Asynchronous input signal function safety design method and device, and chip
By inputting the asynchronous input signal into two identical synchronization modules and detecting the periodic difference of their output signals, the problem that the existing technology cannot monitor the asynchronous input signal is solved, and the safety monitoring and functional safety guarantee of the asynchronous circuit are realized.
Patent Information
- Application Number
- CN202411806573.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-10
- Publication Date
- 2025-03-18
AI Technical Summary
The existing lock step redundant design cannot effectively monitor asynchronous input signals, because even two identical modules cannot guarantee the same status in each clock cycle, and thus cannot achieve safety monitoring through result comparison.
By inputting the asynchronous input signal to two identical synchronization modules at the same time and inputting their output signals into the detection module, the detection module detects the difference in the output signals of the two modules in cycles. If there is inconsistency between two or more cycles, an error flag alarm signal is generated.
It realizes the safety monitoring of key signals in asynchronous circuits, and provides functional safety guarantees for asynchronous input signals through the redundant design and use of detection modules.
Smart Images
Figure CN119645901A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of chip technology, and in particular to a method and device for designing functional safety of asynchronous input signals, and a chip. Background Art
[0003] With the development and progress of integrated circuit technology, the application of embedded central processing unit (CPU) in the field of industrial control has become more and more extensive. In this field, the safety and reliability of CPU are important indicators. Among the many design methods to improve the safety and reliability of CPU, Lock-Step is a common redundant design method to achieve high diagnostic coverage. Figure 1 is a schematic diagram of the existing lock-step principle. Figure 1 As shown in the figure, the lock-step principle is that two identical functional modules obtain the same stimulus (input) from the same upstream module and work in the same clock cycle. The results are compared in each clock cycle, including the module's response (output) and key internal signals. If the results are the same, it means that the operation is normal; if the results are different, it means that the operation is abnormal, and certain safety measures are taken.
[0004] The above lock-step is simple to implement, but it also has certain limitations. It cannot be used for asynchronous input signals because even if there are two completely identical modules, as long as they contain asynchronous input signals, there is no guarantee that their states are the same in each clock cycle, and it is impossible to achieve safe monitoring of the modules by comparing the results. Summary of the invention
[0006] In view of some or all of the problems in the prior art, the present invention provides a method for designing functional safety of asynchronous input signals, the method comprising: inputting the asynchronous input signal into a first synchronization module and a second synchronization module simultaneously, wherein the first synchronization module is the same as the second synchronization module; and The output signal of the first synchronization module and the output signal of the second synchronization module are simultaneously input into a detection module, and the detection module detects the difference in period between the output signal of the first synchronization module and the output signal of the second synchronization module.
[0007] Furthermore, if the detection module detects that the output signal of the first synchronization module and the output signal of the second synchronization module are inconsistent for two or more cycles, an error flag alarm signal is generated.
[0008] Furthermore, the detection module includes a flag register, and the flag register is used to mark the state of a single event occurring in the first synchronization module and the second synchronization module.
[0009] Further, if only one of the first synchronization module and the second synchronization module has a single event, the flag register is set to 1; If the same single event occurs in both the first synchronization module and the second synchronization module, the flag register is set to 0.
[0010] Furthermore, one of the output signal of the first synchronization module and the output signal of the second synchronization module is used to set a flag register, and the other is used to clear the flag register.
[0011] Furthermore, the single event status is checked as follows: The flag register flag is 1, indicating that a single event occurs in the second synchronization module; when a single event occurs in the first synchronization module, the flag register flag is checked to be 1, otherwise an error flag alarm signal is generated; The flag register flag is 0, indicating that no single event occurs in the second synchronization module, or the state of the flag register flag being 1 is cleared by a single event occurring in the first synchronization module, that is, a single event occurs in the first synchronization module and the second synchronization module in pairs; after 4 clock cycles of a single event occurring in the second synchronization module, the flag register flag is checked to be 0, otherwise an error flag alarm signal is generated.
[0012] The present invention also provides a device for the asynchronous input signal functional safety design method, the device comprising: A first synchronization module is configured to synchronize the input asynchronous input signal and output the signal to the detection module; A second synchronization module is configured to synchronize the input asynchronous input signal and output a signal to the detection module; and The detection module is configured to detect a difference in period between an output signal of the first synchronization module and an output signal of the second synchronization module.
[0013] Furthermore, if the detection module detects that the output signal of the first synchronization module and the output signal of the second synchronization module are inconsistent for two or more cycles, an error flag alarm signal is generated.
