Chip temperature monitoring for safety critical applications

Abstract

The invention relates to chip temperature monitoring for safety critical applications. Aspects of the present disclosure relate to an integrated circuit that operates temperature or fault monitoring of one or more electronic components. An apparatus may include a first temperature sensor and a second temperature sensor at different locations. The first temperature sensor and the second temperature sensor may be positioned at different locations so as to have a comparison value relationship indicating whether there is a fault in the electronic component during a baseline period.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Provisional Application No. 63 / 550,441, filed February 6, 2024, entitled “NOVEL AND EFFICIENT APPROACH TO ONCHIP TEMPERATURE MONITORING FOR SAFETY CRITICAL APPLICATIONS,” the entire contents of which are incorporated herein by reference. Background Art

[0003] Automotive Safety Integrity Level (ASIL) is a risk classification system defined by the ISO 26262 standard for functional safety of road vehicles. ASIL classifies hazards into one of four levels, denoted A to D, with a fifth additional level representing non-hazardous systems or components. ASIL D represents the highest risk level, while ASIL A represents the lowest.

[0004] The standard defines functional safety as “the absence of unreasonable risk of hazards due to the malfunctioning behavior of electrical or electronic systems.” ASIL establishes safety requirements for automotive components in accordance with ISO 26262 based on the probability and acceptability of hazards.

[0005] Systems including vehicle brakes may require ASIL-D, the highest level applicable to safety assurance, because their failure poses a significant risk. Examples of ASIL-B are headlights and brake lights, while ASIL C may be used for systems including cruise control. Taillights are an example of lights that could be classified as ASIL-A.

[0006] Potential faults can be diagnosed through hardware built-in self-tests or by taking advantage of built-in redundancies in monitor components (eg, duplicate diodes and analog-to-digital converters (ADCs)).

[0007] Aspects of the subject technology can help improve the overall cost, reliability, and efficiency of circuits or other electronic components. Summary of the Invention

[0008] This disclosure generally relates to methods, devices, or systems for on-chip temperature monitoring that complies with functional safety requirements for road vehicles. Potential faults can be diagnosed through hardware built-in self-tests or by leveraging built-in redundancies in the monitor component. The disclosed subject matter can use software to perform differential temperature diode temperature measurement checks under certain predefined usage patterns of the electronic component. This can include strategically placing temperature diodes in specific locations to help achieve threshold potential fault coverage.

[0009] According to one or more aspects of the present disclosure, one or more devices, such as an integrated circuit, may have a mechanism for temperature or fault monitoring of one or more electronic components. The integrated circuit may include a first power domain, the first power domain may include a first temperature sensor, and the second power domain may include a second temperature sensor. The first temperature sensor and the second temperature sensor may be positioned to have a temperature difference that indicates whether a fault exists in the electronic components of the first power domain or the second power domain during a startup period. The startup period may be defined by the start of a safety application. The electronic component may include the first temperature sensor or the second temperature sensor.

[0010] According to one or more aspects of the present disclosure, there may be one or more methods, systems, or apparatuses for temperature or fault monitoring of one or more electronic components. In an example, a method may include: receiving a first measured temperature of a first region associated with a trigger period; receiving a second measured temperature of a second region associated with the trigger period; determining a measured temperature difference between the first measured temperature and the second measured temperature; determining whether the measured temperature difference exceeds a reference threshold; and transmitting an indication that the measured temperature difference exceeds the reference threshold. The reference threshold may be based on a baseline temperature difference, which may include a temperature difference between a first baseline temperature from the first region during a baseline period and a second baseline temperature from the second region during the baseline period.

[0011] In one or more specific implementations, an indication of a fault in a first component of the one or more electronic components may be sent based on the indication that the measured temperature difference exceeds the reference threshold. The first region and the second region may indicate a first power domain and a second power domain, respectively. The one or more electronic components may include a sensor. The one or more electronic components may include an integrated circuit. The baseline period may be a startup period of the one or more electronic components. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Certain features of the subject technology are set forth in the appended claims.For illustrative purposes, however, several embodiments of the subject technology are set forth in the following figures.

