Integrated circuit device, safety circuit, safety-critical system and method of manufacturing an integrated circuit device
An integrated circuit device comprises a first integrated circuit and a second integrated circuit wherein the first and second integrated circuits are comprised on a single semiconductor die. The second integrated circuit is a safety circuit arranged to monitor the operation of the first integrated circuit, report any detected faults and drive the device into a failsafe state if a fault is detected. The first integrated circuit may be a power management module for a safety critical system. An isolation barrier in the form of a trench is formed between the two integrated circuits so that the safety circuit is protected from any high voltage or thermal stresses arising in the first integrated circuit. The device has particular application to automotive safety-critical systems such as electric power steering systems.
1. An integrated circuit device, comprising:
a first integrated circuit provided in a first region of a semiconductor die; and
a safety circuit arranged to monitor the operation of the first integrated circuit and to output an error signal when a fault in said operation is detected,
the safety circuit being provided in a second region of the semiconductor die separated from the first region by an isolation barrier provided in the semiconductor die, the isolation barrier inhibiting a transfer of perturbations from the first integrated circuit to the safety-circuit, the safety circuit comprises:
at least one fault monitoring module, the at least one fault monitoring module comprises a built in self test module, and
a built in self test checker module operably coupled to the built in self test module, wherein the built in self test module generates status flags, and wherein the built in self test checker module is arranged to verify the validity of the status flags by monitoring their logical states.
2. The integrated circuit device of claim 1 , comprising an oscillator circuit module for providing a clock signal to the least one fault monitoring module.
3. The integrated circuit device of claim 1 , wherein the safety circuit further includes a detector arranged to monitor a voltage being supplied to the safety circuit from an external source, and to generate a fault signal if the magnitude of the monitored voltage supply drops below a predetermined threshold value.
4. A safety critical system comprising the integrated circuit device of claim 1 .
5. A method of manufacturing an integrated circuit device comprising:
providing a semiconductor die,
forming a first circuit on a first region of the die,
forming a safety circuit on a second region of the die, arranged to monitor an operation of the first integrated circuit and to output an error signal when a fault in said operation is detected, on a second region of the die,
forming a fault monitoring module including a built-in-self-test module on the second region, the built-in-self-test module arranged to generate status flags
forming a built-in-self-checker module on the second region, the built-in-self-checker operably coupled to the built-in-self-test module, the built-in-self-checker module arranged to verify the validity of the status flags by monitoring logical states of the status flags,
forming in the semiconductor die an isolation barrier separating the first region from the second region and inhibiting a transfer of perturbations from the first integrated circuit to the safety-circuit, and
forming electrical signal connections across the isolation barrier, for enabling communication between the first circuit and the safety circuits.
6. The method of claim 5 , wherein the isolation barrier comprises an oxide barrier in the form of a trench.
7. The method of claim 5 , wherein the isolation barrier comprises rings formed using a diffusion process.
8. The method of claim 5 wherein the electrical signal connections are formed using a metallisation process.
9. The method of claim 5 , further comprising:
forming an oscillator circuit module arranged to provide a clock signal to the least one fault monitoring module.
10. The method of claim 5 , further comprising:
forming a detector on the second region, the detector arranged to monitor a voltage being supplied to the safety circuit from an external source, and to generate a fault signal if the magnitude of the monitored voltage supply drops below a predetermined threshold value.
11. The integrated circuit device of claim 1 comprising electrical signal connections for enabling communications between the first and second integrated circuits and being formed across the isolation barrier.
12. The integrated circuit device of claim 1 , wherein the first integrated circuit is an electrical power management module.
13. The integrated circuit device of claim 1 , wherein the isolation barrier comprises a trench composed of an oxide barrier.
14. The integrated circuit device of claim 1 , wherein the isolation barrier comprises diffusions of dopants in the semiconductor die in the form of rings.