ASIL-D Chiplet SoC for ADAS — PatSnap Eureka
How to Design an ASIL-D Compliant Chiplet SoC for ADAS
Safety island architecture, dual-die redundancy, dynamically reconfigurable BIST, and PMIC cross-monitoring — the complete patent-backed blueprint for meeting ISO 26262's most demanding functional safety tier in automotive SoC design.
Safety Island (SAIL) Architecture for ASIL-D SoC Design
The safety island (SAIL) architecture is the central organizing principle for ASIL-D chiplet SoC design in ADAS. As described in Qualcomm's 2025 patent, the processor-based system partitions the SoC into a main domain (MD) and a safety island domain (SD). The main domain handles the full ADAS compute pipeline — perception, sensor fusion, path planning — while the safety island contains a leaner hardware configuration that checkpoints vehicle information processed by both domains and monitors errors originating in either domain.
Upon detection of a safety-critical fault in the main domain, ASIL-D requires the SoC to transition the vehicle to a minimum risk condition — for example, a controlled safe stop. The safety island must operate independently enough to enforce this transition even if the main domain has fully crashed. This separation also enables ASIL decomposition: the main domain may carry ASIL-B or ASIL-C rated processing while the safety island achieves the residual ASIL-D requirement.
Fault propagation from the main SoC region to the isolated safety island must be managed carefully. NVIDIA's 2023 patent discloses a mechanism where the first SoC section starts a timer upon sending an error signal to the second section. If the fault data is not cleared within a prescribed interval, a timeout error is transmitted — preventing fault queue saturation from silently blocking safety responses. This is a subtle but critical compliance requirement for ASIL-D diagnostics. Learn more about IP analytics for automotive semiconductor R&D on the PatSnap platform.
Domain isolation must also be enforced at the hardware level — through memory protection units, bus firewalls, and separate clock trees — to prevent a fault in the main ADAS compute domain from corrupting the safety island's ability to respond. ISO 26262 mandates this independence as a prerequisite for ASIL decomposition claims.
Die-to-Die Redundancy and Multi-SoC Fault Management
Chiplet-based multi-die architectures provide fail-operational behavior — not merely fail-safe — through physical redundancy across independent clock and power domains.
Dual-Die ASIL Domain Circuit with D2D Interface
Each chiplet die hosts an independent instance of the ASIL domain circuit, independently processing automotive sensor signals from cameras, radar, lidar, and HD map inputs. A fault monitoring system continuously monitors the first chiplet die; when a fault is detected, a selector circuit automatically outputs the second chiplet die's signal to the vehicle motion control system. The first and second dies operate in independent clock and power domains — a requirement that cannot be met in a single-domain monolithic design.
Fail-operational, not merely fail-safePrimary/Secondary SoC with UCIe Interconnect
A primary SoC posts task state information to a shared memory accessible by a secondary SoC. The secondary SoC keeps a subset of its computational components in a low-power state during normal operation. When the secondary SoC detects a trigger condition indicating a primary failure, it instantly powers up the dormant compute subset and takes over the task set. This patent explicitly references Universal Chiplet Interconnect Express (UCIe) as the interconnect standard, and the state-transfer mechanism must operate within the fault-tolerant time interval (FTTI) imposed by ISO 26262.
UCIe-referenced chiplet interconnectPer-Runnable Safety Rating and Graceful Degradation
A central chiplet contains a sensor data input chiplet, a set of workload processing chiplets, and a shared memory with a scheduling program. Each runnable in the software structure — and each connection between runnables — carries an associated safety rating. Limited execution can be enforced at a granular per-runnable level based on the runtime ASIL context, enabling the system to degrade gracefully from full ADAS functionality to a safety-limited minimal risk mode without a full system reset.
Granular per-runnable ASIL enforcementDomain Isolation via Dedicated Communication Interface
Upon detecting an error in a first domain, the second domain is isolated and continues operating. The second domain then transmits notifications to an external controller via a dedicated first communication interface, bypassing the compromised first domain entirely. If domain isolation is not enforced at the hardware level through memory protection units, bus firewalls, and separate clock trees, a fault in the main ADAS compute domain can corrupt the safety island's ability to respond. See how PatSnap supports safety-critical IP strategies across regulated industries.
