Functional safety mechanism for detection of a fault in a leadframe

A system topology may use intentional signal injection to monitor one or more power supply circuits that may supply electrical power to components of the system. The system topology may include voltage monitoring circuitry to monitor the output of the power supply. In some examples, a power supply rail fault may happen either inside or outside of the power supply circuit, but not be detectable by the voltage monitoring circuitry. Injecting a check signal in the presence of an actual fault, may cause oscillations at the output node of the power supply detectable by the voltage monitoring circuitry. Once the check signal, combined with the fault signal, at the output node reaches the monitoring threshold detectable by the voltage monitoring circuitry, the voltage monitoring circuitry may output an indication of the fault to processing circuitry of the system.

TECHNICAL FIELD

The disclosure relates fault detection for linear power supplies.

BACKGROUND

Power supplies may be subject to faults such as single point faults. Single point faults may be classified into undervoltage, overvoltage and overcurrent faults. Some systems that use power supplies may include power supply monitoring to detect whether the power supplies are functioning as expected or may have developed a fault.

SUMMARY

In general, the disclosure describes a system topology and an intentional check signal injection to monitor one or more power supply circuits that may supply electrical power to components of the system. The system topology may include voltage monitoring circuitry to monitor the output of the power supply. In some examples a power supply rail fault may occur either inside or outside of the power supply circuit, but the fault may not be detectable by the voltage monitoring circuitry. Injecting a check signal in the presence of an actual fault, may cause oscillations at the output node of the power supply detectable by the voltage monitoring circuitry. Once a check signal, combined with the fault signal, at the output node reaches the monitoring threshold detectable by the voltage monitoring circuitry, the voltage monitoring circuitry may output an indication of the fault to processing circuitry of the system.

In one example, this disclosure describes a system that includes a power converter comprising an output terminal and configured to receive an input voltage at a first magnitude and output a voltage at a second magnitude at the output terminal; a voltage monitoring circuit coupled to the output terminal; and a signal injection circuit coupled to the output terminal, the signal injection circuit configured to input a check signal; wherein the voltage monitoring circuit is configured to detect a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold.

In another example, this disclosure describes a circuit that includes a power converter comprising an output terminal and configured to receive an input voltage at a first magnitude and output a voltage at a second magnitude at the output terminal; a voltage monitoring circuit coupled to the output terminal; and a signal injection circuit coupled to the output terminal, the signal injection circuit configured to input a check signal, wherein the voltage monitoring circuit is configured to detect a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold.

In another example, this disclosure describes a method comprising injecting a check signal at an output terminal of a power converter circuit; monitoring, by a voltage monitoring circuit, an output voltage at the output terminal, detecting, by the voltage monitoring circuit, a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold outputting, by the voltage monitoring circuit and to the processing circuitry, an indication that the voltage monitoring circuit detected the fault signal; in response to receiving the indication from the voltage monitoring circuit, placing, by the processing circuitry, the power converter into a fail-safe state.

DETAILED DESCRIPTION

The disclosure describes a system topology that uses a intentional signal injection to monitor one or more power supply circuits that may supply electrical power to components of the system. The system topology may include monitoring circuitry to monitor the output of the power supply and may inject a check signal, configured such that the injected check signal makes a fault in the circuit easier to detect.

A power supply rail fault can occur either within or external to the power supply circuit, yet not be detectable by the voltage monitoring circuitry. In some cases, faults may not be detectable because of frequency band limitations, or because of the arrangement of the power supply circuit. In particular, the detectable frequency band, the detection domain, may be limited by the intrinsic propagation delay of the components, such as comparators, which the voltage monitoring circuit may use for detection. In some cases, the frequency band limitation may be the result of a trade-off between the bandwidth of the comparators and low quiescent constraints imposed by the system.

Some of the factors that may lead to faults may be classified as external factors or internal factors. In the example of a linear regulator, external factors may include a loss of connection to the output capacitor due to bad connection or damage of the output capacitor. In some examples, the linear regulator may include an output capacitor to keep a regulation loop of the linear regulator stable. Some examples of internal factors may include interruption of the connection between the power supply circuit and printed circuit board (PCB) to which it is mounted. For example, power supply circuit leadframe connection or a bond wire between the power supply circuit and the PCB may fail and become disconnected, e.g., caused by mechanical stress or aging.

For other examples of a monitoring circuit, for an oscillation frequency outside the detection domain, the monitoring circuitry may use a window comparator to detect a possible fault at the output voltage rail. However, even with a window comparator, only oscillations or peaks with amplitudes larger than the valid range thresholds (set in the monitoring circuit) are detectable. Therefore, a drawback of the window comparator is that in certain conditions the oscillation amplitudes that are desired to be detected are much smaller than the threshold of the monitoring circuit. As noted above, in other examples, the arrangement of the power supply circuit (e.g., capacitorless power supply or with an on-chip embedded capacitor) may not output detectable oscillations at the output node, even with an oscillation monitoring circuit that has a larger detection domain.

In contrast, the monitoring circuitry of this disclosure may periodically inject a check signal, which may be configured such that the check signal may be similar to an actual fault signal in some respects. However, the check signal may be controlled with known characteristics such that the check signal may emphasize the presence of a fault. The power supply circuit may continue to supply power to a load while injecting the check signal, but no fault is present. In some examples, the check signal comprises a simulation of an overvoltage fault.

