Device including safety logic and method of operating the device

Abstract

An apparatus including safety logic and a method for operating the apparatus are provided. The apparatus includes a first functional module providing a main signal, a second functional module providing a comparison signal, and safety logic. The safety logic includes a trigger signal generator having a comparator, a feedback path, and a first multi-input gate, the comparator providing a comparison result in response to the main signal and the comparison signal, the feedback path generating a first trigger signal in response to the comparison result and providing the feedback signal to the comparator, and the first multi-input gate generating a second trigger signal in response to the comparison result. The safety logic also includes a trigger signal monitor providing a final fault search signal in response to the first trigger signal and the second trigger signal.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Korean Patent Application No. 10-2018-0092061 and Korean Patent Application No. 10-2019-0020050, filed on August 7, 2018 and February 20, 2019, respectively, in the Korean Intellectual Property Office, the common subject matter of which is incorporated herein by reference. Technical Field

[0003] The inventive concept relates to a device including safety logic. More particularly, the inventive concept relates to various devices including safety logic configured to determine whether a main signal is correctly correlated with a comparison signal during runtime. Background Art

[0004] In the broad context of electrical devices, mechanical devices, and electromechanical devices such as automobiles, a latent fault is a specific type of fault whose occurrence is not detected by the safety mechanism intended to perform such detection during the fault detection period. The latent fault is also not detected by the user of the device. Therefore, a latent fault can be understood as a silent fault, which can evolve (or migrate) into multiple faults, ultimately leading to a serious performance failure of the device. A typical example of a latent fault is a memory bit failure.

[0005] Faults and possible faults should be checked during the latent fault tolerance time period (L-FTTI) to prevent the occurrence of latent faults. For example, memory bit faults are checked for each memory access. Traditional fault checking methods that rely on built-in self-test (BIST) logic and / or software test libraries (STL) usually suspend normal operations (e.g., memory access operations) to check for faults. Such temporary suspension of operations may exceed the L-FTTI and usually increase the hardware and / or software overhead associated with fault checking. Summary of the invention

[0006] Embodiments of the inventive concept provide an apparatus including safety logic capable of detecting possible latent failures.

[0007] According to one aspect of the inventive concept, there is provided an apparatus, comprising: a first functional module configured to provide a main signal; a second functional module configured to provide a comparison signal; and safety logic. The safety logic comprises: a trigger signal generator including at least one comparator, a feedback path, and a first multi-input gate, the at least one comparator being configured to provide a comparison result in response to the main signal and the comparison signal, the feedback path being configured to generate a first trigger signal in response to the comparison result and provide the feedback signal to the at least one comparator, the first multi-input gate being configured to generate a second trigger signal in response to the comparison result; and a trigger signal monitor configured to provide a final fault search signal in response to the first trigger signal and the second trigger signal.

[0008] According to another aspect of the inventive concept, there is provided a device including a safety logic. The safety logic includes: a trigger signal generator configured to provide a first trigger signal and a second trigger signal in response to a main signal and a comparison signal, wherein each of the main signal and the comparison signal includes a plurality of bits; and a trigger signal monitor configured to provide a final fault search signal in response to monitoring the first trigger signal and the second trigger signal, wherein the trigger signal generator includes: a plurality of comparators configured to compare the main signal with the comparison signal bit by bit and generate a comparison result; a feedback path configured to perform a first gate operation in response to the comparison result, generate a first trigger signal, and provide a feedback signal to each of the plurality of comparators in response to the first trigger signal; and a first multi-input gate configured to perform a second gate operation in response to the comparison result and generate a second trigger signal.

[0009] According to another aspect of the inventive concept, a device including security logic is provided. The safety logic includes: a plurality of comparators, which respectively receive at least one bit of a main signal and at least one bit of a comparison signal, and are configured to compare the main signal with the comparison signal on a bit-by-bit basis to generate a comparison result; a feedback path, which is configured to generate a first trigger signal in response to the comparison result, and is also configured to generate a feedback signal in response to a clock signal and the first trigger signal, wherein the feedback signal is provided to each of the plurality of comparators; a first multi-input gate, which is configured to perform a first gate operation on the comparison result to generate a second trigger signal; a trigger signal monitor, which is configured to monitor the first trigger signal and the second trigger signal in response to the clock signal, and provide a final fault search signal, wherein the final fault search signal provides information indicating whether the main signal is correctly correlated with the comparison signal; and an error injector, which is configured to generate an error signal in response to the clock signal, wherein the trigger signal monitor further monitors the first trigger signal and the second trigger signal in response to the error signal, and provides a final fault search signal, wherein the final fault search signal further provides information indicating whether at least one of the plurality of comparators, the feedback path, the first multi-input gate, and the trigger signal monitor is faulty.

[0010] According to another aspect of the inventive concept, a method of operating a device including safety logic is provided. The method includes: determining whether a main signal is correctly correlated with a comparison signal, and generating a first trigger signal and a second trigger signal in response to the determination of whether the main signal is correctly correlated with the comparison signal; and generating a final fault search signal in response to the first trigger signal and the second trigger signal, wherein the final fault search signal provides information indicating whether the main signal is correctly correlated with the comparison signal, and further provides information indicating at least one fault in a logic gate used in determining whether the main signal is correctly correlated with the comparison signal. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Embodiments of the present inventive concept will be more easily understood through the following detailed description in conjunction with the accompanying drawings, in which:

[0012] Figure 1 is a block diagram illustrating an apparatus according to an embodiment of the inventive concept;

[0013] Figure 2 is a further illustration of an embodiment according to the present invention. Figure 1 A block diagram of an example of security logic;

