Voltage monitoring using hierarchical techniques in safety critical applications

Abstract

The invention discloses an integrated circuit. The integrated circuit can operate voltage monitoring of one or more electronic components using a grading technique. An apparatus may include a digital controller implemented in a hierarchical structure that may be instantiated closer to a set of sensors that are then indirectly monitored by other digital controllers.

Description

[0001] Cross - Reference to Related Applications

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 627,717, filed on January 31, 2024, entitled "VOLTAGE MONITORING USING HIERARCHICAL TECHNIQUES FOR SAFETY CRITICAL APPLICATIONS", which is hereby incorporated by reference in its entirety. Background Art

[0003] Automotive Safety Integrity Level (ASIL) is a risk classification system defined by the ISO 26262 standard for functional safety of road vehicles. ASIL classifies hazards into one of four levels, denoted as A to D, with a fifth additional level representing non - hazardous systems or components. ASIL D represents the highest risk level, while ASIL A represents the lowest risk level.

[0004] The standard defines functional safety as "the absence of unreasonable risk due to hazards caused by the malfunctioning behavior of electrical or electronic systems". ASIL sets safety requirements compliant with ISO 26262 for automotive components based on the probability and acceptability of hazards.

[0005] Systems including vehicle brakes may require ASIL - D level, which is the highest level of safety assurance, because their failures pose a great risk. Examples of ASIL - B are headlights and brake lights, while ASIL C can be used for systems including cruise control. Tail lights are an exemplary light that can be classified as ASIL - A level.

[0006] There may be several sensors with redundant instances and several corresponding wirings that are routed to a digital controller (in an ASIL - D domain) for monitoring.

[0007] Aspects of the present subject technology can help improve the total cost, reliability, and efficiency of circuits or other electronic components. Summary of the Invention

[0008] This specification generally relates to voltage monitoring using hierarchical techniques in safety - critical applications. According to one or more aspects of the present disclosure, one or more devices (such as integrated circuits) may have mechanisms for voltage monitoring of one or more electronic components using hierarchical techniques. The integrated circuit may include: a first power domain of a first tier, which may include one or more first - tier sensor hubs; a second power domain of a second tier, which may include one or more second - tier sensor hubs; and a third power domain of a third tier. The second power domain is at least one hop away from the first power domain. The third power domain is at least two hops away from the first power domain.

[0009] In accordance with one or more aspects of the present disclosure, there may be one or more methods, systems, or devices for voltage or fault monitoring of one or more electronic components. In an example, a method may include: receiving, by one or more first sensor hubs of a first power domain at a first level, one or more voltage measurements (e.g., voltage status) from one or more first power domain voltage sensors associated with monitoring the voltage of a second power domain at a second level; receiving, by one or more second sensor hubs of a second power domain at the second level, one or more voltage measurements from one or more second power domain voltage sensors associated with monitoring the voltage of a third power domain at the second level; and sending, based on the one or more voltage measurements from the one or more second power domain voltage sensors, an indication of one or more voltage errors for one or more electronic components of a third power domain at a third level. The second power domain may include one or more second sensor hubs. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Certain features of the subject technology are set forth in the appended claims. However, for explanatory purposes, several implementations of the subject technology are set forth in the following drawings.

[0011] Figure 1 An exemplary and simplified direct wiring path for circuit monitoring is shown.

[0012] Figure 2A An exemplary wiring path for circuit monitoring is shown.

[0013] Figure 2B An exemplary hierarchical wiring path for circuit monitoring is shown.

[0014] Figure 3 An exemplary hierarchical communication flow for circuit monitoring is shown. DETAILED DESCRIPTION

[0015] The detailed description set forth below is intended as a description of various configurations of the subject technology and is not intended to represent the only configurations in which the subject technology may be practiced. The drawings are incorporated herein and constitute a part of the detailed description. The detailed description includes specific details for the purpose of providing a thorough understanding of the subject technology. However, the subject technology is not limited to the specific details set forth herein and may be practiced using one or more other specific implementations. In one or more specific implementations, well-known structures and components are shown in block diagram form in order to avoid obscuring the concepts of the subject technology.

[0016] An automotive safety integrity level (ASIL)-rated system-on-chip (SoC) may drive the need for monitors of related fault initiators such as voltages to help detect single-point faults in safety-critical subsystems at the highest safety integrity level. Additionally, a checker may be needed to verify whether the monitor itself has detected a potential fault. These monitors sometimes need to be connected to a controller through long paths that read sensor values to determine faults. These long paths may impose constraints during the physical design of the circuit, which may potentially lead to congestion and the unachievability of minimum or optimal performance.