[0013] Figure 1 An example integrated circuit is shown that may be used to implement one or more features of temperature or fault monitoring for one or more electronic components.

[0014] Figure 2 An example method for temperature or fault monitoring of one or more electronic components is shown.

[0015] Figure 3 An example sequence diagram associated with temperature or fault monitoring of one or more electronic components is shown. DETAILED DESCRIPTION

[0016] The specific embodiments set forth below are intended to be used as a description of various configurations of the subject technology, and are not intended to represent the only configuration that can be put into practice. The accompanying drawings are incorporated herein and constitute a part of the specific embodiments. In order to provide a comprehensive understanding of the subject technology, the specific embodiments include specific details. However, the subject technology is not limited to the specific details set forth herein, and one or more other specific implementations can be used to put it into practice. In one or more specific implementations, well-known structures and components are shown in block diagram form to avoid confusion between the concepts of the subject technology.

[0017] Automotive Safety Integrity Level (ASIL)-rated system-on-chips (SoCs) are likely to drive demand for temperature-related fault initiator monitors to help detect single-point failures in safety-critical subsystems. This monitoring architecture is a safety mechanism designed to detect unexpected temperature increases or decreases that could potentially cause subsystem failures when the temperature breaches a defined operating range threshold. This helps provide the required diagnostic coverage for single-point failures caused by temperature variations.

[0018] In some implementations, to achieve the desired level of accuracy, temperature diodes may be used along with an ADC to read out the temperatures of different parts of various safety-critical subsystems distributed across the SoC via a digital controller at regular time intervals defined by the system's Fault Tolerant Time Interval (FTTI). In addition, a checker may be required to verify whether the monitor itself has a potential fault. These monitors and checkers may be expensive for larger SoCs, where there will be several such safety-critical subsystems that need to be monitored individually. Monitors such as diodes may be reused for redundancy purposes. The use of redundant components may increase cost and complexity.

[0019] In order to ensure that the safety system operates correctly within the required time period, the safety system may need to detect permanent faults in the components that make up the safety system itself, which may allow single point failures in safety-critical subsystems to remain latent. Potential faults can be diagnosed through hardware built-in self-test or by utilizing built-in redundancy of the monitor components. Some embodiments may include duplicate sensors and corresponding connections of the sensors to the ADC. These duplicate sensors can be implemented because there can be a primary temperature sensor and an auxiliary temperature sensor for each area where temperature is required, where the auxiliary temperature sensor can help verify the temperature of the primary temperature sensor and vice versa. This specific implementation can help verify whether the two temperature sensors are functioning properly.

[0020] The disclosed subject matter can minimize the need for such duplicate sensors, which can help minimize cost or reduce complexity while still meeting safety coverage that can meet standards (such as ASIL). The disclosed subject matter can include performing differential temperature diode temperature measurement checks under certain predefined usage modes of the integrated circuit to help achieve high potential fault coverage.

[0021] Figure 1 An example integrated circuit 100 is shown that can be used to implement one or more features of temperature or fault monitoring for one or more electronic components, as disclosed herein. Integrated circuit 100 may include multiple power domains (PDs), such as PD 101, PD 102, PD 103, PD 104, or PD 105. The PDs may include a central processing unit (CPU) PD or a SOC PD, among others. Each power domain may have one or more temperature sensors. As shown, PD 101 may include sensor 110, sensor 111, or sensor hub 120. PD 103 may include sensor 113 or sensor 114. PD 104 may include sensor 115. PD 105 may include sensor 116, sensor 117, or sensor 118. PD 102 may include sensor 112 and ADC 121. The disclosed sensors may have corresponding wired connections to ADC 121. ADC 121 may be communicatively connected to sensor hub 120.

[0022] Continue to refer Figure 1 The disclosed safety system may use one or more expected comparative numerical relationships (such as temperature differences or ratios) associated with two or more sensors over a particular baseline period (e.g., during or shortly after an initial startup sequence) to determine whether a fault exists.