By injecting the check signal, when in the presence of an actual fault, the circuitry of this disclosure may cause oscillations at the output node of the power supply that is detectable by the monitoring circuitry. With the combined actual fault and check signal, the fault signal at the output node may reach the monitoring threshold detectable by the voltage monitoring circuitry and the voltage monitoring circuitry may output an indication of the actual fault to a logic controller of the system.

FIG.1is a block diagram illustrating a power supply circuit with check signal injection according to one or more techniques of this disclosure. System100may supply power to operate systems in a variety of applications including vehicles, such as aircraft, automobiles, as well as industrial and other applications. In some examples, a fault in system100may supply unstable power to downstream components. In the example components and systems subject to ISO 26262, which defines functional safety for the different electrical and electronics systems in a vehicle, a power supply, such as system100, that supplies such components and systems may be configured with safety features to monitor the supplied output power. The arrangement of system100may provide advantages when compared to other power supply circuits.

System100includes a power management circuit150with safety unit110arranged with a topology including an internal check signal injection circuit112and a monitoring and reaction block, voltage monitoring circuit114. Power management circuit may also include a linear regulator, such as low-drop out (LDO) converter102, which is a type of power converter. In some examples, system100may include a DC power source115that supplies power to input terminal I104, such as a battery, or a power converter, such as an AC-DC converter or a DC-DC converter. The arrangement of the components of system100are just one example arrangement of the power supply circuit of this disclosure. In other examples, system100may include more or fewer components, and may be arranged differently. For example, safety unit110may be depicted as part of LDO102.

In the example ofFIG.1, power management circuit150receives an input voltage at a first magnitude at input terminal I104and may output a voltage at a second magnitude at output terminal Q106. Voltage monitoring circuit114is coupled to output terminal Q106. Check signal injection circuit112is also coupled to output terminal Q106. Input terminal I104connects to an input terminal of LDO102. LDO102connects to output terminal Q106through check signal injection circuit112. Controller103may send control signals to LDO102, check signal injection circuit112and may receive sensing signals from voltage monitoring circuit114. Power management circuit150may also include a reference terminal, GND105, connected to one or more components to power management circuit150. In the example of system100, GND105connects to controller103and voltage monitoring circuit114. In some examples, portions of power management circuit150, or the entire power management circuit, may be implemented as an integrated circuit (IC).

Low-dropout regulator, LDO102may receive the input voltage at the first magnitude, e.g., from power source115, and output a voltage at a second magnitude at output terminal Q106. In some examples, LDO102is a power converter that may operate to isolate a load connected to Q106from a dirty or noisy source connected to I104. In other examples, LDO102may act as a low-noise source to power sensitive circuitry connected to output terminal Q106.

Controller103may include one or more processors. Examples of processor in controller103may include any one or more of a microcontroller (MCU), e.g. a computer on a single integrated circuit containing a processor core, memory, and programmable input/output peripherals, a microprocessor (μP), e.g. a central processing unit (CPU) on a single integrated circuit (IC), a controller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a system on chip (SoC) or equivalent discrete or integrated logic circuitry. A processor may be integrated circuitry, i.e., integrated processing circuitry, and that the integrated processing circuitry may be realized as fixed hardware processing circuitry, programmable processing circuitry and/or a combination of both fixed and programmable processing circuitry.

Controller103may include an internal memory, or connect to an external memory (not shown inFIG.1). Examples of a memory may include any type of computer-readable storage media such as random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), one-time programmable (OTP) memory, electronically erasable programmable read only memory (EEPROM), flash memory, or another type of volatile or non-volatile memory device. In some examples the computer readable storage media may store instructions that cause the processing circuitry to execute the functions described herein. In some examples, the computer readable storage media may store data, such as configuration information, temporary values and other types of data used to perform the functions of this disclosure.

The check signal injected by check signal injection circuit112may have characteristics of an analog fault. Controller103may cause check signal injection circuit112to inject the check signal during operation of power converter LDO102, rather than just monitoring the output voltage rail connected to Q106. As noted above, in some cases, a fault may be difficult to detect. In some examples, controller103may cause check signal injection circuit112to periodically inject the check signal e.g., every minute, every second, at fraction of a second intervals, and so on. By performing this measure, a fault caused by an internal failure of the IC, such as an open leadframe, or caused by a component failure, may be highlighted to controller103by increasing an amplitude of an oscillation at the output node, Q106.

Voltage monitoring circuit114may be configured to detect a fault signal at output terminal Q106based on the combination of an actual fault signal and the check signal satisfying a detection threshold. In other words, during the system operation, power management circuit150output node Q106is continuously supervised by voltage monitoring circuit114. Therefore, once the signal at output node Q106reaches the monitoring threshold, voltage monitoring circuit114may trigger a reaction and send an indication125to controller103. In turn, controller103may control LDO102to place put power management circuit150into a fail-safe state. In some examples, controller103may cause LDO102to power down, e.g., disable the output and/or reduce the output at Q106to zero to achieve the fail-safe state.

