FR2896934A1 - INTEGRATED COMPONENT COMPRISING POWER MANAGEMENT AND EMERGENCY MANAGEMENT CIRCUITS - Google Patents

Abstract

This component is divided into two separate, inter-segment modules. An operational module (12) includes a processor, sequencing clocks, and associated digital data processing circuits. A control module (14) comprises an emergency management circuit (26) which, in response to a triggering signal (EMCY_RST), resets the operational module and causes a restart of the processor, and then, after restarting, control l execution by the processor of a predetermined emergency task. The control module (14) further comprises a real-time clock (24) and a power management circuit (28) for driving transitions of the operational module between an active mode where the operational module is powered and the processor executes. predefined tasks, and a standby mode where the processor, sequencing clocks and associated circuits are no longer powered, while the control module remains permanently powered.

Description

1

  The invention relates to an integrated component comprising a processor, sequencing clocks and associated data processing circuits. The presence of digital circuits in the electronic components induces a relatively high power consumption: indeed, even when the circuits are in operation eve and do not perform particular tasks or digital processing, the activity of sequencing clocks and various ancillary circuits, which remain operational even in standby, entails a permanent minimum consumption of the component which is not negligible. In many cases, this residual consumption on standby can be a handicap, in particular when the component is part of a dis-positive powered by batteries or a battery. Such a situation arises in particular with certain electronic equipment used on board motor vehicles, which remain under tension even when the ignition is switched off. Mention may be made, by way of non-limiting example, of equipment intended to be coupled to a mobile phone so as to ensure a hands-free operation of this telephone, in particular equipment incorporating wireless coupling technologies such as the Bluetooth technology (registered trademark of Bluetooth SIG, Inc.) to connect the phone to a car adapter no longer by a cable, but by a radio link, wireless. For this application, Parrot SA has in particular designed and marketed ASICs comprising a microcontroller and a digital signal processor (DSP), to which the invention can advantageously be applied. The invention is however in no way limited to car telephony applications, nor even to battery-powered circuits, and can be implemented in a general manner with all the Nuremberg components for which the residual consumption on standby is a handicap. in the application where these components are used. To reduce the standby power of the circuits, a known solution is to stop the sequencing clocks when the component goes to the standby state, so as to avoid the changes of states, energy consumers. However, there is still a

2

  residuals of a number of gates of the various circuits, in particular for the management of interrupts, so that for relatively complex circuits it is difficult to reduce the residual consumption of the component in standby below the specified limits, for example by below 20 pW in the field of automotive electronics. A first object of the invention is to provide a component that can further reduce the residual power consumption in standby, even for complex components incorporating a very large number of doors. According to another aspect of the invention, because of the multiplication and the increasing complexity of the circuits and the various software which they are brought to execute, the circuit designer is confronted with an increasing uncertainty about the exact state of the circuits. different circuits at a given moment. This uncertainty can be really problematic, and even; dangerous, if the component is used to perform priority security functions, such as, for example, discrimination of an abnormal situation and the triggering of an alarm. Given the great diversity of possible states of the various circuits of the component at a given time, it can not be 100% assured that the security function will be triggered by taking control of the tasks in progress, and that this function will be executed reliably until the end, without any risk of blocking or system error. A particular example, of course without limitation, of such a priority function for which it is necessary to avoid any risk of bug, is in the automotive field the automatic triggering of an emergency call in case of accident on detection of a sudden deceleration for example causing the triggering of airbags (air bags) of the vehicle. In this case it is absolutely essential that the emergency call can be produced and transmitted with the greatest certainty; any other function, even if it is running, will be regarded as secondary and must be able to be interrupted or inhibited and, above all, must not run the risk of impeding the triggering of the emergency call. The invention proposes for this purpose an integrated component of the aforementioned typE, that is to say comprising a processor, sequencing clocks, and associated digital data processing circuits.

3

  According to a first aspect of the invention, this component is divided into two distinct, interdependent modules, with on the one hand an operational module comprising the processor, the sequencing clocks and the associated circuits, and on the other hand a control module. The control module includes an emergency management circuit, for generating,; control signals of the operational module in response to the reception of a trigger signal, these control signals being clean, suücessively, to reset the operational module and cause a restart of the processor and, after restarting, control the execution by the processor of a predetermined emergency task. Very advantageously, the operational module is able to operate in at least two modes, with an active mode where the operational module is powered and the processor executes predefined tasks, and a standby mode where the processor, the sequencing clocks and the circuits partners are no longer powered, while the control module remains powered permanently. The control module then further comprises a real-time clock, as well as a power management circuit, capable of controlling the mode transitions of the operational module. The control signals produced by the emergency management circuit are also suitable for placing, beforehand, the operational module in active mode before resetting it. In addition to the active and standby modes, it is also possible to provide a stopped mode in which the operational module remains energized but the processor does not execute a task, the transitions between these three modes being controlled by the management circuit of the processor. power supply of the control module. The triggering signal may be a signal derived from a signal from an external sensor, and / or a signal produced by a real-time clock of the control module when it reaches a preprogrammed wake-up date. The control module may also include discriminator means capable of detecting and analyzing a reset signal generated by the operational module and selectively or non-selectively producing the trigger signal according to the cause of this reset. . The predetermined emergency task performed by the operational module may include producing an activation signal of a telephone call by an external device coupled to the component, and / or the memory.

