Abstract: Methods and apparatuses directed to. In some examples, a die package includes voltage logic that provides a voltage to a voltage rail, clock logic that generates a clock signal, and adaptive clock distribution logic that receives the clock signal and the voltage. The adaptive clock distribution logic can increment an event count when the clock signal is above a threshold frequency, or when the voltage is below a threshold voltage level. The die package also includes a processor that can monitor the event counts during operation and determine a status of the adaptive clock distribution logic based on the event counts. In some examples, the processor can test the adaptive clock distribution logic by causing the clock signal to operate above the threshold frequency, or causing the voltage logic to provide the voltage below the threshold voltage level. The processor can then read the event counts to determine the status.

Abstract: Aspects of the present disclosure provide techniques and apparatus for safety monitoring of a vehicle control system. An example method of operating a vehicle includes detecting an error associated with a system-on-a-chip (SoC) having a main domain and a safety domain, wherein the main domain is coupled to a first bus for communicating with one or more electronic control units (ECUs) and wherein the safety domain is coupled to a second bus for communicating with the one or more ECUs; indicating the error to the one or more ECUs via at least one of the first bus, the second bus, or a power management integrated circuit (PMIC) in response to detecting the error, wherein the PMIC is configured to supply power to the main domain or the safety domain; and performing one or more actions in response to detecting the error.

Abstract: Aspects of the disclosure are directed to functional safety (FUSA) via performance monitoring and logic, memory error detection and protection monitoring. In accordance with one aspect, the disclosure includes incrementing each of a plurality of functional safety (FUSA) monitoring counters upon detection of a functional safety (FUSA) event, wherein the plurality of FUSA monitoring counters is part of a hardware-based monitoring system; comparing the plurality of FUSA monitoring counters to a plurality of functional safety (FUSA) counter thresholds using a push methodology; generating at least one interrupt signal and sending the at least one interrupt signal to a FUSA control module if at least one of the plurality of FUSA monitoring counters exceeds at least one of the plurality of FUSA counter thresholds; and executing a state transition to a functional safety (FUSA) safe state using the push methodology based on the at least one interrupt signal.

Abstract: Aspects of the disclosure are directed to functional safety (FUSA) via performance monitoring and logic, memory error detection and protection monitoring. In accordance with one aspect, the disclosure includes incrementing each of a plurality of functional safety (FUSA) monitoring counters upon detection of a functional safety (FUSA) event, wherein the plurality of FUSA monitoring counters is part of a hardware-based monitoring system; comparing the plurality of FUSA monitoring counters to a plurality of functional safety (FUSA) counter thresholds using a push methodology; generating at least one interrupt signal and sending the at least one interrupt signal to a FUSA control module if at least one of the plurality of FUSA monitoring counters exceeds at least one of the plurality of FUSA counter thresholds; and executing a state transition to a functional safety (FUSA) safe state using the push methodology based on the at least one interrupt signal.

Abstract: An apparatus includes a central processing unit (CPU) coupled to a system-on-a-chip (SOC) interconnect. The apparatus also includes multiple logic structures coupled to a memory. The apparatus further includes a safety mechanism coupled to and inline with the memory, the logic structures, and the CPU via the SOC interconnect. The safety mechanism comprises a meta cache and is configured to detect errors in one or more of the logic structures and the memory.

Abstract: Aspects of the present disclosure relate to an adaptive clock duty cycle controller (DCC) in an automotive system-on-a-chip (SoC). The adaptive clock DCC may include one or more devices, which may be configured to measure and adapt a duty cycle of a clock signal to compensate for aging effects on components in a signal path of a clock distribution network.

Abstract: Fail-safe and Fail-operational behavior can be achieved by providing two fully-redundant execution channels comprising at least first and second chiplet dies on a single SoC that are in communication with one another via a D2D interface. At least first and second instances of a first automotive safety integrity level (ASIL) domain circuit disposed on the at least first and second chiplet dies, respectively, perform at least a first ASIL domain process on one or more automotive sensor output signals to produce first and second output signals, respectively. A fault monitoring system monitors at least the first chiplet die for faults and assigns a first value to a selector signal if it detects a fault in the first chiplet die. A selector circuit outputs the second output signal from the system if the selector signal has the first value.

Abstract: A method for a clock monitoring subsystem of a system-on-chip (SoC) supporting dynamic clock scaling and voltage gating is described. The method includes generating a set of clocks. The method also includes routing a selected one of the set of clocks for frequency measurement through one or more clock routing subsystems. The method further includes adjusting a frequency of the selected clock after the selected clock is routed through the clock routing subsystems. The method also includes communicating a sideband signal to indicate the adjusted frequency of the selected clock.

Abstract: Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes generating an alarm state signal from a digital count word and a comparator state signal; generating a heartbeat signal by dividing down one of a plurality of multi-phase ring oscillator (RO) output waveforms; and generating an error interrupt signal and a warning interrupt signal in a voltage domain based on the alarm state signal and the heartbeat signal.

Abstract: Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes a multi-phase ring oscillator (RO) configured to operate in a first voltage domain; a frequency counter coupled to the multi-phase RO, the frequency counter configured to accumulate a plurality of phase cycles from the multi-phase RO over a time duration to generate a digital count word; an alarm processor coupled to the frequency counter, the alarm processor configured to receive an alarm state signal from the frequency counter; and a heartbeat detector coupled to the multi-phase RO, the heartbeat detector configured to operate in a second voltage domain and configured to detect a periodic recurrence of a heartbeat pulse to determine an integrity of the sensor function as a whole and alarm state signal in particular.

