and an anode of the avalanche diode is coupled to ground, wherein the level shifter is configured to shift down a voltage of at least one analog signal received from outside the secure region through an external analog input line to produce at least one analog fault signal. A security circuit is powered by the internal regulated voltage and configured to indicate to the at least one external component whether the main logic experienced a fault.

[0022] The internal voltage regulator can comprise a voltage divider coupled between the external supply voltage line and ground, wherein a tap of the voltage divider is coupled to the internal node.

[0023] The internal voltage regulator can comprise a first resistor coupled between the external supply voltage line and the internal node, and a second resistor coupled between the internal node and ground.

[0024] The common-source common-gate circuit can comprise: a first transistor having a first conductive terminal coupled to the external supply voltage line, a second conductive terminal, and a control terminal coupled to the internal node; and a second transistor having a first conductive terminal coupled to the second conductive terminal of the first transistor, a second conductive terminal producing the internal regulated voltage, and a control terminal coupled to the internal node.

[0025] The common-source common-gate circuit can comprise: a first n-channel transistor having a drain coupled to the external supply voltage, a source, and a gate coupled to the internal node; and a second n-channel transistor having a drain coupled to the source of the first n-channel transistor, a source coupled to ground, and a gate coupled to the internal node.

[0026] The reference voltage generator can comprise a plurality of diode-connected transistors connected between the internal node and ground.

[0027] The reference voltage generator can include a first n-channel transistor having a drain coupled to an internal node, a source, and a gate coupled to the internal node; a second n-channel transistor having a drain coupled to the source of the first n-channel transistor, a source, and a gate coupled to the source of the first n-channel transistor; and a third n-channel transistor having a drain coupled to the source of the second n-channel transistor, a source coupled to ground, and a gate coupled to the source of the second n-channel transistor. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 is a block diagram of a prior art integrated circuit chip that utilizes an internal isolated safe region to verify correct operation of master logic within the integrated circuit chip.

[0029] Figure 2 is a block diagram of a vehicle system that includes an integrated circuit chip that includes an isolated safe region within the integrated circuit chip for verifying correct operation of master logic also within the integrated circuit chip, the isolated safe region including an internal voltage regulator for providing an internally protected supply voltage for safe circuits within the safe region, and the isolated safe region further including a protection circuit for protecting the safe circuits within the safe region from high voltage input signals.

[0030] Figure 3 is Figure 2 is a schematic diagram of the protection circuit of

[0031] Figure 4 is a schematic diagram of the internal voltage regulator.

[0032] Figure 5 is a block diagram of another embodiment of a vehicle system that includes an integrated circuit chip that includes an isolated safe region within the integrated circuit chip for verifying correct operation of master logic also within the integrated circuit chip, the isolated safe region including an internal voltage regulator for providing an internally protected supply voltage for safe circuits within the safe region, and the isolated safe region further including a protection circuit for protecting the safe circuits within the safe region from high voltage input signals. DETAILED DESCRIPTION

[0033] The following disclosure enables a person skilled in the art to make and use the subject matter disclosed herein. The general principles described herein can be applied to embodiments and applications other than the embodiments described above and detailed in the detailed description. The present disclosure is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed or suggested herein. Note that in the following description, any described resistor or resistance is a discrete device, unless stated to the contrary, and is not simply an electrical lead between two points. Thus, any described resistor or resistance coupled between two points has a greater resistance than the lead between those two points, and such resistor or resistance cannot be interpreted as a lead.

[0034] Reference is now made to the following drawings Figure 2 Described is a vehicle system including a main logic 11 and a safety region 12' located within a single integrated circuit chip 20. Vehicle components 18, such as transmission components, are external to the single integrated circuit chip 20.

[0035] The safety region 12' is located within a region of a silicon substrate that is surrounded on four sides by two concentric deep trench isolations 27a and 27b, where the safety circuit 13' is located within a region surrounded by the deep trench isolation 27b, and the deep trench isolation 27a surrounds the deep trench isolation 27b.

[0036] The safety circuit 13' is located within the safety region 12' such that signals propagating within the safety circuit 13' are protected from shorting to ground and shorting to the battery voltage of the vehicle. Thus, the nested isolation features 27a and 27b, including but not limited to deep trench isolation, prevent external faults from propagating within the safety region 12' to affect the safety circuit 13'.