[0014] The present invention also provides a chip, wherein the chip comprises the asynchronous input signal functional safety device.
[0015] The present invention also provides a computer-readable storage medium on which machine-readable instructions are stored. When the machine-readable instructions are executed by a processor, the steps of the asynchronous input signal functional safety design method are executed.
[0016] The beneficial effects of the technical solution provided by the present invention are as follows: the asynchronous input signal functional safety design method provided by the present invention realizes a simple safety mechanism for asynchronous circuits through the redundant design of two synchronization modules; the output signals of the two synchronization modules are detected by the detection module, and the marking events are used instead of the comparison results, thereby realizing the safety monitoring of key signals in the asynchronous circuit. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] To further illustrate the above and other advantages and features of various embodiments of the present invention, a more specific description of various embodiments of the present invention will be presented with reference to the accompanying drawings. It will be understood that these drawings only depict typical embodiments of the present invention and are therefore not to be considered as limiting the scope thereof. In the accompanying drawings, for clarity, identical or corresponding parts will be represented by identical or similar reference numerals.
[0019] Figure 1 It is a schematic diagram of the existing lock-step principle; Figure 2 A schematic flow chart of a method for designing functional safety of asynchronous input signals according to an embodiment of the present invention; Figure 3 A block diagram of a functional safety design of an asynchronous input signal according to an embodiment of the present invention; Figure 4 A schematic diagram of a synchronization circuit according to an embodiment of the present invention; Figure 5 A schematic diagram of output waveforms of two synchronization circuits according to an embodiment of the present invention; Figure 6 A schematic diagram of an event marker waveform according to an embodiment of the present invention; Figure 7 A schematic diagram of an error mark waveform according to an embodiment of the present invention; Figure 8 A schematic diagram of an error mark waveform according to another embodiment of the present invention; and Fig. 9 Schematic diagram of an asynchronous input signal functional safety device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0021] In the following description, the present invention is described with reference to various embodiments. However, those skilled in the art will recognize that various embodiments may be implemented without one or more specific details or with other replacement and / or additional methods or components. In other cases, well-known structures or operations are not shown or described in detail to avoid obscuring the inventive point of the present invention. Similarly, for the purpose of explanation, specific numbers and configurations are set forth to provide a comprehensive understanding of embodiments of the present invention. However, the present invention is not limited to these specific details.
[0022] In this specification, reference to "one embodiment" or "the embodiment" means that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present invention. The phrase "in one embodiment" appearing in various places in this specification does not necessarily all refer to the same embodiment.
[0023] It should be noted that the embodiments of the present invention describe the method steps in a specific order, but this is only for the purpose of illustrating the specific embodiment, rather than limiting the order of the steps. On the contrary, in different embodiments of the present invention, the order of the steps can be adjusted according to actual needs.
[0024] In the present invention, each module of the system according to the present invention can be implemented using software, hardware, firmware or a combination thereof. When the module is implemented using software, the function of the module can be implemented through a computer program flow, for example, the module can be implemented by a code segment (such as a code segment of a language such as C, C++, etc.) stored in a storage device (such as a hard disk, memory, etc.), wherein when the code segment is executed by a processor, the corresponding function of the module can be implemented. When the module is implemented using hardware, the function of the module can be implemented by setting a corresponding hardware structure, for example, the function of the module can be implemented by hardware programming a programmable device such as a field programmable gate array (FPGA), or by designing an application-specific integrated circuit (ASIC) including electronic devices such as multiple transistors, resistors and capacitors to implement the function of the module. When the module is implemented using firmware, the function of the module can be written into a read-only memory such as an EPROM or EEPROM of the device in the form of a program code, and when the program code is executed by a processor, the corresponding function of the module can be implemented. In addition, some functions of the module may need to be implemented by separate hardware or by collaboration with the hardware, for example, the detection function is implemented by corresponding sensors (such as proximity sensors, acceleration sensors, gyroscopes, etc.), the signal transmission function is implemented by corresponding communication devices (such as Bluetooth devices, infrared communication devices, baseband communication devices, Wi-Fi communication devices, etc.), the output function is implemented by corresponding output devices (such as displays, speakers, etc.), and so on.
[0025] The technical solutions in the embodiments of the present invention are described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.
[0026] Figure 2 The figure is a flow chart of a method for designing functional safety of asynchronous input signals according to an embodiment of the present invention. Figure 3 This is a structural block diagram of the asynchronous input signal functional safety design of an embodiment of the present invention. Figure 2 and Figure 3 , illustrating the asynchronous input signal functional safety design method provided by the present invention.
