Patent Description:
A modern automobile increasingly relies on electronic devices and systems to control the functions of the automobile. Such electronic devices and systems are utilized to control, manage, and maintain the basic functions of the automobile, such as acceleration, braking, steering, and exterior lighting. In addition, electronic devices and systems are relied upon to operate the more complex functions of the automobile, such as autonomous (driverless) operation, collision avoidance, adaptive cruise control, driver display, passenger infotainment, and passenger environment.

Each of the functions of the automobile that utilize electronic devices and systems is associated with a particular level of impact to the safety of the automobile and its occupants and cargo. For example, functions that relate to the comfort and entertainment of the passengers are deemed to be less critical than functions that relate to the movement of the automobile. Similarly, the functions of the head lamps, while more critical than passenger comfort and entertainment, are less critical than vehicle steering and braking. As such, the reliability demanded of the electronic devices and systems is dependent upon which functions the devices and systems control. Moreover, where a particular electronic device or system controls multiple functions, the reliability of that particular device or system will typically need to be ensured to the level of safety demanded by the most critical function that the particular device or system controls.

The electronic devices and systems that control various critical functions of an automobile are designed to ensure that the devices and systems are highly reliable in the first place, and to ensure that, should a failure occur, the failure is handled in a controlled fashion. That is, the electronic devices and systems are designed to be fault tolerant. One way to ensure the reliability and fault tolerance of electronic devices and systems is through redundancy. Redundancy may be provided on several overlapping levels. Hardware redundancy provides for multiple control devices for critical functions, so that if one control device fails, the other control devices continue controlling the critical functions. Information redundancy provides mechanisms to ensure that the data processed is valid data. Information redundancy may be provided by error detection and correction, or by the redundant data storage for critical data. Time redundancy provides for multiple iterations of a same operation to ensure that the aggregate result of the multiple iterations provide a valid result and to detect spurious instances of the operation.

A system-on-a-chip (SoC) is an integrated circuit or highly integrated system that incorporates many of the elements of a computer into a compact, low-power, low-cost element. The SoC typically provides for easily programmable control over a wide variety of input/output (I/O) devices, and thus is easily embedded into an automobile to provide the control of many of the functions of the automobile. Commonly available SoCs may include multiple processor cores, and so provide an inherent level of redundancy to control critical vehicle functions. As such, SoCs are emerging as a preferred design choice for the control, management, and maintenance of the functions in an automobile.

While providing certain levels of redundancy, a SoC may still be susceptible to failure modes that effect the entire SoC. For example, a power failure or electrostatic discharge (ESD) event may cause the failure of all of the processor cores of a SoC. Thus, there remains a need for more robust fault tolerance in an automotive control system that utilizes a SoC.

<CIT> discloses an IC device comprising a fault detection component arranged to detect an occurrence of fault conditions within the data processing IC device. The peripheral IC device further comprises a safe state control component. Upon detection of a fault condition occurring within the data processing IC device by the fault detection component, the safe state control component is arranged to cause at least one I/O cell of the data processing IC device to be configured into at least one scan-chain.

It will be appreciated that for simplicity and clarity of illustration, elements illustrated in the Figures have not necessarily been drawn to scale. Embodiments incorporating teachings of the present disclosure are shown and described with respect to the drawings presented herein, in which:.

The following description in combination with the Figures is provided to assist in understanding the teachings disclosed herein. The following discussion will focus on specific implementations and embodiments of the teachings. This focus is provided to assist in describing the teachings, and should not be interpreted as a limitation on the scope or applicability of the teachings. However, other teachings can certainly be used in association with this disclosure.

In an embodiment of the present disclosure, an automotive control system, includes a safety processor and a system-on-a-chip (SoC). The SoC includes a primary processor, a safety monitor, first and second general purpose input/output (GPIO) banks, and a debug interface. The safety monitor detects fault conditions of the primary processor and provides an indication of the fault condition to the safety processor. The first GPIO bank is coupled to the primary processor to provide input/output operations to a non-critical function of an automobile. The second GPIO bank is coupled to the primary processor to provide input/output operations to a first critical function of the automobile. The debug interface is coupled to the second GPIO bank to form a first scan chain with input and output registers of the second GPIO bank, and is coupled to the safety processor to receive first control information for the first scan chain to provide input/output operations to the first critical function of the automobile when the safety monitor provides the indication.

