CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority under 35 U.S.C. § 119 of European Patent application no. 20305291.5, filed on 20 Mar. 2020, the contents of which are incorporated by reference herein.

BACKGROUND

Field

This disclosure relates generally to integrated circuits, and more specifically, to managing power for a system-on-a-chip in a manner that prevents a security breach through voltage scaling.

Related Art

Advances in the automotive industry have led to a technological transformation in the number of processors and connectivity present in a modern car. Typical automobiles have both remote connectivity and advanced technology features, such as engine control units and sensor systems providing information to infotainment systems with touch screen, all of which can be kept up-to-date with periodic software updates received over the air.

Today's vehicles not only have in-vehicle networks that allow communication between many of the processors present within the vehicle, but also transceivers that allow for vehicle-to-vehicle, vehicle-to-infrastructure, and vehicle-to-area communication. Such communication enables interaction of vehicles with other vehicles or surrounding infrastructure, including traffic lights, highways, or trains. Communication between a vehicle and the environment surrounding the vehicle is a precursor to autonomous cars, where communication and complex software handles all in-vehicle functionality. Connected and autonomous cars are an important part of the future infrastructure and providing security for the devices and networks that are part of that infrastructure is an important facet.

SUMMARY

Aspects of the disclosure are defined in the accompanying claims.

In a first aspect there is provided a method for providing power to a system-on-a-chip (SoC), the method comprising: providing a first voltage to the SoC; determining whether a requested change in voltage from the SoC is within a predetermined voltage range; applying the requested change in voltage to the SoC when the requested change is within the predetermined voltage range; and informing the SoC that the requested change in voltage is outside the predetermined voltage range when the requested change is outside the predetermined voltage range.

In one or more embodiments, said informing the SoC may comprise providing an interrupt signal to the SoC.

In one or more embodiments, the method may further comprise: incrementing a counter when the requested voltage is outside the predetermined voltage range; determining if the counter is above a pre-set threshold; sending a command to the SoC to enter a protective state when the counter is above the pre-set threshold.

In one or more embodiments, the protective state may be one of a safe state or a deep fail safe state.

In one or more embodiments, the protective state may be determined to be the safe state or the deep fail safe state in light of a pre-set safety reaction configuration variable value.

In one or more embodiments, said determining whether the requested change in voltage from the SoC is within a predetermined voltage range may comprise: storing a positive clamp value representing a highest positive voltage offset from a nominal voltage value; storing a negative clamp value representing a highest negative voltage offset from the nominal voltage value; and comparing the requested change in voltage from the SoC to one of the positive clamp value and the negative clamp value.

In one or more embodiments, said comparing the requested change in voltage to one of the positive clamp value and the negative clamp value may comprise: performing a logical AND on the requested change in voltage to the SoC and the one of the positive clamp value and the negative clamp value; and determining whether a result of the logical AND equals the requested change in voltage.

In one or more embodiments, the requested change in voltage, the positive clamp value, and the negative clamp value may be measured in fixed voltage step increments from the nominal voltage value.

In one or more embodiments, the method may further comprise storing the positive clamp value and the negative clamp value in an one-time programmable memory.

In a second aspect, there is provided a power management integrated circuit (PMIC), coupled to a system-on-a-chip (SoC), the PMIC comprising: a power generation module, coupled to the SoC, and configured to provide a voltage to the SoC; a communication interface, coupled to the SoC, and configured to receive a request to change voltage from the SoC; and a control logic, coupled to the power generation module and the communication interface, and configured to determine whether the requested change in voltage from the SoC is within a predetermined voltage range, instruct the power generation module to apply the requested change in voltage to the SoC when the requested change is within the predetermined voltage range, and inform the SoC that the requested change in voltage is outside the predetermined voltage range when the requested change is outside the predetermined voltage range.

In one or more embodiments, the PMIC may further comprise an interrupt signal output port, coupled to the control logic and an interrupt signal input port of the SoC, and configured to transmit an interrupt signal to the SoC from the PMIC, wherein said informing the SoC that the requested change in voltage is outside the predetermined voltage range comprises transmitting the interrupt signal to the SoC.

In one or more embodiments, the control logic may further comprise a counter register, wherein the control logic is further configured to increment the counter register when the requested voltage is outside the predetermined voltage range, determine if the counter register is above a pre-set threshold, and send a command to the SoC to enter a protective state when the counter register is above the pre-set threshold.

In one or more embodiments, the PMIC may further comprise a reset signal output port, coupled to the control logic and a corresponding reset signal input port of the SoC, and configured to transmit a reset signal to the SoC from the PMIC, wherein said sending the command to enter the protective state comprises transmitting the reset signal to the SoC.

In one or more embodiments, the PMIC may further comprise a one-time programmable memory, coupled to the control logic, and storing a configuration variable setting the protective state, wherein the protective state is one of a safe state or a deep fail safe state.

In one or more embodiments, the PMIC may further comprise a one-time programmable memory, coupled to the control logic, and storing a plurality of configuration variables, wherein the plurality of configuration variables comprises a positive clamp value representing a highest positive voltage offset from a nominal voltage value, and a negative clamp value representing a highest negative voltage offset from the nominal voltage value.

In one or more embodiments, the control logic performing said determining whether the requested change in voltage from the SoC is within a predetermined range may comprise the control logic being configured to compare the requested change in voltage from the SoC to one of the positive clamp value and the negative clamp value.

In one or more embodiments, the control logic performing said comparing the requested change in voltage from the SoC to one of the positive clamp value and the negative clamp value may comprise the control logic being configured to perform a logical AND on the requested change in voltage to the SoC and the one of the positive clamp value and the negative clamp value, and to determine whether a result of the logical AND equals the requested change in voltage.

In one or more embodiments, the requested change in voltage, the positive clamp value, and the negative clamp value may be measured in fixed voltage step increments from the nominal voltage value.

In a third aspect, there is provided a vehicle comprising: a plurality of network nodes, wherein one of the network nodes comprises a system-on-a-chip (SoC), e.g. a microcontroller unit (MCU); a network communicatively coupling the plurality of network nodes; and a power management integrated circuit (PMIC) coupled to the SoC. e.g. the microcontroller unit. The PMIC comprises a power generation module, coupled to the SoC/MCU, and configured to provide a voltage to the SoC/MCU, a communication interface, coupled to the SoC/MCU, and configured to receive a request to change voltage from the SoC/MCU, and a control logic, coupled to the power generation module and the communication interface, and configured to determine whether the requested change in voltage from the SoC/MCU is within a predetermined voltage range, to instruct the power generation module to apply the requested change in voltage to the SoC/MCU when the requested change is within the predetermined voltage range, and to inform the SoC/MCU that the requested change in voltage is outside the predetermined voltage range when the requested change is outside the predetermined voltage range.

In one or more embodiments, the PMIC control logic may further comprise: a counter register, wherein the control logic is further configured to increment the counter if the requested voltage is outside the predetermined voltage range; to determine if the counter is above a pre-set threshold; and to send a command to the MCU to enter a protective state when the counter is above the pre-set threshold.