Safety unit110, with check signal injection circuit112and voltage monitoring circuit114, may be configured such that the check signal from check signal injection circuit112alone does not satisfy a detection threshold of voltage monitoring circuit114. Said another way, although voltage monitoring circuit114may receive both the circuit output from LDO102and the check signal from check signal injection circuit112connected to output terminal Q106, voltage monitoring circuit114may ignore the check signal because the check signal does not satisfy the detection threshold. Only in the presence of a fault signal may the combined fault signal and check signal satisfy the detection threshold. The fault signal may be in indication of a circuit related issue with the output capacitor (not shown inFIG.1) e.g., a high impedance connection either within power management circuit150, or in connections from output terminal Q106to a PCB or lead frame. In some examples, controller103may be configured to cause signal injection circuit112to periodically input the check signal to Q106. When the combined check signal and fault signal exceeds the detection threshold, controller103may receive an indication from the voltage monitoring circuit that the voltage monitoring circuit detected the fault signal. As noted above, in response to receiving the indication, controller103may put power management circuit150in a fail-safe state.

In example of a power management with an LDO, as depicted inFIG.1, an external output capacitor (not shown inFIG.1) may connect to output terminal Q106to keep a regulation loop for power management circuit150stable. The loss of the connection to the output capacitor, or if the capacitor fails, may produce oscillations of the regulation loop, and cause power management circuit150to output an unstable voltage and/or current. This type of event represents a fault because the oscillations may affect the availability of the supply rails or the proper functionality of downstream components. In some supply applications, factors that may cause the fault can may be classified as external factors or internal factors. External factors may include a high impedance connection, such as a partial or complete loss of connection to the output capacitor caused by bad connection or damage of the output capacitor. Damage or failure of the output capacitor may result from capacitor leakage, internal shorts causing a failure, or a change in capacitance, and so on. Internal factors may include interruption of the connection between the power management circuit and application printed circuit board to which it is connected. For example, a solder, conductive adhesive or bond wire connection failure caused by mechanical stress or aging may cause a high impedance connection.

In some examples of other types of circuits, some faults may not be detectable because of frequency band limitations, or because of the arrangement of the other power supply circuit (e.g., capacitorless power supply or with an on-chip embedded capacitor). In examples of circuits that use a window comparator a drawback of the window comparator is that in certain conditions the oscillation amplitudes that are desired to be detected are much smaller than the threshold of the monitoring circuit.

In contrast, system100may provide advantages over other types of power supply circuits configured to comply with safety standards. The use of check signal injection circuit112technique may enable the development of safety mechanisms, e.g., safety units comprising circuitry, which are independent of oscillation frequency, amplitude, voltage regulator topology, solving the disadvantages of other solutions. Furthermore, power management circuit150may offer the extended coverage of safety relevant requirements for multiple voltage rails (e.g., for both pre-regulators and post-regulators which are part of a supply system) without increasing the pin count. By maintaining the pin count on a lead frame, e.g., by not adding extra pins for monitoring, power management circuit150of this disclosure may provide a cost-effective alternative to other types of circuits that may increase the package pin count.

An example application of system100and power management circuit150may include an ASIL-D rated power supply system. ASIL is an automotive safety integrity level risk classification scheme ISO 26262. ASIL-D represents the highest level of risk management, so components or systems that are developed for ASIL-D are made to the most stringent safety requirements, when compared to ASIL-A, B and C. Three factors determine the ASIL requirement for a particular system. The first is severity. Severity considers the safety consequences on the driver, passengers or nearby pedestrians and vehicles that were system to fail or malfunction. The second is probability of exposure or the likelihood of an operational situation that can be hazardous for the failure mode under analysis. The third factor is controllability. Controllability considers the ability to avoid a harm through the timely reactions of the persons involved in the operational situation (driver, passengers or persons in the vicinity of the vehicle) in case of a system failure or malfunction.

FIG.2is a block diagram illustrating a system comprising multiple power supply circuits that are configured to perform signal injection according to one or more techniques of this disclosure. System200is an example of system100described above in relation toFIG.1. The example ofFIG.2depicts two separate power supply output terminals, Q1206and Q2216supplied by two linear regulators, LDO A202and LDO B222, respectively. Each linear regulator LDO A202and LDO B222, receives the same input voltage output from DC-DC supply215. In other examples, system200may have multiple DC voltage inputs at multiple different voltage magnitudes and the input voltage to LDO A202may be different from LDO B222(not shown inFIG.1). In some examples, the magnitude of voltage at Q1206may be different from the magnitude of voltage at Q2216. In other examples, the magnitude of output voltage may be different for Q1206and Q2216.

Although shown inFIG.2with two power management circuits, in other examples, system200may include any number of power management circuits (not shown inFIG.2). In some examples, one or more of the power management circuits may receive the same input voltage. In other examples, each power management circuit may receive a separate input voltage with a different voltage magnitude. Likewise, for one or more power management circuits of system100the output voltage magnitude may have approximately the same magnitude in some examples. In other examples, each power management circuit of system200may output a voltage at a different magnitude. In the disclosure, “approximately” the same means the values are equal, within measurement and manufacturing tolerances. Manufacturing methods, temperature, different types of materials, changing atmospheric pressures, and other factors can cause some small differences in circuit performance.

The example of system100may be considered a pre-regulator arrangement. The example of system200, may be considered a post-regulator arrangement. In the example of system200, DC-DC supply215receives an input voltage from input terminal I204. DC-DC supply215outputs power to the input terminals of LDO A202and LDO B222. As described above in relation toFIG.1, LDO A202outputs a voltage to output terminal Q1206through check signal injection circuit212. Voltage monitoring circuit is coupled to output terminal Q1206. The arrangement of LDO A202, check signal injection circuit212and voltage monitoring circuit214with output terminal Q1206may be considered an example of power management circuit150described above in relation toFIG.1.

