English:
[0002] Microcontroller units (MCUs) and other integrated circuit (IC) chips in functional safety applications should have high coverage for random faults. MCUs typically implement a variety of different functions, which can include safety critical functions along with other non-critical functions, such as data-logging, human machine interface, etc. An MCU or IC chip should provide high levels of safety integrity for the critical control functions, going into a safe state whenever an error in critical functions is detected. Existing solutions use external circuits to detect the failure of outgoing signals, although the addition of external safe logic is expensive and increases the time to detection. Functional safety standards (such as IS026262, IEC61508, IEC61800, IEC81800-5-2 and similar standards) describe failure detection time that is increasingly getting smaller in high safety integrity level systems.
[0003] Described embodiments are directed to a packaged IC chip, e.g., an MCU, which is capable of providing on-chip monitoring of the functionality of the supplied signal. Depending on the application, the monitoring and verification can include only critical control peripheral circuitry, such as a pulse width modulator (PWM) and the associated output signal, or can include some or all of the other elements of the chip that are critical to the production of the output signal.
[0004] In one aspect of a packaged integrated circuit (IC) chip providing input/output (I/O) signal fail safe verification, the packaged IC chip includes: a first processing unit; a first control peripheral coupled to receive a first processed signal from the processing unit and to provide an output signal; and compare logic coupled to receive the output signal and a comparison signal, to compare the output signal and the comparison signal, and to provide an error signal responsive to a difference between the output signal and the comparison signal.
[0005] FIG. 1 depicts an example packaged IC chip according to an embodiment of the disclosure.
[0006] FIG. 2 depicts an example packaged IC chip according to an embodiment of the disclosure.
[0007] FIG. 3 depicts an example multi-chip module according to an embodiment of the disclosure.
[0008] In the drawings, like references indicate similar elements. As used herein, the term "couple" or "couples" means either an indirect or direct electrical connection, unless qualified as in "communicably coupled" (which may include wireless connections). Thus, if a first device couples to a second device, that connection may be through a direct electrical connection, or through an indirect electrical connection via other devices and connections.
[0009] Control modulation, e.g., PWM, can be highly algorithmic intensive, with the net result of all computations leading to I/O pin signal modulation. Associated with any fail safe system is what is known as latent fault, which can be associated with any portion of the entire processing chain. Performing verification of successively more inclusive portions of the processing chain can provide higher levels of coverage in functional safety applications. The present disclosure is directed to providing a number of methods by which increasing levels of verification can be achieved. The described embodiments are able to provide on-chip verification at various levels of coverage, including true end-to-end coverage from the time an input signal is received on the chip to an output signal provided to the outside world on a device pin. The output signal that is provided to an output bond pad can be compared to at least the following other signals: a redundant control peripheral signal that is produced by, e.g., a second PWM module, a redundant processing chain signal that is produced by a duplicate processing chain and a copy of the output signal that is routed back into the IC chip from a device package pin. The described comparison logic can be provided using either on-chip hardware or on-chip configurable logic blocks (CLB). On-chip failure detection is deterministic and increases the failure metrics. Using the described embodiments, the latent fault in the associated elements such as the central processing unit
[0010] Referring to FIG. 1, a schematic diagram of a packaged IC chip 100 that provides I/O signal fail safe checking is shown according to an embodiment of the disclosure. Although the application is described in terms of an IC chip that can be an MCU, the described embodiments can be provided on any type of IC chip, e.g., digital signal processor (DSP), microprocessor unit (MPU), digital signal controller (DSC), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or any analog circuit that can perform mixed signal functions in closed loop or open loop operations. As described herein, a multi-chip module (MCM) can also be utilized to provide the desired fail safe checking. As illustrated, packaged IC chip 100 includes IC chip 102 and device pins 124, which are part of a lead frame (not specifically shown) to which the IC chip 102 has been mounted. Although embodiments are described in terms of device package pins that are part of a lead frame, the described embodiments can also be used with other package types, such as a ball grid array (BGA). Further, while only three device pins 124 and two bond pads 122 are shown in this figure, numerous bond pads 122 and device pins 124 can be present on the packaged IC chip 100. Device pins 124 are attached to bond pads 122 on IC chip 102 via bond wires 126 in order to provide input signals, receive output signals or provide power and ground connections (not specifically shown) to IC chip 102.