4

  component status data, and / or location data provided by an external device coupled to the component, and / or voice data collected by a microphone or an external device coupled to the component, and / or parameters collected by one or more external sensors coupled to the component. Preferably, the control signals inhibit the execution of any other task than the emergency task after restarting the process. The operational module and the control module are advantageously integrated on the same monolithic component chip, the ratic of the respective surfaces occupied by the control module and by the operational module on the monolithic component being in particular less than 1:10, of preferably less than 1:20. The operational module and the control module can be coupled by an interfacing circuit associated with a standard bus, in particular an APB type bus, for which the control module is a slave module when the operational module is not connected. in a waking state.

  We will now describe an embodiment of the component of the invention, with reference to the accompanying drawings wherein the same reference numerals designate from one figure to the other identical or functionally similar elements. FIG. 1 is a general view of the component of the invention, in the form of an integrated circuit monolithic chip. FIG. 2 is an illustration of the functional blocks implemented in the control module of the component of the invention. Figure 3 is a diagram of state transitions that can be taken by the component of the invention. Fig. 4 is a diagram illustrating an example of use of the component in an emergency call system for a motor vehicle. In FIG. 1, reference numeral 10 designates generally the component of the invention, which is advantageously embodied in the form of a monolithic chip of the ASIC type incorporating the various circuits which will be described later, distributed between a An operational module 12 and a control module 14. The operational module 12 incorporates a number of circuits known per se with a processor, its registers, interfaces and associated digital signal processing circuits (DSPs), as well as sequencing clocks of these different organs. The control module 14, characteristic of the invention, is interfaced to the operational module 12 in the manner that will be described hereinafter with reference in particular to FIG. 2, and it can control the activation, awakening and the resetting of the operational module 12. It will be seen in particular that the circuits of the operational module 12 can be put to sleep, that is to say de-energized so as to reduce in a very large proportion the overall consumption of the circuit 10 when that -It is in the waking state. The reference 16 designates the boundary between the portion that can be selectively de-energized (ie the whole of the operational module 12 and the interface with the control module 14) and that which remains powered even in standby.

  The component is divided into two zones: (i) surrounded by the boundary 16, a selectively powered "Main Power" zone (operational module 12), and (ii) a "Low Power" zone outside the border 16. (control module 14), permanently powered and able to wake up the rest of the component chip by controlling its recharge; It will also be seen that the control module makes it possible to manage emergency situations specifically and safely. In practice, the control module 14 occupies only a very small area of the component chip 10, typically less than 10%, preferably less than 5% of the surface of the chip. In an exemplary embodiment, it is thus possible to have a chip of 25 mm 2 whose control module 14 occupies only 1 mm 2, this control module being made with a minimum of components, of the order of about 2000 gates, inducing a less than 20 pW when the entire component is in the sleep state.

  FIG. 2 illustrates in more detail the different circuits composing the control module 14. This comprises an interfacing circuit 13 with the operational module (the latter extending to the right of the border 16) with which it communicates by via a bus 20, for example an Advanced Peripheral Bus (APB), which is a generic bus whose performance is well suited to applications in the field of automotive electronics. The interfacing circuit 18 can also send an IT interrupt signal to the operational module in the situations described below, as well as an EMCY_STS signal (Ernergency Status) characterizing the particular cause for which the signal of IT interrupt has been issued, emergency situation or not. The interruption 1 is a non-maskable interruption in the case where it was triggered in an emergency situation, and maskable in the opposite case. The material separation between the permanently powered part (left of the border 16 and that which is likely to be désalirrentée (to the right of the border 16) is provided by a circuit 22 forming b2 back filtering logic commands: if this circuit 22 is active (by application of an ENABLE command), all the logic control signals can cross the barrier, whereas in the opposite case they are forced to the inactive level for the incoming commands, or at the low level. for outgoing orders). The control module 14 also comprises a time clock; real 24, with an oscillator clocked for example at 32768 Hz to easily generate a clock signal at 1 Hz applied to a 32-bit counter.

  This real-time clock is fed permanently, the counter having been initialized normally only once, at the commissioning of the component. The control module 14 also comprises an emergency management circuit 26 and a power management circuit 28.