[0023] Figure 2 An example method 130 for temperature or fault monitoring of one or more electronic components is shown. At block 131, a reference threshold value may be determined and stored for a group of sensors. The group of sensors may be two or more sensors that may be in the same area (e.g., power domain) or in different areas. For example, a first group of sensors may be sensor 110 and sensor 112, and a second group of sensors may be sensor 113 and sensor 115. Each group may have a different reference threshold value for a baseline period.

[0024] In one example, a sensor can be measured and characterized offline in a test setup, which can include defining reference thresholds. When a safety application is executed in a vehicle, the difference can be compared to the reference thresholds determined offline. If a deviation exists, the sensor can be considered to be malfunctioning.

[0025] The reference threshold can be based on a comparative numerical relationship (such as a temperature difference or ratio) associated with two or more sensors during a baseline period. The baseline period can be associated with a usage pattern, such as a startup sequence or a system test during shutdown. The reference threshold can be a predetermined baseline and can be stored for future reference during a period corresponding to the baseline period. In an example, the baseline period can be during or shortly after an initial startup sequence in which each of the PDs is powered on without running any application software. Test software can be run to measure each temperature sensor. It is contemplated that the reference threshold can include a single numerical value or a range of acceptable values within an error range (e.g., + / - 2°F). A value outside the reference threshold can indicate a fault in one of the sensors.

[0026] Calculating the difference can be particularly helpful because the ambient temperature in which the test is run may not be known at that time, and calculating the difference can offset the absolute ambient temperature value and retain only the location-specific temperature difference. The reference threshold value for the temperature difference can be determined during SoC characterization in the development timeframe and pre-stored in the SoC's non-volatile storage.

[0027] At block 132, the sensor 110 may measure the temperature during a subsequent trigger period (e.g., a startup sequence). The sensor 110 may be located in the PD 101. The measured temperature of the sensor 110 may be sent to the CPU for processing. The trigger period may correspond to a stored baseline period.

[0028] At block 133, sensor 112 may measure the temperature during a trigger period (e.g., a startup sequence). Sensor 112 may be located in PD 102. The measured temperature of sensor 112 may be sent to the CPU for processing. Sensors 110 and 112 may be in the same group, and there may be a corresponding reference threshold for the group.

[0029] At block 134 , a measured temperature difference (or other comparative numerical relationship) between the first measured temperature of block 132 and the second measured temperature of block 133 may be determined.

[0030] At block 135, the temperature difference of block 134 may be compared to a reference threshold. Based on this comparison, it may be determined whether the measured temperature difference of block 134 exceeds or is within the reference threshold of block 131.

[0031] At block 136, an indication that the measured temperature difference exceeds or is within a reference threshold may be sent based on the determination of block 135. In an example, the indication that the measured temperature difference exceeds the reference threshold may be used to determine that a fault exists in one or more sensors in the group, such as by using a relative derivation from a baseline.

[0032] As disclosed, reference thresholds can be compared with measured values at a predefined resolution, and detected anomalies can determine permanent failures of the involved sensors. Through experiments, it has been found that the coverage of potential faults (e.g., failures of the sensor itself) can achieve ASIL-D integrity.

[0033] Figure 3 An example sequence diagram associated with temperature or fault monitoring of one or more electronic components is shown. At step 141, the CPU 124 of the PD 101 can detect that a trigger period (e.g., a startup sequence, etc.) has occurred. In an example, as shown in Table 1, sensors can be assigned to different groups, and each group can have one or more trigger periods and corresponding reference thresholds. At step 142, the CPU 124 of the PD 101 can read the corresponding temperature from each sensor (such as sensor 110, sensor 111, sensor 112, sensor 113, sensor 114, sensor 115, sensor 116, sensor 117, or sensor 118).

[0034] Table 1

[0035]

[0036] At step 143, a difference value for each group can be calculated. At step 144, the corresponding difference value can be compared with a reference threshold. For example, if the trigger period is Trigger A, Group A includes sensors 110 and 111, and the reference threshold is RT A-1. Groups B, C, and D each include two or more sensors and a reference threshold for Trigger A, as shown in Table 1.