[0011] IC chip 102 contains a CPU or processing unit 104, which is coupled to a memory 106. Processing unit 104 provides a processed signal 128 to a control peripheral 108, which in the embodiment shown is PWM logic. In an MCU designed to handle critical control signals, processing unit 104 and control peripheral 108 are typically provided in hardware or in firmware. PWM logic 108 is coupled to forward an output signal 130 towards bond pad 122A, which in operation will be coupled to provide output signal 130 as a control signal to both an actuator (not specifically shown) that controls, in one example embodiment, a motor, and also via buffer 114 to compare logic 120. Buffer 112 is coupled to receive output signal 130 and to provide output signal 130 to bond pad 122A as long as a select signal 112A is turned on. As shown in FIG. 1, bond pad 122A is coupled to device pin 124B by bond wire 126A. Device package pin 124B is also coupled to a second bond pad 122B by bond wire 126B. In this manner, bond pad 122B receives output signal 130 as long as there are no breaks in the intervening circuitry. The signal received at bond pad 122B can then be sent towards compare logic 120 as input signal 132. It is desirable to be able to compare the original output signal 130 to several different signals, each of which is described herein. Using different comparison signals can allow the location of an error signal to be determined more easily. To enable output signal 130 to be compared at different times to one of several different signals, input signal 132 is provided to multiplexor 118, which can then selectively provide input signal 132 as a comparison signal 134 to compare logic 120. In one embodiment, compare logic 120 is provided in a CLB; in another embodiment, compare logic is provided in hardware. In one embodiment, compare logic 120 is a simple comparison using, for example, an exclusive OR (XOR) logic block as shown. In one embodiment, compare logic 120 is a smart comparator that is able to make a complex comparison based on appropriate factors. In all embodiments, compare logic 120 is operable to send an error signal 144 whenever the two signals being compared do not agree.
[0012] As well as providing the ability to verify that the output signal 130 reached device pin 124B as sent, packaged IC chip 100 provides a means for verifying that PWM logic 108 is operating correctly. In one embodiment, this is accomplished by processing unit 104 sending processed signal 128 to a redundant PWM logic 110 as digital signal 136. Redundant PWM logic 110 uses digital signal 136 to perform the same calculations that are performed in PWM logic 108 and sends a redundant peripheral signal 138 towards multiplexor 118. In one embodiment, redundant peripheral signal 138 is received at buffer 116, which selectively provides redundant signal 140 to multiplexor 118. Using redundant PWM logic 110, compare logic 120 is able to verify that PWM logic 108 is operating correctly. Additional diversity/verification capabilities can be provided by having processing unit 104 produce digital signal 136 using a different algorithm from the algorithm used to provide processed signal 128. The use of a separate algorithm provides a check on the calculations used by processing unit 104 and adds another level of verification. In one embodiment, multiplexor 118 is also coupled to receive test inputs 142, which can be provided from an on-chip or off-chip source (not specifically shown). Test inputs 142 are designed to test the compare logic 120 and ensure that compare logic 120 is operating properly. Test inputs 142 can be provided periodically.
[0013] FIG. 2 depicts a schematic diagram of a packaged IC chip 200 that provides I/O signal fail safe checking according to another embodiment of the disclosure. In packaged IC chip 200, IC chip 202 contains full duplication of the entire processing chain that provides the safety critical signal. In a first processing chain 201, a sense converter 204 receives a first input signal 260 from a sensor (not specifically shown) and provides a digital signal 234 to a first processing unit 206 and associated memory 208. Sense converter 204 can be an analog-to-digital converter (ADC), a Delta-Sigma (ΔΣ) modulator, a capture unit or similar device. The first processing unit 206 performs necessary calculations on the provided digital signal and sends a processed signal 236 to a first control peripheral 210, which performs necessary control functions and sends an output signal 238 towards bond pad 228 A. Between the first control peripheral 210 and bond pad 228A, buffer 222 provides a selection switch that determines whether the output signal is provided to bond pad 228A. The first processing unit 206 can optionally also send a processed signal 237 to a redundant control peripheral 212; processed signal 237 can be either the same signal that was sent to first control peripheral 210 or a separately determined signal, as described in the embodiment of FIG. 1. In one embodiment, sense converter 204 receives an analog signal from an electric motor, and control peripheral 210 is a PWM that provides output signal 238. Output signal 238 can be provided to any power stage that is capable of converting or translating a low voltage output signal to a qualified or modulated high voltage signal, e.g., in an uninterruptable power system (UPS), digital power conversion system (DC-DC or DC-AC) or electrical to motion conversion systems (e.g., an electric motor). Control peripheral 210 can also provide any type of digital actuator logic.