[0014] Figure 3 is a further illustration of an embodiment according to the present invention. Figure 2 A block diagram of an example of a trigger signal generator;

[0015] Figure 4 is a further illustration of an embodiment according to the present invention. Figure 1 and Figure 3 A block diagram of an example of a trigger signal monitor;

[0016] Figure 5 is a flowchart outlining a method of operating a device according to an embodiment of the inventive concept;

[0017] Figure 6 is a flowchart outlining a method of operating a trigger signal monitor according to an embodiment of the inventive concept;

[0018] Figure 7 is a timing diagram illustrating exemplary signal timing relationships according to an embodiment of the inventive concept;

[0019] Fig. 8A and Figure 8B is a table showing values ​​of final fault search signals provided under various conditions, respectively;

[0020] Fig. 9 is a flowchart outlining a method of operating a device according to an embodiment of the inventive concept;

[0021] Fig.10 is a block diagram further illustrating a trigger signal generator according to an embodiment of the inventive concept;

[0022] Fig.11 is a timing diagram illustrating exemplary signal timing relationships according to an embodiment of the inventive concept;

[0023] Fig.12 FIG. 1 is a diagram showing an embodiment according to the present invention. Figure 1 A block diagram of another example of security logic;

[0024] Fig.13 is a block diagram illustrating an apparatus according to an embodiment of the inventive concept;

[0025] Fig.14 is a flowchart outlining a method of operating a device according to an embodiment of the inventive concept;

[0026] Fig.15 is a block diagram of a system on chip (SoC) including security logic consistent with an embodiment of the inventive concept;

[0027] Fig.16 is a block diagram of a memory system including security logic according to an embodiment of the inventive concept; and

[0028] Fig.17 is a conceptual diagram of a vehicle including safety logic according to an embodiment of the inventive concept. DETAILED DESCRIPTION

[0029] Hereinafter, certain embodiments of the inventive concept will be described in some additional detail with reference to the accompanying drawings.

[0030] Figure 1 is a block diagram of an apparatus 1 according to an embodiment of the inventive concept.

[0031] Reference Figure 1 , the device 1 generally includes a first functional module 10, a second functional module 20 and a safety logic 30. The device 1 can be designed to perform one or more functions. The operation of the device 1 can be controlled in response to various electrical signals. For example, the device 1 can be applied to robotic devices (e.g., drones and advanced driver assistance systems (ADAS)), automatic vehicles, smart TVs, smart phones, medical devices, mobile devices, image display devices, measuring devices, and Internet of Things (IoT) devices. In addition, the device 1 can be installed on at least one of various types of electronic devices.

[0032] The first functional module 10 is configured to perform at least one function related to the operation of the device 1. As an example, the first functional module 10 may perform (or carry out) a predetermined function to generate (or define) a main signal M_S. The main signal M_S may then be used to control one or more operations of the device 1. As another example, the first functional module 10 may generate a sensed value (or sensed signal) related to a condition (e.g., power condition) or temperature associated with the device 1. The sensed signal may be provided as the main signal M_S (hereinafter, the sensed signal may be understood to be related to a "condition" such as temperature or power).

[0033] In contrast to the first functional module 10 that provides (e.g., outputs) a main (or primary) signal, the second functional module 20 provides a comparison signal C_S that will be compared with the main signal M_S. Therefore, the second functional module 20 can be understood to provide a secondary signal (or comparison signal) relative to the main signal provided by the first functional module 10. In some embodiments, the second functional module 20 can be a functional mirror of the first functional module. That is, the second functional module can have the same construction as the first functional module 10. In this way, assuming that there is no fault related to the operation of the first functional module 10 or the second functional module 20, the comparison signal C_S should be correctly related to the main signal M_S. In some embodiments, the phrase "correctly related to..." means that the main signal M_S is "equal to" the comparison signal C_S. However, in other embodiments, the phrase "correctly related to..." means that the main signal M_S falls within the established range, limit or tolerance relationship relative to the comparison signal C_S. In other words, the first functional module 10 and the second functional module 20 may be designed in a mirror (or lock-step) manner to detect a defect failure potentially occurring in the main signal M_S as provided by the first functional module 10 .

[0034] In other embodiments where the first functional module 10 provides a sensing signal related to a condition as the main signal M_S, the second functional module 20 may provide a critical sensing value to be compared with the sensing value as the comparison signal C_S. For example, when the first functional module 10 is a temperature sensor, the first functional module 10 may provide a temperature sensing signal as the main signal M_S, and the second functional module 20 may provide a critical temperature value as the comparison signal C_S.

[0035] like Figure 1 As shown in , the safety logic 30 may include a trigger signal generator 100 and a trigger signal monitor 200. In an example embodiment, the trigger signal generator 100 may receive a main signal M_S and a comparison signal C_S, and generate a first trigger signal TG_S1 and a second trigger signal TG_S2 in response to the main signal M_S and the comparison signal C_S. In a specific embodiment, each trigger signal may be a signal in which a logic high level and a logic low level are repeated at a predetermined cycle.

[0036] The trigger signal generator 100 may provide the first trigger signal TG_S1 and the second trigger signal TG_S2 to the trigger signal monitor 200. In an example embodiment, the trigger signal generator 100 may include at least one comparator configured to generate a "comparison result" in response to the comparison of the main signal M_S and the comparison signal C_S. The trigger signal generator 100 may also include a feedback path configured to generate the first trigger signal TG_S1 in response to the comparison result and provide the feedback signal to the at least one comparator. The trigger signal generator 100 may also include a first multi-input gate configured to generate the second trigger signal TG_S2 in response to the comparison result. For example, the main signal M_S and the comparison signal C_S may include a plurality of bits (e.g., respectively include a first plurality of bits and a second plurality of bits, wherein the first plurality of bits and the second plurality of bits may be the same or different), and the trigger signal generator 100 may include a plurality of comparators having a desired number so that corresponding (or similar) bits of the main signal M_S and the comparison signal C_S may be compared. That is, the trigger signal generator 100 may perform an operation in which the main signal M_S is compared with the comparison signal C_S on a “bit-by-bit basis” to determine whether the main signal M_S is correctly correlated with the comparison signal C_S.