[0037] The safety circuit 13' includes, for example, a cascading stage 13a' and a refinement stage 13b'. The cascading stage 13a' receives input from outside the safety region 12'. The refinement stage 13b' receives input from the cascading stage 13a' and can also receive input from outside the safety region 12'. The refinement stage 13b' can output one or more feedback signals FBK to the main logic 11 indicating whether an error related to operation of the main logic 11 has been detected. If the feedback signal FBK indicates that an error has been detected, the main logic 11 can take action, for example, by resetting or shutting down the vehicle components 18 or subcomponents within the vehicle components 18, such as a valve driver.

[0038] One or more safety signals from outside the safety zone 12' are received as inputs into the safety zone 12'. One or more power signals PWRJN are received by an internal voltage regulator 26 over external supply lines, which generates (as will be described in detail below) an internal regulated voltage VREG for powering the cascaded stage 13a' and the refinement stage 13b'. One or more analog signals ANALOGJN are also received into the safety zone 12' via analog lines, and generate (as will be described in detail below) an analog fault signal FAULT ANALOG by the protection circuit 25, which is communicated to the cascaded stage 13a'. One or more digital signals DIGITALJN and one or more control signals CTRLJN are also received into the safety zone 12', by the protection circuit 25, to generate a digital fault signal FAULT DIGITAL and a control fault signal FAULT CTRL received by the cascaded stage 13a'.

[0039] The cascaded stage 13a' processes its received input signals to generate intermediate signals. The intermediate signals include one or more digital signals DIGITAL INT, one or more digital representations of the analog signal ANALOG INT (generated from the analog fault signal FAULT ANALOG), and one or more control signals CTRL INT. The analog signal ANALOG IN can have a high voltage, e.g., on the order of 40V, and the protection circuit 25 converts the analog signal ANALOG IN to the diagnostic digital signal FAULT ANALOG before it is evaluated by the cascaded stage 13a'.

[0040] For example, the cascaded stage 13a' can assert certain intermediate signals (to a valid high level or a valid low level) when the input signals indicate that a fault has occurred within the primary logic 11. For example, the safety circuit 13a' can assert one or more digital representations of the analog input signal ANALOG INT if the corresponding analog input signal DIGITAL IN indicates that a fault has occurred within the primary logic 11, and the refinement stage 13b' can assert one or more of the digital input signals DIGITAL INT if the corresponding digital input signal DIGITAL IN indicates that a fault has occurred within the primary logic 11.

[0041] The refinement stage 13b' receives the intermediate signals and generates therefrom a feedback signal FBK to the primary logic 11, and generates therefrom an output OUT to the vehicle component 18, e.g., to directly reset or shut down the vehicle component 18 or a subcomponent within the vehicle component 18, e.g., in response to a fault detection within the primary logic 11.

[0042] Reference is now additionally made to Figure 3Details of the protection circuit 25 are given. For example here, the input analog signal ANALOG_IN is shown here as a plurality of numbers from 1 to N and is therefore denoted ANALOG_IN_1,..., ANALOG_IN_N. The input analog signal ANALOG_IN_1 is coupled through a resistor R1 to the input of a level shifter LVL1 which shifts the voltage domain of ANALOG_IN_1 from e.g. 40 V down to 3.3 V, outputting the result as FAULT_ANALOG_1. A Zener diode D1 has its cathode coupled at a tap between the resistor R1 and the level shifter LVL1 and its anode coupled to ground, where the purpose of D1 is to protect the level shifter LVL1 (and thus the cascade stage 13a') from a short of ANALOG_IN_1 to a higher voltage. The input analog signal ANALOG_IN_N is coupled by a resistor RN to the input of a level shifter LVLN which shifts the voltage domain of ANALOG_IN_N from e.g. 40 V down to 3.3 V, outputting the result as FAULT_ANALOG_N. A Zener diode DN has its cathode coupled at a tap between the resistor RN and the level shifter LVLN and its anode coupled to ground, where the purpose of DN is to protect the level shifter LVLN (and thus the cascade stage 13a') from a short of ANALOG_IN_N to a higher voltage. Each ANALOG_IN signal is digitally processed by the cascade stage 13a' depending on whether its voltage is positive or negative, where a positive voltage has a first meaning (e.g. a fault is present) and where a negative voltage has a second meaning (e.g. a fault is not present).