Similarly, voltage monitoring circuit224is coupled to output terminal Q216. Check signal injection circuit222is also coupled to output terminal Q216. The input terminal of LDO B222receives the power output from DC-DC supply215. LDO B222connects to output terminal Q216through check signal injection circuit222. Safety unit210, in the example ofFIG.2includes check signal injection circuit212and voltage monitoring circuit214for output terminal Q1206and check signal injection circuit222and voltage monitoring circuit224for output terminal216.

Controller203may send control signals to LDO A102, LDO B222, check signal injection circuits212and222and may receive sensing signals from voltage monitoring circuits214and224. Power management circuit150may also include a reference terminal, GND205, connected to one or more components to power management circuit150. In the example of system200, GND205connects to controller203and voltage monitoring circuit214and225. In some examples, multiple power management circuits inFIG.2may be implemented as an integrated circuit (IC).

As described above in relation toFIG.1, in some examples, DC-DC supply215may be implemented as a DC-DC power management that receives a first voltage magnitude and outputs a second voltage magnitude. In other examples, DC-DC supply215may be a battery, or other electrical energy storage element. In other examples, DC-DC supply215may be omitted from system200.

In operation, system100functions as described above in relation to system100inFIG.1. Each power management of system200may receive an input voltage at a first magnitude, e.g., from DC-DC supply215, and output a voltage at a second magnitude each respective output terminal, Q1206and Q2216. Voltage monitoring circuits214and224coupled to each respective output terminal, Q1206and Q2216may detect a respective fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold.

In some examples, controller203, as with controller103ofFIG.1, may periodically cause check signal injection circuit212and/or check signal injection circuit222to output the check signal. Controller203may periodically command a check signal every second, every few minutes, after a predetermined run time, multiple times per second, and so on. The period may depend on the likelihood and severity of a fault for a given circuit. In other examples, controller203may initiate the check signal only during start-up, only once at a predetermined delay after start-up, after detecting a specified event, or based on other criteria. In some examples, sensitive downstream circuitry supplied by the output terminals may be affected by noise placed on the output supply caused by the check signal.

FIG.3is a block diagram illustrating a system with a power supply circuit including signal injection and external components according to one or more techniques of this disclosure. System300is an example of system100, described above in relation toFIG.1and may have similar functions and characteristics.

As with system100, system300includes power management circuit352with input terminal I304, output terminal Q306and a reference terminal GND305. In the example ofFIG.3power management circuit also includes a power converter, LDO302, and a safety unit including check signal injection circuit312and voltage monitoring circuit314. In some examples, power management circuit352may be implemented as an integrated circuit.

Controller303is an example of controller103ofFIG.1and may include processing circuitry that controls the operation of LDO302, check signal injection circuit312and voltage monitoring circuit314. Examples of control signals may include enable signal EN330and control signal332. Controller303may also receive signals from LDO302, check signal injection circuit312and voltage monitoring circuit314indicating status, output voltage, and fault indication, e.g., over voltage indication OV334. The nature of the control signals and other signals of power management circuit352may depend on the specific implementation of the components of power management circuit352, e.g., digital signals, master-slave signals, analog signals, and so on.

Input voltage Vi338connects to input terminal I304through resistor Rpcb307. Rpcb307may model the resistance of the circuit board traces and connections. In the example ofFIG.3, the connection from the PCB to the power management input terminal I304and output terminal Q306is depicted as a wire bond. In other examples, the connection may consist of a solder, e.g., solder paste or a solder ball, conductive adhesive, e.g., silver epoxy, or some other connection.

Input capacitor Ci340connects I304to GND305through resistor Resr342. Resr342may model the equivalent series resistance (ESR) of input capacitor Ci340. Output terminal Q306connects to output capacitor Cq346through resistor Rpcb344. Similar to Rpcb307, Rpcb344may model the resistance of the connections to the circuit board. Output terminal Q306connects to GND305through a series arrangement of Cq346and resistor Resr348. Resistor Resr348may model the ESR of output capacitor Cq346. Power from output terminal Q306from power management circuit352supplies the load, Iload350.

In operation, power management circuit352may function in a similar way as power management circuit150described above in relation toFIG.1. The output node Q306of power management circuit352is continuously supervised by voltage monitoring circuit314. Once a fault signal at output node Q306reaches the monitoring threshold, voltage monitoring circuit314may trigger a reaction and send an indication OV334to controller303. In turn, controller303may control LDO302to place power management circuit352into a fail-safe state. As described above in relation toFIGS.1and2, in some examples, a fault signal, e.g., caused by a high impedance connection go output capacitor Cq346, may not be detected by voltage monitoring circuit314, except when the check signal from check signal injection circuit312is present. In some examples, indication OV334may indicate an overvoltage condition at the output terminal306of power management circuit352.

FIG.4is a block diagram illustrating an example implementation of power supply circuit with signal injection according to one or more techniques of this disclosure. Power management circuit452is an example of power management circuits150and352described above in relation toFIGS.1and3as well as the power management circuits of system200depicted inFIG.2. The example ofFIG.4depicts safety unit410as part of power converter LDO402.

