Chip temperature monitoring for safety-critical applications

Abstract

To provide an integrated circuit that manages temperature or fault monitoring of one or more electronic components.SOLUTION: An apparatus may include a first temperature sensor and a second temperature sensor at different locations. The first temperature sensor and the second temperature sensor may be positioned at different locations in order to have a comparative numeric relationship that is indicative of whether there is a fault in an electronic component during a baseline period.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] (CROSS-REFERENCE TO RELATED APPLICATIONS) This application claims the benefit of U.S. Provisional Application No. 63 / 550,441, filed February 6, 2024, entitled "NOVEL AND EFFICIENT APPROACH TO ON CHIP TEMPERATURE MONITORING FOR SAFETY CRITICAL APPLICATIONS," the entire contents of which are incorporated herein by reference.

[0002] Automotive Safety Integrity Level (ASIL) is a risk classification system defined by the ISO 26262 standard for the functional safety of road vehicles. ASIL classifies hazards into one of four levels, designated A through D, with a fifth additional level for systems or components that are not hazardous. ASIL D represents the highest level of risk, and ASIL A represents the lowest.

[0003] The standard defines functional safety as "the absence of undue risk from hazards caused by the malfunctioning behavior of electrical or electronic systems." ASILs define safety requirements for automotive components to comply with ISO 26262, based on the likelihood and acceptability of hazards.

[0004] Systems including vehicle brakes may require an ASIL-D grade, the highest applicable level of safety rigor, due to the significant risks associated with their failure. Examples of ASIL-B are headlights and brake lights, while ASIL-C may be for systems including cruise control. Taillights are an exemplary light that may be classified with an ASIL-A grade.

[0005] Potential failures can be diagnosed by hardware built-in self-tests or by using inherent redundancy in the monitor components (eg, duplicated diodes and analog-to-digital converters (ADCs)).

[0006] Aspects of the subject technology can help improve the overall cost, reliability, and efficiency of circuits or other electronic components. Summary of the Invention

[0007] This description is generally directed to an on-chip temperature monitoring method, apparatus, or system that is compatible with road vehicle functional safety. Potential faults may be diagnosed by hardware built-in self-tests or by using inherent redundancy to monitor components. The disclosed subject matter may use software to perform differential temperature diode temperature measurement checks in certain predetermined use modes of the electronic components, which may include strategic placement of temperature diodes in specific locations to help achieve threshold latent fault coverage.

[0008] According to one or more aspects of the present disclosure, one or more devices, such as an integrated circuit, may have a mechanism for temperature or fault monitoring of one or more electronic components. The integrated circuit may include a first power domain, the first power domain may include a first temperature sensor, and the second power domain may include a second temperature sensor. The first temperature sensor and the second temperature sensor may be positioned to have a temperature difference during a startup period that indicates whether there is a fault in the electronic component of the first power domain or the second power domain. The startup period may be defined by the initiation of a safety application. The electronic component may include the first temperature sensor or the second temperature sensor.

[0009] According to one or more aspects of the present disclosure, there may be one or more methods, systems, or apparatuses for temperature or fault monitoring of one or more electronic components. In one example, the method may include receiving a first measured temperature of a first area associated with a trigger period, receiving a second measured temperature of a second area associated with the trigger period, determining a measured temperature difference between the first measured temperature and the second measured temperature, determining whether the measured temperature difference exceeds a reference threshold, and transmitting an indication that the measured temperature difference exceeds the reference threshold. The reference threshold may be based on a baseline temperature difference, which may include a temperature difference between a first baseline temperature from the first area during a baseline period and a second baseline temperature from the second area during the baseline period.