[0037] In this way, the trigger signal generator 100 can transmit information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S to the trigger signal monitor 200 using the first trigger signal TG_S1 and the second trigger signal TG_S2. For example, when the main signal M_S is correctly correlated with the comparison signal C_S, each of the first trigger signal TG_S1 and the second trigger signal TG_S2 can be a "normal" trigger signal (i.e., a high / low trigger signal with a predetermined period). However, when at least one bit of the main signal M_S is different from a similar bit of the comparison signal C_S, at least one of the first trigger signal TG_S1 and the second trigger signal TG_S2 may be an "abnormal" trigger signal (i.e., a signal different from a normal trigger signal). For example, when at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, at least one of the first trigger signal TG_S1 and the second trigger signal TG_S2 may not be triggered according to a predetermined period, but remain fixed at a high logic level or a low logic level for two or more periods.

[0038] The trigger signal monitor 200 may be configured to generate and provide a final fault search signal CON_S in response to the first trigger signal TG_S1 and the second trigger signal TG_S2. In an example embodiment, the trigger signal monitor 200 may include: a first XOR gate configured to provide a first error occurrence signal in response to the first trigger signal TG_S1 and the second trigger signal TG_S2; a second XOR gate configured to provide a second error occurrence signal in response to the first trigger signal TG_S1 and the second trigger signal TG_S2; a first output gate configured to provide a first fault search signal in response to the first error occurrence signal and the second error occurrence signal; and a second output gate configured to provide a second fault search signal in response to the first error occurrence signal and the second error occurrence signal.

[0039] Therefore, the trigger signal monitor 200 can receive information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S from the first trigger signal TG_S1 and the second trigger signal TG_S2. Because the trigger signal monitor 200 provides the final fault search signal CON_S in response to the first trigger signal TG_S1 and the second trigger signal TG_S2, the final fault search signal CON_S may include information about whether the main signal M_S is correctly correlated with the comparison signal C_S.

[0040] In an exemplary embodiment, the predetermined error signal ( Figure 1) is applied to the trigger signal monitor 200. For example, a first XOR gate included in the trigger signal monitor 200 may provide a first error generation signal in response to the error signal, and a second XOR gate included in the trigger signal monitor 200 may provide a second error generation signal in response to the error signal. When the trigger signal monitor 200 provides the final fault search signal CON_S in response to the predetermined error signal and the first trigger signal TG_S1 and the second trigger signal TG_S2, the final fault search signal CON_S may be further predicted based on information about whether a gate included in at least one of the trigger signal generator 100 and the trigger signal monitor 200 is faulty.

[0041] Figure 2 is a further illustration of an embodiment according to the present invention. Figure 1 1 is a block diagram of an example of security logic 30 .

[0042] Reference Figure 2 Again, the safety logic 30 includes a trigger signal generator 100 and a trigger signal monitor 200, and further includes a clock generator 300 and an error injector 400. The trigger signal generator 100 may include a plurality of comparators 110-1 to 110-N, where “N” is a positive integer greater than 1. The trigger signal generator 100 may also include a feedback (FB) path 120 and a first multi-input (MI) gate 130.

[0043] Each of the comparators 110-1 to 110-N receives the main signal M_S and the comparison signal C_S, and performs a comparison operation between the main signal M_S and the comparison signal C_S. For example, each of the main signal M_S and the comparison signal C_S may include a plurality of bits, and each of the bits of the main signal M_S and each of the similar bits of the comparison signal C_S may be applied to each of the comparators 110-1 to 110-N. In this manner, the trigger signal generator 100 may determine whether the main signal M_S is correctly correlated with the comparison signal C_S (i.e., whether the main signal M_S is equal to the comparison signal C_S) on a bit-by-bit basis using the comparators 110-1 to 110-N.

[0044] The feedback path 120 may generate a first trigger signal TG_S1 in response to a comparison result provided by each of the comparators 110 - 1 to 110 -N, and output a feedback signal to each of the comparators 110 - 1 to 110 -N. Figure 2 In the illustrated example, feedback path 120 also receives clock signal CLK from clock generator 300 .

[0045] In one embodiment, the feedback path 120 may include a second multi-input gate configured to generate the first trigger signal TG_S1 in response to the comparison results provided by the comparators 110 - 1 to 110 -N. Here, the second multi-input gate may be an AND gate or an OR gate.

[0046] With this configuration, the feedback path 120 can delay the first trigger signal TG_S1 in response to the clock signal CLK and provide the delayed signal as a feedback signal to the comparators 110-1 to 110-N. After the comparators 110-1 to 110-N are fed back through the feedback path 120, when the main signal M_S is correctly correlated with the comparison signal C_S, each of the first trigger signal TG_S1 and the second trigger signal TG_S2 is provided as a normal trigger signal.

[0047] The first multi-input gate 130 may be used to generate a second trigger signal TG_S2 in response to the comparison results of the comparators 110-1 to 110-N. In one embodiment, the first multi-input gate 130 may be an AND gate or an OR gate. In another embodiment, the first multi-input gate 130 may be an AND gate, and the second multi-input gate included in the feedback path 120 may be an OR gate. In yet another embodiment, the first multi-input gate 130 may be an OR gate, and the second multi-input gate included in the feedback path 120 may be an AND gate.

