Failure safety signal output driving circuit and system

Abstract

The invention relates to the technical field of chip protection, in particular to a failure safety signal output driving circuit and system. According to the invention, the self-checking threshold sub-circuit is adopted to carry out voltage detection without depending on other reference power supplies inside or outside the chip, so that introduction of an extra voltage reference source is avoided, and independent voltage detection without depending on other reference power supplies inside the chip is realized, and therefore, when the power supply inside the chip is abnormal or suddenly powered off, the detection accuracy is improved. The continuous effectiveness of the comparison function can still be ensured; after the chip enters a low-power-consumption turn-off state, the chip can be seamlessly switched to a delay output mode controlled by a comparison result of the self-checking threshold value comparison module, and a safety output pin can maintain a controllable high-level time in a chip power-off process by utilizing discharge delay of a preset external RC network to a special pull-up power supply; a reliable fault response window is provided for an external system, and the problem that high and low levels of safety signal output are misaligned due to the fact that an internal digital power supply or a reference source loses efficacy is solved.

Description

Technical Field

[0001] This invention relates to the field of chip protection technology, and in particular to a fail-safe signal output driving circuit and system. Background Technology

[0002] In fields such as industrial control, aerospace electronics, and automotive electronics, the reliability of power supply chips is paramount. When a chip fails, it is essential to ensure that the system can enter a controlled, safe state to prevent the spread of danger. To this end, power supply chips typically incorporate fail-safe logic circuitry, which signals via the fail-safe output pin FSXB (Fail-safe output XB). This pin generally employs an open-drain design and is driven by an internal, dedicated pull-up power supply (VPU_FS). This design reduces reliance on external power paths and utilizes an external RC network to provide controlled charge and discharge delays for VPU_FS, thereby effectively mitigating the risk of common-cause failure of the safety output pin.

[0003] Existing functional safety output driver architectures typically include an on-chip functional safety output driver module, a dedicated pull-up power supply, a voltage detection module, a digital logic module, and a multiplexer (MUX). During normal chip power-up and operation, the multiplexer usually selects a reset reference signal (IN_RST) controlled by digital circuitry to control the output state of the FSXB pin. When a fault such as clock loss or reset anomaly is detected, the digital circuitry sets IN_RST low, thereby pulling the FSXB pin low to indicate the fault state. When the chip enters a low-power shutdown state, the multiplexer switches the control signal to a threshold detection signal (VPU_VTH) generated by analog circuitry. At this time, the VPU_FS voltage is delayed by an external RC network, ensuring that the VPU_FS voltage remains above the comparison threshold for a period of time, thus keeping the FSXB pin high and providing sufficient response time for external systems to perform safety actions such as power-off and data saving. Because digital circuitry may face the risk of failure or state drift during chip power-down, the delay determination mechanism during low-power shutdown usually requires implementation entirely by analog circuitry.

[0004] Currently, common safety output drive schemes mainly fall into two categories: The first category uses a Schmitt trigger for voltage detection. However, this scheme still relies on the chip's internal power supply VDD to maintain the normal operating voltage of the Schmitt trigger after the chip enters a low-power shutdown state. If VDD cannot continuously supply power during the shutdown process, the trigger may fail, causing the safety output signal to fail to pull down correctly, thus affecting the external safety response. The second category uses a comparator detection method based on a bandgap reference voltage. Although it can operate at lower power supply voltages, it still relies on the power supply of the chip's internal bandgap reference source. If the chip suddenly loses power, although the chip's total voltage VBAT and the dedicated pull-up power supply VPU_FS can be delayed by the network of external large capacitors and large resistors, the power supply of the chip's internal bandgap reference source will immediately drop. At this time, the comparator powered by VPU_FS will continuously output VPU_VTH as high, which will cause the comparator to fail and thus the safety mechanism to fail, resulting in erroneous operation of external power devices.

[0005] Therefore, existing functional safety output drive circuits rely to varying degrees on the continuous and stable operation of the chip's internal power module during low-power shutdown or sudden power outage scenarios. Consequently, they are at risk of functional inaccuracy during power interruptions or drops. To address this, a functional safety delay-based decision-making scheme based on analog circuits is needed. This scheme should enable reliable, delayed safety signal output during chip power-down without relying on internal digital power supplies and reference sources, using only an external delay network and analog comparison logic. This ensures that the chip system can complete orderly safety state transitions under various power-down conditions. Summary of the Invention

[0006] The present invention aims to provide a fail-safe signal output driving circuit and system, which provides a fully integrated fail-safe signal output driving circuit based on analog circuits, and solves the risk of inaccurate fail-safe signals in existing chip safety output driving schemes when power is interrupted or dropped.

[0007] To achieve the above objectives, a first aspect of the present invention provides a fail-safe signal output driving circuit, comprising a self-test threshold sub-circuit, a multiplexer, and a signal output sub-circuit; the self-test threshold sub-circuit includes a pull-up power supply voltage divider module, a self-test threshold comparison module, and a buffer module, wherein: The pull-up power supply voltage divider module generates voltage divider nodes based on an external dedicated pull-up power supply; The self-test threshold comparison module generates a voltage comparison reference point based on an external dedicated pull-up power supply, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In turn, it outputs a first voltage when the voltage of the dedicated pull-up power supply meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module is used to convert the first voltage into a high-level signal when receiving the first voltage, so as to output a high-level signal to the first terminal of the multiplexer; the buffer module is used to convert the second voltage into a low-level signal when receiving the second voltage, so as to output a low-level signal to the first terminal of the multiplexer. The multiplexer is used to select to receive a high-level signal or a low-level signal at its first terminal when it receives an external low-power shutdown state signal at its control terminal, and then transmit the high-level signal or the low-level signal to the signal output sub-circuit. The signal output sub-circuit is used to output a high-level fail-safe signal to the safety output pin of the external power device based on the high-level signal, the external dedicated pull-up power supply, and the chip's total power supply when receiving the high-level signal; the signal output sub-circuit is used to output a low-level fail-safe signal to the safety output pin of the external power device when receiving the low-level signal.

[0008] The aforementioned fail-safe signal output drive circuit utilizes a dedicated pull-up power supply (VPU_FS) to generate an internal comparison reference point and compare it with the voltage divider node, avoiding the introduction of an additional voltage reference source. This achieves independent voltage detection without relying on other reference power supplies inside the chip, ensuring the continued effectiveness of the comparison function even when the chip's internal power supply is abnormal or suddenly powered off. Combined with a multiplexer and signal output sub-circuit, after the chip enters a low-power shutdown state, it can seamlessly switch to a delayed output mode controlled by the comparison result of the self-test threshold comparison module. Furthermore, by utilizing a preset external RC network to delay the discharge of the dedicated pull-up power supply, the safety output pin can maintain a controllable high-level time during chip power-down, providing a reliable fault response window for external systems. Ultimately, the aforementioned fail-safe signal output drive circuit uses an analog circuit composed entirely of a pull-up power supply voltage divider module, a self-test threshold comparison module, and a buffer module to determine the high and low levels of the output signal. This avoids the problem of inaccurate high and low levels of the safety signal output caused by the failure of the internal digital power supply or reference source, and significantly improves the functional safety level of the chip under power interruption or drop conditions.

[0009] Specifically, the dedicated pull-up power supply has an external RC delay circuit. When the chip's main power supply is de-energized or cut off and enters a low-power shutdown state, the capacitor of the RC delay circuit releases charge, causing the dedicated pull-up power supply to delay power-down. This results in a time delay in the dedicated pull-up voltage not meeting the preset threshold range, causing the high-level signal output by the buffer module to be delayed in flipping. Ultimately, the failure safety signal can still maintain a high-level state for a period of time even when the chip's main power supply is gone, until the chip voltage (VBAT) is completely de-energized before flipping to a low-level state, thus ensuring that the external system has enough time to respond to the safety mode.

[0010] Furthermore, the pull-up power supply voltage divider module includes a first resistor, a second resistor, a third resistor, a first NMOS transistor, and a first inverter, wherein: The first terminal of the first resistor is electrically connected to an external dedicated pull-up power supply; the second terminal of the first resistor is electrically connected to the first terminal of the second resistor; the second terminal of the second resistor is electrically connected to the first terminal of the third resistor; and the second terminal of the third resistor is grounded. The common terminal of the first resistor and the second resistor is used to generate a voltage divider node; The input terminal of the first inverter is used to receive a high-level signal or a low-level signal output by the buffer module; the output terminal of the first inverter is electrically connected to the gate of the first NMOS transistor. The drain of the first NMOS transistor is electrically connected to the first terminal of the third resistor, and the source of the first NMOS transistor is electrically connected to the second terminal of the third resistor.

[0011] In this implementation, the first NMOS transistor is connected in parallel with the third resistor, and its gate is controlled by the inverted signal of the buffer module output signal after passing through the first inverter. During power-up, the external dedicated pull-up power supply gradually rises from a low voltage to a high voltage, so the buffer module first outputs a low level, and then gradually flips to a high level.