[0010] In one or more embodiments, based on an indication that the measured temperature difference exceeds a reference threshold, there may be a transmission of an indication of a failure of a first component of the one or more electronic components. The first area and the second area may represent a first power domain and a second power domain, respectively. The one or more electronic components may include a sensor. The one or more electronic components may include an integrated circuit. The baseline period may be a start-up period of the one or more electronic components. [Brief explanation of the drawings]

[0011] Certain features of the subject technology are set forth in the appended claims. However, for purposes of explanation, several embodiments of the subject technology are set forth in the following figures. [Figure 1] FIG. 1 illustrates an exemplary integrated circuit that may be used to implement one or more features of temperature or fault monitoring of one or more electronic components. [Figure 2] FIG. 2 illustrates an exemplary method for temperature or fault monitoring of one or more electronic components. [Figure 3] FIG. 3 illustrates an exemplary sequence diagram associated with temperature or fault monitoring of one or more electronic components. DETAILED DESCRIPTION OF THE INVENTION

[0012] The detailed description set forth below is intended as a description of various configurations of the subject technology and is not intended to represent the only configurations in which the subject technology can be practiced. The accompanying drawings are incorporated herein and constitute a part of the detailed description. The detailed description includes specific details for the purpose of providing a thorough understanding of the subject technology. However, the subject technology is not limited to the specific details set forth herein and may be practiced using one or more other implementation forms. In one or more embodiments, structures and components are shown in block diagram form to avoid obscuring the concepts of the subject technology.

[0013] Automotive Safety Integrity Level (ASIL)-defined systems-on-chip (SoCs) can drive the need for monitors for dependent failure initiators, such as temperature, to help detect single-point failures in safety-critical subsystems. Such monitoring architectures are safety mechanisms designed to detect unexpected temperature rises or falls that could potentially cause a subsystem to malfunction when the temperature exceeds a specified operating range threshold. This helps provide the required diagnostic coverage against single-point failures due to temperature fluctuations.

[0014] In some implementations, to obtain a desired level of accuracy, temperature diodes may be used in conjunction with ADCs to read the temperatures of different parts of various safety-critical subsystems scattered across the SoC via a digital controller at regular time intervals, such as those defined by the system's fault tolerant time interval (FTTI). In addition, checkers may be required to verify whether the monitors themselves have potential faults. These monitors and checkers may be expensive for larger SoCs, where there may be several such safety-critical subsystems that need to be monitored separately. Monitors, such as diodes, may be duplicated for redundancy purposes. Using redundant components may increase cost and complexity.

[0015] To ensure that a safety system functions properly for the required period of time, the safety system may be required to detect permanent failures in the components that make up the safety system itself, which could potentially result in a single point of failure of a safety-critical subsystem. Potential failures can be diagnosed by hardware built-in self-tests or by using inherent redundancy in the monitoring components. Some embodiments may incorporate redundant sensors and corresponding connections of the sensors to the ADC. These redundant sensors may be implemented because there may be a primary and secondary temperature sensor in each area where temperature is desired, and the secondary temperature sensor may serve to verify the temperature of the primary temperature sensor, or vice versa. This embodiment may help verify that both temperature sensors are functioning properly.

[0016] The disclosed subject matter can minimize the need for such redundant sensors and can help minimize cost or reduce complexity while still meeting safety margins that may meet standards such as ASIL. The disclosed subject matter can include performing differential temperature diode temperature measurement checks in certain predetermined use modes of the integrated circuit to help achieve high latent fault coverage.

[0017] FIG. 1 illustrates an example integrated circuit 100 that can be used to implement one or more features of temperature or fault monitoring of one or more electronic components as disclosed herein. Integrated circuit 100 can include multiple power domains (PDs), such as PD 101, PD 102, PD 103, PD 104, or PD 105. The PDs can include, among other things, a central processing unit (CPU) PD or a SOC PD. Each power domain can have one or more temperature sensors. As shown, PD 101 can include sensor 110, sensor 111, or sensor hub 120. PD 103 can include sensor 113 or sensor 114. PD 104 can include sensor 115. PD 105 can include sensor 116, sensor 117, or sensor 118. PD 102 can include sensor 112 and ADC 121. The disclosed sensors can have respective wired connections to ADC 121. The ADC 121 may be communicatively connected to the sensor hub 120 .

[0018] With continued reference to FIG. 1 , the disclosed safety system may use one or more expected relative numerical relationships (such as temperature differences or ratios) associated with two or more sensors for a particular baseline period (e.g., during or immediately after the initial startup sequence) to determine whether there is a fault.