[0048] like Figure 2 As shown in FIG. 1 , the trigger signal monitor 200 receives the first trigger signal TG_S1 and the second trigger signal TG_S2 generated by the trigger signal generator 100 . The trigger signal monitor 200 also receives the clock signal CLK from the clock generator 300 and the error signal ER from the error injector 400 .

[0049] With these inputs, the trigger signal monitor 200 can perform monitoring operations on the first trigger signal TG_S1 and the second trigger signal TG_S2. In one embodiment, the trigger signal monitor 200 can perform monitoring operations on the first trigger signal TG_S1 and the second trigger signal TG_S2 in response to the clock signal CLK and the error signal ER to provide a final fault search signal CON_S.

[0050] The final fault search signal CON_S may be provided in response to the first trigger signal TG_S1 and the second trigger signal TG_S2, and may include information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S. Here, the final fault search signal CON_S may be provided in response to the clock signal CLK and the error signal ER so as to further include information indicating whether the gates included in the trigger signal generator 100 and the trigger signal monitor 200 are faulty.

[0051] For example, the clock generator 300 may include a phase locked loop (PLL). Although the present embodiment describes a case where the security logic 30 includes the clock generator 300, the inventive concept is not limited thereto. In another example, the clock generator may be provided outside the security logic 30, and the feedback path 120, the trigger signal monitor 200, and the error injector 400 may receive a clock signal from the outside.

[0052] The error injector 400 may be used to generate and provide an error signal ER in response to a clock signal CLK. In one embodiment, the error injector 400 may include a clock divider configured to divide the clock signal CLK. Therefore, the error signal ER may be a divided clock signal.

[0053] As will be appreciated by those skilled in the art, the security logic 30 may be implemented differently. That is, the security logic 30 may be implemented in software and / or hardware. In a particular embodiment, the security logic 30 may be implemented as hardware, wherein each component included in the security logic 30 may include various circuits configured to perform the above-described operations. However, in other embodiments, the security logic 30 may be implemented as software, programs, and / or commands that are loaded into a memory (not shown) and executed by a processor (not shown) to perform the above-described operations. Still other embodiments may implement the security logic 30 using a combination of hardware and software.

[0054] Figure 3 is a further illustration of an embodiment according to the present invention. Figure 1 and / or Figure 2 1 is a block diagram of an example of a trigger signal generator 100 .

[0055] Reference Figure 3 , the comparators 110 - 1 to 110 -N may include XOR gates 112 - 1 to 112 -N, respectively. In addition, the feedback path 120 may include a second multi-input gate 122 , a first delay circuit 124 , and an inverter 126 .

[0056] The second multi-input gate 122 may generate a first trigger signal TG_S1 in response to the outputs of the XOR gates 112-1 to 112-N. In addition, the first multi-input gate 130 may generate a second trigger signal TG_S2 in response to the outputs of the XOR gates 112-1 to 112-N. The first multi-input gate 130 may include an OR gate, and the second multi-input gate 122 may include an AND gate.

[0057] The first delay circuit 124 may delay the first trigger signal TG_S1 in response to the clock signal CLK. For example, the first delay circuit 124 may include a flip-flop configured to operate in response to the clock signal CLK. The inverter 126 may invert the output of the first delay circuit 124 and provide the inverted output to the XOR gates 112-1 to 112-N as a feedback signal.

[0058] Each of the XOR gates 112-1 to 112-N may receive each bit of the main signal M_S and each bit of the comparison signal C_S. In addition, each of the XOR gates 112-1 to 112-N may receive a feedback signal output through an inverter 126. In a specific embodiment, the first XOR gate 112-1 may receive a first main signal bit M_S1, a first comparison signal bit C_S1, and a feedback signal, and perform an XOR operation in response to the first main signal bit M_S1, the first comparison signal bit C_S1, and the feedback signal.

[0059] Figure 4 is a further illustration of an embodiment according to the present invention. Figure 1 and / or Figure 2 2 is a block diagram of an example of a trigger signal monitor 200 .

[0060] Reference Figure 4 , the trigger signal monitor 200 may include a first XOR gate 210, a second delay circuit 220, a second XOR gate 230, a third delay circuit 240, a first output gate 250, and a second output gate 260. The first XOR gate 210 may receive the error signal ER, the first trigger signal TG_S1, and the first error generation signal ER_B1 delayed by the second delay circuit 220, and perform an XOR operation in response to the error signal ER, the first trigger signal TG_S1, and the delayed first error generation signal ER_B1. The second delay circuit 220 may delay the first error generation signal ER_B1 in response to the clock signal CLK. Therefore, the first XOR gate 210 may provide the first error generation signal ER_B1.

[0061] The second XOR gate 230 may receive the error signal ER, the second trigger signal TG_S2, and the second error generation signal ER_B2 delayed by the third delay circuit 240, and perform an XOR operation in response to the error signal ER, the second trigger signal TG_S2, and the delayed second error generation signal ER_B2. The third delay circuit 240 may delay the second error generation signal ER_B2 in response to the clock signal CLK. Therefore, the second XOR gate 230 may provide the second error generation signal ER_B2.

[0062] The first output gate 250 may provide a first fault search signal CON_S1 in response to the first error generation signal ER_B1 and the second error generation signal ER_B2. In addition, the second output gate 260 may provide a second fault search signal CON_S2 in response to the first error generation signal ER_B1 and the second error generation signal ER_B2. The first fault search signal CON_S1 and the second fault search signal CON_S2 may constitute a final fault search signal CON together or individually.