[0012] Therefore, in the initial stage of the power-on process, the first inverter first outputs a high level, turning on the first NMOS transistor. The third resistor is connected in parallel with the first NMOS transistor, and most of the current is drawn away from the third resistor by the first NMOS transistor. This increases the current flowing through the resistor string of the first, second, and third resistors, and the voltage drop between the resistors increases. This raises the voltage threshold required for the voltage comparison result to flip at the voltage divider node of the common terminal of the first and second resistors and the voltage comparison reference point.

[0013] During the power-down process, the external dedicated pull-up power supply gradually drops from high voltage to zero voltage. Therefore, the buffer module first outputs a high level and then gradually flips to a low level.

[0014] Therefore, the first inverter outputs a low level in the initial stage of the power-down process, and the first NMOS transistor is turned off, so that the current flowing through the resistor string of the first resistor, the second resistor and the third resistor is lower than that in the power-up process, which reduces the voltage threshold required for the voltage comparison result to flip at the voltage divider node of the common terminal of the first resistor and the second resistor and the voltage comparison reference point.

[0015] This hysteresis comparison mechanism, implemented through feedback control, effectively avoids interference to the comparison results caused by voltage jitter or noise from the dedicated pull-up power supply, improves the accuracy of threshold detection, and enhances the anti-interference capability and reliability of the fail-safe signal output.

[0016] Furthermore, the self-test threshold comparison module includes a zeroth transistor, a first transistor, a first PMOS transistor, a second PMOS transistor, a fourth resistor, a fifth resistor, a third PMOS transistor, and a sixth resistor, wherein: The source of the first PMOS transistor and the source of the second PMOS transistor are respectively electrically connected to an external dedicated pull-up power supply; the gate of the first PMOS transistor and the gate of the second PMOS transistor are electrically connected; the drain of the first PMOS transistor and the gate of the second PMOS transistor are electrically connected. The base of the zeroth transistor and the base of the first transistor are used to receive the voltage divider node; the collector of the zeroth transistor is electrically connected to the drain of the first PMOS transistor; the collector of the first transistor is electrically connected to the drain of the second PMOS transistor; the common emitter of the zeroth transistor is electrically connected to the first terminal of the fourth resistor; the common emitter of the first transistor is electrically connected to the second terminal of the fourth resistor. The first end of the fifth resistor is electrically connected to the second end of the fourth resistor, and the second end of the fifth resistor is grounded; The gate of the third PMOS transistor is electrically connected to the collector of the first transistor, the source of the third PMOS transistor is electrically connected to an external dedicated pull-up power supply, and the drain of the third PMOS transistor is electrically connected to the first terminal of the sixth resistor; the second terminal of the sixth resistor is grounded. The common terminal of the third PMOS transistor and the sixth resistor is used to output the first voltage or the second voltage.

[0017] In this implementation, a 1:1 current mirror is formed by a first PMOS transistor and a second PMOS transistor, respectively connected to the collectors of the zeroth transistor and the first transistor of the NPN transistor. The bases of the zeroth transistor and the first transistor are connected to the common terminal of the first and second resistors in the voltage divider path. The common emitter of the zeroth transistor is connected to the fourth and fifth resistors, and the common emitter of the first transistor is connected to the voltage divider formed by the fourth and fifth resistors. The zeroth transistor and the first transistor are configured with an area ratio of N:1, and their base voltage can be determined by the voltage divider formed by the first, second, and third resistors. The third PMOS transistor and the sixth resistor form the output comparison result of the common-source amplifier.

[0018] By utilizing a zeroth transistor and a first transistor with different emitter junction areas, and under the condition that their bases receive the same voltage divider and the common emitter forms a current feedback path through the fourth and fifth resistors, an emitter junction voltage difference ΔVBE proportional to the absolute temperature is generated by the difference in area ratio. This ΔVBE serves as a comparison benchmark, which is only related to the transistor area ratio and current density, and is not sensitive to fluctuations in semiconductor process parameters, thus providing a stable and process-robust voltage comparison benchmark.

[0019] Specifically, when the chip is powered on, the saturation current of the zeroth transistor is larger due to its larger area. However, as the voltage of the external dedicated pull-up power supply gradually increases, the emitter junction voltage VBE of the first transistor also continues to increase. The current ratio of the zeroth transistor and the first transistor gradually approaches, thereby enabling the two transistors to gradually operate in the amplification region and achieving the condition for the gradual establishment of the emitter junction voltage difference ΔVBE. Since the base voltages of the two transistors are fixed, as the emitter junction voltage VBE of the first transistor continues to increase, the voltage drop of the voltage divider resistor increases, causing the conduction of the first transistor to become too strong. This causes the current of the first transistor to increase as the voltage VBE of the first transistor's emitter junction increases, resulting in a lower gate voltage of the third PMOS transistor, which then conducts. A high voltage is generated at the input of the buffer module through the sixth resistor, and a high-level signal is output after passing through the buffer module.

[0020] When the chip is powered down, the voltage of the external dedicated pull-up power supply gradually decreases, causing the two transistors to gradually de-operate in the amplification region and move away from the condition for establishing the emitter-junction voltage difference ΔVBE. When the voltage of the external dedicated pull-up power supply is lower than the condition for establishing the emitter-junction voltage difference ΔVBE, the first transistor exits the positive feedback mechanism. This causes the current of the first transistor to be less than the current of the zeroth transistor. The gate voltage of the third PMOS transistor increases until the third PMOS transistor is turned off, generating a zero-voltage second voltage at the input of the buffer module. After passing through the buffer module, a low-level signal is output.

[0021] Furthermore, the buffer module includes a fourth PMOS transistor, a fifth PMOS transistor, a second NMOS transistor, and a third NMOS transistor, wherein: The gate of the fourth PMOS transistor and the gate of the second NMOS transistor are used to receive the first voltage or the second voltage. The source of the fourth PMOS transistor is electrically connected to an external dedicated pull-up power supply, the drain of the fourth PMOS transistor is electrically connected to the drain of the second NMOS transistor, and the source of the second NMOS transistor is grounded. The gate of the fifth PMOS transistor, the gate of the third NMOS transistor, the drain of the fourth PMOS transistor, and the drain of the second NMOS transistor are electrically connected. The source of the fifth PMOS transistor is electrically connected to an external dedicated pull-up power supply, the drain of the fifth PMOS transistor is electrically connected to the drain of the third NMOS transistor, and the source of the third NMOS transistor is grounded. The drain of the fifth PMOS transistor and the drain of the third NMOS transistor are used to output the high-level signal or the low-level signal.

[0022] In this implementation, the buffer module forms a two-stage buffering and shaping circuit through a first-stage inverter composed of a fourth PMOS transistor and a second NMOS transistor, and a second-stage inverter composed of a fifth PMOS transistor and a third NMOS transistor. This circuit shapes and buffers the analog voltage signal output by the self-test threshold comparison module. This structure converts the analog voltage signal output by the self-test threshold comparison module into a digital logic signal with stronger driving capability and more stable level, i.e., a high-level signal or a low-level signal, to meet the signal quality requirements of the multiplexer input.

[0023] Furthermore, the signal output sub-circuit includes a first diode, a second diode, an internal resistor, a pull-up resistor, a fourth NMOS transistor, and a fifth NMOS transistor, wherein: The anode of the first diode is electrically connected to an external dedicated pull-up power supply, and the cathode of the first diode is electrically connected to the first end of the internal resistor. The anode of the second diode is electrically connected to the external chip's main power supply, and the cathode of the second diode is electrically connected to the first end of the internal resistor. The gate of the fourth NMOS transistor is used to receive the high-level signal or the low-level signal; the drain of the fourth NMOS transistor is electrically connected to the second terminal of the internal resistor, and the source of the fourth NMOS transistor is grounded. The first end of the pull-up resistor is electrically connected to an external dedicated pull-up power supply, and the second end of the pull-up resistor is electrically connected to the drain of the fifth NMOS transistor; the gate of the fifth NMOS transistor is electrically connected to the second end of the internal resistor; the source of the fifth NMOS transistor is grounded. The common terminal of the pull-up resistor and the fifth NMOS transistor is used to output a high-level fail-safe signal or a low-level fail-safe signal to the safety output pin of an external power device.

[0024] In this implementation, a dedicated pull-up power supply and the chip's main power supply are connected to an open-drain structure composed of an internal resistor and a fourth NMOS transistor via a first and a second diode. The dedicated pull-up power supply and the chip's main power supply supply power the fourth NMOS transistor through the diodes, providing a high-level bias voltage to its drain when the fourth NMOS transistor is turned on. The fourth NMOS transistor acts as a drive switch, its gate controlled by the multiplexer output signal, which in turn regulates the gate level of the fifth NMOS transistor through the drain level of the fourth NMOS transistor. The fifth NMOS transistor and the pull-up resistor form the final open-drain output stage, powered by the dedicated pull-up power supply, driving the fail-safe signal pin. This design ensures that during chip power-down, the safety output pin is controlled by the delay characteristics of the external RC network of the dedicated pull-up power supply. Even if the chip's main power supply fails, as long as the dedicated pull-up power supply has voltage and the multiplexer outputs a high-level signal, the output fail-safe signal can maintain a high level for a period of time, thus ensuring that the external system has sufficient time to respond to the safety mode.