Hardware-enforced domain bypassASIL-D Chiplet SoC: Key Metrics and Patent Landscape
Quantitative thresholds, architectural distribution, and assignee activity derived from 60+ patent filings analyzed via PatSnap Eureka.
ASIL-D Fault Coverage Requirements vs. Lower ASIL Tiers
Single-point and latent fault coverage thresholds escalate sharply at ASIL-D, driving the safety island architecture requirement.
ASIL-D Chiplet SoC Patent Activity by Assignee
Qualcomm leads with the broadest multi-jurisdictional portfolio; NVIDIA, Mercedes-Benz, and Chinese SoC firms round out the landscape.
Dynamically Reconfigurable BIST: Test Phase Distribution
ASIL-D diagnostic coverage requires BIST across all three phases — PON, POFF, and runtime — with maximum parallelism to avoid ADAS latency violations.
PMIC Cross-Monitoring Architecture: Eliminating Power Chain SPFs
Mutual cross-monitoring between MD PMIC and SD PMIC eliminates single points of failure in the power monitoring chain without external circuits.
BIST Strategy, Power Monitoring, and Runtime Safety Verification
Achieving ASIL-D diagnostic coverage demands fault detection across power-on, power-off, and runtime phases — with independent power rails and triple-path error notification.
| Safety Mechanism | Coverage Phase | ASIL Target | Key Patent | Key Requirement |
|---|---|---|---|---|
| Dynamically Reconfigurable BIST | PON + POFF + Runtime | ASIL-D | Qualcomm JP/KR 2023–2024 | Maximum parallelism; per-subsystem coverage level; must not violate ADAS latency budgets |
| PMIC Cross-Monitoring (MD ↔ SD) | Runtime (continuous) | ASIL-D | Qualcomm CN 2025 | No external monitoring circuits; mutual rail monitoring eliminates power chain SPF |
| Triple-Path Error Notification | Runtime (fault event) | ASIL-D | Qualcomm SoC Safety Monitoring 2025 | CAN bus + Ethernet bus + PMIC path — three independent channels to downstream ECU |
| Fault Propagation Timeout Timer | Runtime (fault event) | ASIL-D | NVIDIA CN 2023 | Timer started on error signal; timeout triggers external system notification if not cleared |
| Mixed Safety System Opportunistic BIST | State-transition | ASIL-D | Qualcomm CN 2025 | Tests executed when ECU transitions to non-primary state; accumulates latent fault coverage over time |
| Hypervisor ASIL Partition Protection | Runtime (continuous) | ASIL-D | VALEO 2024 | Hardware-enforced memory access restriction isolates Linux/QM OS from ASIL application partition |
Need to benchmark your ASIL-D safety architecture against active patents?
PatSnap Eureka's AI maps claim scope across 60+ ASIL-D chiplet SoC filings in seconds.
ASIL Decomposition, Lockstep Monitoring, and Software Partitioning
ASIL-D compliance extends beyond hardware to software execution environments, lockstep CPU architecture, and system-level ASIL level determination via HARA methodology.
ASIL-B SoC + ASIL-D MCU Decomposition
An ASIL-B SoC handles perception, and an ASIL-D MCU applies safety mechanisms to the SoC's obstacle recognition output, together satisfying overall ASIL-D requirements for emergency steering functions — without adding a new ECU, reducing BOM cost. This approach is validated in production-oriented patents from Chongqing Changan Automobile (2025) and Magneti Marelli (2015). The supervisory MCU adjacent to the ADAS SoC in a chiplet system must also be independently ASIL-D qualified, as confirmed by Infineon's safety state trigger patent (2025).