In a first case, the automotive control system further includes a primary voltage regulator and a safety voltage regulator. The primary voltage regulator coupled to provide power to the primary processor, the safety monitor, and the first GPIO bank. The safety voltage regulator is coupled to provide power to the safety processor, the debug interface, and the second GPIO bank. Here, the SoC may further include a watchdog module coupled to the safety voltage regulator, and coupled to receive the indication from the safety monitor. Further, the watchdog module may be configured to determine that the primary voltage regulator is not providing power, and in response to provide the indication to the safety processor.

In another case, the SoC further includes a third GPIO bank coupled to the primary processor to provide input/output operations to a second critical function of the automobile. Here, the debug interface is further coupled to the third GPIO bank to form a second scan chain with input and output registers of the third GPIO, and is further coupled to the safety processor to receive second control information for the second scan chain to provide input/output operations to the second critical function of the automobile when the safety monitor provides the indication.

In another case, the SoC further includes the safety processor.

In a final case, the first scan chain is a Joint Testing and Access Group (JTAG) scan chain. Here, the debug interface may be coupled to the safety processor via a Test Access Port (TAP).

In a second embodiment, a method is shown for providing control of automobile functions. The method includes coupling a primary processor of a system-on-a-chip (SoC) of an automotive control system to a first general purpose input/output (GPIO) bank of the SoC, and to a second GPIO bank of the SoC, wherein the first GPIO bank is associated with a non-critical function of an automobile and the second GPIO bank is associated with a first critical function of the automobile. The method further includes coupling a debug interface of the SoC to the second GPIO bank to form a first scan chain with input and output registers of the second GPIO bank, coupling the debug interface to a safety processor of the automotive control system to receive first control information for the first scan chain to provide input/output operations to the first critical function of the automobile, providing by the safety monitor an indication of the fault condition to the safety processor, and providing by the safety processor the first control information in response to receiving the indication.

In a first case, the method includes connecting a primary voltage regulator of the automotive control system to provide power to the primary processor, the safety monitor, and the first GPIO bank, and the method further includes connecting a safety voltage regulator of the automotive control system to provide power to the safety processor, the debug interface, and the second GPIO bank. Here, the method may include connecting a watchdog module of the SoC to the safety voltage regulator, and coupling the watchdog module to receive the indication from the safety monitor. Here further, the method may include determining, by the watchdog module, that the primary voltage regulator is not providing power, and providing, by the watchdog module, the indication to the safety processor in response to determining that the primary voltage regulator is not providing power.

In another case, the method includes coupling the primary processor to a third GPIO bank, wherein the third GPIO bank is associated with a second critical function of the automobile. Here the method further includes coupling the debug interface to the third GPIO bank to form a second scan chain with input and output registers of the third GPIO bank, coupling the debug interface to a safety processor of the automotive control system to further receive second control information for the second scan chain to provide input/output operations to the second first critical function of the automobile, and providing, by the safety processor, the second control information in response further to receiving the indication.

In an embodiment of the present disclosure, an automotive control system, includes a safety processor and a system-on-a-chip (SoC). The SoC includes a primary processor, a safety processor, a safety monitor, first and second general purpose input/output (GPIO) banks, and a multiplexor. The safety monitor detects fault conditions of the primary processor and provides an indication of the fault condition to the safety processor. The first GPIO bank is coupled to the primary processor to provide input/output operations to a non-critical function of an automobile. The second GPIO bank is coupled to the primary processor to provide input/output operations to a first critical function of the automobile. The multiplexor includes a first input coupled to the primary processor, a second input coupled to the safety processor, a selector input coupled to the safety processor, and an output coupled to the second GPIO bank. When the safety monitor provides the indication, the safety processor operates to assert a selector signal to the selector input and to provide input/output operations to the crucial function of the automobile.

In a particular case, the automotive control system further includes a primary voltage regulator and a safety voltage regulator. The primary voltage regulator coupled to provide power to the primary processor, the safety monitor, and the first GPIO bank. The safety voltage regulator is coupled to provide power to the safety processor, the multiplexor, and the second GPIO bank.

<FIG> illustrates an automotive control system <NUM> for use in an automobile (not shown). Automotive control system includes a system-on-a-chip (SoC) <NUM>, a safety processor <NUM>, and a primary voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, a SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, and a debug interface <NUM>. Automotive control system <NUM> represents an electronic system for the control, management, and maintenance of the functions of an automobile. The functions can include less critical functions, such as passenger comfort and entertainment functions, more critical functions, such as exterior lighting, and most critical functions, such as vehicle steering and braking.