[0025] Furthermore, it also includes a signal latching control subcircuit and a signal latching subcircuit, wherein: The signal lockout control subcircuit is used to control the signal lockout subcircuit to continuously pull down the output level of the signal output subcircuit when the buffer module outputs a low-level signal and the external power-on reset signal is low.

[0026] In this implementation, by adding a signal latch control subcircuit and a signal latch subcircuit, when the chip enters the power-down process and the self-test threshold circuit has output a low-level signal indicating that the safety output pin needs to be pulled low, if the chip's total power supply voltage drops to a level that might cause the fifth NMOS transistor in the signal output subcircuit to fail due to insufficient conduction voltage, the signal latch control subcircuit will activate the signal latch subcircuit. The signal latch subcircuit will then replace the fifth NMOS transistor to firmly pull the safety output pin low. This mechanism effectively prevents the safety output pin from floating or rising due to the main output transistor being cut off at the end of the chip's complete power-down process, ensuring a stable and reliable pull-down of the safety signal throughout the power-down process and improving the system's safety under extreme power-down conditions.

[0027] Furthermore, the signal-locked loop sub-circuit includes a sixth NMOS transistor, a seventh NMOS transistor, a sixth PMOS transistor, a first capacitor, and an isolation module, wherein: The input terminal of the isolation module is electrically connected to the external chip's main power supply, the output terminal of the isolation module is electrically connected to the first terminal of the first capacitor, and the second terminal of the first capacitor is grounded. The isolation module is used to charge the first capacitor through the external chip power supply when the external power-on reset signal is high, and to isolate the external chip power supply to discharge the first capacitor when the external power-on reset signal is low. The source of the sixth PMOS transistor is electrically connected to the first terminal of the first capacitor, the gate of the sixth PMOS transistor is used to receive the control signal of the signal lock control sub-circuit, and the drain of the sixth PMOS transistor is electrically connected to the gate of the sixth NMOS transistor. The drain of the seventh NMOS transistor is electrically connected to the gate of the sixth NMOS transistor. The gate of the seventh NMOS transistor is used to receive the control signal of the signal lock control sub-circuit. The source of the seventh NMOS transistor is grounded. The drain of the sixth NMOS transistor is electrically connected to the output terminal of the signal output sub-circuit, and the source of the sixth NMOS transistor is grounded.

[0028] In this implementation, the isolation module is turned on when the power-on reset signal is high, charging the first capacitor using the chip's total power supply; it is turned off when the power-on reset signal is low, isolating the chip's total power supply and preventing interference from the chip's total power supply voltage during power-down. The sixth PMOS transistor and the seventh NMOS transistor are controlled by complementary signals output from the signal lockout control sub-circuit. When the buffer module outputs a low-level signal and the external power-on reset signal is low, the sixth PMOS transistor turns on and the seventh NMOS transistor turns off, allowing the first capacitor to drive the sixth NMOS transistor using its stored residual charge. Because the capacitor discharge is relatively independent, even if the chip's total power supply voltage drops to the level of main output transistor failure, the sixth NMOS transistor can still remain on due to the capacitor charge, continuously pulling the failure safety signal pin low until the capacitor charge is exhausted. This achieves full-cycle signal lockout before the chip is completely powered down, eliminating the risk of output signal bounce.

[0029] Furthermore, the isolation module includes an eighth NMOS transistor and a ninth NMOS transistor, wherein: The drain of the eighth NMOS transistor serves as the input terminal of the isolation module; the source of the eighth NMOS transistor and the source of the ninth NMOS transistor are electrically connected; the gate of the eighth NMOS transistor and the gate of the ninth NMOS transistor are used to receive external power-on reset signals; the drain of the ninth NMOS transistor serves as the output terminal of the isolation module.

[0030] In this implementation, the signal lockout sub-circuit achieves bidirectional controllable isolation between the chip's main power supply and the first capacitor through a Back-to-Back MOSFET isolation module composed of the eighth and ninth NMOS transistors connected together. When the external power-on reset signal is high, the eighth and ninth NMOS transistors are turned on, allowing the chip's main power supply to charge the first capacitor. When the power-on reset signal goes low, the eighth and ninth NMOS transistors are quickly turned off, preventing the charge from the first capacitor from flowing back into the chip's main power supply and isolating the potential impact of the chip's main power supply shutdown on the capacitor's discharge circuit. This ensures that the discharge of the first capacitor is controlled only by the sixth PMOS transistor and the seventh NMOS transistor. The sixth PMOS transistor and the seventh NMOS transistor are controlled by complementary signals output from the signal lockout control sub-circuit, which are used to convert the stored charge of the first capacitor into a control voltage to drive the gate of the sixth NMOS transistor during the first capacitor's discharge. This enables reliable pull-down of the safety output pin by utilizing capacitor energy storage when the chip's main power supply is insufficient.

[0031] The aforementioned Back to Back MOSFET isolation structure can effectively block leakage current from either the source or drain of the MOSFET, achieving efficient electrical isolation between the power supply and the capacitor. This ensures the independence and controllability of the capacitor's stored charge during the discharge phase, preventing charge loss or malfunctions caused by parasitic paths during the complex power-down process of the chip.

[0032] Furthermore, the signal locking control sub-circuit includes an OR gate, a second inverter, and a third inverter, wherein: The first input of the OR gate is used to receive an external power-on reset signal, and the second input of the OR gate is used to receive a high-level signal or a low-level signal from the buffer module; the output of the OR gate is electrically connected to the gate of the seventh NMOS transistor; the output of the OR gate is electrically connected to the input of the second inverter; the output of the second inverter is electrically connected to the input of the third inverter; and the output of the third inverter is electrically connected to the gate of the sixth PMOS transistor.

[0033] In this implementation, the signal lockout control sub-circuit performs a logical OR operation between the level signal output from the buffer module and the external power-on reset signal using an OR gate. Its output directly controls the on / off state of the seventh NMOS transistor and generates an inverted control signal through two inverters to drive the sixth PMOS transistor. This logic design ensures that the OR gate outputs a low level only when the chip is in a power-down state (power-on reset signal is low) and the self-test threshold comparison circuit has determined that a safety signal needs to be output (buffer module outputs a low-level signal). This causes the seventh NMOS transistor to turn off and the sixth PMOS transistor to turn on, thereby opening the path for the first capacitor to discharge through the sixth PMOS transistor to the gate of the sixth NMOS transistor, activating the signal lockout function. In any other operating state, this lockout circuit is disabled, avoiding interference with the power-on process and normal operation, and achieving precise and reliable backup pull-down control.

[0034] A second aspect of the present invention provides a fail-safe signal output driving system, comprising a dedicated pull-up power supply, a chip main power supply, a digital logic circuit, and a fail-safe signal output driving circuit; the fail-safe signal output driving circuit includes a self-test threshold sub-circuit, a multiplexer, and a signal output sub-circuit; the self-test threshold sub-circuit includes a pull-up power supply voltage divider module, a self-test threshold comparison module, and a buffer module; wherein: The pull-up power supply voltage divider module generates voltage divider nodes based on the dedicated pull-up power supply; The self-test threshold comparison module generates a voltage comparison reference point based on the dedicated pull-up power supply, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In turn, it outputs a first voltage when the voltage of the dedicated pull-up power supply meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module is used to convert the first voltage into a high-level signal when receiving the first voltage, so as to output a high-level signal to the first terminal of the multiplexer; the buffer module is used to convert the second voltage into a low-level signal when receiving the second voltage, so as to output a low-level signal to the first terminal of the multiplexer. When the multiplexer receives a low-power shutdown state signal from the digital logic circuit at its control terminal, it selects to receive a high-level signal or a low-level signal at its first terminal, and then transmits the high-level signal or the low-level signal to the signal output sub-circuit. The signal output sub-circuit is used to output a high-level fail-safe signal to the safety output pin of an external power device based on the high-level signal, the dedicated pull-up power supply, and the chip's total power supply when receiving the high-level signal; the signal output sub-circuit is used to output a low-level fail-safe signal to the safety output pin of an external power device when receiving the low-level signal. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a fail-safe signal output driving circuit provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a fail-safe signal output driving circuit provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the specific structure of a self-test threshold sub-circuit and a multiplexer provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the specific structure of a signal output sub-circuit, a signal locking control sub-circuit, and a signal locking sub-circuit provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an external RC delay circuit for a dedicated pull-up power supply provided in an embodiment of the present invention; Figure 6 This is a simplified architecture diagram of a driver that can safely output data, provided by an embodiment of the present invention. Figure 7 This is a schematic diagram of a driving circuit structure provided by an embodiment of the present invention, in which prior art is applied to a safety function and detection is performed using a Schmitt trigger; Figure 8 This is a schematic diagram of a driving circuit structure provided by an embodiment of the present invention, which is a prior art applied to a safety function and uses a reference voltage comparison detection. Figure 9 This is a schematic diagram of a driving circuit structure provided by an embodiment of the present invention, which is a prior art applied to a safety function and uses a charge pump to assist bias comparison detection. Detailed Implementation

[0036] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that the following detailed descriptions are exemplary and intended to provide further detailed explanation of the invention. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein in the specification is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0037] Before describing this application in detail with reference to the accompanying drawings and embodiments, the terms and application scenarios involved in this application will first be explained.