As with system100and system300, power management circuit452may include input terminal I404, output terminal Q406and a reference terminal GND405. In the example ofFIG.4power management circuit also includes a power converter, LDO402with safety unit410and LDO regulation loop454. Safety unit410includes check signal injection circuit412and voltage supervision circuit414. Voltage supervision circuit414is an example of voltage monitoring circuits114,214,224and314described above in relation toFIGS.1-3. In some examples, power management circuit452may be implemented as an integrated circuit.

Controller403is an example of controller103ofFIG.1and may include processing circuitry that controls the operation of LDO402, check signal injection circuit412and voltage supervision circuit414. Examples of control signals may include enable signal EN430and other control signals not shown inFIG.4. Controller403may also receive signals from LDO402such as the fault indication OV434. In the example ofFIG.4control signal EN430enables the output of LDO402when signal EN430transitions from HIGH to LOW. When signal OV434transitions from LOW to HIGH, controller403receives an indication of a fault. In other examples, the control and indication signals may be configured in a different manner than described in the example ofFIG.4. As with controller103, controller403may communicate with other systems and processing circuitry not shown inFIG.4. In the example of a vehicle, controller403may communicate with a body control unit (BCU), engine control unit (ECU) or other systems to receive commands, communicate status, warnings and so on.

LDO402includes LDO regulation loop454, and safety unit410, which includes voltage supervision circuit414and check signal injection circuit412. Voltage supervision circuit414may receive commands from controller403and output signal OV434. Voltage supervision circuit414may also controls switch SW458of check signal injection circuit412. Switch SW458connects the check signal current source Icheck456to ground, GND405, when SW458is closed. A second terminal of Icheck456connects to output terminal Q406. The output of LDO regulation loop454connects to output terminal Q406.

In the example ofFIG.4, the bond wire connects Q406to LDO402. If the bond wire breaks, then components, such as an output capacitor described above in relation toFIG.3, may disconnect from LDO402, and cause instability in the output voltage from LDO402, as described above in relation toFIG.3.

In operation, voltage supervision circuit414may cause SW458to close, allowing the check signal, Icheck456to flow from output terminal Q406to GND405. In some examples, controller403may command voltage supervision circuit414to close SW458. In some examples, voltage supervision circuit414may periodically close SW458, for example once per second. In other examples, voltage supervision circuit414may only close SW458during startup, or during other times as described above in relation toFIG.2. With the combined actual fault and check signal, Icheck456, a fault signal at the output node may reach the monitoring threshold detectable by the voltage monitoring circuitry and the voltage monitoring circuitry may output an indication of the actual fault to a logic controller of the system.

FIG.5is a block diagram illustrating an example implementation of a signal injection circuit according to this disclosure. System500is an example of system100,300and400, described above and includes power management circuit552. Power management circuit552is an example of the power management circuits described above in relation toFIGS.1-4as well as the power management circuits of system200depicted inFIG.2. Any of the arrangements and components described inFIGS.1-5may be interchanged with any of the other configurations described above in relation toFIGS.1-4.

Power management circuit552may include input terminal I504, output terminal Q506and a reference terminal GND505. In the example ofFIG.5power management circuit also includes a power converter, LDO502with safety unit510. Safety unit510includes check signal injection circuit512. In some examples, power management circuit552may be implemented as an integrated circuit.

Controller503is an example of controller103ofFIG.1and may include processing circuitry that controls the operation of LDO502, check signal injection circuit512and other components of power management circuit552. Examples of control signals may include enable signal EN530, signal535and other control signals not shown inFIG.4. Controller503may also receive signals from LDO502such as the fault indication OV534. In the example ofFIG.5control signal EN530enables the output of LDO502when signal EN530transitions from HIGH to LOW. When signal OV534transitions from LOW to HIGH, controller503receives an indication of a fault, as described above in relation toFIG.4. In other examples, the control and indication signals may be configured in a different manner than described in the example ofFIG.5. As with controller103, controller503may communicate with other systems and processing circuitry not shown inFIG.5.

LDO502receives an input voltage from input terminal I504via a wire bond, in the example ofFIG.5. In other examples, the input507to LDO502may receive the input voltage via other connection techniques such as a conductive clip, jumper, solder joint, conductive adhesive, and so on. Input507connects to a source of a pass element M1562, which in the example ofFIG.5is a P-channel metal oxide semiconductor transistor (PMOS). A cathode of diode D1564connects to the source of transistor M1562and the anode of D1564connects to the drain of M1562. The drain of M1562is the output of LDO502and connects to output terminal Q506.

Output terminal Q506also connects to the reference terminal, e.g., GND505through a series arrangement of resistors R1574, R2578and R3580. A first terminal of R1574connects to Q506. The non-inverting input of error amplifier566receives the voltage at the node between R1574and R2578. The output of error amplifier566controls the gate of pass element M1562based on the difference between the voltage at the non-inverting input of error amplifier566and the reference voltage570connected to the inverting input to error amplifier566. The voltage divider formed by resistors R1574, R2578and R3580, along with error amplifier566connected to the gate of transistor M1562forms the regulation loop for LDO502, similar to LDO regulation loop454described above in relation toFIG.4.

The non-inverting input of comparator568receives the voltage at the node between R2578and R3580. Comparator568receives a reference voltage572at the inverting input. Therefore, the fault indication signal OV534to controller503is based on the difference between reference voltage572and the voltage divider formed at the node between R2578and R3580. Comparator568forms a portion of the voltage monitoring circuit of LDO502, as in the example of voltage monitoring circuits114,214,224,314and414described above in relation toFIGS.1-4.