SoC <NUM> receives power from primary voltage regulator <NUM> to power the elements of the SoC. Primary processors <NUM> execute machine-executable code receive information via GPIO banks <NUM>, <NUM>, and <NUM> related to the various functions, and to control the functions of the automobile based upon information provided to the automobile functions via the GPIO banks. As such, primary processors <NUM> and GPIO banks <NUM>, <NUM>, and <NUM> are in data communication with each other via various communication interfaces, not shown. GPIO bank <NUM> is exemplary of I/O devices configured to control less critical functions of the automobile. In a particular embodiment, GPIO bank <NUM> is exemplary of I/O devices configured to control functions of the automobile that are of intermediate criticality, while GPIO bank <NUM> is exemplary of I/O devices configured to control highly critical functions. In another embodiment, both of GPIO banks <NUM> and <NUM> are exemplary of I/O devices configured to control functions of the automobile that are highly critical, but GPIO bank <NUM> is utilized to control functions which need less frequent attention than the functions controlled by GPIO bank <NUM>. The control of automobile functions by processors in a SoC via GPIO banks is known in the art and will not be further described herein, except as needed to illustrate the present embodiments.

Debug interface <NUM> includes a Joint Test Action Group (JTAG) interface <NUM>, primary processors <NUM> each include a JTAG interface <NUM>, GPIO bank <NUM> includes a JTAG interface <NUM>, GPIO bank <NUM> includes a JTAG interface <NUM>, and GPIO bank <NUM> includes a JTAG interface <NUM>. JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> are test and debug interfaces that are coupled together into one or more serially connected scan chains. In a typical SoC, the scan chains are utilized to load pre-determined test patterns into the scan elements of the SoC, to trigger logic operations on the test patterns to and to retrieve the resulting patterns from the scan elements of the SoC. The resulting patterns can be compared with expected results that should be retrieved if the logic elements of the SoC are working correctly, and failures to retrieve the expected results may be considered to be indications of logic failures within the SoC. The typical SoC thus may include a Test Access Port (TAP) to which test equipment can be connected. The test equipment then scans the pre-determined test patterns into the scan elements of the SoC, triggers the logic operations, and scans the resulting patterns out of the scan elements of the SoC. This is typically done during test phases in manufacturing, or for debug purposes when failures are observed in the SoC.

Here, safety processor <NUM> is connected to a TAP port of debug interface <NUM>. When it is detected that primary processors <NUM> are unavailable for normal operation, safety processor <NUM> utilizes the TAP port of debug interface <NUM> to scan the scan chains established with JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> to load the output registers associated with GPIO banks <NUM>, <NUM>, and <NUM> with command information associated with the automobile functions that are controlled thereby, to trigger the outputting of the command information by the GPIO banks, and to retrieve the resulting information associated with the automobile functions from the input registers associated with the GPIO banks. In this way, when primary processors <NUM> become unavailable for normal operation, safety processor <NUM> operates to control the functions of the automobile to safely handle the loss of the processing capabilities of the primary processors. Note that the connections between JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> are not depicted as typical scan chains with the elements of the scan chain serially connected, but are depicted as in a bus-type interconnection in order to simplify the illustration, but it will be understood that the scan chains formed between the JTAG interfaces are provided in accordance with the practices as known in the art. It will be further understood that the scan chains include the input and output registers of GPIO banks <NUM>, <NUM>, and <NUM>, in order for safety processor <NUM> to be maintain critical functions of the automobile. In a particular embodiment, safety processor <NUM> is powered by primary voltage regulator <NUM>. In another embodiment, safety processor <NUM> is powered by a separate voltage regulator (not shown).