Abstract: This disclosure provides systems, methods, and devices for vehicles with automated driving systems. In a first aspect, a method of isolation in an automated driving system includes detecting the error in a first domain of the automated driving system, isolating a second domain of the automated driving system from the first domain, maintaining operation of the second domain after isolating the second domain from the first domain, and bypassing, by the second domain, the first domain to transmit notifications to an external controller via a first communication interface. Other aspects and features are also claimed and described.

Abstract: Aspects relate to monitoring timing margin of logic paths and its degradation through an integrated circuit. In one example an integrated circuit has a logic path formed in the integrated circuit. A monitor circuit is formed in the integrated circuit near the logic path and configured to monitor a condition of the logic path and to generate a diagnostic code sequence to indicate the condition of the logic path over time. A monitor controller is configured to receive diagnostic codes of the diagnostic code sequence, to determine a condition of the integrated circuit based on the diagnostic code sequence, and to initiate a remedial action in response to the condition of the integrated circuit.

Abstract: Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes a multi-phase ring oscillator (RO) configured to operate in a first voltage domain; a frequency counter coupled to the multi-phase RO, the frequency counter configured to accumulate a plurality of phase cycles from the multi-phase RO over a time duration to generate a digital count word; an alarm processor coupled to the frequency counter, the alarm processor configured to receive an alarm state signal from the frequency counter; and a heartbeat detector coupled to the multi-phase RO, the heartbeat detector configured to operate in a second voltage domain and configured to detect a periodic recurrence of a heartbeat pulse to determine an integrity of the sensor function as a whole and alarm state signal in particular.

Abstract: A method for a clock monitoring subsystem of a system-on-chip (SoC) supporting dynamic clock scaling and voltage gating is described. The method includes generating a set of clocks. The method also includes routing a selected one of the set of clocks for frequency measurement through one or more clock routing subsystems. The method further includes adjusting a frequency of the selected clock after the selected clock is routed through the clock routing subsystems. The method also includes communicating a sideband signal to indicate the adjusted frequency of the selected clock.

Abstract: Methods and apparatuses directed to. In some examples, a die package includes voltage logic that provides a voltage to a voltage rail, clock logic that generates a clock signal, and adaptive clock distribution logic that receives the clock signal and the voltage. The adaptive clock distribution logic can increment an event count when the clock signal is above a threshold frequency, or when the voltage is below a threshold voltage level. The die package also includes a processor that can monitor the event counts during operation and determine a status of the adaptive clock distribution logic based on the event counts. In some examples, the processor can test the adaptive clock distribution logic by causing the clock signal to operate above the threshold frequency, or causing the voltage logic to provide the voltage below the threshold voltage level. The processor can then read the event counts to determine the status.

Abstract: Aspects relate to monitoring timing margin of logic paths and its degradation through an integrated circuit. In one example an integrated circuit has a logic path formed in the integrated circuit. A monitor circuit is formed in the integrated circuit near the logic path and configured to monitor a condition of the logic path and to generate a diagnostic code sequence to indicate the condition of the logic path over time. A monitor controller is configured to receive diagnostic codes of the diagnostic code sequence, to determine a condition of the integrated circuit based on the diagnostic code sequence, and to initiate a remedial action in response to the condition of the integrated circuit.

Abstract: Aspects relate to monitoring timing. In one example an apparatus includes a first sensor array formed in an integrated circuit, sensors of the first sensor array having paths through the integrated circuit and sensors of the first sensor array configured to generate one or more first level indications of a condition of the integrated circuit. A second sensor array is formed in the integrated circuit. Sensors of the second sensor array have paths through the integrated circuit and sensors of the second sensor array are configured to generate one or more second level indications of the condition of the integrated circuit. A monitor controller is coupled to the first sensor array and to the second sensor array and configured to receive the one or more first level indications and to actuate the second sensor array in response to the one or more first level indications.

Abstract: Aspects relate to monitoring timing margin of logic paths and its degradation through an integrated circuit. In one example an apparatus includes an integrated circuit having a logic path formed in the integrated circuit and a monitor circuit formed in the integrated circuit. The monitor circuit is configured to monitor a condition of the logic path and to generate a diagnostic code sequence to indicate the condition of the logic path over time. A monitor controller is configured to receive diagnostic codes of the diagnostic code sequence, to store the diagnostic codes in a log with a corresponding time stamp and to determine a condition of the integrated circuit based on the diagnostic code sequence.

Abstract: This disclosure provides systems, methods, and devices for vehicles with automated driving systems. In a first aspect, a method of isolation in an automated driving system includes detecting the error in a first domain of the automated driving system, isolating a second domain of the automated driving system from the first domain, maintaining operation of the second domain after isolating the second domain from the first domain, and bypassing, by the second domain, the first domain to transmit notifications to an external controller via a first communication interface. Other aspects and features are also claimed and described.

Abstract: Fail-safe and Fail-operational behavior can be achieved by providing two fully-redundant execution channels comprising at least first and second chiplet dies on a single SoC that are in communication with one another via a D2D interface. At least first and second instances of a first automotive safety integrity level (ASIL) domain circuit disposed on the at least first and second chiplet dies, respectively, perform at least a first ASIL domain process on one or more automotive sensor output signals to produce first and second output signals, respectively. A fault monitoring system monitors at least the first chiplet die for faults and assigns a first value to a selector signal if it detects a fault in the first chiplet die. A selector circuit outputs the second output signal from the system if the selector signal has the first value.