[0037] At step 145, based on the comparison of step 145 indicating an error, an error indication may be sent to the external pin 123 for further action. Such further action may be displaying an error on a screen or limiting access to one or more functions of the vehicle or other device, such as disabling autonomous driving functions or turning off the infotainment system.

[0038] The disclosed subject matter may relate to an on-chip temperature monitoring method or system that complies with an Automotive Safety Integrity Level (ASIL). The disclosed subject matter may be used in or with an automotive electronic component. The electronic component may be integrated into an automobile, such as an electric vehicle.

[0039] Methods, systems, and devices, etc., as described herein, can provide temperature or fault monitoring of one or more electronic components. For example, a system can include a first power domain and a second power domain. The first power domain can include a first temperature sensor, and the second power domain can include a second temperature sensor. The first temperature sensor and the second temperature sensor can be positioned to have a selected temperature difference or ratio (which can be non-zero) that indicates whether there is a fault (e.g., faulty or non-faulty) in the electronic component of the first power domain or the second power domain during a trigger period (such as startup). The reference thresholds disclosed herein can be considered to be selected temperature differences or ratios. The reference threshold can be a range that can take into account an acceptable range of error. The electronic component can include the first temperature sensor or the second temperature sensor. The first power domain can include a device that sends an error indication when comparing the measured temperature difference of the first temperature sensor or the second temperature sensor during a subsequent baseline period. The first power domain and the second power domain can be different. The system may further include a central processing unit; a sensor hub communicatively connected to the central processing unit, wherein the central processing unit reads the measured temperature from the first temperature sensor or the second temperature sensor via the sensor hub; and an analog-to-digital converter (ADC) communicatively connected to the first temperature sensor, the second temperature sensor, and the sensor hub. All combinations in this paragraph (including removal or addition of steps or components) are contemplated in a manner consistent with other parts of the detailed description.

[0040] The methods, systems, or devices disclosed herein may be incorporated into electric vehicles or other devices. The methods, systems, or devices disclosed herein may be incorporated into products such as electronic control units (ECUs) to perform autonomous driving, infotainment, or vehicle dynamics / control. In an example, a method may include: receiving a first measured temperature of a first region associated with a trigger period; receiving a second measured temperature of a second region associated with the trigger period; determining a measured temperature difference between the first measured temperature and the second measured temperature; determining whether the measured temperature difference exceeds a reference threshold; and sending an indication that the measured temperature difference exceeds the reference threshold. The reference threshold may be based on a baseline temperature difference, the baseline temperature difference comprising a temperature difference between a first baseline temperature from the first region during a baseline period and a second baseline temperature from the second region during the baseline period. The first region and the second region may be in the same power domain. All combinations of this paragraph and the previous paragraph (including removal or addition of steps or components) are contemplated in a manner consistent with other parts of the specific embodiment.

[0041] The method may include sending an indication of a fault in a first component of the one or more electronic components based on the indication that the measured temperature difference exceeds the reference threshold. The first area or the second area may indicate a corresponding first power domain or second power domain. The first power domain and the second power domain may be the same or different. The one or more electronic components may include one or more sensors. The one or more electronic components may include an integrated circuit. The trigger period may be a startup period for the one or more electronic components. The trigger period may be a startup period when no application software is running. The reference threshold may be compared to the measured value at a predefined resolution, and any anomaly may determine a permanent fault of the sensor involved. All combinations in this paragraph and the previous paragraph (including the removal or addition of steps or components) are contemplated in a manner consistent with other parts of the specific embodiment.

[0042] Unless otherwise specified, an element mentioned in the singular is not intended to mean one and only one, but rather one or more. For example, "a" module may refer to one or more modules. Without further constraints, an element beginning with "a," "an," "the," or "said" does not exclude the presence of additional identical elements.

[0043] Headings and subheadings, if any, are used for convenience only and do not limit the invention. The word "exemplary" is used to mean serving as an example or illustration. To the extent that the terms "including" or "having" are used, such terms are intended to be inclusive in a manner similar to the term "comprising," as understood when "including" is used as a transitional word in a claim. Relational terms such as "first" and "second" may be used to distinguish one entity or action from another without necessarily requiring or implying any actual such relationship or order between such entities or actions.