Hypervisor-Based ASIL Partition Protection
VALEO's 2024 ECU architecture employs a hypervisor to partition memory resources into an OS partition (running Linux and QM applications) and a separate ASIL partition. The ASIL partition is protected from access by the OS partition, and an inter-partition communication manager handles cross-partition messaging. This enables integration of non-safety-critical compute on the same hardware platform as ASIL-D ADAS functions without compromising the ASIL partition's integrity — a key goal of merged ADAS/IVI SoC designs. See PatSnap's approach to safety-critical IP analysis across regulated domains.
Key Players in ASIL-D Chiplet SoC for ADAS
Four primary clusters of innovation dominate the 60+ patent dataset, spanning chip companies and Tier-1 automotive suppliers.
Qualcomm
The most prolific single assignee in this domain, with active patents covering safety island architecture, PMIC cross-monitoring, dynamically reconfigurable BIST, SoC error propagation via dual bus and PMIC paths, domain isolation, and hybrid safety system testing. Patents span US, JP, KR, and CN jurisdictions. Qualcomm's portfolio collectively defines a comprehensive ASIL-D SoC IP position. Explore PatSnap Analytics to map Qualcomm's full automotive safety IP landscape.
Safety island · BIST · PMIC · Domain isolationNVIDIA Corporation
Contributes critical architectural patents on fault propagation to isolated safety regions and end-to-end ASIL-D autonomous driving platform design. NVIDIA's fault-propagation protocol — including the timeout timer mechanism for fault queue saturation prevention — is a foundational reference for safety island designs. NVIDIA's autonomous vehicle platform patents are tracked by NHTSA as part of AV safety framework analysis.
Fault propagation protocol · Timeout timerMercedes-Benz Group AG
Drives innovation in multi-SoC and chiplet-level redundancy, with UCIe-referenced interconnect architectures for vehicle computing. The primary/secondary SoC state-transfer patent and the per-runnable safety rating scheduling patent represent a systems integration approach to ASIL-D compliance. Mercedes-Benz's approach aligns with UNECE WP.29 cybersecurity and software update regulations for automated driving systems.
UCIe interconnect · Per-runnable ASIL · State transferBeijing Huixi + Tier-1 Suppliers
Beijing Huixi Intelligent Technology (北京辉羲智能科技) provides the most detailed published specification of ASIL-D quantitative fault coverage targets for a domestic chiplet SoC design. Tier-1 suppliers including VALEO, VEONEER, TTTech Automotive, and Infineon round out the landscape with ECU-level software partitioning, lockstep monitoring, and safety state trigger patents that complement SoC-level architecture patents. Explore how automotive OEMs use PatSnap for competitive IP intelligence.
ASIL-D quantitative spec · ECU-level safetyASIL-D Chiplet SoC for ADAS — key questions answered
ASIL-D mandates single-point fault coverage ≥99%, latent fault coverage ≥90%, and a hardware random failure rate of <10⁻⁸/hour. These quantitative thresholds directly determine that the SoC must incorporate a dedicated fault management module within a safety island, along with individual fault collection modules embedded in every major functional block.
The safety island (also termed SAIL) architecture partitions the SoC into a main domain (MD) and a safety island domain (SD). The main domain handles the full ADAS compute pipeline — perception, sensor fusion, path planning — while the safety island contains a leaner hardware configuration that checkpoints vehicle information processed by both domains and monitors errors originating in either domain. Upon detection of a safety-critical fault in the main domain, ASIL-D requires the SoC to transition the vehicle to a minimum risk condition.
Each chiplet die hosts an independent instance of the ASIL domain circuit, which independently processes automotive sensor output signals — from cameras, radar, lidar, and HD map inputs — and generates separate output signals. A fault monitoring system continuously monitors the first chiplet die; when a fault is detected, a selector circuit automatically outputs the second chiplet die's signal to the vehicle motion control system. The first and second chiplet dies additionally operate in independent clock and power domains, so a clock or voltage fault in one die does not propagate to the other.