[0019] 2 illustrates an example method 130 for temperature or fault monitoring of one or more electronic components. In block 131, baseline thresholds may be determined and stored for groups of sensors. A group of sensors may be two or more sensors that may be in the same area (e.g., power domain) or different areas. For example, a first group of sensors may be sensors 110 and 112, and a second group of sensors may be sensors 113 and 115. Each group may have a different baseline threshold for the baseline period.

[0020] In one example, the sensor can be measured and characterized offline in a test setup, which can be a process in which reference thresholds are defined. When the safety application is run on the vehicle, the difference can be compared against the offline determined reference thresholds. If there is a deviation, the sensor can be considered to be functioning incorrectly.

[0021] The reference threshold may be based on a relative numerical relationship (such as a temperature difference or ratio) associated with two or more sensors for a baseline period. The baseline period may be associated with a usage mode, such as a startup sequence or a system test during shutdown. The reference threshold may be a predetermined baseline and may be stored for the future for a period of time corresponding to the baseline period. In one embodiment, the baseline period may be during or immediately after the initial startup sequence, when each of the PDs is powered on without running application software. Test software may be run to measure each of the temperature sensors. It is contemplated that the reference threshold may include a single numerical value or a range of acceptable values within a margin of error (e.g., + / - 2°F). A value outside the reference threshold may indicate a malfunction of one of the sensors.

[0022] Calculating the difference can be particularly useful because the ambient temperature at which the test is performed may not be determined at the time, and calculating the difference may cancel out the absolute ambient temperature value and retain only the location-specific temperature difference. The temperature difference reference threshold can be determined during SoC characterization in the development timeframe and pre-stored in non-volatile storage for the SoC.

[0023] In block 132, the sensor 110 may measure a temperature during a subsequent trigger period (e.g., a wake-up sequence). The sensor 110 may be located on the PD 101. The measured temperature of the sensor 110 may be sent to the CPU for processing. The trigger period may correspond to a stored baseline period.

[0024] In block 133, the sensor 112 may measure a temperature during a trigger period (e.g., a wake-up sequence). The sensor 112 may be located on the PD 102. The measured temperature of the sensor 112 may be sent to the CPU for processing. The sensor 110 and the sensor 112 may be in the same group, and there may be corresponding reference thresholds for the group.

[0025] In block 134 , a measured temperature difference (or other relative numerical relationship) may be determined between the first measured temperature of block 132 and the second measured temperature of block 133 .

[0026] In block 135, the temperature difference of block 134 may be compared to a reference threshold value. Based on the comparison, there may be a determination whether the measured temperature difference of block 134 exceeds or is within the reference threshold value of block 131.

[0027] At block 136, an indication that the measured temperature difference exceeds or is within the reference threshold may be transmitted based on the determination of block 135. In one example, the indication that the measured temperature difference exceeds the reference threshold may be used to determine that one or more sensors in the group are faulty, such as by using a relative derivation from a baseline.

[0028] As disclosed, the reference thresholds can be compared to the measured values at a predetermined resolution, and the detected anomalies can be determined to be permanent failures of the involved sensors. Through experiments, it has been found that the detection rate of potential failures (e.g., malfunctions of the sensors themselves) can achieve an ASIL-D integrity level.

[0029] 3 illustrates an exemplary sequence diagram associated with temperature or fault monitoring of one or more electronic components. In step 141, the CPU 124 of the PD 101 may detect that a trigger period (e.g., a power-up sequence) has occurred. In one embodiment, the sensors may be assigned to different groups, each having one or more trigger periods and corresponding reference thresholds, as shown in Table 1. In step 142, the CPU 124 of the PD 101 may read a respective temperature from each sensor, such as sensor 110, sensor 111, sensor 112, sensor 113, sensor 114, sensor 115, sensor 116, sensor 117, or sensor 118.

[0030] [Table 1]

[0031] In step 143, a difference for each group may be calculated. In step 144, each difference may be compared to a reference threshold. For example, if the trigger period is Trigger A, then Group A includes sensors 110 and 111, and the reference threshold is RT A-1. Groups B, C, and D each include two or more sensors and reference thresholds for Trigger A, as shown in Table 1.

