# US 12,602,273 B2 · Safety monitoring of a system-on-a-chip > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,273 B2 - Document ID: US12602273B2 - Status: Granted - Kind: B2 - Application number: 18/489,809 - Filed: 2023-10-18 - Published: 2024-04-25 - Granted: 2026-04-14 - Earliest claimed: 2022-10-19 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Amit Aneja; Vasant Kumar Easwaran; Rahul Gulati - Web page: https://patentgrep.com/patent/US12602273B2 ## CPC - G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems} - G06F 11/0745: {in an input/output transactions management context (input/output processing in general G06F13/00)} - G06F 11/0757: {by exceeding a time limit, i.e. time-out, e.g. watchdogs} - G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Aspects of the present disclosure provide techniques and apparatus for safety monitoring of a vehicle control system. An example method of operating a vehicle includes detecting an error associated with a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; indicating the error to the one or more ECUs via at least one of the first bus, the second bus, or a power management integrated circuit (PMIC) in response to detecting the error, wherein the PMIC is configured to supply power to the main domain or the safety domain; and performing one or more actions in response to detecting the error. ## Claims ### Claim 1 A method of operating a vehicle, comprising: detecting an error associated with a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; indicating the error to the one or more ECUs via at least one of the first bus, the second bus, or a power management integrated circuit (PMIC) in response to detecting the error, wherein the PMIC is configured to supply power to the main domain or the safety domain, and wherein indicating the error comprises: indicating the error via the first bus in response to the error being associated with the safety domain; and indicating the error via the second bus in response to the error being associated with the main domain; and performing one or more actions in response to detecting the error. ### Claim 2 (depends on 1) The method of claim 1, wherein: the error includes a functional safety error associated with the SoC; and performing the one or more actions comprises shutting down the SoC or rebooting the SoC. ### Claim 3 (depends on 2) The method of claim 2, further comprising: outputting, from the SoC, an indication of the error to the PMIC, wherein the PMIC is coupled to the main domain of the SoC or the safety domain of the SoC, and wherein indicating the error further comprises indicating the error to the one or more ECUs via the PMIC in response to the PMIC obtaining the indication of the error from the SoC, wherein the PMIC is in communication with the one or more ECUs. ### Claim 4 (depends on 2) The method of claim 2, wherein shutting down the SoC comprises: outputting, to a first PMIC and a second PMIC, an indication to shut down the SoC, wherein the first PMIC is coupled to the main domain of the SoC, wherein the second PMIC is coupled to the safety domain of the SoC, and wherein the PMIC includes at least one of the first PMIC or the second PMIC; and powering off the SoC via the first PMIC and the second PMIC in response to the indication to shut down the SoC. ### Claim 5 (depends on 1) The method of claim 1, wherein the error includes the SoC being unresponsive or the SoC suspending an operation. ### Claim 6 (depends on 5) The method of claim 5, wherein detecting the error comprises using the safety domain of the SoC to detect that the error occurred at the main domain of the SoC. ### Claim 7 (depends on 5) The method of claim 5, wherein the PMIC is coupled to the safety domain and wherein detecting the error comprises using the PMIC to detect that the error occurred at the safety domain of the SoC. ### Claim 8 (depends on 1) The method of claim 1, wherein the error includes a functional safety error associated with a first PMIC. ### Claim 9 (depends on 8) The method of claim 8, further comprising: outputting, to the safety domain of the SoC or to a second PMIC from the first PMIC, an indication of the error at the first PMIC, wherein the first PMIC is coupled to the main domain of the SoC, wherein the second PMIC is coupled to the safety domain of the SoC, wherein the PMIC includes at least one of the first PMIC or the second PMIC, and wherein performing the one or more actions comprises shutting down at least the main domain of the SoC. ### Claim 10 (depends on 9) The method of claim 9, wherein performing the one or more actions comprises operating the safety domain of the SoC while the main domain of the SoC is shutdown. ### Claim 11 (depends on 8) The method of claim 8, further comprising: outputting, to the main domain of the SoC or the one or more ECUs from the first PMIC, an indication of the error at the first PMIC, wherein the first PMIC is coupled to the safety domain of the SoC, and wherein performing the one or more actions comprises shutting down the SoC. ### Claim 12 (depends on 1) The method of claim 1, wherein the error includes a functional safety error associated with the main domain of the SoC. ### Claim 13 (depends on 12) The method of claim 12, further comprising: outputting, from the SoC, an indication of the error to the PMIC, wherein the PMIC is coupled to the main domain of the SoC, wherein performing the one or more actions comprises shutting down