The safety operation of safety processor <NUM> is triggered by SoC reset/safety monitor <NUM>. In a typical SoC, a reset and safety monitor operates to detect error conditions that effect the operations of the SoC, and, where possible, to redirect processing tasks between the processors. For example, if one of the processors of the SoC experiences a fault, such as a machine check, the reset/safety monitor can redirect the processing tasks from the failing processor to the other processors, reset the failing processor, and reallocate the processing tasks back to the reset processor. In another example, if all of the processors are unable to operate due to a global fault on the SoC, the reset/safety monitor can trigger a reboot of the SoC, and issue a fault/reset indication to the automobile. Here, SoC reset/safety monitor <NUM> operates to maintain the processing operations of primary processors <NUM> in so far is the primary processors are able to handle the reallocated load. However, when a fault impacts all of primary processors <NUM>, SoC reset/safety monitor issues a fault/reset indication to safety processor <NUM>, whereupon the safety processor proceeds to handle the critical functions of the automobile via debug commands to debug interface <NUM>, as described above. Here, because safety processor <NUM> operates in the safety mode to control only those functions of the automobile that are the most safety critical, and does not necessarily control the less safety critical functions, the processing power of the safety processor can be considerably less than the processing power of primary processors <NUM>. As such, the processing architecture implemented by automotive control system <NUM> is considered an asymmetric processing architecture. Here, automotive control system <NUM> is adaptable to existing SoCs that implement a debug architecture as shown by SoC <NUM>, and the reliability of existing automotive control systems can be greatly enhanced by the addition of a secondary processor such as secondary processor <NUM>, as shown and described above.

<FIG> illustrates another automotive control system <NUM>, including a system-on-a-chip (SoC) <NUM>, safety processor <NUM>, primary voltage regulator <NUM>, and a safety voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, debug interface <NUM>, and a reset/watchdog module <NUM>. Automotive control system <NUM> is similar to automotive control system <NUM>, and where an element of automotive control system <NUM> includes the same reference numeral as was used for an element of automotive control system <NUM>, the element of automotive control system <NUM> will be understood to have the same features and to perform the same functions as described above with respect to <FIG>, unless otherwise noted. As such automotive control system <NUM> represents an electronic system for the control, management, and maintenance of the functions of an automobile.

Here, SoC <NUM> includes a safety power domain <NUM> that includes GPIO banks <NUM>, <NUM>, and <NUM>, debug interface <NUM>, JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, and reset/watchdog module <NUM>. Here, GPIO banks <NUM>, <NUM>, and <NUM>, debug interface <NUM>, JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, and reset/watchdog module <NUM> (the elements within safety power domain <NUM>), and safety processor <NUM> are powered separately by safety voltage regulator <NUM>. Thus, the safety operations of automotive control system <NUM> are capable of being performed in a wider range of fault conditions than those capable of being performed by automotive control system <NUM>. In particular, here, the elements within safety power domain <NUM> and safety processor <NUM>, being powered separately from the other elements of SoC <NUM>, will operate when the fault mode that precipitates the failure of primary processors <NUM> includes a total power loss form primary voltage regulator <NUM>. Note that here, because existing scan chains in SoC <NUM> are utilized for the safety operations of safety processor <NUM>, the scan operations performed by the safety processor will include the scanning of information into and out of JTAG interfaces <NUM>. Here, the logic operations of primary processors <NUM> may not be valid due to the fault mode that precipitates the failure of the primary processors. For this reason, JTAG interfaces <NUM> are included within safety power domain <NUM> to ensure that the scan chains between the JTAG interfaces are in good operating state in all conditions.

The safety operation of safety processor <NUM> is triggered by reset/watchdog module <NUM>, similarly to the way that the operation of safety processor <NUM> is triggered by SoC reset/safety monitor <NUM>, as described above. In particular, SoC reset and safety monitor <NUM> operates to maintain the processing operations of primary processors <NUM> in so far is the primary processors are able to handle the reallocated load, and issues a fault/reset indication to reset/watchdog module <NUM> when a fault impacts all of the primary processors <NUM>. Reset/watchdog module <NUM> forwards the fault/reset indication to safety processor <NUM>, thereby triggering the operation of the safety processor. In addition, reset/watchdog module <NUM> provides a watchdog function, such that, if SoC reset and safety monitor <NUM> fails to provide a periodic refresh signal, the reset/watchdog module determines that SoC <NUM> is in a failure mode so sever that the SoC reset and safety monitor can not provide the periodic refresh signal. Here, when a watchdog timer of reset/watchdog module <NUM> times out, the reset/watchdog module provides a fault/reset indication to safety processor <NUM>, thereby triggering the operation of the safety processor. As with automotive control system <NUM>, automotive control system <NUM> implements an asymmetric processing architecture. In this case, automotive control system <NUM> is adaptable to SoCs that are modified to implement a safety power domain similar to safety power domain <NUM>.