[0014] In a second processing chain 203, a sense converter 214 receives a second input signal 262 from a sensor (not specifically shown) and provides a digital signal 244 to a second processing unit 216 and associated memory 218. In one embodiment, sense converter 204 and sense converter 214 receive copies of the same signal from a single sensor. In one embodiment, sense converter 204 receives a first signal from a first sensor and sense converter 214 receives a second signal from a second sensor that is different from the first sensor. Processing unit 216 performs necessary calculations on the provided digital signal 244 and sends a processed signal 246 to redundant control peripheral 220, which sends a redundant processing chain signal 248 towards compare logic 232. In one embodiment, buffer 226 sits between the redundant control peripheral 220 and compare logic 232 and provides a selection switch that determines whether the redundant processing chain signal 248 is provided to multiplexor 256. In an embodiment in which control peripheral 212 is provided, buffer 226 has dual selection switches in order to select which of the two signals is forwarded towards multiplexor 256. In one embodiment (not specifically shown), both redundant peripheral signal 250 and redundant signal-chain signal 248 can be separately provided directly to multiplexor 256.
[0015] As shown in FIG. 2, multiplexor 256 receives three signals that can be selectively forwarded towards compare logic 232: redundant signal 252, which can be either redundant peripheral signal 250 or redundant processing chain signal 248, test inputs 258, which are provided to test compare logic 232, and input signal 240, which receives an input signal received on device pin 230B and bond pad 228B. Compare logic 232 compares a comparison signal 242 that is provided by multiplexor 256 with output signal 238 that can be selectively forwarded through buffer 224 and can provide error signal 254 when the two signals do not agree. Output signal 238 is also provided to buffer 222, bond pad 228A and device pin 230A. This embodiment is designed to have device pins 230A and 230B tied together on a printed circuit board (PCB) (not specifically shown), so that an off-chip feedback connection is provided. Device pin 230B is coupled to bond pad 228B via a bond wire and the resultant input signal 240 is provided to multiplexor 256. Alternatively, bond pad 228B can be coupled to device pin 23 OA, similar to the coupling seen in FIG. 1, in order to provide an on-chip feedback connection to provide input signal 240.
[0016] Using the described packaged IC chip 200, multiple different operations of IC chip 202 can be monitored and verified. Comparing output signal 238 to redundant peripheral signal 250 can determine that control peripheral 210 is operating correctly; comparing output signal 238 to redundant processing chain signal 248 can ensure that the entire processing chain is operating correctly; and comparing output signal 238 to input signal 240 can ensure that the signal that was determined at control peripheral 210 actually made its way to device pin 23 OA. Compare logic 232 is also tested by comparing output signal 238 to test inputs 258. In one embodiment, packaged IC chip 200 is a C2000TM MCU chip sold by Texas Instruments Incorporated. In one embodiment, the two processing units 206, 216 in packaged IC chip 200 are identical processors, such as a C28x DSP. In one embodiment, the two processing units 206, 216 in packaged IC chip 200 are different types of processors that introduce additional diversity into the processing chains, e.g., the first processing chain includes a C28xTM DSP processor while the second processing chain includes a Control Law Accelerator (CLA) processor, all in the same chip.