[0038] In the fields of industrial control, aerospace electronics, and automotive electronics, power supply chips must ensure that the system enters a controllable and safe state when a fault occurs in order to prevent the spread of danger. Therefore, power supply chips used in these applications are often designed with a set of fail-safe logic for fault detection.

[0039] In existing technologies, power supply chips typically provide one or more fail-safe output signals. These signals detect faults such as undervoltage / overvoltage, overcurrent, chip overheating, and clock loss, triggering a fail-safe state. The signals are then sent through safety output pins, causing external power devices to enter safe mode or disconnect power. Generally, these fail-safe output signals work in concert, triggering different protection measures through delays or timed events. Safety output pins commonly employ an open-drain design, where the high-level voltage is determined by a pull-up resistor Rpu, ensuring signal controllability and clarity. This simple and robust design meets the requirements of most industrial electronic specifications. These types of chip safety output pins are generally referred to as FSXB (Fail-safe output XB).

[0040] To optimize system-level design, typical chips do not rely solely on external power supplies for the pull-up of the safety output drive circuit, as this increases complexity and risk due to the need to consider additional safety power supply paths. Therefore, by isolating a dedicated pull-up channel for the safety output pin within the chip, dependence on external power supplies is reduced. This channel, via an external RC network, ensures delayed operation even in the event of chip failure and effectively reduces the risk of common-cause failure of the safety output pin. This type of dedicated pull-up power supply, VPU_FS signal, is generally referred to as VPU_FS (Fail-safe Pull-up for FSXB).

[0041] like Figure 6 The diagram illustrates a simplified architecture for a functional safety output driver. This architecture primarily includes an on-chip functional safety output driver module (FSXB), a dedicated pull-up power supply VPU_FS, a voltage detection module (i.e., an analog circuit module) for the dedicated pull-up power supply VPU_FS, a logic module controlled by digital circuitry (a digital logic circuit module), and a multiplexer MUX. Furthermore, an external RC delay network, consisting of a delay resistor Rpd and a delay capacitor Cpd, provides controlled charging and discharging delays for VPU_FS during the chip's power-down phase.

[0042] After the chip powers on, the multiplexer (MUX) is generally controlled by the reset reference signal IN_RST output from the digital circuit by default, and MUX_SEL is high by default. When the chip powers off and receives a low-power shutdown command, MUX_SEL defaults to low and selects the VPU_VTH signal for output. The IN_RST signal after power-on can be configured by the digital circuit according to system requirements. For example, when the chip powers on normally and IN_RST is configured to be high, the FSXB pin maintains a high output, indicating that the system is working normally. When the chip experiences clock loss, reset anomaly, or other abnormal conditions without triggering low-power shutdown, the IN_RST signal is set low by the digital circuit, and the FSXB pin voltage is pulled low to indicate a fault in the chip and notify the external system to enter the corresponding safe mode.

[0043] When the chip detects that it has entered a Low Power Off state, the multiplexer MUX switches the comparison input from the reset reference signal (IN_RST) to the threshold detection signal (VPU_VTH). At this time, because the external RC network provides a charging / discharging delay for the voltage pull-up terminal (VPU_FS), the VPU_FS voltage does not immediately drop below the comparison threshold, but rather undergoes a gradual decrease over a period of time. Therefore, while the VPU_FS voltage is above the VPU_VTH comparison threshold, the comparator output remains high, and the functional safety pin FSXB continues to remain high. When the VPU_FS voltage drops below VPU_VTH, the comparator output flips, and the FSXB output is pulled low by the logic circuit, thereby triggering the external system to enter a safety response state. Through this delayed pull-down mechanism, the external safety circuitry can obtain sufficient response time before the chip is powered down to perform safety actions such as power-off, data saving, or power switching, preventing uncontrollable states caused by the simultaneous shutdown of the main chip and external circuitry.

[0044] It is worth noting that during the chip power-down phase, digital circuit modules may face the risk of temporary failure or state drift due to the shutdown of the power domain, making it impossible to stably control the shutdown logic. Therefore, functional safety output driver circuits typically rely entirely on analog circuits for delay determination when handling low-power shutdown. Thus, proposing a functional safety delay determination scheme based on analog circuits is crucial.

[0045] Please refer to Figure 7This diagram illustrates a prior art drive circuit structure used for safety functions and employing a Schmitt trigger for detection. In this circuit, VPU_FS and VBAT power NM1 through diodes, and Rint is a large resistor to provide current limiting protection. Rpu is the pull-up resistor Rpu for MN2, forming an open-drain structure with MN2, and VPU_FS serves as the pull-up power supply. IN_RST is the reset reference signal controlled by the on-chip digital circuitry. VPU_FS is compared by a Schmitt trigger, whose power supply is provided by VDD generated internally by the chip, and its trigger threshold is VPU_VTH. MUX_SEL is the selection signal of the multiplexer MUX, used to select VPU_VTH or IN_RST to control NM1. When the chip is powered on, the multiplexer MUX selects IN_RST for control; if the chip receives a low-power shutdown command, MUX_SEL is set low, and the multiplexer MUX switches to VPU_VTH for control. The VPU_VTH toggle threshold is typically set high to ensure that during chip power-down, when the VPU_FS voltage drops below this threshold, the Schmitt trigger output toggles, driving the FSXB signal low and completing the safety signal release process. The drawback of this approach is that the normal operation of the Schmitt trigger depends on the continuous supply of the chip's internal power supply VDD. If VDD cannot be maintained for a sufficient time after being turned off, the Schmitt trigger may malfunction, leading to abnormal safety signal output.

[0046] Please refer to Figure 8 This diagram illustrates a prior art driving circuit structure used for safety functions and employing a reference voltage comparison detection. In this circuit, VPU_FS and VBAT power NM1 through diodes, and Rint is a large resistor to provide current limiting protection. Rpu is the pull-up resistor Rpu for MN2, forming an open-drain structure with MN2, and VPU_FS serves as the pull-up power supply. IN_RST is a signal controlled by the chip's internal digital circuitry. VPU_FS, after being divided by resistors R1 and R2, is compared with the chip's internal reference voltage VREF. The comparator is powered by VPU_FS. Its trigger threshold is VPU_VTH, and MUX_SEL is the selection signal for the multiplexer MUX, used to select either VPU_VTH or IN_RST to control NM1. When the chip is powered on, the multiplexer MUX selects IN_RST for control; if the chip receives a low-power shutdown command, MUX_SEL is set low, and the multiplexer MUX switches to VPU_VTH for control. In this scheme, VREF is typically a lower reference voltage from the bandgap reference source, which can still operate stably when the chip power supply voltage is reduced. However, if the chip experiences a sudden power failure, although VPU_FS can delay power-down through an external RC network, the internal bandgap reference source may lose power rapidly, causing the comparator to fail and thus preventing the safety mechanism from responding properly.

[0047] Please refer to Figure 9 This diagram illustrates another prior art driving circuit structure used for safety functions and employing a charge pump-assisted bias comparison detection. In this circuit, VPU_FS and VBAT power NM1 through diodes, and Rint is a large resistor to provide current limiting protection. Rpu is the pull-up resistor Rpu for MN2, forming an open-drain structure with MN2, and VPU_FS serves as the pull-up power supply. IN_RST is a signal controlled by the on-chip digital circuitry. VPU_FS, after being divided by resistors R1 and R2, is compared with the bias voltage generated by the charge pump powered by VBAT. Its trigger threshold is VPU_VTH, and MUX_SEL is the selection signal of the multiplexer MUX, used to select VPU_VTH or IN_RST to control NM1. When the chip is powered on, the multiplexer MUX selects IN_RST for control; if the chip receives a low-power shutdown command, MUX_SEL is set low, and the multiplexer MUX switches to VPU_VTH for control. When the chip power supply drops, the energy storage capacitor inside the charge pump can maintain a portion of the charge to support the comparator's brief operation. The disadvantage of this approach is that the charge pump and its bias circuit must be implemented within the chip, requiring a large energy storage capacitor and relying on an additional clock control, resulting in a complex circuit structure, high power consumption, and a large footprint.