Control circuit582of safety unit510receives a command signal535from controller503. Based on signal535, control circuit582may control the operation of switch SW558, to connect the check signal from current source Icheck556to ground. When control circuit582asserts CTRL584to close SW558, then check signal current flows from output terminal Q506to GND505. The check signal current may also be described as an analog load jump signal because closing SW558may appear to the LDO regulation loop as an increase, or jump, in the load current.

A load, depicted as Iload550, receives power from LDO502from output terminal Q506. Output terminal Q506connects to output capacitor Cq546through resistor Rpcb544. As described above in relation toFIG.3, Rpcb544may model the resistance of the connections to the circuit board. Output terminal Q506connects to GND505through a series arrangement of Cq546and resistor Resr548. Resistor Resr548may model the ESR of output capacitor Cq546.

As described above in relation toFIGS.1-4, a fault signal may be in indication of a circuit related issue with output capacitor Cq546, e.g., a high impedance connection either within power management circuit552, or in connections from output terminal Q506to a PCB or leadframe. The monitoring threshold of safety unit510may be set by selecting the value for resistors R1574, R2578and R3580and the magnitude of reference voltage572. Once a fault signal at output node Q506reaches a value such that the voltage at the input to comparator568is greater than the magnitude of reference voltage572, the output of comparator568may transition from LOW to HIGH and output signal OV534to controller503. Controller503may control LDO502to place put power management circuit552into a fail-safe state, which in some examples may include disabling the output from output terminal Q506, e.g., based on enable signal EN530. As described above in relation toFIGS.1-4, in some examples, the fault signal, may not be detected by voltage monitoring circuit including comparator568, except when the check signal I check556from check signal injection circuit512is present.

As with any of systems100-600described in this disclosure, the specific arrangements are just one example implementation of a power management circuit that performs the functions described in this disclosure. In other examples, reference voltage572may connect to the non-inverting terminal of comparator568and the inverting terminal connected through a different arrangement of resistors. In other examples, the inputs to controller503may be to an analog to digital converter (ADC) rather than arrangement as shown.

FIG.6is a timing diagram illustrating an example operation of a power supply circuit with signal injection according to one or more techniques of this disclosure. The timing diagram ofFIG.6will be described in terms ofFIG.5but may illustrate the operation of any of systems100-700of this disclosure. In the example ofFIG.6, during time period602, no fault is present in system500, and during time period604a fault signal is present, which may be in indication of a circuit related issue with the output capacitor.

In some examples, the starting and control of the analog check signal injection may use a clock signal derived from the digital domain, for example, synchronized with the clock of the system (not shown inFIG.6). This clock signal, Vctrl612may drive a switch, such as a MOS device, configured as a low-side switch, e.g., SW558depicted inFIG.5. Vctrl612corresponds to the output of control circuit582, CTRL584ofFIG.5. In other examples, controller503may cause SW558to close based on specific events, such as during start-up, shut-down, or other detected events, or when receiving a command from other portions system to which system500is connected, e.g., an ECU.

Closing SW558causes Icheck614to flow, which corresponds to current source Icheck556ofFIG.5. At the signal transitions of Icheck614, e.g., from LOW to HIGH or from HIGH to LOW, the output voltage Vq616may include some voltage ripple, but safety unit510ofFIG.5may be configured such that the voltage608does not exceed the monitoring threshold610of the voltage monitoring circuit during time period602, when no fault is present. However, during time period604, a fault, such as a high impedance connection at Vq506ofFIG.5, may cause the combined fault signal and check signal to exceed the monitoring threshold610as shown at620and622. Once the amplitude reaches the safety thresholds, the voltage monitoring circuit including comparator568may react and change its state. Further this information is propagated to controller503. Based on the received change in OV534, controller503may react in such a way to put system500into a fail-safe state, such as to power-down LDO502.

FIG.7is a block diagram illustrating a second example implementation of power supply circuit with signal injection according to one or more techniques of this disclosure. System700is an example of system100,300,400, and500described above and includes power management circuit752. Power management circuit752is an example of the power management circuits described above in relation toFIGS.1-5as well as the power management circuits of system200depicted inFIG.2. Any of the arrangements and components described inFIGS.1-5and7may be interchanged with any of the other configurations described above.

As with systems100-500described above, system700includes circuitry to inject an analog fault, a check signal, to detect a fault (open connection) in the leadframe during the entire operation of the voltage regulator. By injecting the check signal, the high impedance or missing connection to output capacitor Cq746may be emphasized, as described above in relation toFIG.6. The check signal may stimulate the LDO regulation loop in a way that puts the voltage regulator of LDO702into an oscillation condition when the high impedance fault may be detected. The detected fault may provide an information to controller703, which may cause controller703to put the system in to a fail-safe state. Because the operation of safety unit710is independent on the response of LDO702, then in case of a fault, no dedicated oscillation monitor is required, in contrast to other examples of fault detection circuitry. Therefore, a power management circuit that includes a safety unit, such as safety unit710may provide advantages over other examples of monitoring circuitry because the possibility of unwanted oscillations or of a failure of system700to detect that the power supplied by LDO702is unavailable may be reduced or eliminated.