[0017] FIG. 3 depicts a multi-chip module 300 according to an embodiment of the disclosure. In MCM 300, the components used to provide verification of the primary processing chain are the same, but the redundant processing chain is provided as a separate chip. IC chip 301 includes compare logic 232 and the primary processing chain, which includes sense converter 204, processing unit 206 and control peripheral 210. Redundant control peripheral 212 can also be provided is desired. IC chip 303 provides the redundant processing chain, which includes sense converter 214, processing unit 216 and redundant control peripheral 220. IC chip 301 and IC chip 303 will each have separate power supplies and separate clocks, but are bonded inside MCM 300. Although only IC chips 301, 303 are shown in this figure for simplicity, MCM can include any number of additional chips coupled together. In MCM 300, redundant processing chain signal 248 is provided to a bond pad (not specifically shown) on IC chip 303. Bond wire 305 ties the bond pad on IC chip 303 to a bond pad (also not specifically shown) on IC chip 301, from which redundant processing chain signal 248 is provided to multiplexor 256. The embodiment of MCM 300 can provide diverse processor capabilities and diversity to sensing, processing and actuation paths. In this implementation as an MCM, if the silicon dies 301 and 303 are powered and clocked independently the limitation of common cause problem are reduced and the fault coverage of the sensing, processing and PWM actuation chain will higher than the implementation in FIG. 1 and FIG 2.
[0018] Using the described embodiments, the safety integrity of an output signal can be provided at varying levels of coverage in dependence on the needs of a system. The described packaged IC chip enables a reliable way to test control peripherals during device manufacturing and improve systematic and random failure mode coverage during real-time operation of the device. The described packaged IC chip can also reduce device test cost and capture early defects caused by systematic and random defects. Fault coverage metrics during runtime can be greater than ninety-nine percent. Because the monitoring and verification is performed on the sensing, processing and critical control signals, such as PWM pairs, the described packaged IC chip can provide an inexpensive solution to achieve very high fault coverage.