[0048] Please refer to Figure 1 To address the shortcomings of the prior art, the first embodiment of the present invention provides a fail-safe signal FSXB output driving circuit, including a self-test threshold sub-circuit 100, a multiplexer MUX, and a signal output sub-circuit 200; the self-test threshold sub-circuit 100 includes a pull-up power supply voltage divider module 110, a self-test threshold comparison module 120, and a buffer module 130, wherein: The pull-up power supply voltage divider module 110 generates voltage divider nodes based on an external dedicated pull-up power supply VPU_FS; The self-test threshold comparison module 120 generates a voltage comparison reference point based on an external dedicated pull-up power supply VPU_FS, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In this way, it outputs a first voltage when the voltage of the dedicated pull-up power supply VPU_FS meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module 130 is used to convert the first voltage into a high-level signal VPU_VTH when receiving the first voltage, so as to output the high-level signal VPU_VTH to the first terminal of the multiplexer MUX; the buffer module 130 is used to convert the second voltage into a low-level signal VPU_VTH when receiving the second voltage, so as to output the low-level signal VPU_VTH to the first terminal of the multiplexer MUX. The multiplexer MUX is used to select to receive either a high-level signal VPU_VTH or a low-level signal VPU_VTH at its first terminal when it receives an external low-power shutdown state signal at its control terminal, and then transmits the high-level signal VPU_VTH or the low-level signal VPU_VTH to the signal output sub-circuit 200. The signal output sub-circuit 200 is used to output a high-level fail-safe signal FSXB to the safety output pin of the external power device based on the high-level signal VPU_VTH, the external dedicated pull-up power supply VPU_FS, and the chip's total power supply VBAT when receiving the high-level signal VPU_VTH; the signal output sub-circuit 200 is also used to output a low-level fail-safe signal FSXB to the safety output pin of the external power device when receiving the low-level signal VPU_VTH.

[0049] The aforementioned fail-safe signal FSXB output drive circuit utilizes a dedicated pull-up power supply VPU_FS (VPU_FS) to generate an internal comparison reference point and compare it with the voltage divider node, avoiding the introduction of an additional voltage reference source. This achieves independent voltage detection without relying on other reference power supplies inside the chip, ensuring the continued effectiveness of the comparison function even when the chip's internal power supply is abnormal or suddenly powered off. Combined with the multiplexer MUX and signal output sub-circuit 200, after the chip enters a low-power shutdown state, it can seamlessly switch to a delayed output mode controlled by the comparison result of the self-test threshold comparison module 120. Furthermore, by using a preset external RC network to delay the discharge of the dedicated pull-up power supply VPU_FS, the safety output pin can maintain a controllable high level for a period of time during chip power-down, providing a reliable fault response window for external systems. Ultimately, the aforementioned failure safety signal FSXB output drive circuit uses an analog circuit composed entirely of a pull-up power supply voltage divider module 110, a self-test threshold comparison module 120, and a buffer module 130 to determine the high and low levels of the output signal. This avoids the problem of inaccurate high and low levels of the safety signal output due to the failure of the internal digital power supply or reference source, and significantly improves the functional safety level of the chip under power interruption or drop conditions.

[0050] Specifically, the dedicated pull-up power supply VPU_FS has an external RC delay circuit. When the chip's main power supply VBAT is powered off or de-energized and enters a low-power shutdown state, the capacitor of the RC delay circuit releases charge, causing the dedicated pull-up power supply VPU_FS to be powered off with a delay. This results in a time delay in the dedicated pull-up voltage not meeting the preset threshold range, causing the high-level signal VPU_VTH output by the buffer module 130 to flip with a delay. Finally, the failover safety signal FSXB can still maintain a high-level state for a period of time when the chip's main power supply VBAT is gone, until the chip voltage (VBAT) is completely powered off before flipping to a low-level state, thus ensuring that the external system has enough time to respond to the safety mode.

[0051] Please refer to Figure 2 Furthermore, it also includes a signal locking control sub-circuit 300 and a signal locking sub-circuit 400, wherein: The signal lockout control sub-circuit 300 is used to control the signal lockout sub-circuit 400 to continuously pull down the output level of the signal output sub-circuit 200 when the buffer module 130 outputs a low-level signal VPU_VTH and the external power-on reset signal POR is low.

[0052] In this implementation, by adding a signal latch control subcircuit 300 and a signal latch subcircuit 400, when the chip enters the power-down process and the self-test threshold circuit has output a low-level signal VPU_VTH indicating that the safety output pin needs to be pulled low, if the chip's total power supply VBAT voltage drops to a level that might cause the fifth NMOS transistor MN5 in the signal output subcircuit 200 to fail due to insufficient conduction voltage, the signal latch control subcircuit 300 will activate the signal latch subcircuit 400. The signal latch subcircuit 400 will then replace the fifth NMOS transistor MN5 to firmly pull the safety output pin low. This mechanism effectively prevents the safety output pin from floating or rising due to the main output transistor being cut off at the end of the chip's total power supply VBAT completely losing power, ensuring the stable and reliable pulling of the safety signal FSXB during the entire power-down process and improving the system's safety under extreme power-down conditions.

[0053] Please refer to Figure 3 Furthermore, the pull-up power supply voltage divider module 110 includes a first resistor R1, a second resistor R2, a third resistor R3, a first NMOS transistor MN1, and a first inverter INV1, wherein: The first terminal of the first resistor R1 is electrically connected to the external dedicated pull-up power supply VPU_FS; the second terminal of the first resistor R1 is electrically connected to the first terminal of the second resistor R2; the second terminal of the second resistor R2 is electrically connected to the first terminal of the third resistor R3; and the second terminal of the third resistor R3 is grounded. The common terminal of the first resistor R1 and the second resistor R2 is used to generate a voltage divider node; The input terminal of the first inverter INV1 is used to receive the high-level signal VPU_VTH or the low-level signal VPU_VTH output by the buffer module 130; the output terminal of the first inverter INV1 is electrically connected to the gate of the first NMOS transistor MN1. The drain of the first NMOS transistor MN1 is electrically connected to the first terminal of the third resistor R3, and the source of the first NMOS transistor MN1 is electrically connected to the second terminal of the third resistor R3.

[0054] Please refer to Figure 3 Furthermore, the self-test threshold comparison module 120 includes a zeroth transistor Q0, a first transistor Q1, a first PMOS transistor MP1, a second PMOS transistor MP2, a fourth resistor R4, a fifth resistor R5, a third PMOS transistor MP3, and a sixth resistor R6, wherein: The source of the first PMOS transistor MP1 and the source of the second PMOS transistor MP2 are electrically connected to the external dedicated pull-up power supply VPU_FS; the gate of the first PMOS transistor MP1 and the gate of the second PMOS transistor MP2 are electrically connected; the drain of the first PMOS transistor MP1 and the gate of the second PMOS transistor MP2 are electrically connected. The base of the zeroth transistor Q0 and the base of the first transistor Q1 are used to receive the voltage divider node; the collector of the zeroth transistor Q0 is electrically connected to the drain of the first PMOS transistor MP1; the collector of the first transistor Q1 is electrically connected to the drain of the second PMOS transistor MP2; the common emitter of the zeroth transistor Q0 is electrically connected to the first terminal of the fourth resistor R4; the common emitter of the first transistor Q1 is electrically connected to the second terminal of the fourth resistor R4. The first end of the fifth resistor R5 is electrically connected to the second end of the fourth resistor R4, and the second end of the fifth resistor R5 is grounded. The gate of the third PMOS transistor MP3 is electrically connected to the collector of the first transistor Q1, the source of the third PMOS transistor MP3 is electrically connected to the external dedicated pull-up power supply VPU_FS, and the drain of the third PMOS transistor MP3 is electrically connected to the first terminal of the sixth resistor R6; the second terminal of the sixth resistor R6 is grounded. The common terminal of the third PMOS transistor MP3 and the sixth resistor R6 is used to output the first voltage or the second voltage.

[0055] Please refer to Figure 3Furthermore, the buffer module 130 includes a fourth PMOS transistor MP4, a fifth PMOS transistor MP5, a second NMOS transistor MN2, and a third NMOS transistor MN3, wherein: The gate of the fourth PMOS transistor MP4 and the gate of the second NMOS transistor MN2 are used to receive the first voltage or the second voltage. The source of the fourth PMOS transistor MP4 is electrically connected to the external dedicated pull-up power supply VPU_FS, the drain of the fourth PMOS transistor MP4 is electrically connected to the drain of the second NMOS transistor MN2, and the source of the second NMOS transistor MN2 is grounded. The gate of the fifth PMOS transistor MP5, the gate of the third NMOS transistor MN3, the drain of the fourth PMOS transistor MP4, and the drain of the second NMOS transistor MN2 are electrically connected. The source of the fifth PMOS transistor MP5 is electrically connected to the external dedicated pull-up power supply VPU_FS, the drain of the fifth PMOS transistor MP5 is electrically connected to the drain of the third NMOS transistor MN3, and the source of the third NMOS transistor MN3 is grounded. The drain of the fifth PMOS transistor MP5 and the drain of the third NMOS transistor MN3 are used to output the high-level signal VPU_VTH or the low-level signal VPU_VTH.