  The power management circuit 28 can be activated in three different cases: application of an external wake-up signal WKUP, -application of an external emergency signal EMCY, -application of an internal signal RTC_ALM , derived from the real time clock 24 and corresponding to a scheduled wake-up date.

  The detection of one of these three signals will cause the generation of an interrupt IT transmitted to the operational module via the interfacing circuit 18, the cause of waking (that of the three situations above has triggered the generation of interrupt) being indicated by the signal EMCY STS. The interruption IT is not maskable if it was triggered by an emergency signal EMCY type, and maskable in the case where it was triggered by a signal type WKUP or RTC_ALM. In the case of an emergency signal of the EMCY type incident, the power management circuit 28 addresses to the emergency management circuit 26 a trigger signal EMCY RST which will cause the application to the operational module of a signal of PWR restart and RST reset signal. The control module 14 is also bidirectionally coupled to the oscillator 30 (located in the operational module) which controls the clocks of the operational module, so as to be able on the one hand to detect the stop of this oscillator (resulting stop of putting the operational module to sleep) and, on the other hand, to control the alarm of the operational module by starting up this oscillator and therefore the clocks. The two modules of the component are powered by separate respective circuits: (i) a "Main Power" circuit 32, producing VDD and VSS strands for the operational module, and (ii) a "Low Power" circuit 34, producing VDD_LPW and VSS_LPW voltages for the permanent power supply of the control module, with a very low consumption of energy.

  Figure 3 schematically illustrates the different states that can take the operational module, with the transitions between these different states. The initial state is a general reset state G_RST (General Reset) of the entire component, including the "Low Power" part consisting of the control module 14. This state occurs when the first power is turned on. component, when connecting the device in the vehicle, and is normally taken only once, except disconnection of the housing or application of a specific signal RST I_PW general reset. The state RST corresponds to the functional reset of the component, that is to say the reset of the only part "Main Power", that is to say the operational module 12 with its processor, its clocks, its digital circuits, registers, etc., the state of the control module 14 not being affected. This functional reset also triggers a software reboot of the component (BOOT), which places the operational module in an ON state. The ON state is an active mode where the clocks of the operational module are powered, which has the effect of sequencing the processor and allow it to perform a number of predefined operations. The STOP state corresponds to a situation where the processing performed by the processor does not require the full computing power available: it is then advantageous to temporarily suspend the processing at the software level, between two tasks, by stopping the clocks that clock the clock. processor so as to save energy. The operational module 12 thus alternates between two states ON (active processor) and STOP (processor stopped at the software level) by brief sequences of a few milliseconds in each state, according to the computation power actually required for the execution of the processing. This alternation between ON and STOP modes is managed internally to the operational module, in a manner known in itself and independent of the actions of the control module of the invention. The STBY state is a situation where the processor has finished performing the required processing tasks and there is no other task pending. It can then be set, possibly after a predefined delay of a few seconds, in a standby mode STBY, which is a hardware stop mode, where not only the clocks are stopped, but also the power of the various circuits of the operational module is interrupted. In this STBY standby mode, the consumption of the component is only that of the "Low Power" part constituted by the control module 14, which comprises only a very small number of gates (of the order of typically 2000 gates). , with extremely low consumption, which can be less than 20 pW. The alarm clock is managed by the control module according to the three; possible causes, indicated above: - preprogrammed wake-up date (RTC_ALM signal), - alarm controlled by an external wake-up signal (WKUN signal), ù alarm transmitted by an external emergency signal (EMCY signal). In all cases, the first action is to supply Io operational module, then to trigger a functional reset this one (transition to RST). The resetting of the operational module (transition to the F.ST state) can also be forced from the ON or STOP states on receipt of an emergency external signal (EMCY signal) or a specific reset signal. zero (RST). On the other hand, according to a particularly advantageous aspect of the invention, in the case where the reset has been triggered by an emergency signal (which the processor can know according to the state of the indicator EMCY_STS), the restart of the operational module is carried out in a secure or degraded mode, distinct from the normal restart. This secure mode includes the execution of a limited number of features and / or the launch of specific software, in order to reduce the risk of bug and increase the chances of correct execution of the priority actions required by the detection of the signal emergency.

  FIG. 4 gives an example of application of the circuit of the invention in the automotive field, for triggering an emergency call in the event of an accident. The circuit 10 of the invention is incorporated in a device 40 connected to an external accelerometer 42 such as the accelerometer for triggering airbags 44 in the event of an accident. This accelerometer produces an emergency signal EMCY applied to the circuit 10, possibly with a specific coding of the signal to discriminate with certainty the signal from this accelerometer 42 among other data signals or sig nals parasitic. In addition to the bus 46 of the CAN (Controller Area Network) type, which is commonly used in the automotive industry, which interfaces with the other electronic circuits of the vehicle, the circuit 10 e 3t connected to a data storage memory 48 and This circuit 50 makes it possible to manage a wireless link with a mobile phone in accordance with the specificatic ns Bluetooth, which makes it possible to automatically detect the presence of a telephone.