[0020] The described packaged IC chip can offer higher safety integrity and reliability checks during system operation, reduce device test cost, capture early defects due to systematic and random defects and enable safety metric calculation in functional safety standards, such as IS026262, IEC61508, IEC61800-5-2 and similar standards.
[0021] Modifications are possible in the described embodiments, and other embodiments are possible, within the scope of the claims.

中文:
[0002]功能安全应用中的微控制器单元(MCU)和其他集成电路(IC)芯片应该具有针对随机故障的高覆盖范围。MCU通常实现多种不同的功能,其包括安全关键功能连同其他非关键功能,诸如数据记录、人机接口等。MCU或IC芯片应该提供用于关键控制功能的高等级的安全完整性,只要检测到关键功能中的错误就进入安全状态。现有的解决方案使用外部电路来检测外向信号的故障,尽管增加外部安全逻辑是昂贵的并且增加了检测时间。功能安全标准(例如IS026262、IEC61508、IEC61800、IEC81800-5-2和类似标准)描述了在高安全完整性等级系统中越来越小的故障检测时间。
[0003]所描述的实施例涉及封装的IC芯片,例如MCU,其能够提供对所供应的信号的功能的片上监视。根据应用,监视和验证可以仅包括关键控制外围电路,诸如脉冲宽度调制器(PWM)和相关联的输出信号,或者可以包括芯片的一些或所有其他元件,这些元件对输出信号的产生至关重要。
[0004]在提供输入/输出(I/O)信号故障安全验证的封装集成电路(IC)芯片的一个方面,封装的IC芯片包括:第一处理单元;第一控制外围设备,其经耦合以从处理单元接收第一处理的信号并提供输出信号;以及比较逻辑,其经耦合以接收输出信号和比较信号,比较输出信号和比较信号以及响应于输出信号和比较信号之间的差异提供误差信号。
[0005]图1描绘了根据本公开的一个实施例的示例封装的IC芯片。
[0006]图2描绘了根据本公开的一个实施例的示例封装的IC芯片。
[0007]图3描绘了根据本公开的一个实施例的示例多芯片模块。
[0008]在附图中,相同的参考标记指示类似的元件。如本文中所使用的,术语“耦合(couple或者couples)”意在间接或直接电连接,除非有资格作为(可以包括无线连接的)“可通信地耦合”。因此,如果第一器件耦合到第二器件,则该连接可以通过直接电连接,或通过经由其他器件和连接的间接电连接。
[0009]控制调制(例如,PWM)可以是高度算法密集的,所有计算的净结果导致I/O引脚信号调制。与任何故障安全系统相关联的是所谓的潜在故障,其可以与整个处理链的任何部分相关联。对连续更具包容性的处理链部分进行验证可以在功能安全应用中提供更高级别的覆盖。本公开旨在提供许多方法,通过这些方法可以实现提高的验证级别。所描述的实施例能够在各种覆盖级别上提供片上验证,包括从在芯片上接收输入信号的时间到在器件引脚上提供给外界的输出信号的真实端到端覆盖。提供给输出键合焊盘的输出信号可以与至少以下其他信号进行比较:由例如第二PWM模块产生的冗余控制外围设备信号,由复制处理链产生的冗余处理链信号以及从器件封装引脚布线回到IC芯片的输出信号的副本。可以使用片上硬件或片上可配置逻辑块(CLB)来提供所描述的比较逻辑。片上故障检测具有确定性,并增加故障度量。使用所描述的实施例,在相关联的元件(诸如中央处理单元(CPU)、存储器、外围设备路径、其他外围设备和输出路径)中的潜在故障为了功能安全都得到了很好的覆盖。此外,关键电路的功能测试的响应时间将完全在系统故障响应时间内,并将增加诊断和潜在故障覆盖,
[0010]参考图1,根据本公开的一个实施例示出了提供I/O信号故障安全检查的封装的IC芯片100的示意图。尽管根据可以是MCU的IC芯片描述了本申请,但是可以在任何类型的IC芯片(例如,数字信号处理器(DSP)、微处理器单元(MPU)、数字信号控制器(DSC)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或可在闭环或开环操作中执行混合信号功能的任何模拟电路)上提供所描述的实施例。如本文中所描述的,还可以利用多芯片模块(MCM)来提供所需的故障安全检查。如图所示,封装的IC芯片100包括IC芯片102和器件引脚124,它们是已安装IC芯片102的引线框架(未具体示出)的一部分。尽管根据作为引线框架的一部分的器件封装引脚来描述实施例,但是所描述的实施例也可以与其他封装类型一起使用,诸如球栅阵列(BGA)。此外,虽然在该图中仅示出了三个器件引脚124和两个键合焊盘122,但是在封装的IC芯片100上可以存在多个键合焊盘122和器件引脚124。器件引脚124经由键合线126附接到IC芯片102上的键合焊盘122,以便提供输入信号、接收输出信号或向IC芯片102提供电源和接地连接(未具体示出)。