[0056] Specifically, the working principle of the pull-up power supply voltage divider module 110, the self-test threshold comparison module 120, and the buffer module 130 mentioned above is as follows: In the pull-up power supply voltage divider module 110, the first resistor R1, the second resistor R2, the third resistor R3, and the first NMOS transistor MN1 form a voltage divider network with hysteresis function. The gate of the first NMOS transistor MN1 is controlled by the final output signal of the buffer module 130 through the first inverter INV1. When the output is low, the first inverter INV1 outputs a high level, turning on the first NMOS transistor MN1 and short-circuiting the third resistor R3 in parallel. At this time, the current in the voltage divider branch increases, and the voltage at the common point of the first resistor R1 and the second resistor R2 increases, that is, the voltage of the voltage divider node increases. This means that a higher dedicated pull-up power supply VPU_FS voltage is required to make the subsequent comparator circuit flip, thus forming a high threshold. Conversely, when the buffer module 130 outputs a high level, the first NMOS transistor MN1 is turned off, the third resistor R3 is connected to the voltage divider network, the voltage of the voltage divider node is relatively reduced, and the dedicated pull-up power supply VPU_FS voltage required for flipping also decreases accordingly, forming a low threshold. Through this mechanism, the circuit obtains hysteresis characteristics that resist power supply jitter.

[0057] In the self-test threshold comparison module 120, the first PMOS transistor MP1 and the second PMOS transistor MP2 form a precise 1:1 current mirror. The zeroth transistor Q0 and the first transistor Q1 are arranged in an N:1 area ratio, and their bases share the voltage from the voltage divider node. The collector-emitter path of the zeroth transistor Q0 is connected in series with the fourth resistor R4, while the emitter of the first transistor Q1 is connected between the fourth resistor R4 and the fifth resistor R5. This structure makes the current flowing through the two transistors inversely proportional to their area, so that when both are operating in the amplification region and the current is the same, the base-emitter voltage of the two transistors generates a difference ΔVBE, which is proportional to the absolute temperature, forming an internal comparison reference point.

[0058] The circuit operates in two phases. During power-up from the dedicated pull-up power supply VPU_FS, the voltage divider node voltage is initially low, and transistor Q0, due to its large area, dominates the current. As the VPU_FS voltage increases, the voltage divider node voltage also increases, leading to an increase in the base-emitter voltage of transistor Q1 and enhanced conduction. When the currents of the two transistors tend to be equal under the influence of the current mirror, the ΔVBE condition is established. If the voltage continues to rise, transistor Q1 enters a stronger conduction state, and its collector current increases, causing a decrease in the drain voltage of the second PMOS transistor MP2 and the collector voltage of the first transistor Q1. This voltage directly controls the gate voltage of the third PMOS transistor MP3. The third PMOS transistor MP3 and the sixth resistor R6 form a common-source amplifier, and its drain output voltage decreases accordingly. This voltage is shaped and amplified by a first-stage inverter composed of the fourth PMOS transistor MP4 and the second NMOS transistor MN2, and a second-stage inverter composed of the fifth PMOS transistor MP5 and the third NMOS transistor MN3, ultimately outputting a high-level signal VPU_VTH. At this time, the high-level signal VPU_VTH is fed back to the first inverter INV1, turning off the first NMOS transistor MN1, and the circuit enters the low threshold state.

[0059] During the power-down process of the dedicated pull-up power supply VPU_FS, when the voltage drops below the condition required to maintain ΔVBE, the conduction capability of the first transistor Q1 weakens, its collector voltage increases, causing the third PMOS transistor MP3 to tend to turn off, and its drain output voltage increases. The buffer module 130 then flips, ultimately outputting a low-level signal VPU_VTH. This low-level signal VPU_VTH again turns on the first NMOS transistor MN1 through the first inverter INV1, and the circuit switches back to the high threshold state, preparing for the next power-up.

[0060] Please refer to Figure 4Furthermore, the signal output sub-circuit 200 includes a first diode D1, a second diode D2, an internal resistor Rint, a pull-up resistor Rpu, a fourth NMOS transistor MN4, and a fifth NMOS transistor MN5, wherein: The anode of the first diode D1 is electrically connected to the external dedicated pull-up power supply VPU_FS, and the cathode of the first diode D1 is electrically connected to the first terminal of the internal resistor Rint. The anode of the second diode D2 is electrically connected to the external chip power supply VBAT, and the cathode of the second diode D2 is electrically connected to the first terminal of the internal resistor Rint. The gate of the fourth NMOS transistor MN4 is used to receive the high-level signal VPU_VTH or the low-level signal VPU_VTH; the drain of the fourth NMOS transistor MN4 is electrically connected to the second terminal of the internal resistor Rint, and the source of the fourth NMOS transistor MN4 is grounded. The first end of the pull-up resistor Rpu is electrically connected to the external dedicated pull-up power supply VPU_FS, the second end of the pull-up resistor Rpu is electrically connected to the drain of the fifth NMOS transistor MN5, the gate of the fifth NMOS transistor MN5 is electrically connected to the second end of the internal resistor Rint, and the source of the fifth NMOS transistor MN5 is grounded. The common terminal of the pull-up resistor Rpu and the fifth NMOS transistor MN5 is used to output a high-level fail-safe signal FSXB or a low-level fail-safe signal FSXB to the safety output pin of an external power device.

[0061] In this implementation, a dedicated pull-up power supply VPU_FS and the chip's main power supply VBAT are connected to an open-drain structure composed of an internal resistor Rint and a fourth NMOS transistor MN4 via a first diode D1 and a second diode D2. The dedicated pull-up power supply VPU_FS and the main power supply VBAT supply power to the fourth NMOS transistor MN4 through the diodes. When the fourth NMOS transistor MN4 is turned on, a high-level bias voltage is provided to its drain. The fourth NMOS transistor MN4 acts as a drive switch, and its gate is controlled by the output signal of the multiplexer MUX. This, in turn, regulates the gate level of the fifth NMOS transistor MN5 through the drain level of the fourth NMOS transistor MN4. The fifth NMOS transistor MN5 and the pull-up resistor Rpu form the final open-drain output stage, powered by the dedicated pull-up power supply VPU_FS, driving the fail-safe signal FSXB pin. This design allows the safety output pin to be controlled by the delay characteristics of the external RC network of the dedicated pull-up power supply VPU_FS during chip power-down. Even if the chip's main power supply VBAT fails, as long as the dedicated pull-up power supply VPU_FS has voltage and the multiplexer MUX outputs a high-level signal, its output failure safety signal FSXB can still maintain a high level for a period of time, thereby ensuring that the external system has enough time to respond to the safety mode.

[0062] Please refer to Figure 4 Furthermore, the signal locking sub-circuit 400 includes a sixth NMOS transistor MN6, a seventh NMOS transistor MN7, a sixth PMOS transistor MP6, a first capacitor C1, and an isolation module 410, wherein: The input terminal of the isolation module 410 is electrically connected to the external chip main power supply VBAT, the output terminal of the isolation module 410 is electrically connected to the first terminal of the first capacitor C1, and the second terminal of the first capacitor C1 is grounded. The isolation module 410 is used to charge the first capacitor C1 through the external chip power supply VBAT when the external power-on reset signal POR is high, and to isolate the external chip power supply VBAT to discharge the first capacitor C1 when the external power-on reset signal POR is low. The source of the sixth PMOS transistor MP6 is electrically connected to the first terminal of the first capacitor C1, the gate of the sixth PMOS transistor MP6 is used to receive the control signal of the signal lock control sub-circuit 300, and the drain of the sixth PMOS transistor MP6 is electrically connected to the gate of the sixth NMOS transistor MN6. The drain of the seventh NMOS transistor MN7 is electrically connected to the gate of the sixth NMOS transistor MN6. The gate of the seventh NMOS transistor MN7 is used to receive the control signal of the signal lock control sub-circuit 300. The source of the seventh NMOS transistor MN7 is grounded. The drain of the sixth NMOS transistor MN6 is electrically connected to the output terminal of the signal output sub-circuit 200, and the source of the sixth NMOS transistor MN6 is grounded.

[0063] Please refer to Figure 4 Furthermore, the isolation module 410 includes an eighth NMOS transistor MN8 and a ninth NMOS transistor MN9, wherein: The drain of the eighth NMOS transistor MN8 serves as the input terminal of the isolation module 410; the source of the eighth NMOS transistor MN8 and the source of the ninth NMOS transistor MN9 are electrically connected; the gate of the eighth NMOS transistor MN8 and the gate of the ninth NMOS transistor MN9 are used to receive the external power-on reset signal POR; the drain of the ninth NMOS transistor MN9 serves as the output terminal of the isolation module 410.

[0064] Please refer to Figure 4 Furthermore, the signal locking control sub-circuit 300 includes an OR gate, a second inverter INV2, and a third inverter INV3, wherein: The first input of the OR gate is used to receive an external power-on reset signal POR, and the second input of the OR gate is used to receive a high-level signal VPU_VTH or a low-level signal VPU_VTH from the buffer module 130; the output of the OR gate is electrically connected to the gate of the seventh NMOS transistor MN7; the output of the OR gate is electrically connected to the input of the second inverter INV2; the output of the second inverter INV2 is electrically connected to the input of the third inverter INV3; and the output of the third inverter INV3 is electrically connected to the gate of the sixth PMOS transistor MP6.