at least the main domain of the SoC in response to obtaining the indication of the error at the PMIC. ### Claim 14 (depends on 13) The method of claim 13, wherein performing the one or more actions comprises operating the safety domain of the SoC while the main domain of the SoC is shutdown. ### Claim 15 (depends on 1) The method of claim 1, wherein the error includes the main domain of the SoC becoming unresponsive or suspending an operation. ### Claim 16 (depends on 15) The method of claim 15, wherein detecting the error comprises using the safety domain of the SoC to detect that the error occurred at the main domain of the SoC. ### Claim 17 (depends on 16) The method of claim 16, wherein performing the one or more actions comprises shutting down at least the main domain of the SoC. ### Claim 18 (depends on 17) The method of claim 17, wherein performing the one or more actions comprises operating the safety domain of the SoC while the main domain of the SoC is shutdown. ### Claim 19 (depends on 1) The method of claim 1, wherein the error includes a functional safety error associated with the safety domain of the SoC. ### Claim 20 (depends on 19) The method of claim 19, further comprising: indicating, from the safety domain of the SoC to the main domain of the SoC, to shut down the SoC, wherein performing the one or more actions comprises shutting down the SoC. ### Claim 21 (depends on 1) The method of claim 1, wherein the main domain is configured to support up to a different automotive safety integrity level (ASIL) than the safety domain. ### Claim 22 An apparatus for operating a vehicle, comprising: a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; and a power management integrated circuit (PMIC) configured to supply power to the main domain or the safety domain, wherein at least one of the SoC or the PMIC is configured to: detect an error associated with the SoC, indicate the error to the one or more ECUs via at least one of the first bus, the second bus, or the PMIC in response to detecting the error, wherein to indicate the error: the main domain is configured to indicate the error via the first bus in response to the error being associated with the safety domain; and the safety domain is configured to indicate the error via the second bus in response to the error being associated with the main domain, and perform one or more actions in response to detecting the error. ### Claim 23 (depends on 22) The apparatus of claim 22, wherein: the error includes a functional safety error associated with the SoC; and to perform the one or more actions, the PMIC is configured to shut down the SoC. ### Claim 24 (depends on 22) The apparatus of claim 22, wherein the SoC is configured to communicate with the one or more ECUs via at least one of the first bus, the second bus, or the PMIC without a vehicle interface processor coupled between the safety domain and the one or more ECUs. ### Claim 25 (depends on 22) The apparatus of claim 22, wherein the main domain is configured to support at least up to an automotive safety integrity level (ASIL) B and wherein the safety domain is configured to support up to an ASIL D. ### Claim 26 (depends on 22) The apparatus of claim 22, wherein the main domain is configured to support up to a different automotive safety integrity level (ASIL) than the safety domain. ### Claim 27 A non-transitory computer-readable medium comprising computer-executable instructions that, when executed by one or more processors of a processing system, cause the processing system to: detect an error associated with a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; indicate the error to the one or more ECUs via at least one of the first bus, the second bus, or a power management integrated circuit (PMIC) in response to detecting the error, wherein the PMIC is configured to supply power to the main domain or the safety domain, and wherein to indicate the error: the main domain is configured to indicate the error via the first bus in response to the error being associated with the safety domain; and the safety domain is configured to indicate the error via the second bus in response to the error being associated with the main domain; and perform one or more actions in response to detecting the error. ### Claim 28 (depends on 27) The non-transitory computer-readable medium of claim 27, wherein the main domain is configured to support up to a different automotive safety integrity level (ASIL) than the safety domain. ### Claim 29 An apparatus for operating a vehicle, the apparatus comprising: means for detecting an error associated with a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; means for indicating the error to the one or more ECUs via at least one of the first bus, the second bus, or a power management integrated circuit (PMIC) in response to detecting the error, wherein the PMIC is configured to supply power to the main domain or the safety domain and wherein indicating the error comprises: indicating the error via the first bus in response to the error being associated with the safety domain; and indicating the error via the second bus in response to the error being associated with the main domain; and means for performing one or more actions in response to detecting the error. ### Claim 30 (depends on 29) The apparatus of claim 29, wherein the main domain is configured to support up to a different automotive safety integrity level (ASIL) than the safety domain.