[0017] In some specific implementations, to obtain the required coverage for detecting critical voltage drops in complex circuits, voltage sensors or overcurrent detectors may be used, which monitor different parts of various safety-critical subsystems distributed on the SoC via a digital controller at intervals defined by the fault-tolerant time interval (FTTI) of the system. Due to the large number of sensors and their redundant instances, the amount of wiring that can be routed to the digital controller (in the ASIL-D domain) for monitoring may also be large. Figure 1 An exemplary and simplified direct wiring path for circuit monitoring is shown. As shown, circuit 90 may include power domains (PD) 93, PD 94, and PD 92, which are directly routed to PD91 for monitoring. In the direct wiring implementation, the positioning of circuit components may be significantly affected to account for the large amount of wiring that may come from relatively distant PDs.

[0018] The disclosed subject matter may alleviate the problems of the physical implementation of these safety mechanisms. ASIL decomposition techniques may be used to perform hierarchical monitoring of sensors, which can achieve the same integrity level but with less routed wiring, which can reduce the cost or complexity of the circuit. In an exemplary implementation, a digital controller may be instantiated closer to a group of sensors, and then that group of sensors is indirectly monitored by another digital controller that is part of the ASIL-D domain. Such a configuration should meet the same integrity level as a direct connection and can reduce the risk of physical design.

[0019] Figure 2AAn example of a simplified routing path for circuit voltage monitoring is shown. As shown, circuit 100 may include power domains (PDs) 103 and 104, which are routed to PD 102 for voltage monitoring; and PDs 102 and 105, which are routed to PD 101 for voltage monitoring. Such hierarchical routing implementation may allow circuit components to be positioned in a more efficient or effective manner. PD 101 may be considered at the first level. PDs 102 and 105 may be at the second level. PDs 103 and 104 may be at the third level. The third level is subordinate to the second level, and the second level is subordinate to the first level. It is envisioned that other tree structure terms may be applicable to describe the subject matter, such as parent (e.g., the first level), child (e.g., the second level), grandchild (the third level), etc.

[0020] Figure 2B An example of a hierarchical routing path for circuit monitoring is shown. Circuit 100 may include multiple PDs, such as PD101, PD 102, PD 1 03, PD 104, and PD 105. As shown, PDs 103 and 104 may be routed to PD 102 for monitoring. PD 1 05 and PD 102 may be routed to PD 101 for monitoring. As Figure 2B Further shown, PD 101 may include sensor hubs 110 and 111. Sensor hub 110 may be connected to voltage sensor 126 that monitors PD 105, while sensor hub 111 may be connected to voltage sensor 127 that monitors PD 105. As envisioned and shown herein, there may be multiple redundant voltage sensors. Sensor hub 111 may monitor PD 102 via voltage sensor 121.

[0021] PD 102 may include sensor hubs 111, 113, 114, and 115. Sensor hub 112 may be connected to voltage sensor 122 that monitors PD 103. Sensor hub 113 may be connected to voltage sensor 123 that monitors PD 103. Sensor hub 114 may be connected to voltage sensor 124 that may monitor PD 104. Sensor hub 115 may be connected to voltage sensor 125 that monitors PD 104. As die size grows, monitoring may be completed through several other hops before ultimately being monitored by PD 101. How the hierarchy is constructed (e.g., which PDs are placed at different levels of the hierarchy) may be based on different factors, such as minimization of wiring amount or distance, maximization of signal integrity, or manufacturing simplicity (e.g., placing electronic components in cost - efficient or time - efficient positions in manufacturing), etc.

[0022] Figure 3An example of a hierarchical communication flow for circuit monitoring is shown. Considering Figure 2A or Figure 2B in the context, at step 141, PD 104 can be monitored by the voltage sensor 124 of the sensor hub 114 or the voltage sensor 125 of the sensor hub 115 corresponding to PD 102. PD 102 can be an ASIL-B PD. At step 142, PD 102 can be monitored by the voltage sensor 121 of the sensor hub 111 corresponding to PD 101. PD 101 can be an ASIL-D PD. At step 143, if one or more voltage sensors for monitoring PD 104 detect an error condition, an error indication can be triggered. The error at step 143 can be sent from PD 102 to CPU 131. CPU 131 can be located in PD 101. At step 144, if one or more voltage sensors for monitoring PD 102 detect an error condition, an error indication can be triggered. The error at step 144 can be sent from PD 101 to CPU 1 31. Contrary to some specific implementations, multiple PDs can send error indications to CPU 1 31 (as shown), rather than all voltage errors coming from a single PD (e.g., PD 101).