[0065] The specific collaborative working mechanism of the aforementioned signal locking sub-circuit 400, isolation module 410, and signal locking control sub-circuit 300 is as follows: The isolation module 410 consists of an eighth NMOS transistor MN8 and a ninth NMOS transistor MN9 arranged back-to-back. The gates of both transistors are controlled by an external power-on reset signal. When the power-on reset signal is high, the chip is in normal operation, both transistors are turned on, and the chip's total power supply VBAT charges the first capacitor C1 through them, bringing its voltage close to the chip's total power supply VBAT voltage. When the power-on reset signal goes low, the chip enters a low-power shutdown state, and both transistors are reliably turned off simultaneously, effectively blocking the path between the chip's total power supply VBAT and the first capacitor C1, preventing residual current backflow, and allowing the first capacitor C1 to enter an isolated discharge state.

[0066] The signal locking control sub-circuit 300 is based on an OR gate. The two inputs of the OR gate receive an external power-on reset signal and a self-test threshold signal output by the buffer module 130, respectively. One output of the OR gate directly controls the gate of the seventh NMOS transistor MN7, and the other output passes through the second inverter INV2 and the third inverter INV3 in sequence to generate an inverted control signal that is sent to the gate of the sixth PMOS transistor MP6.

[0067] During normal chip power-on and operation, the power-on reset signal is high, and the OR gate output is always high. This high level turns on the seventh NMOS transistor MN7, forcibly pulling the gate of the sixth NMOS transistor MN6 low to ground potential, ensuring its turn-off. Simultaneously, after two stages of inversion, the gate of the sixth PMOS transistor MP6 is low, and the sixth PMOS transistor MP6 is also turned off. At this time, the first capacitor C1 remains charged, the signal lockout sub-circuit 400 does not work, and the fail-safe signal FSXB is entirely controlled by the fifth NMOS transistor MN5 in the signal output sub-circuit 200 to pull it low.

[0068] When the chip powers down and the self-test threshold circuit detects that the voltage of the dedicated pull-up power supply VPU_FS is below the threshold, the self-test threshold signal goes low. If the power-on reset signal has also gone low, the OR gate output goes low. This low-level signal causes the seventh NMOS transistor MN7 to turn off, and after two stages of inversion, it goes high, thus turning on the sixth PMOS transistor MP6. At this time, the charge stored in the first capacitor C1 is released through the turned-on sixth PMOS transistor MP6, providing a drive voltage to the gate of the sixth NMOS transistor MN6, turning it on. The drain of the sixth NMOS transistor MN6 is directly connected to the fail-safe signal FSXB pin, thus continuously pulling it low.

[0069] This mechanism aims to provide dual protection. In the initial power-down phase, the fifth NMOS transistor MN5 in the signal output sub-circuit 200 can still be driven by the dedicated pull-up power supply VPU_FS, which still has voltage, to perform its pull-down function. However, when the chip's total power supply VBAT voltage continues to drop to a low level, the fifth NMOS transistor MN5 may fail to conduct effectively or be completely turned off due to insufficient gate drive voltage, causing the fail-safe signal FSXB pin level to fluctuate with the residual power supply voltage. At this time, the signal lockout sub-circuit 400, powered by the first capacitor C1, is activated. Since the first capacitor C1 has been pre-charged during normal chip operation and is isolated from the chip's power-down total power supply VBAT, its discharge rate is slow. Therefore, after the fifth NMOS transistor MN5 fails, it can continue to keep the sixth NMOS transistor MN6 conducting for a period of time, thereby ensuring that the fail-safe signal FSXB is firmly locked at a low level until the capacitor's charge is depleted. This design completely eliminates the risk of unstable safety signals due to the failure of the main output transistor at the end of power-down, greatly improving the functional safety and reliability of the system under extreme power conditions.

[0070] Please refer to Figure 5 , Figure 5 This is a schematic diagram of the external RC delay circuit of a dedicated pull-up power supply VPU_FS provided in an embodiment of the present invention. The delay resistor Rpd and the delay capacitor Cpd constitute the external RC delay circuit of the dedicated pull-up power supply VPU_FS. When the chip is powered off, the stored charge is released through the delay resistor Rpd and the delay capacitor Cpd, so that the dedicated pull-up power supply VPU_FS is powered off more slowly than the chip's total power supply VBAT.

[0071] A second aspect of the present invention provides a fail-safe signal (FSXB) output driving system, comprising a dedicated pull-up power supply VPU_FS, a chip main power supply VBAT, digital logic circuitry, and a fail-safe signal (FSXB) output driving circuit; the fail-safe signal (FSXB) output driving circuit includes a self-test threshold sub-circuit 100, a multiplexer MUX, and a signal output sub-circuit 200; the self-test threshold sub-circuit 100 includes a pull-up power supply voltage divider module 110, a self-test threshold comparison module 120, and a buffer module 130; wherein: The pull-up power supply voltage divider module 110 generates a voltage divider node based on the dedicated pull-up power supply VPU_FS; The self-test threshold comparison module 120 generates a voltage comparison reference point based on the dedicated pull-up power supply VPU_FS, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In turn, it outputs a first voltage when the voltage of the dedicated pull-up power supply VPU_FS meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module 130 is used to convert the first voltage into a high-level signal VPU_VTH when receiving the first voltage, so as to output the high-level signal VPU_VTH to the first terminal of the multiplexer MUX; the buffer module 130 is used to convert the second voltage into a low-level signal VPU_VTH when receiving the second voltage, so as to output the low-level signal VPU_VTH to the first terminal of the multiplexer MUX. The multiplexer MUX is used to select to receive either a high-level signal VPU_VTH or a low-level signal VPU_VTH at its first terminal when it receives a low-power shutdown state signal from the digital logic circuit at its control terminal, and then transmits the high-level signal VPU_VTH or the low-level signal VPU_VTH to the signal output sub-circuit 200. The signal output sub-circuit 200 is used to output a high-level fail-safe signal FSXB to the safety output pin of an external power device based on the high-level signal VPU_VTH, the dedicated pull-up power supply VPU_FS, and the chip's total power supply VBAT when receiving the high-level signal VPU_VTH; the signal output sub-circuit 200 is also used to output a low-level fail-safe signal FSXB to the safety output pin of an external power device when receiving the low-level signal VPU_VTH.

[0072] The fail-safe signal FSXB output drive circuit and system provided by the present invention have at least the following advantages compared with the prior art: First, this invention employs a self-test threshold sub-circuit 100 for voltage detection, eliminating the need for internal or external reference power supplies. This achieves independence and simplification of functional safety self-testing, reducing the system's coupling requirements across multiple power domains. Second, even after the chip enters a low-power shutdown state, this circuit can still slowly discharge via an external RC delay network connected to the dedicated pull-up power supply VPU_FS, continuously detecting and outputting based on a set voltage threshold. This ensures a safe signal output for a period even after the chip's main power supply fails, providing a reliable fault response window for external systems. Furthermore, through the coordination of the charging / discharging capacitor delay circuit and accompanying logic control, the functional safety pin can be thoroughly and reliably pulled low when the voltage of the dedicated pull-up power supply VPU_FS falls below a set threshold. This prevents signal fluctuations due to residual power supply voltage, ensuring the system maintains a defined safe state even during complete power-down. Moreover, all of the above functions are highly integrated within the chip, significantly reducing the complexity of peripheral circuits and the types of power supplies required. This improves the overall system integration and reliability, facilitating the achievement of high-level functional safety requirements in a compact design.

[0073] In one possible implementation, the self-test threshold circuit detection can use a PNP transistor and an NMOS current mirror structure to replace the self-test comparison module composed of an NPN transistor and a PMOS current mirror provided in the technology to achieve the detection purpose. The charge / discharge capacitor delay circuit can be replaced by a redundant power supply designed separately for the chip, which would have a very large area and be highly complex.

[0074] The term "embodiment" as used herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; however, any combination of these technical features that does not contradict each other should be considered within the scope of this specification.

[0075] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the concept of this application, and these improvements and substitutions should also be considered within the scope of protection of this invention. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A fail-safe signal output driving circuit, characterized in that, It includes a self-test threshold sub-circuit, a multiplexer, and a signal output sub-circuit; the self-test threshold sub-circuit includes a pull-up power supply voltage divider module, a self-test threshold comparison module, and a buffer module, wherein: The pull-up power supply voltage divider module generates voltage divider nodes based on an external dedicated pull-up power supply; The self-test threshold comparison module generates a voltage comparison reference point based on an external dedicated pull-up power supply, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In turn, it outputs a first voltage when the voltage of the dedicated pull-up power supply meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module is used to convert the first voltage into a high-level signal when receiving the first voltage, so as to output a high-level signal to the first terminal of the multiplexer; the buffer module is used to convert the second voltage into a low-level signal when receiving the second voltage, so as to output a low-level signal to the first terminal of the multiplexer. The multiplexer is used to select to receive a high-level signal or a low-level signal at its first terminal when it receives an external low-power shutdown state signal at its control terminal, and then transmit the high-level signal or the low-level signal to the signal output sub-circuit. The signal output sub-circuit is used to output a high-level fail-safe signal to the safety output pin of the external power device based on the high-level signal, the external dedicated pull-up power supply, and the chip's total power supply when receiving the high-level signal; the signal output sub-circuit is used to output a low-level fail-safe signal to the safety output pin of the external power device when receiving the low-level signal.