[0063] In one embodiment, the first output gate 250 may include a NAND gate. In addition, the second output gate 260 may include a NOR gate. The trigger signal monitor 200 may transmit information about whether the main signal M_S is correctly correlated with the comparison signal C_S to one or more components outside the trigger signal monitor 200 using a combination of the first fault search signal CON_S1 and the second fault search signal CON_S2 included in the final fault search signal CON_S. In addition, the trigger signal monitor 200 may also transmit information indicating whether the gates included in the trigger signal generator 100 and the trigger signal monitor 200 are faulty to the external components using the first fault search signal CON_S1 and the second fault search signal CON_S2.

[0064] Figure 5 The present invention is an overview of the operation of an exemplary embodiment of the present inventive concept. Figure 1 A flowchart of an example of a method of the apparatus 1. Figure 1 , Figure 2 and Figure 3 The embodiments described are described in the context of Figure 5 Flowchart of the process.

[0065] Reference Figure 1 , Figure 2 and Figure 5 The apparatus 1 determines whether the main signal M_S and the comparison signal C_S are applied to the trigger signal generator 100 ( S10 ). Here, the main signal M_S may be provided by the first functional module 10 , and the comparison signal C_S may be provided by the second functional module 20 .

[0066] Therefore, the apparatus 1 can generate a first trigger signal TG_S1 and a second trigger signal TG_S2 in response to the main signal M_S and the comparison signal C_S (S20). Figure 2 According to the safety logic 30 , the trigger signal generator 100 may generate the first trigger signal TG_S1 and the second trigger signal TG_S2 in response to the main signal M_S and the comparison signal C_S using a plurality of comparators 110 - 1 to 110 -N and a feedback path 120 .

[0067] The device 1 may monitor the generated first trigger signal TG_S1 and the second trigger signal TG_S2 (S30). Here, the safety logic 30 included in the device 1 may include a reference signal Figure 4 The trigger signal monitor 200 described above is similar to the trigger signal monitor 200 configured to monitor the first trigger signal TG_S1 and the second trigger signal TG_S2. The trigger signal monitor 200 may provide a final fault search signal CON_S (S40) in response to the first trigger signal TG_S1 and the second trigger signal TG_S2. The safety logic 30 may generate information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S in response to the final fault search signal CON_S provided by monitoring the first trigger signal TG_S1 and the second trigger signal TG_S2.

[0068] Figure 6 is another flow chart outlining one example of a method of operating the trigger signal monitor 200 according to an embodiment of the inventive concept.

[0069] Reference Figure 2 , Figure 3 , Figure 4 and Figure 6 , the trigger signal monitor 200 may determine whether the error signal ER is applied to the trigger signal monitor 200 (S100). For example, the error signal ER may be a signal indicating whether a gate included in each of the trigger signal generator 100 and the trigger signal monitor 200 is faulty. For example, the error signal ER may be a trigger signal. In one embodiment, the error signal ER may be provided by an error injector 400 included in the apparatus 1, and the error injector 400 may provide the error signal ER in response to the clock signal CLK.

[0070] When the error signal ER is applied to the trigger signal monitor 200, the trigger signal monitor 200 may provide a final fault search signal CON_S in response to the first trigger signal TG_S1, the second trigger signal TG_S2, and the error signal ER (S110). For example, the trigger signal monitor 200 may provide the first fault search signal CON_S1 and the second fault search signal CON_S2 as the final fault search signal CON_S, wherein the first fault search signal CON_S1 is generated by performing a NAND operation on the first error generation signal ER_B1 and the second error generation signal ER_B2, and the second fault search signal CON_S2 is generated by performing a NOR operation on the first error generation signal ER_B1 and the second error generation signal ER_B2. However, the logical combination of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be changed according to the logical state of the error signal ER, whether the main signal M_S is correctly correlated with the comparison signal C_S, and whether the gate included in each of the trigger signal generator 100 and the trigger signal monitor 200 is faulty.

[0071] Therefore, according to certain embodiments of the inventive concept, the device 1 including the safety logic 30 can provide information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S and whether the gate included in each of the trigger signal generator 100 and the trigger signal monitor 200 is faulty as the final fault search signal CON_S. In addition, all of this information can be provided during runtime operation without suspending the operation of the device or components of the device. In this way, the device 1 can accurately detect possible potential faults during runtime operation, thereby improving performance and operational stability.

[0072] Figure 7 1 is a timing diagram showing an exemplary set of timing relationships that may exist between the various signals described in the foregoing embodiments. Here, it is assumed that the error signal ER is obtained by dividing the clock signal CLK by four (4). Those skilled in the art will recognize that the nature and sources of these signals and their timing relationships are merely illustrative.

[0073] Reference Figure 7, assuming that the first trigger signal TG_S1 is abnormally provided at the first time point t1. This abnormal output of the first trigger signal TG_S1 may be a result caused by a difference between at least one bit of the main signal M_S and at least one bit of the comparison signal C_S. Specifically, the first trigger signal TG_S1 may be kept fixed at a logic low and output from the first time point t1 to the second time point t2. In response to the abnormal first trigger signal TG_S1, the first error occurrence signal ER_B1 is output at a logic low from the first time point t1 to the second time point t2. In addition, from the first time point t1 to the second time point t2, the first fault search signal CON_S1 may be output at a logic high, and the second fault search signal CON_S2 may be output at a logic low.