[0043] Note that N can be any number, and thus there can be any number of input analog signals ANALOG_IN and any equal corresponding number of resistors R, Zener diodes D and level shifters LVL, resulting in any number of analog fault signals FAULT_ANALOG. As previously mentioned, the cascade stage 13a' receives the analog fault signals FAULT_ANALOG_1,..., FAULT_ANALOG_N as input.

[0044] The digital input signals DIGITAL_IN here are shown as a number of digits from 1 to M, and are thus denoted DIGITAL_IN_1,..., DIGITAL_IN_M. The digital input signal DIGITAL_IN_1 is coupled through a resistor RR1 to the input of a level shifter or buffer LVLD1. A Zener diode DD1 has its cathode coupled to the resistor RR1 and its anode coupled to ground, where the purpose of DD1 is to protect the cascade stage 13a' from a short circuit of DIGITAL_IN_1 to a higher voltage. The digital input signal DIGITAL_IN_M is coupled through a resistor RRM to the input of a level shifter or buffer LVLDM. A Zener diode DDM has its cathode coupled to the resistor RRM and its anode coupled to ground, where the purpose of DDM is to protect the cascade stage 13a' from a short circuit of DIGITAL_IN_M to a higher voltage. Each DIGITAL_IN signal is digitally processed by the cascade stage 13a' according to whether its voltage is a logic high or low, where a logic high voltage has a first meaning (e.g. a fault is present), and where a logic low voltage has a second meaning (e.g. a fault is not present).

[0045] Note that M can be any number, and thus there can be any number of digital input signals DIGITAL_IN, and any equal corresponding number of resistors RR, level shifters or buffers LVLD and Zener diodes DD, resulting in any number of digital fault signals FAULT_DIGITAL. As previously mentioned, the cascade stage 13a' receives the digital fault signals FAULT_DIGITAL_1,..., FAULT_DIGITAL_M as input.

[0046] The control signals CTRL_IN here are shown as a number of digits from 1 to O, and are thus denoted CTRL_IN_1,..., CTRL_IN_O. The control signal CTRL_IN_1 is coupled through a resistor RRR1 to the input of a level shifter or buffer LVLC1. A Zener diode DDD1 has its cathode coupled to the resistor RRR1 and its anode coupled to ground, where the purpose of DDD1 is to protect the cascade stage 13a' from a short circuit of CTRL_IN_1 to a higher voltage. The control signal CTRL_IN_O is coupled through a resistor RRRO to the input of a level shifter or buffer LVLCO. A Zener diode DDDO has its cathode coupled to the resistor RRRO and its anode coupled to ground, where the purpose of DDDO is to protect the cascade stage 13a' from a short circuit of CTRL_IN_O to a higher voltage. Each CTRL_IN signal is digitally processed by the cascade stage 13a' according to whether its voltage is a logic high or low, where a logic high voltage has a first meaning (e.g. a fault is present), and where a logic low voltage has a second meaning (e.g. a fault is not present).

[0047] Note that O can be any number, so there can be any number of control signals CTRL_IN, and any equal corresponding number of resistors RRR, level shifters or buffers LVLC, and zener diodes DDD, resulting in any number of control fault signals FAULT_CTRL. As mentioned previously, the cascaded stage 13a' receives the control fault signals FAULT_CTRL_1,..., FAULT_CTRL_O as inputs.

[0048] Now additionally referring to Figure 4 Details of the internal voltage regulator 26 are given. The internal voltage regulator 26 includes diode-connected n-channel transistors M3, M4, and M5 coupled in series between a node Nn and ground, with a resistor R4 coupled in parallel with the diode-connected transistors M3, M4, and M5 between the node Nn and ground. A zener diode D3 is also coupled in parallel with the diode-connected transistors M3, M4, and M5 and the resistor R4 between the node Nn and ground, with the cathode of the zener diode D3 coupled to the node Nn and the anode of the zener diode D3 coupled to ground. A resistor R3 is coupled between an input power signal PWR_IN and the node Nn.