2. The fail-safe signal output driving circuit according to claim 1, characterized in that, The pull-up power supply voltage divider module includes a first resistor, a second resistor, a third resistor, a first NMOS transistor, and a first inverter, wherein: The first terminal of the first resistor is electrically connected to an external dedicated pull-up power supply; the second terminal of the first resistor is electrically connected to the first terminal of the second resistor; the second terminal of the second resistor is electrically connected to the first terminal of the third resistor; and the second terminal of the third resistor is grounded. The common terminal of the first resistor and the second resistor is used to generate a voltage divider node; The input terminal of the first inverter is used to receive a high-level signal or a low-level signal output by the buffer module; the output terminal of the first inverter is electrically connected to the gate of the first NMOS transistor. The drain of the first NMOS transistor is electrically connected to the first terminal of the third resistor, and the source of the first NMOS transistor is electrically connected to the second terminal of the third resistor.

3. The fail-safe signal output driving circuit according to claim 1, characterized in that, The self-test threshold comparison module includes a zeroth transistor, a first transistor, a first PMOS transistor, a second PMOS transistor, a fourth resistor, a fifth resistor, a third PMOS transistor, and a sixth resistor, wherein: The source of the first PMOS transistor and the source of the second PMOS transistor are respectively electrically connected to an external dedicated pull-up power supply; the gate of the first PMOS transistor and the gate of the second PMOS transistor are electrically connected; the drain of the first PMOS transistor and the gate of the second PMOS transistor are electrically connected. The base of the zeroth transistor and the base of the first transistor are used to receive the voltage divider node; the collector of the zeroth transistor is electrically connected to the drain of the first PMOS transistor; the collector of the first transistor is electrically connected to the drain of the second PMOS transistor; the common emitter of the zeroth transistor is electrically connected to the first terminal of the fourth resistor; the common emitter of the first transistor is electrically connected to the second terminal of the fourth resistor. The first end of the fifth resistor is electrically connected to the second end of the fourth resistor, and the second end of the fifth resistor is grounded; The gate of the third PMOS transistor is electrically connected to the collector of the first transistor, the source of the third PMOS transistor is electrically connected to an external dedicated pull-up power supply, and the drain of the third PMOS transistor is electrically connected to the first terminal of the sixth resistor; the second terminal of the sixth resistor is grounded. The common terminal of the third PMOS transistor and the sixth resistor is used to output the first voltage or the second voltage.

4. The fail-safe signal output driving circuit according to claim 1, characterized in that, The buffer module includes a fourth PMOS transistor, a fifth PMOS transistor, a second NMOS transistor, and a third NMOS transistor, wherein: The gate of the fourth PMOS transistor and the gate of the second NMOS transistor are used to receive the first voltage or the second voltage. The source of the fourth PMOS transistor is electrically connected to an external dedicated pull-up power supply, the drain of the fourth PMOS transistor is electrically connected to the drain of the second NMOS transistor, and the source of the second NMOS transistor is grounded. The gate of the fifth PMOS transistor, the gate of the third NMOS transistor, the drain of the fourth PMOS transistor, and the drain of the second NMOS transistor are electrically connected. The source of the fifth PMOS transistor is electrically connected to an external dedicated pull-up power supply, the drain of the fifth PMOS transistor is electrically connected to the drain of the third NMOS transistor, and the source of the third NMOS transistor is grounded. The drain of the fifth PMOS transistor and the drain of the third NMOS transistor are used to output the high-level signal or the low-level signal.

5. The fail-safe signal output driving circuit according to claim 1, characterized in that, The signal output sub-circuit includes a first diode, a second diode, an internal resistor, a pull-up resistor, a fourth NMOS transistor, and a fifth NMOS transistor, wherein: The anode of the first diode is electrically connected to an external dedicated pull-up power supply, and the cathode of the first diode is electrically connected to the first end of the internal resistor. The anode of the second diode is electrically connected to the external chip's main power supply, and the cathode of the second diode is electrically connected to the first end of the internal resistor. The gate of the fourth NMOS transistor is used to receive the high-level signal or the low-level signal; the drain of the fourth NMOS transistor is electrically connected to the second terminal of the internal resistor, and the source of the fourth NMOS transistor is grounded. The first end of the pull-up resistor is electrically connected to an external dedicated pull-up power supply, and the second end of the pull-up resistor is electrically connected to the drain of the fifth NMOS transistor; the gate of the fifth NMOS transistor is electrically connected to the second end of the internal resistor; the source of the fifth NMOS transistor is grounded. The common terminal of the pull-up resistor and the fifth NMOS transistor is used to output a high-level fail-safe signal or a low-level fail-safe signal to the safety output pin of an external power device.

6. The fail-safe signal output driving circuit according to claim 1, characterized in that, It also includes a signal latching control subcircuit and a signal latching subcircuit, wherein: The signal lockout control subcircuit is used to control the signal lockout subcircuit to continuously pull down the output level of the signal output subcircuit when the buffer module outputs a low-level signal and the external power-on reset signal is low.

7. The fail-safe signal output driving circuit according to claim 6, characterized in that, The signal-locked loop sub-circuit includes a sixth NMOS transistor, a seventh NMOS transistor, a sixth PMOS transistor, a first capacitor, and an isolation module, wherein: The input terminal of the isolation module is electrically connected to the external chip's main power supply, the output terminal of the isolation module is electrically connected to the first terminal of the first capacitor, and the second terminal of the first capacitor is grounded. The isolation module is used to charge the first capacitor through the external chip power supply when the external power-on reset signal is high, and to isolate the external chip power supply to discharge the first capacitor when the external power-on reset signal is low. The source of the sixth PMOS transistor is electrically connected to the first terminal of the first capacitor, the gate of the sixth PMOS transistor is used to receive the control signal of the signal lock control sub-circuit, and the drain of the sixth PMOS transistor is electrically connected to the gate of the sixth NMOS transistor. The drain of the seventh NMOS transistor is electrically connected to the gate of the sixth NMOS transistor. The gate of the seventh NMOS transistor is used to receive the control signal of the signal lock control sub-circuit. The source of the seventh NMOS transistor is grounded. The drain of the sixth NMOS transistor is electrically connected to the output terminal of the signal output sub-circuit, and the source of the sixth NMOS transistor is grounded.

8. The fail-safe signal output driving circuit according to claim 7, characterized in that, The isolation module includes an eighth NMOS transistor and a ninth NMOS transistor, wherein: The drain of the eighth NMOS transistor serves as the input terminal of the isolation module; the source of the eighth NMOS transistor and the source of the ninth NMOS transistor are electrically connected; the gate of the eighth NMOS transistor and the gate of the ninth NMOS transistor are used to receive external power-on reset signals; the drain of the ninth NMOS transistor serves as the output terminal of the isolation module.

9. The fail-safe signal output driving circuit according to claim 7, characterized in that, The signal locking control sub-circuit includes an OR gate, a second inverter, and a third inverter, wherein: The first input of the OR gate is used to receive an external power-on reset signal, and the second input of the OR gate is used to receive a high-level signal or a low-level signal from the buffer module; the output of the OR gate is electrically connected to the gate of the seventh NMOS transistor; the output of the OR gate is electrically connected to the input of the second inverter; the output of the second inverter is electrically connected to the input of the third inverter; and the output of the third inverter is electrically connected to the gate of the sixth PMOS transistor.

10. A fail-safe signal output driving system, characterized in that, It includes a dedicated pull-up power supply, a main chip power supply, digital logic circuits, and a fail-safe signal output driver circuit; the fail-safe signal output driver circuit includes a self-test threshold sub-circuit, a multiplexer, and a signal output sub-circuit; the self-test threshold sub-circuit includes a pull-up power supply voltage divider module, a self-test threshold comparison module, and a buffer module; wherein: The pull-up power supply voltage divider module generates voltage divider nodes based on the dedicated pull-up power supply; The self-test threshold comparison module generates a voltage comparison reference point based on the dedicated pull-up power supply, and then performs voltage comparison based on the voltage divider node and the voltage comparison reference point. In turn, it outputs a first voltage when the voltage of the dedicated pull-up power supply meets the preset threshold range, or outputs a second voltage when the voltage of the dedicated pull-up power supply does not meet the preset threshold range. The buffer module is used to convert the first voltage into a high-level signal when receiving the first voltage, so as to output a high-level signal to the first terminal of the multiplexer; the buffer module is used to convert the second voltage into a low-level signal when receiving the second voltage, so as to output a low-level signal to the first terminal of the multiplexer. When the multiplexer receives a low-power shutdown state signal from the digital logic circuit at its control terminal, it selects to receive a high-level signal or a low-level signal at its first terminal, and then transmits the high-level signal or the low-level signal to the signal output sub-circuit. The signal output sub-circuit is used to output a high-level fail-safe signal to the safety output pin of an external power device based on the high-level signal, the dedicated pull-up power supply, and the chip's total power supply when receiving the high-level signal; the signal output sub-circuit is used to output a low-level fail-safe signal to the safety output pin of an external power device when receiving the low-level signal.

Images