Board‑Level Fault Signaling
Overview
Board‑level fault signaling defines how devices on the same PCB communicate fault conditions to each other.
These signals ensure that critical components such as PMICs, MCUs, external watchdogs, sensors, and safety monitors can coordinate safe‑state transitions.
Because faults may originate from power, clocking, thermal conditions, or internal logic, reliable inter‑device signaling is essential to guarantee deterministic and timely reactions across the entire system.
Board‑Level Fault Signaling in a Safety Architecture
Board‑level fault lines propagate safety‑critical information between devices. The MCU (via FCCU) interprets these signals and coordinates system‑wide safe‑state transitions.
Role in a Safety Architecture
Board‑level fault signaling provides:
- cross‑device visibility — faults detected by one component are propagated to others
- coordinated safe‑state transitions — actuators, power rails, and logic blocks enter a safe state together
- redundancy and diversity — multiple independent devices supervise each other
- fail‑safe behavior — a single device failure cannot compromise system safety
- deterministic timing — fault propagation must meet strict latency requirements
Board‑level signaling is the glue that binds the safety architecture across devices.
Typical Fault Signaling Paths
PMIC → MCU
- undervoltage
- overvoltage
- thermal shutdown
- watchdog expiration
- power‑good failure
MCU → PMIC
- request for safe shutdown
- controlled power‑down
- emergency reset
External Watchdog → MCU
- timeout events indicating software failure
MCU → External Watchdog
- periodic heartbeat or trigger pulses
Sensor → MCU
- diagnostic flags
- plausibility errors
- over‑range conditions
MCU → Actuators
- safe‑state outputs (disable, brake, open‑circuit)
Co‑processors / Accelerators → MCU
- internal error flags
- ECC failures
- illegal states
These paths ensure that faults are visible and actionable across the entire board.
Signal Types and Encoding
Board‑level fault signals may use:
Digital fault lines
- active‑high
- active‑low
- open‑drain
Analog monitoring lines
- voltage levels indicating health or degradation
Differential signaling
- for noise‑immune propagation in harsh environments
Pulse‑based signaling
- watchdog triggers
- heartbeat pulses
Redundant lines
- dual or triple lines for high‑integrity systems
Signal polarity, timing, and electrical characteristics must be defined and verified.
Fault Propagation and Timing
Safety standards require deterministic fault reaction times.
Board‑level signaling must ensure:
- low‑latency propagation — faults must reach the MCU or PMIC within defined time windows
- glitch filtering — avoid false positives due to noise or transients
- debounce and validation — confirm signal stability before acting
- synchronous reactions — coordinate power‑down, reset, or safe‑state activation
Timing analysis is essential to guarantee end‑to‑end safety integrity.
Interaction with the FCCU
The FCCU integrates board‑level fault signals into the system’s safety logic:
- external fault lines are mapped to FCCU inputs
- FCCU classifies external faults as critical or non‑critical
- FCCU triggers resets, interrupts, or safe‑state outputs
- FCCU ensures external faults cannot be ignored or masked by software
- FCCU logs external fault events for diagnostics and post‑mortem analysis
This ensures that board‑level faults are treated with the same rigor as internal faults.
Design and Layout Considerations
Board‑level fault signaling must be robust against noise, interference, and physical degradation:
- short routing paths — minimize delay and noise susceptibility
- shielding and ground reference — protect sensitive lines
- pull‑ups / pull‑downs — ensure defined behavior during faults or disconnection
- redundant traces — for high‑integrity systems
- EMC‑aware design — avoid coupling with high‑current or high‑frequency lines
- connector integrity — ensure reliable signaling across modules or harnesses
Physical design is as important as logical design in safety‑critical systems.
Relationship with Security
Although primarily a Safety topic, board‑level fault signaling intersects with Security:
- fault lines can be spoofed to trigger false safe‑state transitions
- attackers may attempt to mask real faults by manipulating signals
- PMIC or watchdog interfaces must be protected from unauthorized access
- secure boot ensures software cannot disable or reconfigure fault inputs
Safety and security must be co‑designed to avoid conflicting behaviors.