<FIG> illustrates another automotive control system <NUM>, including a system-on-a-chip (SoC) <NUM>, safety processor <NUM>, primary voltage regulator <NUM>, and safety voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, a debug interface <NUM>, and reset/watchdog module <NUM>. Automotive control system <NUM> is similar to automotive control systems <NUM> and <NUM>, and represents an electronic system for the control, management, and maintenance of the functions of an automobile.

Here, SoC <NUM> includes a safety power domain <NUM> that includes GPIO banks <NUM> and <NUM>, debug interface <NUM>, JTAG interfaces <NUM>, <NUM>, and <NUM>, and reset/watchdog module <NUM>. Here, GPIO banks <NUM>, <NUM>, and <NUM>, debug interface <NUM>, JTAG interfaces <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, and reset/watchdog module <NUM> (the elements within safety power domain <NUM>), and safety processor <NUM> are powered separately by safety voltage regulator <NUM>. Thus, the safety operations of automotive control system <NUM> are capable of being performed in a similar range of fault conditions than those capable of being performed by automotive control system <NUM>. In particular, here, the elements within safety power domain <NUM> and safety processor <NUM>, being powered separately from the other elements of SoC <NUM>, will operate when the fault mode that precipitates the failure of primary processors <NUM> includes a total power loss form primary voltage regulator <NUM>. Note that here, because existing scan chains in SoC <NUM> are utilized for the safety operations of safety processor <NUM>, the scan operations performed by the safety processor will include the scanning of information into and out of JTAG interfaces <NUM>.

Debug interface <NUM> includes a debug JTAG interface <NUM>, a first safety JTAG interface <NUM>, and a second safety JTAG interface <NUM>. Debug JTAG interface <NUM> is connected to JTAG interfaces <NUM>, <NUM>, <NUM>, and <NUM> into one or more scan chains as shown in SoCs <NUM> and <NUM>, and as described above. Here, debug interface <NUM> operates in testing and debug by utilizing the scan chains associated with debug JTAG interface <NUM>. First safety JTAG interface <NUM> is connected to from one or more scan chains in GPIO bank <NUM> via JTAG interface <NUM>, and second safety JTAG interface <NUM> is connected to form one or more scan chains in GPIO bank <NUM> via JTAG interface <NUM>.

The safety operation of safety processor <NUM> is triggered by reset/watchdog module <NUM>, as shown in <FIG> and <FIG>, and as described above. However, here, when safety processor <NUM> operates in the safety mode, the safety processor selectively scans the scan chains associated with GPIO bank <NUM> and with GPIO bank <NUM> to control the associated functions. By splitting the scan chains associated with GPIO bank <NUM> from the scan chains associated with GPIO bank <NUM>, SoC <NUM> permits a more efficient operation of safety processor <NUM>. For example, where GPIO bank <NUM> is associated with critical functions that require less frequent attention than GPIO bank <NUM>, safety processor <NUM> can more frequently access the scan chains associated with safety JTAG interface <NUM>. In another example, where GPIO bank <NUM> is associated with less critical functions than GPIO bank <NUM>, safety processor <NUM> can dedicate more processing power to the control of the functions associated with GPIO bank <NUM>. As with automotive control systems <NUM> and <NUM>, automotive control system <NUM> implements an asymmetric processing architecture. In this case, automotive control system <NUM> may more efficiently manage critical functions than automotive control system <NUM>.

<FIG> illustrates another automotive control system <NUM>, including a system-on-a-chip (SoC) <NUM>, primary voltage regulator <NUM>, and safety voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, a debug interface <NUM>, a safety processor <NUM>, and reset/watchdog module <NUM>. Automotive control system <NUM> is similar to automotive control systems <NUM>, <NUM>, and <NUM>, and represents an electronic system for the control, management, and maintenance of the functions of an automobile. Here, SoC <NUM> includes a safety power domain <NUM> that includes GPIO banks <NUM>, <NUM> and <NUM>, debug interface <NUM>, JTAG interfaces <NUM>, <NUM>, and <NUM>, safety processor <NUM>, and reset/watchdog module <NUM>. Automotive control system <NUM> operates in the same manner as automotive control system <NUM>, except that automotive control system <NUM> dispenses with the separate safety processor <NUM> and integrates safety processor <NUM> into SoC <NUM>.

