Electrical and logic isolation for systems on a chip

1. An integrated circuit comprising:

a first voltage domain that includes a first logic module coupled to a first communication interface;

a second voltage domain that includes a second logic module coupled to a second communication interface, wherein the second voltage domain is voltage isolated from the first voltage domain;

isolation circuitry coupled between the first communication interface and the second communication interface, the isolation circuitry operable to allow communication between the first communication interface and the second communication interface in a first mode of operation and operable to isolate the first communication interface from the second communication interface in a second mode of operation; and

fault detection logic located within the first voltage domain, wherein:

the fault detection logic is coupled to the isolation circuitry;

the fault detection logic comprises voltage detection circuitry coupled to a voltage terminal in the second voltage domain; and

the fault detection logic is operable to control a mode of operation of the isolation circuitry by:

detecting that a voltage level on the voltage terminal is out of tolerance; and

placing the isolation circuitry in the second mode of operation when the voltage on the voltage terminal in the second voltage domain is out of tolerance.

2. The integrated circuit of claim 1 , wherein the fault detection logic comprises timing logic coupled to the first communication interface operable to detect a communication timeout failure, wherein the fault detection logic is operable to place the isolation circuitry in the second mode of operation in response to a communication timeout failure.

3. The integrated circuit of claim 1 , wherein the fault detection logic comprises a safety microcontroller configured to execute safety software to control the mode of operation of the isolation circuitry.

4. The integrated circuit of claim 3 , wherein the fault detection logic comprises an override finite state machine (FSM) configured to detect a fault condition in the second voltage domain and operable to override the safety microcontroller to control the mode of operation of the isolation circuitry.

5. The integrated circuit of claim 4 , wherein the fault detection logic includes timing logic coupled to the first communication interface operable to detect a communication timeout failure, wherein the override FSM is operable to place the isolation circuitry in the second mode of operation in response to the communication timeout failure.

6. The integrated circuit of claim 1 , wherein the fault detection logic includes a memory mapped register coupled to the isolation circuitry and operable to cause the isolation circuitry to be in either the first mode of operation or the second mode of operation.

7. The integrated circuit of claim 1 , wherein the fault detection logic includes:

a supply monitoring circuit operable to detect whether the voltage level on the voltage terminal is out of tolerance; and

de-glitch logic coupled to the supply monitoring circuit and operable to cause the isolation circuitry to be in the second mode of operation when the voltage on the voltage terminal in the second voltage domain is out of tolerance for more than a specified amount of time.

8. The integrated circuit of claim 1 , wherein:

the isolation circuitry includes a set of signal lines coupled between the first communication interface and the second communication interface; and

each signal line of the set of signal lines includes a respective pass-gate operable to allow or inhibit communication via the respective signal line.

9. A method of operating a system, the method comprising:

supplying power to a first voltage domain of a system on chip integrated circuit (SoC) with a first voltage supply;

supplying power to a second voltage domain of the SoC with a second voltage supply;

communicating between a first logic module in the first voltage domain and a second logic module in the second voltage domain via a communication bus;

detecting whether a fault occurred in the second voltage domain by detection logic located in the first voltage domain by detecting whether a communication timeout failure between the first logic module and the second logic module occurred; and

determining whether to inhibit communication between the first voltage domain and the second voltage domain based on whether the fault in the second voltage domain occurred.

10. The method of claim 9 , wherein:

the fault is a first fault; and

the method further comprises:

detecting whether a second fault occurred by detecting whether a voltage supply level in the second voltage domain is out of tolerance; and

determining whether to inhibit communication between the first voltage domain and the second voltage domain based on whether the second fault occurred.

11. The method of claim 9 , wherein:

the fault is a first fault; and

the method further comprises:

detecting whether a second fault occurred by executing software on a safety processor located in the first voltage domain; and

determining whether to inhibit communication between the first voltage domain and the second voltage domain based on whether the second fault occurred.

12. The method of claim 11 , further comprising overriding control signals provided by the safety processor with control signals produced by an override finite state machine for electrically isolating the first voltage domain from the second voltage domain.

13. The method of claim 11 , further comprising rebooting processing logic in the second voltage domain of the SoC under control of the safety processor in response to detecting that either of the first fault or the second fault has been corrected.

14. A system comprising:

a system on chip integrated circuit (SoC);

a first power supply coupled to a first voltage domain of the SoC;

a second power supply coupled to a second voltage domain of the SoC; and

wherein the SoC comprises:

a first logic module in the first voltage domain, the first logic module coupled to a first communication interface;

a second logic module in the second voltage domain, the second logic module coupled to a second communication interface, wherein the second voltage domain is voltage isolated from the first voltage domain;

isolation circuitry coupled between the first communication interface and the second communication interface, the isolation circuitry operable to allow communication between the first communication interface and the second communication interface in a first mode of operation and operable to isolate the first communication interface from the second communication interface in a second mode of operation; and

fault detection logic located within the first voltage domain, wherein:

the fault detection logic is coupled to the isolation circuitry; and

the fault detection logic comprises a safety microprocessor configured to execute safety software operable to control a mode of operation of the isolation circuitry.

15. The system of claim 14 , wherein the fault detection logic comprises voltage detection circuitry coupled to a voltage terminal in the second voltage domain, the fault detection logic operable to detect that a voltage level on the voltage terminal is out of tolerance, wherein the fault detection logic is operable to place the isolation circuitry in the second mode of operation when the voltage on the voltage terminal in the second voltage domain is out of tolerance.

16. The system of claim 14 , wherein the fault detection logic comprises timing logic coupled to the first communication interface operable to detect a communication timeout failure, wherein the fault detection logic is operable to place the isolation circuitry in the second mode of operation in response to the communication timeout failure.

17. The system of claim 14 , wherein the fault detection logic comprises an override finite state machine (FSM) configured to detect a fault condition in the second voltage domain and operable to override the safety microprocessor to control the mode of operation of the isolation circuitry.

18. The system of claim 17 , wherein the fault detection logic includes timing logic coupled to the first communication interface operable to detect a communication timeout failure, wherein the override FSM is operable to place the isolation circuitry in the second mode of operation in response to the communication timeout failure.

19. The system of claim 18 , wherein the fault detection logic comprises voltage detection circuitry coupled to a voltage terminal in the second voltage domain, the fault detection logic operable to detect that a voltage level on the voltage terminal is out of tolerance, wherein the fault detection logic is operable to place the isolation circuitry in the second mode of operation when the voltage on the voltage terminal is out of tolerance.

20. The system of claim 14 , wherein:

the isolation circuitry includes a set of signal lines coupled between the first communication interface and the second communication interface; and

each signal line of the set of signal lines includes a respective pass-gate operable to allow or inhibit communication via the respective signal line.