At least one main domain PMIC regulates power to the MD, and at least one safety domain PMIC regulates power to the SD. Each PMIC monitors the other's power rail — the MD PMIC monitors the SD PMIC power rail, and the SD PMIC monitors the MD PMIC power rail — entirely without requiring external monitoring circuits. This mutual cross-monitoring eliminates single points of failure in the power monitoring chain itself.
ASIL decomposition allows the main domain to carry ASIL-B or ASIL-C rated processing while the safety island achieves the residual ASIL-D requirement. An ASIL-B SoC handles perception, and an ASIL-D MCU applies safety mechanisms to the SoC's obstacle recognition output, together satisfying overall ASIL-D requirements for emergency steering functions — without adding a new ECU, reducing BOM cost.
Components dynamically identify which subsystems require BIST, determine the required test phases (PON, POFF, runtime, or combinations), dynamically calculate achievable test parallelism, and set coverage level requirements per identified subsystem. Executing BISTs at the maximum achievable parallelism is critical for minimizing runtime overhead — running all BISTs sequentially would violate ADAS latency budgets.
Still have questions about ASIL-D chiplet SoC design? Let PatSnap Eureka answer them with patent-backed intelligence.
Ask PatSnap Eureka Your ASIL-D QuestionDesign ASIL-D Compliant Chiplet SoCs Faster with Patent Intelligence
Join 18,000+ innovators already using PatSnap Eureka to accelerate their R&D — from safety island architecture to BIST strategy and PMIC design.
References
- 一种满足ISO26262标准最高汽车安全完整性等级的片上系统芯片 — 北京辉羲智能科技有限公司, 2024
- 采用安全岛架构以用于失效安全操作的基于处理器的系统 — 高通股份有限公司 (Qualcomm), 2025
- 汽车故障检测系统和方法 — 高通股份有限公司 (Qualcomm), 2025
- 无外部监测电路的电源管理集成电路(PMIC)电源监测 — 高通股份有限公司 (Qualcomm), 2025
- 片上系统的安全监测 — 高通股份有限公司 (Qualcomm), 2025
- Dynamically Reconfigurable In-Field Self-Test Capability for Automotive Systems — Qualcomm, 2024 (JP)
- Dynamically reconfigurable in-field self-test capability for automotive systems — Qualcomm, 2023 (KR)
- Dynamically re-configurable in-field self-test capability for automotive systems — Qualcomm, 2023 (KR)
- Domain Isolation in Automotive Automated Driving Systems — Qualcomm, 2026 (KR)
- 测试混合安全系统 — 高通股份有限公司 (Qualcomm), 2025
- 将故障传送至片上系统的隔离安全区 — 辉达公司 (NVIDIA), 2023
- Systems and methods for safe and reliable autonomous vehicles — NVIDIA Corporation, 2023 (US)
- Multiple system-on-chip arrangement for vehicle computing systems — Mercedes-Benz Group AG, 2024 (US)
- Adaptation of runnable performance level based on safety rating — Mercedes-Benz Group AG, 2026 (KR)
- ASIL-B compatible automotive safety function via high-diagnostic QM-compatible IC — Magneti Marelli, 2015
- 辅助驾驶方法、装置、控制器和车辆 — 重庆长安汽车股份有限公司 (Chongqing Changan Automobile), 2025
- 安全状态触发器 — Infineon Technologies AG, 2025
- 自动驾驶车辆的ASIL等级信息确定方法、装置及电子设备 — Apollo Intelligent Technology, 2025
- Vehicle Safety Electronic Control System — VEONEER, 2019
- 高级驾驶员辅助系统的安全监测器 — TTTech Automotive, 2024
- ISO 26262: Road vehicles — Functional safety — International Organization for Standardization
- NHTSA: Automated Vehicles for Safety — National Highway Traffic Safety Administration
- UNECE WP.29: Automated/Autonomous and Connected Vehicles — United Nations Economic Commission for Europe
- Infineon Technologies AG — Automotive Safety ICs and ASIL-D Solutions
All data and statistics on this page are sourced from the references above and from PatSnap's proprietary innovation intelligence platform.
PatSnap Eureka searches patents and research to answer instantly.