[0032] In step 145, based on the comparison in step 145 indicating an error, an error indication can be transmitted to external pin 123 for further action. These further actions can be displaying the error on a screen or restricting access to one or more functions of the vehicle or other device, such as disabling full self-driving functionality or shutting down the infotainment system, among others.

[0033] The disclosed subject matter may be directed to an on-chip temperature monitoring method or system that meets Automotive Safety Integrity Level (ASIL) standards. The disclosed subject matter may be used in or with automotive electronic components. The electronic components may be incorporated into automobiles, such as electric vehicles.

[0034] Among other things, the methods, systems, and devices described herein can provide temperature or fault monitoring of one or more electronic components. For example, the system can include a first power domain and a second power domain. The first power domain can include a first temperature sensor, and the second power domain can include a second temperature sensor. The first and second temperature sensors can be positioned to have a selected temperature difference or ratio, which can be non-zero, during a triggered period, such as startup, that indicates whether an electronic component in the first or second power domain has a fault (e.g., fault or no fault). The reference threshold disclosed herein can be considered a selected temperature difference or ratio. The reference threshold can be a range that can account for a margin of error. The electronic component can include a first temperature sensor or a second temperature sensor. The first power domain can include a device that transmits an error indication when comparing the measured temperature difference of the first or second temperature sensor during a subsequent baseline period. The first and second power domains can be different. The system may further include a central processing unit, a sensor hub communicatively coupled to the central processing unit that reads a measured temperature from the first temperature sensor or the second temperature sensor via the sensor hub, and an analog-to-digital converter (ADC) communicatively coupled to the first temperature sensor, the second temperature sensor, and the sensor hub. All combinations in this paragraph (including removal or addition of steps or components) are contemplated consistent with other portions of the detailed description.

[0035] The methods, systems, or apparatuses disclosed herein may be incorporated into electric vehicles or other devices. The methods, systems, or apparatuses disclosed herein may be incorporated into products, such as electronic control units (ECUs), to perform autonomous driving, infotainment, or vehicle dynamics / control. In one example, the method may include receiving a first measured temperature of a first area associated with a trigger period; receiving a second measured temperature of a second area associated with the trigger period; determining a measured temperature difference between the first measured temperature and the second measured temperature; determining whether the measured temperature difference exceeds a reference threshold; and transmitting an indication that the measured temperature difference exceeds the reference threshold. The reference threshold may be based on a baseline temperature difference, including a temperature difference between a first baseline temperature from the first area during a baseline period and a second baseline temperature from the second area during the baseline period. The first area and the second area may be within the same power domain. All combinations in this and the previous paragraphs (including removal or addition of steps or components) are contemplated consistent with other portions of the detailed description.

[0036] The method may include transmitting an indication of a failure of a first one of the one or more electronic components based on an indication that the measured temperature difference exceeds a reference threshold. The first area or second area may refer to a respective first power domain or second power domain. The first power domain and the second power domain may be the same or different. The one or more electronic components may include one or more sensors. The one or more electronic components may include integrated circuits. The trigger period may be a start-up period of the one or more electronic components. The trigger period may be a start-up period during which application software is not running. The reference threshold may be compared against the measured value at a predetermined resolution, and any anomaly may be determined to be a permanent failure of the associated sensor. All combinations in this and the previous paragraphs (including removal or addition of steps or components) are contemplated consistent with other portions of the detailed description.

[0037] Reference to an element in the singular is not intended to mean one and only one, but rather one or more, unless otherwise specified. For example, "a" module may refer to one or more modules. The use of an element preceded by "a," "an," "the," or "said" does not, without further constraints, exclude the presence of more identical elements.

[0038] Headings and sub-headings, if any, are used for convenience only and are not intended to limit the invention. The word exemplary is used to mean serving as an example or illustration. When terms such as include and have are used, such terms are intended to be inclusive in the same manner as the term "comprise" is interpreted when employed as a transitional term in the claims. Relative terms such as "first" and "second" may be used to distinguish one entity or act from another and do not necessarily require or imply any actual relationship or order between such entities or acts.