[0044] Phrases such as an aspect, this aspect, another aspect, some aspects, one or more aspects, a specific implementation, this specific implementation, another specific implementation, some specific implementations, one or more specific implementations, an embodiment, this embodiment, another embodiment, some embodiments, one or more embodiments, a configuration, this configuration, another configuration, some configurations, one or more configurations, the subject technology, the disclosure, the disclosure, other variations thereof, etc., are for convenience and do not imply that the disclosure associated with such phrases is essential to the subject technology or that such disclosure applies to all configurations of the subject technology. The disclosure associated with such phrases may apply to all configurations or one or more configurations. The disclosure associated with such phrases may provide one or more examples. Phrases such as an aspect or some aspects may refer to one or more aspects, and vice versa, and this applies similarly to the other aforementioned phrases.

[0045] The phrase "at least one of" following a list of items, with the terms "and" or "or" used to separate any of those items, modifies the list as a whole, not each of its constituent items. The phrase "at least one of" does not require the selection of at least one item; rather, the phrase allows for the meaning of at least one of any of those items, and / or at least one of any combination of those items, and / or at least one of each of those items. By way of example, each of the phrases "at least one of A, B, and C" or "at least one of A, B, or C" means only A, only B, or only C; any combination of A, B, and C; and / or at least one of each of A, B, and C.

[0046] It should be understood that the specific order or level of the disclosed steps, operations or processes is an illustration of an exemplary method. Unless otherwise explicitly stated, it should be understood that the specific order or level of steps, operations or processes can be performed in different orders. Some of the steps, operations or processes can be performed simultaneously. The attached method claims (if any) present the elements of various steps, operations or processes in a sample order and are not meant to be limited to the specific order or level presented. These can be performed continuously, linearly, in parallel or in different orders. It should be understood that the described instructions, operations and systems can usually be integrated together in a single software / hardware product or packaged into multiple software / hardware products.

[0047] In one aspect, the term "coupled" or the like may refer to a direct coupling. In another aspect, the term "coupled" or the like may refer to an indirect coupling.

[0048] Terms such as top, bottom, front, back, side, horizontal, vertical, etc. refer to an arbitrary reference frame other than the ordinary gravitational reference frame. Thus, such terms may extend upward, downward, diagonally, or horizontally in a gravitational reference frame.

[0049] The present disclosure is provided to enable any person skilled in the art to practice the various aspects described herein. In some instances, well-known structures and components are shown in block diagram form to avoid confusion about the various concepts of the subject technology. The present disclosure provides various examples of the subject technology, and the subject technology is not limited to these examples. Various modifications to these aspects will be readily apparent to those skilled in the art, and the principles described herein may be applied to other aspects.

[0050] All structural and functional equivalents of the various elements of the various aspects described throughout this disclosure are known or will later become known to those of ordinary skill in the art, and these equivalents are expressly incorporated herein by reference and are intended to be included in the claims. In addition, nothing disclosed herein is intended to serve the public, regardless of whether such disclosure is explicitly stated in the claims. No claim element should be interpreted under the provisions of 35 U.S.C. § 112(f) unless the element is explicitly stated using the phrase "means for..." or, in the case of a method claim, the element is stated using the phrase "step for..."

[0051] Those skilled in the art will appreciate that the various illustrative blocks, modules, elements, parts, methods and algorithms described herein can be implemented as hardware, electronic hardware, computer software or a combination thereof. In order to illustrate this interchangeability of hardware and software, various illustrative blocks, modules, elements, parts, methods and algorithms have been generally described above in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the entire system. Those skilled in the art can implement the described functionality in different ways for each specific application. Various components and blocks can be arranged differently (e.g., arranged in different orders or divided in different ways), all of which do not depart from the scope of the present subject technology.