[0074] The first trigger signal TG_S1 and the second trigger signal TG_S2 are normally output from the second time point t2 to the third time point t3. When the first trigger signal TG_S1 and the second trigger signal TG_S2 are normally output, the first error generation signal ER_B1 and the second error generation signal ER_B2 may be output at a logic high from the second time point t2 to the third time point t3. In addition, the first fault search signal CON_S1 may be output at a logic low, and the second fault search signal CON_S2 may be output at a logic high.

[0075] The second trigger signal TG_S2 may be abnormally output at the third time point t3. For example, the abnormal output of the second trigger signal TG_S2 may be caused by the difference between at least one bit of the main signal M_S and at least one bit of the comparison signal C_S. Specifically, the second trigger signal TG_S2 remains fixed to a logic high from the third time point t3 to the fourth time point t4. In response to the second trigger signal TG_S2 fixed to a logic high, the second error occurrence signal ER_B2 may be output as a logic low from the third time point t3 to the fourth time point t4. In addition, from the third time point t3 to the fourth time point t4, the first fault search signal CON_S1 may be output as a logic high, and the second fault search signal CON_S2 may be output as a logic low.

[0076] Fig. 8A is a first table TB1 indicating the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 according to the value of the error signal ER and depending on whether the main signal M_S is correctly correlated with the comparison signal C_S. Figure 8B is a second table TB2 indicating values ​​of the first fault search signal CON_S1 and the second fault search signal CON_S2 depending on whether each gate included in the trigger signal generator 100 and the trigger signal monitor 200 is faulty and according to a fault type condition and a value of the error signal ER.

[0077] Reference Fig. 8A , when the value of the error signal ER is 0 (or logic low) and the main signal M_S is correctly correlated with the comparison signal C_S, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 0. When the value of the error signal ER is 0 and at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 1 (or logic high).

[0078] When the value of the error signal ER is 1 and the main signal M_S is correctly correlated with the comparison signal C_S, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 1. When the value of the error signal ER is 1 and at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 0.

[0079] Reference Figure 8B , the first case assumes that the gate fails and the output of the gate is fixed to 0, and the second case assumes that the gate fails and the output of the gate is fixed to 1. For example, when the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N fails and corresponds to the first case, the value of the first fault search signal CON_S1 may be 1, and the value of the second fault search signal CON_S2 may be 0. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N fails and corresponds to the first case, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 0.

[0080] For example, when the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N is faulty and corresponds to the second case, the value of the first fault search signal CON_S1 may be 1, and the value of the second fault search signal CON_S2 may be 0. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N is faulty and corresponds to the second case, the value of each of the first fault search signal CON_S1 and the second fault search signal CONS_S2 may be 0.

[0081] Although only the values ​​of the first fault search signal CON_S1 and the second fault search signal CON_S2 in each of the first case and the second case in which the XOR gates 112-1 to 112-N fail have been described, the same explanation as above may be applied to the case in which each of the other gates included in the second table TB2 fails. For example, when the value of the error signal ER is 0 and the first XOR gate 210 fails and corresponds to the first case, the value of the first fault search signal CON_S1 may be 1, and the value of the second fault search signal CON_S2 may be 0. In addition, when the value of the error signal ER is 1 and the first XOR gate 210 fails and corresponds to the first case, the value of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be 1.

[0082] As described above, in each case, the values ​​of the first fault search signal CON_S1 and the second fault search signal CON_S2 may be prepared for the first table TB1 and the second table TB2 in response to the error signal ER in which a 0 value and a 1 value are repeated (or a logic low and a logic high are repeated) at a predetermined cycle. Therefore, the first fault search signal CON_S1 and the second fault search signal CON_S2 may include information indicating whether the main signal M_S is correctly correlated with the comparison signal C_S. In addition, the first fault search signal CON_S1 and the second fault search signal CON_S2 may also include information indicating whether a gate included in each of the trigger signal generator 100 and the trigger signal monitor 200 is faulty.

[0083] Fig. 9 The operation of the embodiment according to the present inventive concept is summarized as follows Figure 1 Flowchart of an example of a method of apparatus 1.

[0084] Reference Figure 1 and Fig. 9 , the device 1 may apply the sensing signal and the critical signal to the safety logic 30 (S200). In one example, the device 1 may apply the sensing signal as the main signal M_S to the safety logic 30, and may also apply the critical signal as the comparison signal C_S to the safety logic 30. The sensing signal may be an output of a sensor indicating a specific condition associated with the device 1.

[0085] In one example, the first functional module 10 may be a temperature sensor that provides a temperature sensing signal as a main signal M_S to the safety logic 30, and the second functional module 20 may be a circuit that provides a critical signal (or limit value) obtained from preset temperature condition information as a comparison signal C_S to the safety logic 30. In another example, the first functional module 10 may be a power sensor (e.g., a voltage, current, signal waveform sensor) that provides a power sensing signal as a main signal M_S to the safety logic 30, and the second functional module 20 may be a circuit that provides a critical signal (or limit value) obtained from preset power condition information as a comparison signal C_S to the safety logic 30.

[0086] Next, the device 1 may generate a first trigger signal TG_S1 and a second trigger signal TG_S2 in response to the sensing signal and the critical signal (ie, in response to the main signal M_S and the comparison signal C_S) (S210). The safety logic 30 included in the device 1 may include a trigger signal generator 100, which is similar to the trigger signal generator 100 described above. Figure 1 and Figure 2 The trigger signal generator 100 described herein is configured to provide a first trigger signal TG_S1 and a second trigger signal TG_S2 that are changed depending on whether the sensed signal is correctly correlated with the critical signal.

