Fail-safe device corresponding apparatus and vehicle

Patent metadata

Field	Value
Publication number	US-9929556-B2
Application number	US-201514753103-A
Country	US
Kind code	B2
Filing date	Jun 29, 2015
Priority date	Sep 30, 2014
Publication date	Mar 27, 2018
Grant date	Mar 27, 2018

Abstract

A fail-safe device may be coupled to a main device for actuating a switch responsive to a failure. The fail-safe device may include a fail-safe circuit, and an isolation trench surrounding the fail-safe circuit and isolating the fail-safe circuit from the main device. The fail-safe device may include an internal power supply connection, an internal reference voltage connection, a self-biased drive block configured to drive the at least one switch, and a receiver configured to receive failure signals from the main device.

First claim

That which is claimed is:

1. A fail-safe device to be coupled to a monitored device for actuating a switch responsive to a failure of the monitored device, the fail-safe device comprising:
a fail-safe circuit; and
an isolation trench located between the fail-safe circuit and the monitored device, wherein the fail-safe circuit comprises:
an internal power supply connection,
an internal reference voltage connection,
a self-biased drive block configured to drive the switch, and
a receiver configured to receive a plurality of encoded failure signals from the monitored device, each received encoded failure signal indicative of a different failure mode, wherein the receiver includes a decoder configured to decode each received encoded failure signal.

2. The fail-safe device of claim 1 , wherein the isolation trench comprises a deep trench isolation configured to provide redundancy for the internal reference voltage connection.

3. The fail-safe device of claim 1 , wherein the decoder comprises a frequency-shift keying (FSK) decoder.

4. The fail-safe device of claim 1 , wherein the decoder comprises a Manchester decoder configured to decode Manchester encoded failure signals.

5. The fail-safe device of claim 1 , wherein the decoder is configured to distinguish slowly varying signals conveying fail-safe state flagging information for the monitored device from encoded signals encoded with an encoding clock frequency, and wherein a received signal at the encoding clock frequency is indicative of a failure of a clock signal and/or a failure of data signals from the monitored device.

6. The fail-safe device of claim 1 , wherein the switch is actuated by switching off the switch.

7. An electronic device comprising:
a monitored device;
a switch;
a fail-safe device comprising
a first transistor having a control terminal coupled to a first supply terminal,
a second transistor having a control terminal coupled to the first supply terminal
a third transistor having a control terminal coupled to a second supply terminal,
a fourth transistor having a control terminal coupled to the second supply terminal,
a fail-safe circuit, and
an isolation trench located between the fail-safe circuit and the monitored device, the fail-safe circuit comprising
an internal power supply connection,
an internal reference voltage connection,
a self-biased drive block configured to drive the switch, and
a receiver configured to receive failure signals from the monitored device; and

a first and second electrical connections coupling the fail-safe device with the monitored device via the first, second, third and fourth transistors, wherein the first transistor is coupled to the third transistor with the first electrical connection that passes through the isolation trench, and the second transistor is coupled to the fourth transistor with the second electrical connection that passes through the isolation trench, and wherein the first electrical connection is configured to carry a first signal flowing through the first and third transistors and the second electrical connection is configured to carry a negated first signal flowing through the second and fourth transistors so that a failure voltage applied to one of the monitored and fail-safe devices is prevented from propagating to the other of the monitored and fail-safe devices.

8. The electronic device of claim 7 , wherein the isolation trench comprises a deep trench isolation (DTI) ring.

9. The electronic device of claim 7 , wherein the isolation trench comprises a depth of about 25 um and a width of about 2.4 um.

10. The electronic device of claim 7 , wherein the monitored device and the fail-safe device are integrated on a single chip.

11. The electronic device of claim 7 , wherein the switch controls functions on board a vehicle.

12. A vehicle comprising:
an operating member controlled by a switch; and
an electronic device configured to actuate the switch responsive to a failure, the electronic device comprising
a monitored device,
a fail-safe device comprising a fail-safe circuit having a self-biased block configured to drive the switch,
an isolation trench
a receiver configured to receive a plurality of failure signals from the monitored device, and
an electrical connection coupling the fail-safe device with the monitored device, the electrical connection passing through the isolation trench, the electrical connection comprising distinct signal and negated signal lines so that a failure voltage applied to one of the monitored and fail-safe devices is prevented from propagating to the other of the monitored and fail-safe devices, wherein the plurality of failure signals comprises a plurality of encoded failure signals, wherein the receiver includes a decoder configured to decode each received encoded failure signal, and wherein each received encoded failure signal indicative of a different failure mode.

13. The vehicle of claim 12 , wherein the decoder comprises a frequency-shift keying (FSK) decoder.

14. The vehicle of claim 12 , wherein the isolation trench configured to isolate the fail-safe circuit from the monitored device, and wherein the fail-safe circuit comprises an internal power supply connection, and an internal reference voltage connection.

15. The vehicle of claim 12 , wherein the isolation trench comprises a filling having an oxide-based material.

16. The vehicle of claim 14 , wherein the isolation trench comprises a deep trench isolation configured to provide redundancy for the internal reference voltage connection.

17. The vehicle of claim 12 , wherein plurality of failure signals comprises a watchdog failure signal, an under-voltage failure signal, or a thermal-shutdown failure signal.

18. The vehicle of claim 12 , wherein the operating member comprises a motorized window having a window-regulator.

19. A method of making a fail-safe device to be coupled to a monitored device for actuating at least one switch responsive to a failure of the monitored device, the method comprising:
providing a fail-safe circuit; and
forming an isolation trench to isolate the fail-safe circuit from the monitored device, the fail-safe circuit comprising an internal power supply connection, an internal reference voltage connection, at least one self-biased drive block configured to drive the at least one switch, and a receiver configured to receive a plurality of failure signals from the monitored device, wherein the plurality of failure signals comprises a plurality of encoded failure signals, wherein the receiver includes a decoder configured to decode each received encoded failure signal, each received encoded failure signal indicative of a different failure mode.

20. The method of claim 19 , wherein the isolation trench comprises a deep trench isolation configured to provide redundancy for the internal reference voltage connection.

21. The method of claim 19 , wherein the decoder comprises a frequency-shift keying (FSK) decoder.

22. A device comprising:
a semiconductor substrate;
a first circuit disposed over the semiconductor substrate;
a second circuit disposed over the semiconductor substrate; and
a protection element located between the first circuit and the second circuit, wherein
the first circuit comprises
a first transistor having a control terminal coupled to a first supply terminal, and
a second transistor having a control terminal coupled to the first supply terminal,

the second circuit comprises
a third

Assignees

• St Microelectronics Srl

Inventors

• Poletto Vanni
• Gaertner Manuel
• Lecce Sergio
• Torrisi Giovanni Luca

Classifications

• H02H7/0852

  directly responsive to abnormal temperature by using a temperature sensor (in a control circuit H02H7/0833) · CPC title

• H02H3/05 Primary

  with means for increasing reliability, e.g. redundancy arrangements {(for logic circuits H03K19/003)} · CPC title

• H02H7/0851

  for motors actuating a movable member between two end positions, e.g. detecting an end position or obstruction by overload signal · CPC title

• H03K19/007

  Fail-safe circuits · CPC title

• H02H7/0844

  Fail safe control, e.g. by comparing control signal and controlled current, isolating motor on commutation error · CPC title