[0027] First, an asynchronous input signal is simultaneously input into a first synchronization module and a second synchronization module, wherein the first synchronization module is identical to the second synchronization module, the first synchronization module is the main body, and the second synchronization module is a copy of the main body.
[0028] Next, the output signal of the first synchronization module and the output signal of the second synchronization module are simultaneously input into the detection module, and the detection module detects whether there is a periodic inconsistency between the output signal of the first synchronization module and the output signal of the second synchronization module. If the detection module detects that there are two or more periods of inconsistency between the output signal of the first synchronization module and the output signal of the second synchronization module, an error flag alarm signal is generated.
[0029] The first synchronization module and the second synchronization module both include synchronization circuits. Figure 4 FIG. 1 is a schematic diagram of a synchronization circuit according to an embodiment of the present invention. Figure 4 The synchronous circuit shown is a circuit that synchronizes an input asynchronous input signal and generates a pulse signal. Figure 3 The inputs of the first synchronization module and the second synchronization module are both asynchronous input signals, so although their outputs are synchronized with the Clock, their timing may not be exactly the same. Figure 5 Schematic diagram of output waveforms of two synchronization circuits according to an embodiment of the present invention. Given the same input to the first synchronization module and the second synchronization module, the outputs of the first synchronization module and the second synchronization module may be Figure 5 There are four situations shown. Figure 5 As shown, in the first two cases, the outputs of the first synchronization module and the second synchronization module are different. Figure 4 The circuit shown cannot achieve safety monitoring using lockstep comparison results.
[0030] A flag register is designed to indicate the occurrence of a single event. The detection module includes a flag register, which is used to mark the state of the first synchronization module and the second synchronization module having a single event. If only one of the first synchronization module and the second synchronization module has a single event, the flag register is set to 1; if both of the first synchronization module and the second synchronization module have the same single event, the flag register is set to 0.
[0031] One of the output signal of the first synchronization module and the output signal of the second synchronization module is used to set a flag register, and the other is used to clear the flag register. Figure 6 FIG. 1 is a schematic diagram of an event marker waveform according to an embodiment of the present invention. Figure 6 As shown, the synchronization pulse output by the second synchronization module sets it, and the synchronization pulse output by the first synchronization module is cleared after a delay of 2 clock cycles. Figure 7 is a schematic diagram of an error mark waveform according to an embodiment of the present invention, Figure 7 The corresponding situation is that after an event occurs in the second synchronization module, it is not detected that the first synchronization module has also experienced the same event. Figure 7 As shown, the synchronization pulse output by the second synchronization module is delayed by 4 clock cycles to check whether the flag is 0, and if it is not 0, the error flag is set. Figure 8 is a schematic diagram of an error mark waveform according to another embodiment of the present invention, Figure 8 The corresponding situation is that after an event occurs in the first synchronization module, it is not detected that the second synchronization module has also experienced the same event. Figure 8 As shown, the first synchronization module outputs the clear flag and checks whether the flag is 1 at the same time, and if it is not 1, sets the error flag.
[0032] Figure 6 In the example, the single event flag is set to 1 by the output of the second synchronization module (cycle 2), and then cleared to 0 by the output of the first synchronization module two beats later (cycle 5). This takes into account the situation that the output of the second synchronization module is one cycle later than the output of the first synchronization module, that is, corresponding to Figure 5 The second case in .
[0033] by Figure 6 For example, the inspection method for a single event status is: Cycle 4 checks a single event, i.e., the flag register flag is 1, indicating that a single event occurs in the second synchronization module; the signal used is still the output of the first synchronization module pushed back by 2 beats. When a single event occurs in the first synchronization module, the flag register flag is checked to be 1, otherwise an error flag alarm signal is generated; Cycle 5 checks a single event, that is, the flag register flag is 0, indicating that no single event occurs in the second synchronization module, or the state of the flag register flag being 1 is cleared by a single event occurring in the first synchronization module, that is, a single event occurs in the first synchronization module and the second synchronization module in pairs; the signal of the output of the second synchronization module is pushed back by 4 beats, in order to stagger the phase with the output of the first synchronization module, that is, the flag register flag is checked to be 0 4 clock cycles after the single event occurs in the second synchronization module, otherwise an error flag alarm signal is generated.
[0034] The asynchronous input signal functional safety design method provided by the present invention realizes a safety mechanism for a simple asynchronous circuit through a redundant design of two synchronization modules; the output signals of the two synchronization modules are detected by a detection module, and a marking event is used instead of a comparison result, thereby realizing safety monitoring of key signals in the asynchronous circuit.