10

  compatible mobile phone in the range of the device and to remotely control all functions (stall, hang-up, dialing, etc.) via a bidirectional wireless link taking full remote control. The mobile phone 52 includes in itself a SIM card-type subscriber identification module 54 inserted in the telephone 52. As a variant or in addition, the communications can also be provided by an incorporated GSM 56 circuit. to the apparatus 40, the associated SIM card may be incorporated in the apparatus 40, as illustrated at 58, or inserted into a dashboard connector, as illustrated at 60. Advantageously, the circuit 10 is further connected to a GPS circuit 62 to know at any time the position of the vehicle. In the event of an accident detected by the accelerometer 42, the circuit 10 performs the functions indicated above, namely: if necessary, waking the operational module if it is in the waking state, by reactivating its power supply - In any case, resetting of the operating module, so as to be certain that the subsequent restart: will be from a known state, regardless of the previous situation and the states of the different registers , circuits, etc. restart in a secure mode, so as to minimize the risk of blocking and bugging, with restricted functionalities, automatic activation of a call by the telephone 52 and / or the integrated GSM module 56, at the destination a specific number of a site centralizing emergency calls. The telephone call may include sending short SMS type digital messages, and / or automatically engaging an audio conversation between the remote site and the vehicle.

  Moreover, at the time of the accident, a certain number of parameters are automatically fixed and stored in the device memory 48, for example: the geographical position of the vehicle given by the GPS module 62, a certain number of parameters of vehicle operation such as speed, alarms, vehicle sensor status, ietc., 5

Claims (12)

  An integrated component (10) comprising a processor, sequencing clocks, and associated data processing circuits; characterized in that it is divided into two distinct, interdependent modules, namely, on the one hand, an operational module (12) comprising the processor, the sequencing clocks and the associated circuits, and on the other hand a control module (14), and in that the control module (14) comprises an emergency management circuit (26), for producing operational module control signals (IT, EMCY STS) in response upon receipt of a trigger signal (EMCY_RST), these control signals otant to: reset the operational module and cause a restart of the processor, then, after restarting, control the execution by IE 'processor' a predetermined emergency task.   The component of claim 1 wherein, in addition: the operational module (12) is adapted to operate in at least two modes, with an active mode (ON) where the operational module is powered and the processor performs predefined tasks , and a sleep mode (STBY) where the processor, the sequencing clocks and the associated circuits are no longer powered, while the control module remains permanently powered, the control module (14) furthermore comprises a real-time clock (24), as well as a power management circuit (28) adapted to control the mode transitions of the operational module, and the control signals produced by the emergency management circuit are also able to place, if necessary, the operational module in active mode before resetting it.   3. The component of claim 2, wherein the operation-nel module (12) is adapted to operate in at least three modes with, in addition to the 13 modes active (ON) and standby (STBY), a stopped mode (STOP ) where the operational module remains powered but where the processor 'executes: no task, the transitions between these three modes being controlled by the power management circuit (28) of the control module (14;).   The component of claim 1, wherein said trigger signal (EMCY RST) is derived from a signal from an external sensor.   The component of claim 1, wherein the control module (14) comprises a real-time clock (24) and wherein said trigger signal (EMCY RST) is a signal generated by this real-time clock when it is reaches a preprogrammed wake-up date.   The component of claim 1, wherein the control module (14) comprises discriminator means for detecting and analyzing a reset signal generated by the operational module and for selectively producing, or not, said trigger signal (EMCY RST) depending on the cause of said reset. 20   The component of claim 1, wherein said predetermined emergency task performed by the operational module comprises producing an activation signal of a telephone call by an ex-dull device (52, 56) coupled to the component (10). 25   The component of claim 1, wherein said predetermined emergency task performed by the operational module comprises storing component status data, and / or location data output from an external device (62) coupled to the component, and / or voice data collected by a microphone or an external device 30 coupled to the component, and / or parameters collected by one or more external sensors coupled to the component.   The component of claim 1, wherein said control signals are also capable of inhibiting the execution of any other task than the emergency task after restarting the processor.   The component of claim 1, wherein the operation module (12) and the control module (14) are integrated on the same monolithic component chip (10).   The component of claim 10, wherein the ratio of the respective areas occupied by the control module (14) and the operational module (12) to the monolithic component (10) is less than 1:10, preferably less than at 1:20. 10   12. The component of claim 1, wherein the operational module (12) and the control module (14) are coupled by an interfacing circuit (18) associated with a standard bus (20), in particular a bu: of the APB type, for which the control module (14) is a slave module when the operational module (12) is not in a standby state (3TBY).