[0052] The invention title, background technology, figure description, abstract of the specification and drawings are hereby incorporated into this disclosure and are provided as illustrative examples of the present disclosure rather than as limiting descriptions. It is submitted with the understanding that they will not be used to limit the scope or meaning of the claims. In addition, in the detailed description, it can be seen that for the purpose of simplifying the present disclosure, the description provides illustrative examples and various features are grouped together in various specific implementations. The method of the present disclosure should not be interpreted as reflecting an intention that the claimed subject matter requires more features than those expressly stated in each claim. On the contrary, as reflected in the claims, the inventive subject matter lies in less than all the features of a single disclosed configuration or operation. The claims are hereby incorporated into the detailed description, with each claim independently serving as a separately claimed subject matter.

[0053] The claims are not intended to be limited to the aspects described herein, but should be given the full scope consistent with the language of the claims and encompassing all legal equivalents. Nevertheless, none of the claims is intended to encompass subject matter that fails to meet the requirements of applicable patent law, nor should they be interpreted in such a manner.

Claims

1. A method for temperature or fault monitoring of one or more electronic components, the method comprising: receiving a first measured temperature of a first region associated with a trigger period; receiving a second measured temperature of a second area associated with the trigger period; determining a measured temperature difference between the first measured temperature and the second measured temperature; determining whether the measured temperature difference exceeds a reference threshold, wherein the reference threshold is based on a baseline temperature difference comprising a temperature difference between a first baseline temperature from the first region during a baseline period and a second baseline temperature from the second region during the baseline period; as well as An indication is sent that the measured temperature difference exceeds the reference threshold.

2. The method according to claim 1, further comprising: An indication of a fault in a first component of the one or more electronic components is sent based on the indication that the measured temperature difference exceeds the reference threshold. 3 . The method of claim 1 , wherein the first area indicates a first power domain and the second area indicates a second power domain, wherein the first power domain and the second power domain are different. The method of claim 1 , wherein the one or more electronic components comprise a sensor. The method of claim 1 , wherein the one or more electronic components comprise an integrated circuit. The method according to claim 1 , wherein the trigger period is a start-up period of the one or more electronic components. The method of claim 1 , wherein the one or more electronic components are integrated into an electric vehicle.

8. An integrated circuit, comprising: a first power domain, the first power domain comprising a first temperature sensor; and A second power domain includes a second temperature sensor, wherein the first temperature sensor and the second temperature sensor are positioned to have a temperature difference that indicates whether a fault exists in an electronic component of the first power domain or the second power domain during a startup period. 9 . The integrated circuit of claim 8 , wherein the electronic component comprises the first temperature sensor or the second temperature sensor.

10. The integrated circuit of claim 8, wherein the first power domain and the second power domain are different.

11. The integrated circuit of claim 8, wherein the integrated circuit is integrated into a component of an electric vehicle.

12. An integrated circuit, comprising: a first temperature sensor; and A second temperature sensor, wherein the first temperature sensor and the second temperature sensor are positioned to have a comparative numerical relationship that indicates whether a fault is present in the electronic component during a baseline period. 13 . The integrated circuit of claim 12 , wherein the baseline period comprises a startup period of one or more power domains of the integrated circuit.

14. The integrated circuit of claim 12, wherein the comparison numerical relationship comprises a difference between the first temperature sensor and the second temperature sensor.

15. The integrated circuit of claim 12, wherein the comparison numerical relationship comprises a ratio of the first temperature sensor and the second temperature sensor. 16 . The integrated circuit of claim 12 , wherein the electronic component comprises the first temperature sensor or the second temperature sensor. 17 . The integrated circuit of claim 12 , wherein the first temperature sensor and the second temperature sensor are located in respective first and second regions of a first power domain.

18. The integrated circuit of claim 12, wherein the first temperature sensor is located in a first power domain and the second temperature sensor is located in a second power domain, wherein the first power domain and the second power domain are different.

19. The integrated circuit of claim 12, further comprising: Central processing unit; a sensor hub communicatively connected to the central processing unit, wherein the central processing unit reads a measured temperature from the first temperature sensor or the second temperature sensor via the sensor hub; and An analog-to-digital converter (ADC) is communicatively connected to the first temperature sensor, the second temperature sensor, and the sensor hub.

20. The integrated circuit of claim 12, wherein the integrated circuit is a component of an electronic control unit (ECU) for implementing safety-critical functions within an electric vehicle.

Images