[0011]IC芯片102包含CPU或处理单元104,其耦合到存储器106。处理单元104将处理的信号128提供给控制外围设备108,在所示的实施例中,控制外围设备108是PWM逻辑。在经设计以用于处理关键控制信号的MCU中,处理单元104和控制外围设备108通常以硬件或固件提供。PWM逻辑108经耦合以将输出信号130朝向键合焊盘122A传送,其在操作中将经耦合以将输出信号130作为控制信号提供给在一个示例实施例中控制电动机的致动器(未具体示出)并且还经由缓冲器114提供给比较逻辑120。只要选择信号112A导通,缓冲器112经耦合以接收输出信号130并将输出信号130提供给键合焊盘122A。如图1所示,键合焊盘122A通过键合线126A耦合到器件引脚124B。器件封装引脚124B还通过接合线126B耦合到第二键合焊盘122B。以这种方式,只要中间电路中没有中断,键合焊盘122B就接收输出信号130。然后,可以将在键合焊盘122B处接收的信号作为输入信号132朝向比较逻辑120发送。期望能够将原始输出信号130与若干不同信号进行比较,其中每个信号在本文中描述。使用不同的比较信号可以允许更容易地确定误差信号的位置。为了使输出信号130能够在不同时间与几个不同信号之一进行比较,输入信号132被提供给多路复用器118,多路复用器118然后可以选择性地将输入信号132作为比较信号134提供给比较逻辑120。在一个实施例中,比较逻辑120在CLB中提供;在另一个实施例中,比较逻辑以硬件提供。在一个实施例中,比较逻辑120是使用例如所示的异或(XOR)逻辑块的简单比较。在一个实施例中,比较逻辑120是智能比较器,其能够基于适当的因素进行复杂的比较。在所有实施例中,比较逻辑120可操作以在被比较的两个信号不一致时发送误差信号144。
[0012]封装的IC芯片100不仅提供验证输出信号130在发送时到达器件引脚124B的能力,还提供用于验证PWM逻辑108正在正确操作的装置。在一个实施例中,这通过处理单元104将处理的信号128作为数字信号136发送到冗余PWM逻辑110来实现。冗余PWM逻辑110使用数字信号136来执行在PWM逻辑108中执行的相同计算,并将冗余外围设备信号138朝向多路复用器118发送。在一个实施例中,在缓冲器116处接收冗余外围设备信号138,其选择性地向多路复用器118提供冗余信号140。使用冗余PWM逻辑110,比较逻辑120能够验证PWM逻辑108正在正确地操作。通过使处理单元104使用与用于提供处理的信号128的算法不同的算法产生数字信号136,可以提供附加的多样性/验证能力。使用单独的算法提供对处理单元104使用的计算的检查,并增加另一个级别的验证。在一个实施例中,多路复用器118还经耦合以接收测试输入142,测试输入142可以从片上或片外源(未具体示出)提供。测试输入142被设计为测试比较逻辑120并确保比较逻辑120正确地操作。可以周期性地提供测试输入142。
[0013]图2描绘了根据本公开另一个实施例的提供I/O信号故障安全检查的封装的IC芯片200的示意图。在封装的IC芯片200中,IC芯片202包含提供安全关键信号的整个处理链的完全复制。在第一处理链201中,感测转换器204从传感器(未具体示出)接收第一输入信号260,并将数字信号234提供给第一处理单元206和相关联的存储器208。感测转换器204可以是模数转换器(ADC)、Delta-Sigma(ΔΣ)调制器、捕获单元或类似器件。第一处理单元206对提供的数字信号执行必要的计算,并将处理的信号236发送到第一控制外围设备210,第一控制外围设备210执行必要的控制功能,并朝向键合焊盘228A发送输出信号238。在第一控制外围设备210和键合焊盘228A之间,缓冲器222提供选择开关,其确定输出信号是否被提供给键合焊盘228A。第一处理单元206还可以可选地将处理的信号237发送到冗余控制外围设备212;处理的信号237可以是发送到第一控制外围设备210的相同信号,也可以是单独确定的信号,如图1的实施例中所描述的。在一个实施例中,感测转换器204从电动机接收模拟信号,并且控制外围设备210是提供输出信号238的PWM。输出信号238可以被提供给能够将低压输出信号转换或变换成合格或调制的高压信号的任何功率级,例如,在不间断电源系统(UPS)、数字电源转换系统(DC-DC或DC-AC)或电动转换系统(例如电动机)中。控制外围设备210还可以提供任何类型的数字致动器逻辑。