[0023] ASIL-D monitoring can be performed only from PD 101 (e.g., the safety island PD), which in some specific implementations can be at a relatively significant distance from other PDs that should be monitored. From a safety requirement perspective, according to the ISO 26262 standard, ASIL-D monitoring can be implemented as follows: an ASIL-D monitor monitoring an ASIL-B function is equivalent to an ASIL-D monitor monitoring an ASIL-B monitor, which further monitors another lower ASIL / quality management function. The disclosed subject matter can address high-integrity safety monitoring requirements because PD 101 (the first tier) is at ASIL D, and PD 102 is at least ASIL B. PD 103, PD 104, etc. can be ASIL-B or lower (e.g., ASIL A, ASIL B). For each lower ASIL level, there may be an increasing number of failure modes. The disclosed subject matter can address high-integrity (ASIL-D) safety monitoring requirements while also significantly reducing the complexity of the physical implementation (e.g., reducing the wiring length).

[0024] A system, computer-readable storage medium, or device can be incorporated into an electric vehicle or other device to perform the disclosed subject matter. The disclosed subject matter can be used in or with automotive electronic components. The electronic components can be integrated into an automobile (such as an electric vehicle). Methods, systems, or devices as described herein can use a hierarchical structure or technique to provide voltage monitoring of one or more electronic components. For example, the system can include a first power domain at a first tier, the first power domain can include one or more first-tier sensor hubs; a second power domain at a second tier, the second power domain can include one or more second-tier sensor hubs; and a third power domain at a third tier. One or more of the second-tier sensor hubs can be connected to one or more second voltage sensors that measure a voltage associated with the third power domain at the third tier. One or more of the first-tier sensor hubs can be connected to one or more first voltage sensors (e.g., voltage sensor 121 of PD 101) that measure a voltage associated with the second power domain at the second tier. The second power domain is at least one hop away from the first power domain for voltage monitoring. The third power domain can be at least two hops away from the first power domain and can be a sub (e.g., subordinate) power domain of the second power domain in terms of voltage monitoring. The system can include a fourth power domain, where the fourth power domain is at a fourth tier and is at least three hops away from the first power domain at the first tier. In terms of voltage monitoring, the fourth power domain can be a sub (e.g., subordinate) power domain of the third power domain. All combinations in this paragraph (including removal or addition of steps or components) are contemplated in a manner consistent with the other parts of the detailed description.

[0025] The methods, systems, or devices disclosed herein may be incorporated into an electric vehicle or other device. The methods, systems, or devices disclosed herein may be incorporated into products (which may be feature-specific) such as various electronic control units (ECUs) to perform autonomous driving, infotainment, or vehicle dynamics / control. According to one or more aspects of the present disclosure, one or more devices (such as integrated circuits) may have a mechanism for voltage monitoring of one or more electronic components using a hierarchical technique. In an example, a method may include: receiving, by one or more first sensor hubs of a first power domain of a first tier, one or more voltage measurements from one or more first power domain voltage sensors associated with monitoring the voltage of a second power domain of a second tier; receiving, by one or more second sensor hubs of a second power domain of a second tier, one or more voltage measurements from one or more second power domain voltage sensors associated with monitoring the voltage of a third power domain of a second tier; and sending an indication of one or more voltage errors for one or more electronic components of a third power domain of a third tier based on the one or more voltage measurements from the one or more second power domain voltage sensors. The second power domain of the second tier may be connected to a subordinate third power domain of the third tier. All combinations (including removal or addition of steps or components) in this and the preceding paragraphs are contemplated in a manner consistent with the other parts of the detailed description.

[0026] Unless otherwise specified, an element recited in the singular is not intended to mean one and only one, but one or more. For example, "a" module can mean one or more modules. Without further limitation, an element preceded by "a," "an," "the," or "said" does not exclude the presence of additional identical elements.

[0027] Headings and subheadings (if any) are used for convenience only and do not limit the invention. The use of the word "exemplary" is meant to be illustrative or an example. To the extent the scope of use of terms such as "comprising" or "having" is concerned, such terms are intended to be inclusive in a manner similar to the term "including" as understood when used as a transitional word in a claim. Relative terms such as first and second may be used to distinguish one entity or action from another, without necessarily requiring or implying any actual such relationship or order between these entities or actions.