Power management circuit752may include input terminal I704, output terminal Q706and a reference terminal GND705. In the example ofFIG.7power management circuit also includes a power converter, LDO702with safety unit710. Safety unit710includes check signal injection circuit712. In some examples, power management circuit752may be implemented as an integrated circuit.

Controller703is an example of controller103ofFIG.1and may include processing circuitry that controls the operation of LDO702, check signal injection circuit712and other components of power management circuit752. Examples of control signals may include enable signal EN730A, the clock output from707and other control signals not shown inFIG.4. Controller703may also receive signals from LDO702such as the fault indication OV734. As with controller103, controller703may communicate with other systems and processing circuitry not shown inFIG.7.

In the example ofFIG.7enable signal EN730A enables the output of LDO702when signal EN730A transitions from HIGH to LOW. The enable signal controls the gate of transistor M2786. EN730A connects to EN730B. When the enable signal EN730B transitions from HIGH to LOW, it shuts off transistor M2786. When EN730B is HIGH, transistor M2786is conducting and pulls the output terminal Q706to ground through pull down resistor R4790, thereby disabling the output of LDO702.

LDO702receives an input voltage from input terminal I704via a wire bond, in the example ofFIG.7. As described above in relation toFIG.5the input to LDO702may receive the input voltage via other connection techniques. The input to LDO702connects to a source of a pass element M1762. A cathode of diode D1764connects to the source of transistor M1762and the anode of D1764connects to the drain of M1762. The drain of M1762is the output of LDO702and connects to output terminal Q706.

Output terminal Q706also connects to the reference terminal, e.g., GND705through a series arrangement of resistors R1774, R2778and R3780. A first terminal of R1774connects to Q506. The non-inverting input of error amplifier766receives the voltage at the node between R1774and R2778. The output of error amplifier766controls the gate of pass element M1762based on the difference between the voltage at the non-inverting input of error amplifier766and the reference voltage770connected to the inverting input to error amplifier766. The voltage divider formed by resistors R1774, R2778and R3780, along with error amplifier766connected to the gate of transistor M1762forms the regulation loop for LDO702, similar to LDO regulation loop454described above in relation toFIG.4.

The non-inverting input of comparator768receives the voltage at the node between R2778and R3780. Comparator768receives a reference voltage772at the inverting input. Therefore, the fault indication signal OV734to controller703is based on the difference between reference voltage772and the voltage divider formed at the node between R2778and R3780. Comparator768forms a portion of the voltage monitoring circuit of LDO702, as in the example of voltage monitoring circuits114,214,224,314and414described above in relation toFIGS.1-4. When signal OV734transitions from LOW to HIGH, controller703receives an indication of a fault, as described above in relation toFIGS.4and5. In other examples, the control and indication signals may be configured in a different manner than described in the example ofFIG.7.

In the example ofFIG.7, control circuit782of safety unit710receives clock signal707from controller703. Based on clock signal707, control circuit782may control the operation of switch transistor M1758, to cause the check signal current through R5792to flow, as described above in relation toFIG.6.

The load, depicted as Iload750, receives power from LDO702from output terminal Q706. Output terminal Q706connects to output capacitor Cq746through resistor Rpcb744. As described above in relation toFIGS.3and5, Rpcb744may model the resistance of the connections to the circuit board. Output terminal Q706connects to GND705through a series arrangement of Cq746and resistor Resr748. Resistor Resr748may model the ESR of output capacitor Cq746.

In the example ofFIG.7the starting and control of the check signal, e.g., an analog load jump injection, may use clock signal derived from the digital domain, as described above in relation toFIG.6. The clock signal707may be synchronized with the clock of a system to which system700is connected (not shown inFIG.7). The output from clock707may cause control circuitry782to output CTRL784that drives a MOS device, M3788, which is configured as a low-side switch. The level of the internal load jump may be designed to stimulate the regulation loop of LDO702in a way that it can be handled by the loop in normal operation and but indicate a fault to controller703in a fault condition. To further limit the value of the internal load jump, a series resistor, R5792may be added in series to the transistor M3788.

The monitoring function of power management circuit752in the example ofFIG.7, is implemented by a voltage comparator786, that takes as input a fraction of the output voltage at output terminal Q706. The values of resistors R1774, R2778and R3780, arranged in series as a voltage divider determine the value of the fraction. Comparator786receives reference voltage772, which may be the same reference voltage used by the regulation loop, e.g., reference voltage770, or may an independent safety bandgap.

To permit the logic controller, e.g., controller703, to process the information and also to avoid potential glitches, the response of the comparator may be deglitched769on the positive edge. Safety unit710, with check injection circuit712may the system to implement the functional safety requirements, which may be relevant for automotive systems that need to be ISO 26262 compliant, up to ASIL-D. In other words, the arrangement of power management circuit752may further mitigates risks that can appear in the system, caused by an unavailability of the supply voltage rails caused by internal or external faults. The detection of such single point faults may trigger controller703to react every time an event is detected. Therefore, the integrity of the system may be regularly checked and when a fault is detected, the system generates a reaction based on the associated fault severity level.

FIG.8is a flow chart illustrating the operation of a power supply circuit with signal injection according to one or more techniques of this disclosure. The blocks ofFIG.8will be described in terms ofFIG.1, but may apply to any of systems100-700of this disclosure.