[0039] Phrases such as one aspect, aspect, another aspect, some aspects, one or more aspects, one embodiment, an embodiment, another embodiment, some embodiments, one or more embodiments, one embodiment, embodiment, another embodiment, some embodiments, one or more embodiments, one configuration, configuration, another configuration, some configurations, one or more configurations, the subject technology, the disclosure, the present disclosure, other variations thereof, and the like are used for convenience and do not imply that the disclosure associated with such phrases is essential to the subject technology or that such disclosure applies to all configurations of the subject technology. The disclosure associated with such phrases may apply to all configurations or to one or more configurations. The disclosure associated with such phrases may provide one or more examples. Phrases such as one aspect or some aspects may refer to one or more aspects, and vice versa, and this applies equally to the other aforementioned phrases.

[0040] The phrase "at least one of," preceding a list of items, together with the term "and" or "or" separating any of the items, modifies the list as a whole, not each member of the list. The phrase "at least one of," does not require the selection of at least one item; rather, the phrase allows for the inclusion of at least one of any one of the items, and / or at least one of any combination of the items, and / or at least one of each of the items. By way of example, each of "at least one of A, B, and C" or "at least one of A, B, or C" refers to A only, B only, or C only, any combination of A, B, and C, and / or at least one of each of A, B, and C.

[0041] It is understood that the specific order or hierarchy of steps, operations, or processes disclosed is an illustration of example approaches. Unless otherwise specified, it is understood that the specific order or hierarchy of steps, operations, or processes may be performed in different order. Some of the steps, operations, or processes may be performed simultaneously. The accompanying method claims present the various steps, operations, or process elements, if any, in an example order and are not meant to be limited to the specific order or hierarchy presented. They may be performed serially, linearly, in parallel, or in different orders. It is understood that the described instructions, operations, and systems may generally be integrated together in a single software / hardware product or packaged in multiple software / hardware products.

[0042] In one aspect, the term coupled or the like may refer to being directly coupled. In another aspect, the term coupled or the like may refer to being indirectly coupled.

[0043] Terms such as top, bottom, front, back, side, horizontal, vertical, etc. refer to an arbitrary coordinate system, rather than the usual gravitational coordinate system, and thus such terms may extend upward, downward, diagonally, or horizontally in the gravitational coordinate system.

[0044] This disclosure is provided to enable those skilled in the art to practice the various aspects described herein. In some instances, well-known structures and components are shown in block diagram form to avoid obscuring the concepts of the subject technology. This disclosure provides various examples of the subject technology, and the subject technology is not limited to these examples. Various modifications to these aspects will be readily apparent to those skilled in the art, and the principles described herein may be applied to other aspects.

[0045] All structural and functional equivalents to the elements of the various aspects described throughout this disclosure that are known, or that later become known, to those skilled in the art are expressly incorporated herein by reference and are intended to be encompassed by the claims. Furthermore, nothing disclosed herein is intended to be dedicated to the public, regardless of whether such disclosure is expressly recited in the claims. No element of a claim is to be construed under the provisions of 35 U.S.C. § 112(f) unless the element is expressly recited using the phrase "means for," or, in the case of a method claim, the element is recited using the phrase "step for."

[0046] Those skilled in the art will understand that the various illustrative blocks, modules, elements, components, methods, and algorithms described herein can be implemented as hardware, electronic hardware, computer software, or a combination thereof. To illustrate this interchangeability of hardware and software, the various illustrative blocks, modules, elements, components, methods, and algorithms have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the particular application and design constraints on the overall system. Those skilled in the art may implement the described functionality in a variety of ways for each particular application. The various components and blocks may all be arranged differently (e.g., placed in a different order or divided differently) without departing from the scope of the subject technology.