[0014]在第二处理链203中,感测转换器214从传感器(未具体示出)接收第二输入信号262,并将数字信号244提供给第二处理单元216和相关联的存储器218。在一个实施例中,感测转换器204和感测转换器214从单个传感器接收相同信号的副本。在一个实施例中,感测转换器204接收来自第一传感器的第一信号,感测转换器214接收来自不同于第一传感器的第二传感器的第二信号。处理单元216对提供的数字信号244执行必要的计算,并将处理的信号246发送到冗余控制外围设备220,冗余控制外围设备220朝向比较逻辑232发送冗余处理链信号248。在一个实施例中,缓冲器226位于冗余控制外围设备220和比较逻辑232之间,并提供选择开关,该选择开关确定冗余处理链信号248是否被提供给多路复用器256。在提供控制外围设备212的实施例中,缓冲器226具有双选择开关,以便选择哪两个信号被传送到多路复用器256。在一个实施例(未具体示出)中,冗余外围设备信号250和冗余信号链信号248可以分别直接提供给多路复用器256。
[0015]如图2所示,多路复用器256接收可以选择性地朝向比较逻辑232传送的三个信号:冗余信号252,其可以是冗余外围设备信号250或冗余处理链信号248;测试输入258,其被提供给测试比较逻辑232;以及输入信号240,其接收在器件引脚230B和键合焊盘228B上接收的输入信号。比较逻辑232将由多路复用器256提供的比较信号242与可以通过缓冲器224选择性地传送的输出信号238进行比较,并且当两个信号不一致时可以提供误差信号254。输出信号238还被提供给缓冲器222、键合焊盘228A和器件引脚230A。该实施例被设计成使器件引脚230A和230B在印刷电路板(PCB)(未具体示出)上连结在一起,使得提供片外反馈连接。器件引脚230B经由接合线耦合到键合焊盘228B,并且所得到的输入信号240被提供给多路复用器256。替代性地,键合焊盘228B可以耦合到器件引脚230A,类似于图1中所见的耦合,为了提供片上反馈连接以提供输入信号240。
[0016]使用所描述的封装IC芯片200,可以监视和验证IC芯片202的多种不同操作。将输出信号238与冗余外围设备信号250进行比较可以确定控制外围设备210正在正确地操作;将输出信号238与冗余处理链信号248进行比较可以确保整个处理链正常操作;并且将输出信号238与输入信号240进行比较可以确保在控制外围设备210处确定的信号实际上已经到达器件引脚230A。还通过将输出信号238与测试输入258进行比较来测试比较逻辑232。在一个实施例中,封装的IC芯片200是由德克萨斯仪器有限公司(TexasInstrumentsIncorporated)出售的C2000TM MCU芯片。在一个实施例中,封装的IC芯片200中的两个处理单元206、216是相同的处理器,诸如C28xTM DSP。在一个实施例中,封装的IC芯片200中的两个处理单元206、216是不同类型的处理器,其将额外的种类引入处理链,例如,第一处理链包括C28xTM DSP处理器,而第二处理链包括控制律加速器(CLA)处理器,其都在同一芯片上。当处理链包括不同的处理器时,比较逻辑232可以包含考虑处理器之间的差异的复杂比较逻辑。关于具有两个处理链的实施例的进一步细节可以在共同未决的专利申请号US 15/584,550中找到,其通过参考并入本文。
[0017]图3描绘了根据本公开的一个实施例的多芯片模块300。在MCM 300中,用于提供主处理链验证的组件是相同的,但冗余处理链作为单独的芯片提供。IC芯片301包括比较逻辑232和主处理链,其包括感测转换器204、处理单元206和控制外围设备210。还可以根据需要提供冗余控制外围设备212。IC芯片303提供冗余处理链,其包括感测转换器214、处理单元216和冗余控制外围设备220。IC芯片301和IC芯片303将各自具有单独的电源和单独的时钟,但是在MCM 300内部结合。尽管为简单起见,在该图中仅示出了IC芯片301、303,但是MCM可以包括耦合在一起的任何数量的附加芯片。在MCM 300中,冗余处理链信号248被提供给IC芯片303上的键合焊盘(未具体示出)。键合线305将IC芯片303上的键合焊盘连结到IC芯片301上的键合焊盘(也未具体示出),从该键合焊盘将冗余处理链信号248提供给多路复用器256。MCM 300的实施例可以为感测、处理和致动路径提供各种处理器能力和多样性。在作为MCM的该实施方式中,如果硅管芯301和303被独立供电和定时,则减少了常见原因问题的限制,并且感测、处理和PWM致动链的故障覆盖率将高于图1和图2中的实施方式。
[0018]使用所描述的实施例,可以根据系统的需要以不同的覆盖级别提供输出信号的安全完整性。所描述的封装的IC芯片使得能够在器件制造期间测试控制外围设备的可靠方式,并且在器件的实时操作期间改善系统和随机故障模式覆盖率。所描述的封装的IC芯片还可以降低器件测试成本并捕获由系统和随机缺陷引起的早期缺陷。运行时期间的故障覆盖率度量可超过百分之九十九。因为对诸如PWM对的感测、处理和关键控制信号执行监视和验证,所描述的封装的IC芯片可以提供廉价的解决方案以实现非常高的故障覆盖率。
[0020]所描述的封装IC芯片可在系统操作期间提供更高的安全完整性和可靠性检查,降低器件测试成本,捕获由于系统和随机缺陷导致的早期缺陷,并在功能安全标准中实现安全度量计算,该功能安全标准诸如IS026262、IEC61508、IEC61800-5-2和类似的标准。
[0021]在权利要求的范围内,在所描述的实施例中修改是可能的,并且其他实施例也是可能的。