As seen in the example ofFIG.8, check signal injection circuit112may inject a check signal at an output terminal Q106of a power converter circuit (90). In some examples, controller103may cause check signal circuit112to periodically inject the check signal throughout the operation of LDO102, or only at certain times during operation.

Voltage monitoring circuit114may compare the output voltage at Q106to a reference voltage, as described above in relation toFIGS.5-7(92). In some examples a circuit issue such as a high impedance connection to an output capacitor, may not be detectable by voltage monitoring circuit114, as described above in relation toFIG.1. However, voltage monitoring circuit114may detect a fault signal at output terminal Q106based on the combined fault signal and the check signal satisfying a detection threshold (94).

Next, voltage monitoring circuit114may output to the processing circuitry, such as controller103, an indication that the voltage monitoring circuit detected the fault signal (96). Further, controller103, in response to receiving the indication from voltage monitoring circuit114, may place the power converter, LDO102into a fail-safe state (98), such as to power down LDO102and/or disable the output of LDO102, as described above in relation toFIG.7.

In one or more examples, the functions described above may be implemented in hardware, software, firmware, or any combination thereof. For example, the various components ofFIG.5may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on a tangible computer-readable storage medium and executed by a processor or hardware-based processing unit.

Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuit (ASIC), Field programmable gate array (FPGAs), or other equivalent integrated or discrete logic circuitry. Accordingly, the term “processor,” and “processing circuitry” as used herein, such as may refer to any of the foregoing structure or any other structure suitable for implementation of the techniques described herein. Also, the techniques could be fully implemented in one or more circuits or logic elements.

The techniques of this disclosure may also be described in the following examples.

Example 1: A system includes a power converter comprising an output terminal and configured to receive an input voltage at a first magnitude and output a voltage at a second magnitude at the output terminal; a voltage monitoring circuit coupled to the output terminal; and a signal injection circuit coupled to the output terminal, the signal injection circuit configured to input a check signal; wherein the voltage monitoring circuit is configured to detect a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold.

Example 2: The system of example 1, wherein the power converter is a first power converter comprising an input terminal, the system further comprising a DC-DC power converter coupled to the input terminal of the first power converter.

Example 3: The system of any of examples 1 and 2, wherein the power converter is a first power converter, the system further comprising a second power converter wherein the second power converter is configured to receive a second input voltage of a third magnitude and output a voltage of a fourth magnitude at a second output terminal.

Example 4: The system of any combination of examples 1 through 3, further comprising an output capacitor coupled to the output terminal, wherein the fault signal is an indication of a circuit issue related to the output capacitor.

Example 5: The system of combination of examples 1 through 4, wherein the circuit issue comprises a high impedance connection to the output capacitor.

Example 6: The system of combination any of examples 1 through 5, further comprising processing circuitry configured to cause the signal injection circuit to periodically input the check signal; and receive an indication from the voltage monitoring circuit that the voltage monitoring circuit detected the fault signal.

Example 7: The system of combination of examples 1 through 6, wherein in response to receiving the indication, the processing circuitry is configured to put the power converter in a fail-safe state.

Example 8: The system of any combination of examples 1 through 7, wherein, in response to receiving the indication, the processing circuitry is configured to cause the power converter to power down.

Example 9: The system of any combination of examples 1 through 8, wherein the power converter comprises a linear power converter.

Example 10: The system of combination of examples 1 through 9, wherein the power converter comprises a low drop out (LDO) regulator.

Example 11: A circuit includes a power converter comprising an output terminal and configured to receive an input voltage at a first magnitude and output a voltage at a second magnitude at the output terminal; a voltage monitoring circuit coupled to the output terminal; and a signal injection circuit coupled to the output terminal, the signal injection circuit configured to input a check signal, wherein the voltage monitoring circuit is configured to detect a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold.

Example 12: The circuit of example 11, further includes cause the signal injection circuit to periodically input the check signal; and receive an indication from the voltage monitoring circuit that the voltage monitoring circuit detected the fault signal.

Example 13: The circuit of examples 11 and 12, wherein in response to receiving the indication, the processing circuitry is configured to put the power converter in a fail-safe state.

Example 14: The circuit of any combination of examples 11 through 13, wherein, in response to receiving the indication, the processing circuitry is configured to cause the power converter to power down.

Example 15: The circuit of any combination of examples 11 through 14, wherein the signal injection circuit configured to periodically input the check signal.

Example 16: The circuit of any combination of examples 11 through 15, wherein the power converter comprises a low drop out (LDO) regulator.

Example 17: The circuit of any combination of examples 11 through 16, wherein the signal injection circuit comprises: a current source; and a switch configured to control a duration of the check signal.

Example 18: The circuit of any combination of examples 11 through 17, wherein the signal injection circuit comprises a pull-down resistor configured to disable the output of the power converter.

Example 19: The circuit of any combination of examples 11 through 18, further comprising a deglitching circuit coupled to an output of the voltage monitoring circuit.

Example 20: A method includes injecting a check signal at an output terminal of a power converter circuit; monitoring, by a voltage monitoring circuit, an output voltage at the output terminal, detecting, by the voltage monitoring circuit, a fault signal at the output terminal based on the combined fault signal and the check signal satisfying a detection threshold outputting, by the voltage monitoring circuit and to processing circuitry, an indication that the voltage monitoring circuit detected the fault signal; in response to receiving the indication from the voltage monitoring circuit, placing, by the processing circuitry, the power converter into a fail-safe state.