<FIG> illustrates another automotive control system <NUM>, including a system-on-a-chip (SoC) <NUM>, primary voltage regulator <NUM>, and safety voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, multiplexors <NUM> and <NUM>, a safety processor <NUM>, and reset/watchdog module <NUM>. Primary processors <NUM> each include an I/O interface <NUM>. GPIO bank <NUM> includes an I/O interface <NUM>, GPIO bank <NUM> includes an I/O interface <NUM>, and GPIO bank <NUM> includes an I/O interface <NUM>. Safety processor <NUM> includes I/O interfaces <NUM> and <NUM>. In contrast to the depictions in <NUM>-<NUM>, where connections between JTAG interfaces represented scan chains, here, I/O interfaces <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> represent data communication interfaces which may be bus-based data communication interfaces, serial-based data communication interfaces, or a combination thereof, as needed or desired.

I/O interfaces <NUM> are connected to I/O interface <NUM>, to a first input of multiplexor <NUM>, and to a first input of multiplexor <NUM>. I/O interface <NUM> is connected to a second input of multiplexor <NUM>, and I/O interface <NUM> is connected to a second input of multiplexor <NUM>. An output of multiplexor <NUM> is connected to I/O interface <NUM>, and an output of multiplexor <NUM> is connected to I/O interface <NUM>. A selector output of I/O interface <NUM> is connected to a selector input of multiplexor <NUM>, and a selector output of I/O interface <NUM> is connected to a selector input of multiplexor <NUM>. Here, when the safety mode is triggered by reset/watchdog module <NUM>, safety processor <NUM> asserts the selector outputs of I/O interfaces <NUM> and <NUM>, and directly interacts with I/O interfaces <NUM> and <NUM> via respective multiplexors <NUM> and <NUM>.

<FIG> illustrates another automotive control system <NUM>, including a system-on-a-chip (SoC) <NUM>, primary voltage regulator <NUM>, and safety voltage regulator <NUM>. SoC <NUM> includes primary processors <NUM>, SoC reset and safety monitor <NUM>, general purpose I/O (GPIO) banks <NUM>, <NUM>, and <NUM>, multiplexors <NUM> and <NUM>, a safety processor <NUM>, and reset/watchdog module <NUM>. Primary processors <NUM> each include an I/O interface <NUM>. GPIO bank <NUM> includes an I/O interface <NUM>, GPIO bank <NUM> includes an I/O interface <NUM>, and GPIO bank <NUM> includes an I/O interface <NUM>. Safety processor <NUM> includes direct I/O interfaces <NUM> and <NUM>. I/O interfaces <NUM> are connected to I/O interfaces <NUM>, <NUM>, and <NUM>. Here, direct I/O interface <NUM> is connected directly to GPIO bank <NUM>, and direct I/O interface <NUM> is connected directly to GPIO bank <NUM>. Here, because safety processor <NUM> is integrated into SoC <NUM>, the connection between the safety processor and the critical I/O can be designed into the SoC, such that, when in the safety mode, the safety processor can directly access the input and output registers of the critical automotive functions, as needed or desired. The direct connection may represent a serial communication link, similar to a JTAG interface, but may represent a proprietary interface as needed or desired.

<FIG> illustrates a method <NUM> for controlling automobile functions via an automotive control system. The automotive control system can include a system-on-a-chip (SoC) that integrates one or more primary processor and I/O blocks. The I/O blocks can include inputs and outputs whereby the primary processor operates to control the functions of the automobile. The method starts at block <NUM>. A criticality level is determined for each automobile function that is controlled by the automotive control system in block <NUM>. Here, a particular level of impact to the safety of the automobile and its occupants and cargo is associated with each automobile function. All of the I/O banks of the SoC are communicatively connected to the primary processor in block <NUM>. Here, the primary processor receives information from the inputs of the I/O banks from sensors associated with the automobile functions, and the primary processor provides information to the outputs of the I/O banks to control the functions of the automobile.