[0049] A cascode output stage is formed by n-channel transistors Ml and M2 (e.g., which are high voltage NMOS transistors) coupled in series between the input power signal PWR_IN and an output node from which the internal regulated voltage VREG will be generated, with the drain of Ml coupled to receive the input power signal PWR_IN and the source of Ml coupled to the drain of M2, while the gate of Ml is coupled to the gate of M2. Likewise, the drain of M2 is coupled to the source of Ml, and the source of Ml is coupled to the output node from which the internal regulated voltage VREG will be generated, while the gate of M2 is coupled to the gate of Ml. Both gates of Ml and M2 are coupled to the node Nn.

[0050] The zener diode D3 works with the diode-connected transistors M3-M5 to generate a reference voltage VREF at the node Nn, with the zener diode D3 providing some level of protection in the event that the external supply voltage PWR_IN is a high voltage. This reference voltage VREF is used to turn on the cascode, turning on transistors Ml and M2 to produce the internal regulated voltage VREG. The internal regulated voltage VREG is immune to spikes in the external supply voltage PWR_IN because the high current that would be generated by the zener diode D3 shorting to a high voltage from the external supply voltage PWR_IN is quickly conducted to ground. The cascode formed by Ml and M2 themselves is immune to such spikes in the external supply voltage PWR_IN because the n-channel transistors Ml and M2 are high voltage transistors that can withstand high voltage spikes on PWR_IN.

[0051] Note that diode D3 is represented for simplicity as a Zener diode, and can in fact be a Zener diode, but in some cases can have a bandgap-like structure to provide a particularly stable reference voltage VREF at node Nn.

[0052] For example purposes only, reference is now made to Figure 5 A specific example of a safety region 200 is described, and the present disclosure is in no way intended to be limited to this specific embodiment. Safety circuit 13' is located within safety region 12' such that signals propagating within safety circuit 13' are protected from shorting to ground and shorting to the battery voltage of the vehicle. Thus, the nested deep trench isolations 27a and 27b prevent external faults from propagating within safety region 12' to affect safety circuit 13'.

[0053] Safety region 12' includes an internal isolated voltage regulator 26 that receives an external supply voltage from outside of safety region 12a' via a voltage supply line and generates an internal supply voltage VREG (e.g., 5V) for powering safety circuit 13', and also includes a separate bandgap voltage generator 39 that generates a bandgap voltage VBG (e.g., 3.3V) for internal monitors within the safety region.

[0054] Protection circuits 25a and 25b receive input analog signals ANALOG_IN_1 and ANALOG_IN_2 via analog lines, and protect them and other circuits within safety region 12' from high voltage shorts, and convert them to analog fault signals FAULT_ANALOG_1 and FAULT_ANALOG_2 that are provided to internal integrated logic 33. Protection circuits 25a and 25b have the same structure as described with reference to Figure 3

[0055] ​The internal integrated logic circuit 33 also receives externally generated digital signals DIGITAL IN 1 and DIGITAL IN 2 (which pass through protection circuits 25c, 25d to generate digital fault signals FAULT DIGITAL 1 and FAULT DIGITAL 2 and protect the circuits within the safety zone 12' from shorting to high voltage by DIGITAL IN 1 and DIGITAL IN 2) and externally generated control signals CTRL IN 1 and CTRL IN 2 (which pass through protection circuits 25e, 25f to generate control fault signals FAULT CTRL 1 and FAULT CTRL 2 and protect the circuits within the safety zone 12' from shorting to high voltage by CTRL IN 1 and CTRL IN 2), from which it can determine whether certain faults within the single integrated circuit chip 20 outside the safety zone 12' have occurred. The first digital fault signal FAULT DIGITAL 1 can be a watchdog signal from the main logic, assertion of which can indicate a fault. The second digital fault signal FAULT DIGITAL 2 can be an overcurrent detection signal from the main logic, deassertion of which can indicate a fault. The internal integrated logic circuit 33 generates an output signal to a Schmitt trigger 34, which in turn generates a safety status echo signal SAFE STATE ECHO, which can be used to inform the main logic when the safety circuit 13' detects a fault in the main logic.

[0056] The output of the internal integrated logic circuit 33 is also applied to a buffer 35, which generates a reset signal RESET, which is used to reset appropriate external circuits (external to the single integrated circuit chip 20) when the safety circuit 13' detects a fault in the main logic. A Schmitt trigger 37 generates an echo of the reset signal RESET, labeled RESET ECHO, which can be provided to the main logic to inform the main logic when a fault has occurred therein.