[0028] Phrases such as an aspect, the aspect, another aspect, some aspects, one or more aspects, a specific implementation, the specific implementation, another specific implementation, some specific implementations, one or more specific implementations, an embodiment, the embodiment, another embodiment, some embodiments, one or more embodiments, a configuration, the configuration, another configuration, some configurations, one or more configurations, the subject technology, the disclosure, the present disclosure, and other variations thereof are for convenience and do not imply that the disclosure related to such phrases is necessary for the subject technology or that such disclosure applies to all configurations of the subject technology. The disclosure related to such phrases may apply to all configurations or one or more configurations. The disclosure related to such phrases may provide one or more examples. Phrases such as an aspect or some aspects may refer to one or more aspects and vice versa, and this similarly applies to the other foregoing phrases.

[0029] The phrase "at least one" before a series of items, in conjunction with the terms "and" or "or" used to separate any of these items, modifies the list as a whole, rather than each individual item in the list. The phrase "at least one" does not require the selection of at least one item; rather, the phrase allows for the meaning that includes at least one of any one of these items, and / or at least one of any combination of these items, and / or at least one of each of these items. As an example, each of the phrases "at least one of A, B, and C" or "at least one of A, B, or C" refers to only A, only B, or only C; any combination of A, B, and C; and / or at least one of each of A, B, and C.

[0030] It should be understood that the particular order or hierarchy of the disclosed steps, operations, or processes is an illustration of exemplary methods. Unless otherwise expressly stated, it should be understood that the particular order or hierarchy of steps, operations, or processes may be performed in a different order. Some of the steps, operations, or processes may be performed simultaneously. The appended method claims (if any) present the elements of the various steps, operations, or processes in a sample order and are not meant to be limited to the particular order or hierarchy presented. These may be performed sequentially, linearly, in parallel, or in a different order. It should be understood that the described instructions, operations, and systems can generally be integrated together in a single software / hardware product or packaged into multiple software / hardware products.

[0031] In one aspect, terms such as "coupled" may refer to direct coupling. In another aspect, terms such as "coupled" may refer to indirect coupling.

[0032] Terms such as top, bottom, front, rear, side, horizontal, vertical, etc. refer to any reference frame, rather than the ordinary gravity reference frame. Thus, such terms can extend upward, downward, diagonally, or horizontally in a gravity reference frame.

[0033] The present disclosure is provided to enable any person skilled in the art to practice the various aspects described herein. In some instances, well-known structures and components are shown in block diagram form in order to avoid obscuring the concepts of the subject technology. The present disclosure provides various examples of the subject technology, and the subject technology is not limited to these examples. Those skilled in the art will readily appreciate various modifications to these aspects, and the principles described herein can be applied to other aspects.

[0034] All structural and functional equivalents of the elements of the various aspects described throughout this disclosure are known or will be known to those of ordinary skill in the art, and these equivalents are expressly incorporated herein by reference and are intended to be covered by the claims. Additionally, nothing disclosed herein is intended to be dedicated to the public, whether or not such disclosure is explicitly recited in the claims. No claim element should be construed under the provisions of 35 U.S.C. § 112(f) unless the element is expressly recited using the phrase "means for" or, in the case of a method claim, using the phrase "step for".

[0035] Those skilled in the art will appreciate that the various illustrative blocks, modules, elements, components, methods, and algorithms described herein can be implemented as hardware, electronic hardware, computer software, or combinations thereof. To illustrate this interchangeability of hardware and software, the various illustrative blocks, modules, elements, components, methods, and algorithms have been generally described above in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Those skilled in the art can implement the described functionality in varying ways for each particular application. The various components and blocks can be arranged differently (e.g., in a different order or divided in a different manner), all of which are within the scope of the subject technology.

[0036] The invention name, background art, brief description of the drawings, abstract of the specification, and the drawings are hereby incorporated into the present disclosure and provided as illustrative examples of the present disclosure rather than as restrictive descriptions. It is understood at the time of filing this document that they will not be used to limit the scope or meaning of the claims. Additionally, in the detailed description, it can be seen that, for the purpose of simplifying the present disclosure, the description provides illustrative examples and various features are grouped together in various specific implementations. The method of the present disclosure should not be construed as reflecting an intention that the claimed subject matter requires more features than are expressly recited in each claim. Rather, as reflected in the claims, the inventive subject matter lies in less than all of the features of a single disclosed configuration or operation. The claims are hereby incorporated into the detailed description, where each claim stands on its own as a separately claimed subject matter.