The primary processor and the I/O banks associated with non-critical functions of the automobile are powered by a primary voltage regulator of the automotive control system in block <NUM>. The I/O banks associated with the critical automobile functions are connected to a safety processor in block <NUM>. The connection between the I/O banks associated with the critical automobile functions and the safety processor may include a scan chain connections, direct serial connections, or other connections as needed or desired. The safety processor and the I/O banks associated with the critical automobile functions are powered by a safety voltage regulator in block <NUM>. The I/O banks associated with the critical automobile functions may also be powered by the primary voltage regulator as needed or desired. Here, the power to the automotive control system can be configures such that, in normal operation the automotive control system receives power from the primary voltage regulator, and when a safety mode of operation is entered, the safety voltage regulator takes over powering the I/O banks associated with the critical automobile functions. In a particular embodiment, the safety voltage regulator may be associated with a power supply that is provided for testing and debug of the SoC.

The primary processor controls the automobile functions through the I/O banks in block <NUM>. A decision is made as to whether or not the primary processor is experiencing a fault condition in decision block <NUM>. If not, the "NO" branch of decision block <NUM> is taken and the method returns to block <NUM> where the primary processor controls the automobile functions through the I/O banks. If the primary processor is experiencing a fault condition, the "YES" branch of decision block <NUM> is taken, the safety processor begins to control the critical automobile functions through the I/O banks associated with the critical automobile functions in block <NUM>, and the method ends in block <NUM>.

An automotive control system includes a safety processor and a system-on-a-chip. The SoC includes a primary processor, a safety monitor, first and second GPIO banks, and a debug interface. The safety monitor is configured to detect a fault condition of the primary processor and to provide an indication of the fault condition to the safety processor. The first GPIO bank is coupled to the primary processor to provide input/output operations to a non-critical function of an automobile, while the second GPIO bank is coupled for a critical function of the automobile. The debug interface is coupled to the second GPIO bank to form a scan chain with input and output registers of the second GPIO bank, and is coupled to the safety processor to receive control information for the scan chain to provide input/output operations to the critical function of the automobile when the safety monitor provides the indication.

For purpose of this disclosure, automotive control systems and SoCs are representative of any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an automotive control system or a SoC can include a device that integrates all or substantially all of the components typically associated with a computer system or other electronic system, such as a data processing element for executing machine-executable code (e.g., a central processing unit (CPU), a microprocessor unit (MPU), or another type of data processing element), a memory element (e.g., a random-access memory (RAM) element, a non-volatile memory element, or another type of memory element), input/output (I/O) ports, power conditioning elements, and the like. An automotive control system or a SoC may further include elements for analog signal processing or mixed signal (combined analog and digital) processing. A SoC may represent a single integrated circuit device, or may represent a circuit board that includes additional functions and features. For example, where a single integrated circuit device includes a power supply circuit, a circuit board that includes the integrated circuit device may be provided with bulk capacitors that are integrated onto the circuit board. Other elements, such as various power and data connectors may also be integrated onto the circuit board. While the present embodiments are represented utilizing a SoC, the teachings of the present disclosure are not limited to applications utilizing SoCs, but may likewise be applicable in various types of systems, with varying levels of system integration and processing power, such as a computer system or consumer electronic device, a network system, or any other suitable device and may vary in size, shape, performance, functionality, and price, as needed or desired.

Although only a few exemplary embodiments have been described in detail herein, those skilled in the art will readily appreciate that many modifications are possible in the exemplary embodiments without materially departing from the novel teachings and advantages of the embodiments of the present disclosure.

Claim 1:
An automotive control system (<NUM>), comprising:
a safety processor (<NUM>); and
a system-on-a-chip (<NUM>), SoC, including:
a primary processor (<NUM>);
a safety monitor (<NUM>) configured to detect a fault condition of the primary processor and to provide an indication of the fault condition to the safety processor;
a first general purpose input/output, GPIO, bank (<NUM>) coupled to the primary processor to provide input/output operations to a non-critical function of an automobile;
a second GPIO bank (<NUM>, <NUM>) coupled to the primary processor to provide input/output operations to a first critical function of the automobile;
a debug interface (<NUM>) coupled to the second GPIO bank to form a first scan chain with input and output registers of the second GPIO bank, and coupled to the safety processor to receive first control information for the first scan chain to provide input/output operations to the first critical function of the automobile when the safety monitor provides the indication of the fault condition;
a primary voltage regulator (<NUM>) coupled to provide power to the primary processor, the safety monitor, and the first GPIO bank; and
a safety voltage regulator (<NUM>) coupled to provide power to the safety processor, the debug interface, and the second GPIO bank,
wherein the processing power of the safety processor is less than the processing power of the primary processor.