Electrical and logic isolation for systems on a chip
In described examples, an SoC includes at least two voltage domains interconnected with a communication bus. Detection logic in a first voltage domain determines when a voltage error occurs in a second voltage domain and isolates communication via the communication bus when a voltage error or a timing error is detected.
1 . An integrated circuit device comprising:
a first voltage domain;
a second voltage domain; and
a communication circuit coupled between the first voltage domain and the second voltage domain, wherein the first voltage domain includes:
an error signal circuit;
a processor core coupled to the error signal circuit and configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain; and
a fault response circuit coupled between the error signal circuit and the communication circuit and configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain.
2 . The integrated circuit device of claim 1 , wherein:
the first voltage domain includes a memory mapped register coupled to the processor core and to the communication circuit; and
the processor core is configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain by writing a value to the memory mapped register.
3 . The integrated circuit device of claim 1 , wherein the error signal circuit is configured to:
detect a voltage of the second voltage domain exceeding a threshold; and
based on the voltage of the second voltage domain exceeding the threshold, provide an error signal to the processor core and the fault response circuit.
4 . The integrated circuit device of claim 3 , wherein the processor core is configured to execute software to determine whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal.
5 . The integrated circuit device of claim 3 , wherein the fault response circuit is configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal.
6 . The integrated circuit device of claim 1 further comprising a voltage supply monitor circuit that includes an input coupled to the second voltage domain and an output coupled to the error signal circuit.
7 . The integrated circuit device of claim 6 further comprising a deglitch circuit coupled between the output of the voltage supply monitor circuit and the error signal circuit.
8 . The integrated circuit device of claim 1 , wherein:
the first voltage domain includes:
a communication interface coupled to the communication circuit; and
a timeout detection circuit coupled between eh communication interface and the error signal circuit; and
the error signal circuit is configured to:
detect a timeout associated with the communication interface; and
based on the timeout associated with the communication interface, provide an error signal to the processor core and the fault response circuit.
9 . The integrated circuit device of claim 8 , wherein the processor core is configured to execute software to determine whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal.
10 . The integrated circuit device of claim 8 , wherein the fault response circuit is configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal.
11 . An integrated circuit device comprising:
a first voltage domain;
a second voltage domain; and
a communication circuit coupled between the first voltage domain and the second voltage domain that includes a set of pass gates, wherein the first voltage domain includes:
an error signal circuit; and
a processor core coupled to the error signal circuit and configured to execute software to determine whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal circuit.
12 . The integrated circuit device of claim 11 , wherein:
the first voltage domain includes a memory mapped register coupled to the processor core and to the communication circuit; and
the processor core is configured to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain by writing a value to the memory mapped register.
13 . The integrated circuit device of claim 11 , wherein the error signal circuit is configured to:
detect a voltage of the second voltage domain exceeding a threshold; and
based on the voltage of the second voltage domain exceeding the threshold, provide an error signal to the processor core.
14 . The integrated circuit device of claim 11 further comprising a voltage supply monitor circuit that includes an input coupled to the second voltage domain and an output coupled to the error signal circuit.
15 . The integrated circuit device of claim 11 , wherein:
the first voltage domain includes:
a communication interface coupled to the communication circuit; and
a timeout detection circuit coupled between eh communication interface and the error signal circuit; and
the error signal circuit is configured to:
detect a timeout associated with the communication interface; and
based on the timeout associated with the communication interface, provide an error signal to the processor core.
16 . The integrated circuit device of claim 11 , further comprising a fault response circuit coupled between the error signal circuit and the communication circuit and configured to determine whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on the error signal circuit.
17 . A method comprising:
determining, by a circuit in a first voltage domain, whether a fault occurred in a voltage supplied to a second voltage domain;
determining, by a processor core, whether to cause a communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on whether the fault occurred; and
in parallel, determining, by a fault response circuit, whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on whether the fault occurred.
18 . The method of claim 17 , wherein the fault includes at least one of a high voltage or low voltage condition associated with the voltage.
19 . The method of claim 17 further comprising:
determining whether a communication error occurred between the first voltage domain and the second voltage domain;
determining, by the processor core, whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on whether the communication error occurred; and
in parallel, determining, by the fault response circuit, whether to cause the communication circuit to inhibit communication between the first voltage domain and the second voltage domain based on whether the communication error occurred.
20 . The method of claim 19 , wherein the communication error includes a communication timeout error.