Power Supply Handshake Monitoring for ASIL-D Safety Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional power management architectures for automotive systems are costly, complex, and not scalable, often requiring duplication of biasing blocks and full-featured state machines, which are not portable and lack effective detection of latent failures, leading to potential system damage and safety risks.
Innovation Solution
A safety power management system utilizing a Digital Machine Supervisor (DMS) and a Main Digital Control Unit (DCU) with independent clocking and power supplies, performing a handshake procedure to ensure logic integrity and monitor system operations, including a separate monitoring unit to detect faults and initiate fail-safe notifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a dedicated full-featured state machine with physical isolation is used for safety power management, then safety integrity is improved, but device complexity and cost increase
Solution Approach 1:
The safety power management architecture is segmented into distinct functional blocks: a main control unit for normal operation and a separate safety monitor unit for safety-critical functions. This segmentation allows each unit to be optimized for its specific purpose while maintaining overall system safety integrity without requiring full physical isolation of entire state machines.
Solution Approach 2:
The safety monitor unit is designed to perform multiple safety-related functions including fault detection, verification of control signals, monitoring of power supply conditions, and initiation of fail-safe procedures. This multi-functionality consolidates what would otherwise require separate dedicated circuits, reducing overall device complexity while maintaining safety integrity.
2Reliability
If conventional power management architectures are used, then safety features are provided, but cost and complexity increase and scalability is reduced
Solution Approach 1:
The safety monitor unit and main control unit are integrated into a single power management IC, sharing common infrastructure such as power supply rails, signal routing, and packaging. This merging reduces manufacturing complexity and cost compared to using separate dedicated safety circuits, while still providing comprehensive safety features through the coordinated operation of the integrated units.
Solution Approach 2:
The architecture uses configurable parameters and adjustable thresholds for safety monitoring, allowing the same hardware design to be adapted to different safety requirements and application domains. This parametric flexibility enables scalability across different product lines without requiring complete redesign, thereby reducing development cost and improving ease of manufacture.
3Reliability
If independent verification of control signals is implemented, then detection of latent failures is improved, but device complexity increases
Solution Approach 1:
The safety monitor unit continuously receives feedback signals from the main control unit regarding control signal states and system operating conditions. By comparing actual signals against expected values and monitoring for anomalies, the feedback mechanism enables detection of latent failures without requiring complex redundant verification circuits, as the monitor leverages existing signal paths for its verification functions.
Data Source
AI summary
Provided is a safety power management system that includes a main digital control unit configured to control one or more system power supplies. In addition, a digital machine supervisor is configured to execute a handshake procedure in which it: (a) sends handshake requests to the main digital control unit at predetermined times, (b) waits for a response signal from the main digital control unit to each of the handshake requests, (c) performs a verification process on the response signal if the response signal is received within an expected timeframe, and (d) outputs a DMS safety signal if the response signal is not received within the expected timeframe or if the verification process fails. The main digital control unit also is configured to output a DCU safety signal if one of the handshake requests is not received at any one of the predetermined times.