[0035] Fig. 9 FIG. 1 is a schematic diagram of an asynchronous input signal functional safety device according to an embodiment of the present invention. Fig. 9 As shown, the device comprises: A first synchronization module is configured to synchronize the input asynchronous input signal and output the signal to the detection module; A second synchronization module is configured to synchronize the input asynchronous input signal and output the signal to the detection module; The detection module is configured to detect the difference in period between the output signal of the first synchronization module and the output signal of the second synchronization module. If the detection module detects that the output signal of the first synchronization module and the output signal of the second synchronization module are inconsistent for two or more periods, an error flag alarm signal is generated.
[0036] In one embodiment of the present invention, the present invention further provides a chip, wherein the chip comprises the asynchronous input signal functional safety device.
[0037] In one embodiment of the present invention, the present invention also provides a computer-readable storage medium having machine-readable instructions stored thereon, and the machine-readable instructions implement the following processing steps when executed by a processor: inputting an asynchronous input signal into a first synchronization module and a second synchronization module at the same time, the first synchronization module being the same as the second synchronization module; inputting an output signal of the first synchronization module and an output signal of the second synchronization module into a detection module at the same time, the detection module detecting the difference in period between the output signal of the first synchronization module and the output signal of the second synchronization module.
[0038] The readable storage medium includes: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store machine-readable instructions.
[0039] Although various embodiments of the present invention are described above, it should be understood that they are presented as examples only and not as limitations. It is obvious to those skilled in the relevant art that various combinations, modifications and changes can be made thereto without departing from the spirit and scope of the present invention. Therefore, the breadth and scope of the present invention disclosed herein should not be limited by the exemplary embodiments disclosed above, but should only be defined according to the attached claims and their equivalents.
Claims
1. A method for designing functional safety of asynchronous input signals, characterized in that: include: Inputting the asynchronous input signal into a first synchronization module and a second synchronization module simultaneously, wherein the first synchronization module is the same as the second synchronization module; as well as The output signal of the first synchronization module and the output signal of the second synchronization module are simultaneously input into a detection module, and the detection module detects the difference in period between the output signal of the first synchronization module and the output signal of the second synchronization module.
2. The asynchronous input signal functional safety design method according to claim 1, characterized in that: If the detection module detects that the output signal of the first synchronization module and the output signal of the second synchronization module are inconsistent for two or more cycles, an error flag alarm signal is generated.
3. The asynchronous input signal functional safety design method according to claim 1, characterized in that: The detection module includes a flag register, and the flag register is used to mark the state of a single event occurring in the first synchronization module and the second synchronization module.
4. The asynchronous input signal functional safety design method according to claim 3, characterized in that: If only one of the first synchronization module and the second synchronization module has a single event, the flag register is set to 1; If the same single event occurs in both the first synchronization module and the second synchronization module, the flag register is set to 0.
5. The asynchronous input signal functional safety design method according to claim 3, characterized in that: One of the output signal of the first synchronization module and the output signal of the second synchronization module is used to set a flag register, and the other is used to clear the flag register.
6. The asynchronous input signal functional safety design method according to claim 3, characterized in that: The checks for a single event status are: The flag register flag is 1, indicating that a single event occurs in the second synchronization module; when a single event occurs in the first synchronization module, the flag register flag is checked to be 1, otherwise an error flag alarm signal is generated; The flag register flag is 0, indicating that no single event occurs in the second synchronization module, or the flag register flag is 1, which is cleared by a single event occurring in the first synchronization module, i.e., a single event occurs in the first synchronization module and the second synchronization module in pairs; The second synchronization module checks the flag register to be 0 after 4 clock cycles of a single event, otherwise an error flag alarm signal is generated.
7. An asynchronous input signal functional safety device, characterized in that: include: A first synchronization module is configured to synchronize the input asynchronous input signal and output the signal to the detection module; A second synchronization module is configured to synchronize the input asynchronous input signal and output the signal to the detection module; as well as The detection module is configured to detect a difference in period between an output signal of the first synchronization module and an output signal of the second synchronization module.
8. The asynchronous input signal functional safety device according to claim 1, characterized in that: If the detection module detects that the output signal of the first synchronization module and the output signal of the second synchronization module are inconsistent for two or more cycles, an error flag alarm signal is generated.
9. A chip, characterized in that: The chip includes the asynchronous input signal functional safety device according to claim 7 or 8.
10. A computer-readable storage medium, characterized in that: Machine-readable instructions are stored thereon, and when the machine-readable instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are performed.