[0037] The claims are not intended to be limited to the aspects described herein, but rather should be accorded the full scope consistent with the claim language and cover all legal equivalents. Nevertheless, none of the claims are intended to embrace subject matter that fails to satisfy the requirements of applicable patent law, nor should they be construed in such a way.

Claims

1. A circuit using hierarchical voltage monitoring, the circuit comprising: A first power domain of a first level, the first power domain including one or more first-level sensor hubs; A second power domain of a second level, the second power domain including one or more second-level sensor hubs; And A third power domain of a third level, Wherein the one or more second-level sensor hubs are connected to one or more voltage sensors for monitoring the third power domain of the third level, and Wherein the one or more first-level sensor hubs are connected to one or more voltage sensors for monitoring the second power domain of the third level.

2. The circuit according to claim 1, wherein the second power domain is at least one hop away from the first power domain, and the third power domain is at least two hops away from the first power domain.

3. The circuit according to claim 1, wherein the one or more second-level sensor hubs send an indication of a voltage error associated with the third power domain.

4. The circuit according to claim 1, wherein the one or more first-level sensor hubs send an indication of a voltage error associated with the second power domain, and the one or more second-level sensor hubs send an indication of a voltage error associated with the third power domain.

5. The circuit according to claim 1, wherein the first power domain conforms to Automotive Safety Integrity Level (ASIL) D, and the second power domain conforms to ASIL B.

6. The circuit according to claim 1, wherein the first power domain conforms to Automotive Safety Integrity Level (ASIL) D, the second power domain conforms to ASIL B, and the third power domain conforms to ASIL B or lower.

7. The circuit according to claim 1, wherein the third power domain is a sub-power domain of the second power domain, and the second power domain is a sub-power domain of the first power domain.

8. The circuit according to claim 1, the circuit further comprising a fourth power domain, wherein the fourth power domain is a sub-power domain of the third power domain, and the fourth power domain is at a fourth level.

9. The circuit according to claim 1, the circuit further comprising a fourth power domain, wherein the fourth power domain is a sub-power domain of the second power domain.

10. The circuit according to claim 1, wherein the circuit is integrated into a component of an electric vehicle.

11. A method for hierarchical voltage monitoring of a circuit, the method comprising: Receiving, by one or more sensor hubs of a first power domain of a first level, one or more first voltage measurements from one or more voltage sensors associated with a second power domain of a second level; Receiving, by the one or more sensor hubs of the second power domain of the second level, one or more second voltage measurements from one or more voltage sensors associated with a third power domain of a third level; and Based on the one or more second voltage measurements, sending, from the second power domain, an indication of one or more voltage errors associated with the third power domain of the third level.

12. The method according to claim 11, wherein the method further comprises: Based on the one or more first voltage measurements, an indication of one or more voltage errors associated with the second power domain of the second hierarchy is sent from the first power domain.

13. The method according to claim 11, wherein the second power domain is at least one hop away from the first power domain, and the third power domain is at least two hops away from the first power domain.

14. The method according to claim 11, wherein the first power domain conforms to Automotive Safety Integrity Level (ASIL) D, and the second power domain conforms to ASIL B.

15. The method according to claim 11, wherein the first power domain conforms to Automotive Safety Integrity Level (ASIL) D, the second power domain conforms to ASIL B, and the third power domain conforms to ASIL B or lower.

16. The method according to claim 11, wherein the third power domain is a sub - power domain of the second power domain, and the second power domain is a sub - power domain of the first power domain.

17. The method according to claim 11, wherein the second power domain is a parent power domain for voltage monitoring of a fourth power domain.

18. The method according to claim 11, wherein the circuit is integrated into components of an electronic control unit for implementing safety - critical functions in an electric vehicle.

19. A vehicle, the vehicle comprising: A circuit using hierarchical voltage monitoring, the circuit comprising: A first - level first power domain, the first power domain comprising one or more first - level sensor hubs; A second - level second power domain, the second power domain comprising one or more second - level sensor hubs; and A third - level third power domain, wherein the one or more second - level sensor hubs are connected to one or more voltage sensors for monitoring the third - level third power domain, and wherein the one or more first - level sensor hubs are connected to one or more voltage sensors for monitoring the third - level second power domain.

20. The vehicle according to claim 19, wherein the first power domain conforms to Automotive Safety Integrity Level (ASIL) D, and the second power domain conforms to ASIL B.

Images