[0057] The output of the internal integrated logic circuit 33 is also provided to an integrated logic circuit 36, which also receives as an input an external control signal CTRL 1 and generates therefrom an enable signal EN for a vehicle component external to the single integrated circuit chip 20, such as a valve driver within a transmission. Thus, when a fault is detected, the enable signal EN is deasserted, and thus the valve driver ceases to operate.

[0058] It will be apparent that modifications and variations can be made to the herein described and illustrated structures without departing from the scope or spirit of the disclosure as defined in the appended claims.

[0059] While the present disclosure has been described with respect to a limited number of embodiments, those skilled in the art will appreciate that other embodiments can be devised without departing from the scope of the present disclosure as disclosed herein. Accordingly, the scope of the present disclosure should be limited only by the appended claims.

Claims

1. An integrated circuit chip comprising: an integrated circuit substrate; a main logic within the integrated circuit substrate, the main logic configured to control at least one external component, the main logic further configured to generate at least one digital signal and at least one analog signal, the correct operation of the main logic being determinable from the at least one digital signal and the correct operation of the main logic being determinable from the at least one analog signal; a safety region within the integrated circuit substrate and isolated from the main logic, the safety region comprising: an internal voltage regulator configured to receive an external supply voltage via an external supply voltage line and generate an internal regulated voltage from the external supply voltage, the internal voltage regulator configured to protect circuitry within the safety region from a short of the external supply voltage line to other voltages; a protection circuit configured to receive the at least one analog signal through an external analog input line and generate at least one analog fault signal from the at least one analog signal by down-level shifting a voltage of the at least one analog signal to produce the at least one analog fault signal, the protection circuit configured to protect circuitry within the safety region from a short of the external analog input line to other voltages; and a safety circuit powered by the internal regulated voltage and configured to: generate at least one analog internal signal from the at least one analog fault signal, the at least one analog internal signal indicating whether an improper operation of the main logic has occurred; generate at least one digital fault signal from the at least one digital signal, the at least one digital fault signal indicating whether an improper operation of the main logic has occurred; and generate an output signal and a feedback signal based on the at least one analog internal signal and the at least one digital fault signal, the output signal causing the at least one external component to perform a desired function in response to an improper operation of the main logic, the feedback signal indicating that an improper operation of the main logic has not occurred.

2. The integrated circuit chip of claim 1, wherein the protection circuit comprises an input resistor coupled to a level shifter, wherein a cathode of an avalanche diode is coupled to a tap between the input resistor and the level shifter, and an anode of the avalanche diode is coupled to ground, wherein the level shifter is configured to move a voltage of the at least one analog signal down to produce the at least one analog fault signal.

3. The integrated circuit chip of claim 2, wherein the avalanche diode comprises a Zener diode.

4. The integrated circuit chip of claim 1, wherein the internal voltage regulator comprises: a reference voltage generator connected between an internal node and ground, the internal node coupled to the external supply voltage line, the reference voltage generator configured to generate a reference voltage from the external supply voltage on the external supply voltage line; an avalanche diode coupled between the internal node and ground, the avalanche diode configured to protect the internal voltage regulator from a short of the external supply voltage line to other voltages; and a feedback resistor coupled between the internal node and ground. A common-source common-gate circuit coupled to the reference voltage as an input and configured to generate the internal regulated voltage from the external supply voltage.

5. The integrated circuit chip of claim 4, wherein the internal voltage regulator further comprises a voltage divider coupled between the external supply voltage line and ground, wherein a tap of the voltage divider is coupled to the internal node.

6. The integrated circuit chip of claim 4, wherein the internal voltage regulator further comprises a first resistor coupled between the external supply voltage line and the internal node, and a second resistor coupled between the internal node and ground.

7. The integrated circuit chip of claim 4, wherein the avalanche diode comprises a Zener diode.

8. The integrated circuit chip of claim 4, wherein the common-source common-gate circuit comprises: a first transistor having: a first conductive terminal coupled to the external supply voltage line; a second conductive terminal; and a control terminal coupled to the internal node; and a second transistor having: a first conductive terminal coupled to the second conductive terminal of the first transistor; a second conductive terminal at which the internal regulated voltage is produced; and a control terminal coupled to the internal node.

