Power Management — Power Gating and Domain Isolation
Overview
Power gating and domain isolation ensure that subsystems can be independently powered, shut down, or isolated without compromising system integrity. In safety‑critical designs, these mechanisms prevent unintended signal propagation, leakage, or unsafe actuator behavior when parts of the system are powered down. Proper domain control is essential for low‑power operation, fault containment, and deterministic safe‑state transitions.
This page describes the safety‑relevant aspects of power gating switches, isolation cells, retention strategies, and domain‑level supervision.
Power Gating Fundamentals
Power gating disconnects a power domain from its supply using dedicated switches.
Why Power Gating Matters
- Reduces power consumption during standby or low‑power modes.
- Allows independent control of subsystems.
- Supports fault containment by shutting down faulty domains.
- Enables safe‑state transitions through controlled power removal.
Types of Power Gating Switches
- Header switches (PMOS): disconnect the supply rail.
- Footer switches (NMOS): disconnect ground return.
- Distributed switches: multiple smaller switches for fine‑grained control.
Safety considerations include switch reliability, stuck‑on/stuck‑off faults, and transient behavior.
Domain Isolation
Isolation cells prevent signals from powered‑down domains from propagating invalid or floating values.
Isolation Cell Behavior
- Clamp outputs to a defined logic level.
- Prevent back‑driving into active domains.
- Avoid leakage paths that could corrupt logic.
Safety Requirements
- Isolation must activate before power is removed.
- Isolation must remain active until the domain is fully powered.
- Clamp values must be consistent with system‑level safe states.
- Isolation control signals must be glitch‑free and supervised.
Retention Strategies
Some domains require state retention during power gating.
Retention Cells
- Store critical configuration or context.
- Operate from a small always‑on supply.
Safety Considerations
- Retention failure may lead to incorrect initialization.
- Retention must be validated at startup.
- Redundant retention may be required for ASIL‑D systems.
Safety Risks in Power Gating and Isolation
- Stuck‑on power switches: domain remains powered when it should be off.
- Stuck‑off power switches: domain cannot power up.
- Incorrect isolation timing: unsafe signal propagation.
- Leakage paths: unintended current flow or logic corruption.
- Back‑driving: powered domains driving unpowered logic.
- Retention corruption: invalid state after wake‑up.
- Glitchy control signals: unpredictable transitions.
These risks must be mitigated through supervision, redundancy, and deterministic sequencing.
Monitoring and Protection Mechanisms
Power Switch Monitoring
- Detect stuck‑on/stuck‑off conditions.
- Validate switch gate control.
- Monitor current flow for anomalies.
Isolation Monitoring
- Ensure isolation cells are active during power transitions.
- Cross‑check clamp values.
Domain Voltage Monitoring
- Verify that each domain reaches valid voltage levels.
- Detect partial or unstable power‑up.
Fault Reaction
- Trigger safe‑state transitions.
- Notify MCU or FCCU.
- Initiate controlled shutdown.
Interaction with MCU and PMIC
- MCU controls domain enable/disable sequences.
- PMIC supervises rail health and sequencing.
- FCCU integrates domain faults into system‑level reactions.
- External watchdogs may supervise domain transitions.
Power gating must be coordinated with reset, clocking, and safe‑state logic.
Design Considerations
- Use short, low‑impedance routing for power switch control.
- Ensure isolation control signals are synchronized.
- Validate wake‑up and shutdown timing across temperature and load.
- Provide redundant isolation for high‑integrity domains.
- Avoid coupling between switching domains and sensitive analog circuits.