[0087] Next, the device 1 may monitor the generated first trigger signal TG_S1 and second trigger signal TG_S2 (S220). The safety logic 30 included in the device 1 may include a trigger signal monitor 200, which is similar to the trigger signal monitor 200 described above. Figure 1 and Figure 4 The trigger signal monitor 200 described above is configured to monitor the first trigger signal TG_S1 and the second trigger signal TG_S2. The trigger signal monitor 200 may provide a final fault search signal CON_S (S230) in response to the first trigger signal TG_S1 and the second trigger signal TG_S2. That is, the safety logic 30 may generate information indicating whether the sensing signal is correctly correlated with the critical signal in response to the final fault search signal CON_S provided by monitoring the sensing signal and the critical signal.

[0088] Fig.10 is a further illustration of an embodiment according to the present invention. Figure 1 1 is a block diagram of another example (100a) of a trigger signal generator 100. Fig.10 The structure of the trigger signal generator 100a shown in FIG. Figure 3The configuration of the trigger signal generator 100 described is generally similar. However, the first multi-input gate 130a may include an AND gate, and the second multi-input gate 122a may include an OR gate. Therefore, the first multi-input gate 130a may perform an AND operation on the outputs of the XOR gates 112a-1 to 112a-N and generate the second trigger signal TG_S2a.

[0089] The second multi-input gate 122a can perform an OR operation on the outputs of the XOR gates 112a-1 to 112a-N and generate a first trigger signal TG_S1a. In addition, the first delay circuit 124a can delay the first trigger signal TG_S1a in response to the clock signal CLKa, and the inverter 126a can invert the output of the first delay circuit 124a, generate a feedback signal, and provide the generated feedback signal to the XOR gates 112a-1 to 112a-N.

[0090] Fig.11 It is shown that there can be Fig.10 A timing diagram of an exemplary set of timing relationships between various signals described in the embodiments.

[0091] Fig.11 The timing diagram and Figure 7 The timing diagrams are generally similar. For example, Fig.11 The timing diagram shows that when the application is Figure 7 In the embodiment of the present invention, the main signal and the comparison signal are similar to each other. However, referring to Fig.11 , the second trigger signal TG_S2a may be fixed to logic low and output from the first time point t1a to the second time point t2a, and the first trigger signal TG_S1a may be fixed to logic high and output from the third time point t3a to the fourth time point t4a.

[0092] Fig.12 is a further illustration of an embodiment according to the present invention. Figure 1 A block diagram of another example of the safety logic 30 is shown. Here, Fig.12 Construction and reference of safety logic 30b in Figure 2 The construction of the described safety logic 30 is generally similar.

[0093] It is worth noting that Figure 2 The safety logic 30 includes an internally arranged error injector 400 for providing an error signal ER. Fig.12 The safety logic 30b receives an externally generated error signal ERb (eg, an error signal supply source). However, the externally generated error signal ERb may be a trigger signal having a cycle longer than that of the clock signal CLKb generated by the clock generator 300b.

[0094] Fig.13 is a block diagram of an apparatus 1c according to an embodiment of the present inventive concept. Here, Fig.13 The structure and reference of device 1c in Figure 1 The construction of the described apparatus 1 is substantially similar. However, the apparatus 1c further comprises a controller 50 and an interrupt generator 40c, wherein the interrupt generator 40c is used to generate an interrupt signal ITc applied to the controller 50 in response to the final fault search signal CON_Sc.

[0095] Here, it is assumed that the controller 50 controls (CTRL) the overall operation of the first functional module 10c and the second functional module 20c. It is further assumed that the controller 50 is responsive in its operation to an interrupt signal ITc conditionally provided by the interrupt generator 40c.

[0096] For example, the interrupt generator 40c can obtain information indicating whether the main signal M_Sc is correctly correlated with the comparison signal C_Sc in response to the final fault search signal CON_Sc. The interrupt generator 40c can also obtain information indicating whether the gates included in the trigger signal generator 100c and the trigger signal monitor 200c are faulty in response to the final fault search signal CON_Sc.

[0097] It is further noted that, in certain embodiments, the interrupt generator 40c may conform to Fig. 8A The first table TB1 is operated to provide information indicating whether the main signal M_Sc is correctly correlated with the comparison signal C_Sc in response to the final fault search signal CON_Sc. Therefore, when it is determined that at least one bit of the main signal M_Sc is different from at least one bit of the comparison signal C_Sc, the interrupt generator 40c can provide the interrupt signal ITc in response to the determination result. In addition, when the first functional module 10c provides the main signal M_Sc as the sensing signal and the second functional module 20c provides the comparison signal C_Sc as the critical signal, it can be determined that the main signal M_Sc is correctly correlated with the comparison signal C_Sc, and the interrupt generator 40c can provide the interrupt signal ITc in response to the determination result.

[0098] Additionally, in certain embodiments, the interrupt generator 40c may conform to Figure 8B The second table TB2 is operated to obtain information indicating whether any one of the gates included in the trigger signal generator 100c and the trigger signal monitor 200c is faulty in response to the final fault search signal CON_Sc. Therefore, at least one fault of the gates included in the trigger signal generator 100c and the trigger signal monitor 200c can be determined, and the interrupt generator 40c can provide the interrupt signal ITc in response to the determination result.

[0099] For example, the interrupt generator 40c may provide the interrupt signal ITc to the controller 50 included in the device 1c. Alternatively, the interrupt generator 40c may provide the interrupt signal ITc to an upper controller located outside the device 1c.

[0100] Fig.14 The operation of the embodiment according to the present inventive concept is summarized as follows Fig.13 Flow chart of an example of a method of apparatus 1c.

