Back to results
US 12,164,000 B2Granted
On-chip checker for on-chip safety area
AssigneeSTMicroelectronics S.r.l.
InventorsAlessandro Cannone, Enrico Ferrara, Nicola Errico, Gea Donzelli
Life of this patent
Estimating the term…
Abstract
Disclosed herein is a single integrated circuit chip including main logic that operates a vehicle component such as a valve driver. Isolated from the main logic within the chip is a safety area that operates to verify proper operation of the main logic. A checker circuit within the chip outside of the safety area serves to verify proper operation of the checker circuit. The checker circuit receives signals from the safety circuit and uses combinatorial logic circuit to verify from those signals that the check circuit is operating properly.
Claims13
An integrated circuit chip, comprising:
- an integrated circuit substrate;
- main circuitry within the integrated circuit substrate, the main circuitry configured to control at least one external component, the main circuitry further configured to generate at least one digital signal from which proper operation of the main circuitry can be determined, at least one analog signal from which proper operation of the main circuitry can be determined, and at least one other signal;
- a safety area within the integrated circuit substrate and isolated from the main circuitry, the safety area configured to:
- generate, from the at least one analog signal, at least one fault signal indicating whether improper operation of the main circuitry has occurred;
- generate, from the at least one digital signal, at least one digital fault signal indicating whether improper operation of the main circuitry has occurred;
- and
- generate, based upon the at least one fault signal, the at least one digital fault signal, and the at least one other signal, an output signal that causes the at least one external component to perform a desired function in response to improper operation of the main circuitry, and a feedback signal that indicates that improper operation of the main circuitry has not occurred;
- and
- a safety area checker circuit within the integrated circuit substrate and located outside the safety area, the safety area checker circuit comprising:
- a first logic receiving as input the at least one fault signal and the at least one digital fault signal, the first logic generating a first logic output indicative of whether the at least one fault signal or the at least one digital fault signal indicates that improper operation of the main circuitry has occurred;
- a second logic receiving as input the first logic output and the at least one other signal, the second logic generating a second logic output;
- a first comparison circuit receiving as input the second logic output and either the output signal or the feedback signal, the first comparison circuit asserting a first check signal in response to a lack of match in logic levels among inputs to the first comparison circuit;
- a second comparison circuit receiving as input the first logic output and either the output signal or the feedback signal, the second comparison circuit asserting a second check signal in response to a lack of match in logic levels among inputs to the second comparison circuit;
- and
- an OR circuit receiving the first and second check signals as input and generating an error check signal in response to either of the first and second check signals being asserted.
12 more elements
An integrated circuit chip, comprising:
- an integrated circuit substrate;
- main circuitry within the integrated circuit substrate, the main circuitry configured to control at least one external component, the main circuitry further configured to generate a plurality of signals from which proper operation of the main circuitry can be determined, and to generate at least one other signal;
- a plurality of safety areas within the integrated circuit substrate and isolated from the main circuitry, each of the plurality of safety areas configured to:
- generate, from some of the plurality of signals, a plurality of fault signals indicating whether improper operation of the main circuitry has occurred;
- and
- generate, based on the plurality of fault signals and the at least one other signal, an output signal that causes the at least one external component to perform a desired function in response to improper operation of the main circuitry, and a feedback signal that indicates that improper operation of the main circuitry has not occurred;
- a plurality of safety area checker circuits within the integrated circuit substrate and located outside the plurality of safety areas, each of the plurality of safety area checker circuits associated with one of the plurality of safety areas and comprising:
- a first logic receiving as input the plurality of fault signals, the first logic generating a first logic output indicative of whether the plurality of fault signals indicate that improper operation of the main circuitry has occurred;
- a second logic receiving as input the first logic output and the at least one other signal, the second logic generating a second logic output;
- a first comparison circuit receiving as input the second logic output and either the output signal or the feedback signal, the first comparison circuit asserting a first check signal in response to a lack of match in logic levels among inputs to the first comparison circuit;
- a second comparison circuit receiving as input the first logic output and either the output signal or the feedback signal, the second comparison circuit asserting a second check signal in response to a lack of match in logic levels among inputs to the second comparison circuit;
- and
- an OR circuit receiving the first and second check signals as input and generating an error check signal in response to either of the first and second check signals being asserted;
- a first main OR circuit receiving the error check signal from each of the plurality of safety area checker circuits as input, and generating an intermediate error check signal based thereupon;
- a second main OR circuit receiving as input the intermediate error check signal and a final error check output;
- and
- a flip flop receiving as input output from the second main OR circuit and generating as output the final error check output.
14 more elements
Dependencies are inferred from the claim text.