9. The integrated circuit chip of claim 4, wherein the common-source common-gate circuit comprises: a first n-channel transistor having: a drain coupled to the external supply voltage; a source; and a gate coupled to the internal node; and a second n-channel transistor having: a drain coupled to the source of the first n-channel transistor; a source coupled to ground; and a gate coupled to the internal node.

10. The integrated circuit chip of claim 4, wherein the reference voltage generator comprises a plurality of diode-connected transistors connected between the internal node and ground.

11. The integrated circuit chip of claim 4, wherein the reference voltage generator comprises: a first n-channel transistor having: a drain coupled to the internal node; a source; and a gate coupled to the internal node; a second n-channel transistor having: a drain coupled to the source of the first n-channel transistor; a source; and a gate coupled to the source of the first n-channel transistor; and a third n-channel transistor having: a drain coupled to the source of the second n-channel transistor; a source coupled to ground; and a gate coupled to the source of the second n-channel transistor.

12. The integrated circuit chip of claim 1, wherein the secure region is isolated by at least one deep trench isolation.

13. The integrated circuit chip of claim 1, wherein the secure region is isolated by two concentric deep trench isolations.

14. An integrated circuit chip, comprising: an integrated circuit substrate; main logic within the integrated circuit substrate, the main logic configured to control at least one external component; a secure region within the integrated circuit substrate and surrounded by at least one deep trench isolation, the secure region comprising: ​ ​ ​ ​ ； ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ An internal voltage regulator comprising: a reference voltage generator connected between an internal node and ground, the internal node being coupled to an external supply voltage line to receive an external supply voltage, the reference voltage generator being configured to generate a reference voltage from the external supply voltage on the external supply voltage line; an avalanche diode coupled between the internal node and ground, the avalanche diode being configured to protect the internal voltage regulator from a short circuit of the external supply voltage line to other voltages; and a cascode circuit coupled to the reference voltage as an input and configured to generate an internal regulated voltage from the external supply voltage; a protection circuit comprising an input resistor coupled to a level shifter, wherein a cathode of the avalanche diode is coupled to a tap between the input resistor and the level shifter, and an anode of the avalanche diode is coupled to ground, wherein the level shifter is configured to shift down a voltage of at least one analog signal received from outside the safety region through an external analog input line to produce at least one analog fault signal; and a safety circuit powered by the internal regulated voltage and configured to indicate to the at least one external component whether the main logic has experienced a fault.

15. The integrated circuit chip of claim 14, wherein the internal voltage regulator further comprises a voltage divider coupled between the external supply voltage line and ground, wherein, The tap of the voltage divider is coupled to the internal node.

16. The integrated circuit chip of claim 14, wherein the internal voltage regulator further comprises: a first resistor coupled between the external supply voltage line and the internal node; and a second resistor coupled between the internal node and ground.

17. The integrated circuit chip of claim 14, wherein the avalanche diode comprises a Zener diode.

18. The integrated circuit chip of claim 14, wherein the cascode circuit comprises: a first transistor having: a first conductive terminal coupled to the external supply voltage line; a second conductive terminal; and a control terminal coupled to the internal node; and a second transistor having: a first conductive terminal coupled to the second conductive terminal of the first transistor; a second conductive terminal at which the internal regulated voltage is generated; and a control terminal coupled to the internal node.

19. The integrated circuit chip of claim 14, wherein the cascode circuit comprises: a first n-channel transistor having: a drain coupled to the external supply voltage; a source; and a gate coupled to the internal node; and a second n-channel transistor having: a drain coupled to the source of the first n-channel transistor; a source coupled to ground; and a gate coupled to the internal node.

20. The integrated circuit chip of claim 14, wherein the reference voltage generator comprises a plurality of diode-connected transistors connected between the internal node and ground.

21. The integrated circuit chip of claim 14, wherein the reference voltage generator comprises: a first n-channel transistor having: a drain coupled to the internal node; a source; and a gate coupled to the internal node; and a second n-channel transistor having a drain coupled to the source of the first n-channel transistor; a source; and a gate coupled to the internal node. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ； ​ ​ ​ and a gate coupled to the source of the first n-channel transistor; and a third n-channel transistor having a drain coupled to the source of the second n-channel transistor; a source coupled to ground; and a gate coupled to the source of the second n-channel transistor.

Images