[0047] The title, background art, brief description of the drawings, abstract, and drawings are incorporated into this disclosure and are provided as illustrative examples of the disclosure, not as a limiting description. They are submitted with the understanding that they will not be used to limit the scope or meaning of the claims. Additionally, it will be appreciated that the detailed description provides illustrative examples, and that in various embodiments, various features are grouped together for purposes of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed subject matter requires more features than are expressly recited in each claim. Rather, as the claims reflect, inventive subject matter lies in less than all features of a single disclosed structure or operation. The claims are incorporated into the detailed description, with each claim standing on its own as separately claimed subject matter.

[0048] The claims are not intended to be limited to the embodiments described herein, but are to be accorded the full scope consistent with the language of the claims and encompass all legal equivalents. Nevertheless, none of the claims are intended, and should not be interpreted, to encompass subject matter that lacks the requirements of applicable patent law.

Claims

1. 1. A method for temperature or fault monitoring of one or more electronic components, said method comprising: receiving a first measured temperature of a first area associated with a trigger period; receiving a second measured temperature of a second area associated with the trigger period; determining a measured temperature difference between the first measured temperature and the second measured temperature; determining whether the measured temperature difference exceeds a reference threshold, the reference threshold being based on a baseline temperature difference comprising a temperature difference between a first baseline temperature from the first area during a baseline period and a second baseline temperature from the second area during the baseline period; and transmitting an indication that the measured temperature difference exceeds the reference threshold.

2. 10. The method of claim 1, further comprising transmitting an indication of a failure of a first one of the one or more electronic components based on the indication that the measured temperature differential exceeds the reference threshold.

3. 2. The method of claim 1, wherein the first area represents a first power domain and the second area represents a second power domain, the first power domain and the second power domain being different.

4. The method of claim 1 , wherein the one or more electronic components comprise a sensor.

5. The method of claim 1 , wherein the one or more electronic components comprise an integrated circuit.

6. The method of claim 1 , wherein the trigger period is a start-up period of the one or more electronic components.

7. The method of claim 1 , wherein the one or more electronic components are incorporated into an electric vehicle.

8. 1. An integrated circuit comprising: a first power domain, the first power domain comprising a first temperature sensor; a second power domain, the second power domain comprising a second temperature sensor, the first temperature sensor and the second temperature sensor being positioned to have a temperature difference during a start-up period that indicates whether there is a fault in an electronic component of the first power domain or the second power domain.

9. The integrated circuit of claim 8 , wherein the electronic component comprises the first temperature sensor or the second temperature sensor.

10. The integrated circuit of claim 8 , wherein the first power domain and the second power domain are different.

11. The integrated circuit of claim 8 , wherein the integrated circuit is incorporated into a component of an electric vehicle.

12. 1. An integrated circuit comprising: a first temperature sensor; and a second temperature sensor, wherein the first temperature sensor and the second temperature sensor are positioned to have a relative numerical relationship that indicates whether an electronic component has a fault during a baseline period.

13. The integrated circuit of claim 12 , wherein the baseline period comprises a start-up period of one or more power domains of the integrated circuit.

14. The integrated circuit of claim 12 , wherein the relative numerical relationship comprises a difference between the first temperature sensor and the second temperature sensor.

15. The integrated circuit of claim 12 , wherein the relative numerical relationship comprises a ratio of the first temperature sensor to the second temperature sensor.

16. The integrated circuit of claim 12 , wherein the electronic component comprises the first temperature sensor or the second temperature sensor.

17. 13. The integrated circuit of claim 12, wherein the first and second temperature sensors are located in respective first and second areas of a first power domain.

18. 13. The integrated circuit of claim 12, wherein the first temperature sensor is located in a first power domain and the second temperature sensor is located in a second power domain, the first power domain and the second power domain being different.

19. a central processing unit; a sensor hub communicatively coupled to the central processing unit that reads a temperature measurement from the first temperature sensor or the second temperature sensor via the sensor hub; an analog-to-digital converter (ADC) communicatively coupled to the first temperature sensor, the second temperature sensor, and the sensor hub; The integrated circuit of claim 12 further comprising:

20. 13. The integrated circuit of claim 12, wherein the integrated circuit is part of an electronic control unit (ECU) used to implement safety-critical functions in electric vehicles.

Images