[0101] Reference Fig.13 and Fig.14 , the device 1c may apply the main signal M_Sc and the comparison signal C_Sc to the safety logic 30c (S300). The safety logic 30c may include a trigger signal generator 100c and a trigger signal monitor 200c. The trigger signal generator 100c may provide a first trigger signal TG_S1c and a second trigger signal TG_S2c in response to the main signal M_Sc and the comparison signal C_Sc, and the trigger signal monitor 200c may provide a final fault search signal CON_Sc in response to the first trigger signal TG_S1c and the second trigger signal TG_S2c (S310).

[0102] The interrupt generator 40c may determine whether a fault has occurred in response to the final fault search signal CON_Sc (S320). For example, when it is determined in response to the fault search signal CON_Sc that at least one bit of the main signal M_Sc is different from at least one bit of the comparison signal C_Sc, the interrupt generator 40c may determine that a fault has occurred. Alternatively, when it is determined in response to the final fault search signal CON_Sc that at least one fault in the gates included in the trigger signal generator 100c and the trigger signal monitor 200c is faulted, the interrupt generator 40c may determine that a fault has occurred.

[0103] When a fault occurs, the interrupt generator 40c may provide an interrupt signal ITc (S330). For example, the device 1c may include a controller configured to control components of the device 1c, and the interrupt generator 40c may provide the interrupt signal ITc to the controller. In addition, the interrupt generator 40c may provide the interrupt signal ITc to the outside of the device 1c.

[0104] Fig.15 is a block diagram illustrating a system on chip (SoC) 1000 including a security logic 1040 consistent with certain embodiments of the inventive concepts.

[0105] Reference Fig.15, SoC 1000 includes a plurality of IP (intellectual property) cores (e.g., a first IP core 1010, a second IP core 1020, and a third IP core 1030), a security logic 1040, and a system bus 1050. SoC 1000 may be designed to perform various functions in a semiconductor system. For example, SoC 1000 may be an application processor.

[0106] SoC 1000 may include various types of IP cores. For example, the first IP core 1010, the second IP core 1020, and the third IP core 1030 may include a processing unit, a plurality of cores included in the processing unit, a multi-format codec (MFC), a video module (e.g., a camera interface, a joint photo expert group (JPEC) processor, a video processor, or a mixer), a three-dimensional (3D) graphics core, an audio system, a driver, a display driver, a volatile memory, a non-volatile memory, a memory controller, an input / output (I / O) interface block, or a cache memory.

[0107] The connection scheme based on system bus 1050 can be used as the technology of connecting the first IP core 1010, the second IP core 1020 and the third IP core 1030 to the safety logic 1040. For example, the advanced microcontroller bus architecture (AMBA) protocol from advanced RISC machine (ARM) can be used as a standard bus protocol. The bus type of AMBA protocol can include advanced high performance bus (AHB), advanced peripheral bus (APB), advanced extensible interface (AXI), AXI4, AXI consistency extension (ACE) etc. In the above bus type, AXI can be an interface protocol between IPs, and multiple unfinished address functions and data interleaving functions are provided. In addition, other types of protocols such as uNetwork from SONICs company, CoreConnect from IBM and open core protocol (OCP) from OCP-IP can be applied to system bus 1050.

[0108] In an example embodiment, the safety logic 1040 may detect whether there is a fault in a signal output by at least one of the first IP core 1010, the second IP core 1020, and the third IP core 1030. In an example, the second IP core (or IP2) 1020 may include a construction identical to that of the first IP core (or IP1) 1010 to determine whether there is a fault in IP1 1010. Therefore, IP1 1010 may output a main signal to the safety logic 1040, and IP2 1020 may output a comparison signal to the safety logic 1040. The safety logic 1040 may be based on a reference signal. Figures 1 to 14Therefore, the SoC 1000 can detect whether there is a fault in the signals output by the first IP core 1010, the second IP core 1020, and the third IP core 1030 during the run-time operation, and detect whether the gate included in the safety logic 1040 is faulty.

[0109] Fig.16 is a block diagram illustrating a memory system 1100 including security logic consistent with certain embodiments of the inventive concepts.

[0110] Reference Fig.16 , the memory system 1100 generally includes a memory controller 1200 and a memory device 1300, wherein the memory controller 1200 controls access (e.g., write / read) to the memory device 1300 in response to a command from a host (not shown). Specifically, the memory controller 1200 may provide address, command, and control signals to the memory device 1300, and control programming operations, reading operations, and erasing operations on the memory device 1300.

[0111] The memory controller 1200 may include a first error correction code (ECC) encoder 1210, a second ECC encoder 1220, and a first security logic 1230. For example, the first ECC encoder 1210 and the second ECC encoder 1220 may perform an ECC encoding operation based on the input write data WD and the output first encoded write data WD_C1 and the second encoded write data WD_C2, respectively. For example, the second ECC encoder 1220 may include the same construction as the first ECC encoder 1210 to determine whether there is a fault in the signal output by the first ECC encoder 1210.

[0112] The first safety logic 1230 may be based on reference Figures 1 to 14 In an example embodiment, the first ECC encoder 1210 may output the first encoded write data WD_C1 as a main signal to the first safety logic 1230. In addition, the second ECC encoder 1220 may output the second encoded write data WD_C2 as a comparison signal to the first safety logic 1230. The first safety logic 1230 may output the first fault search signal CON_Sd_1 in response to the first encoded write data WD_C1 and the second encoded write data WD_C2.

[0113] The memory controller 1200 may further include a first ECC decoder 1240, a second ECC decoder 1250, and a second security logic 1260. For example, the first ECC decoder 1240 and the second ECC decoder 1250 may perform an ECC decoding operation based on the read data RD_C read from the memory device 1300, and output first decoded read data RD_1 and second decoded read data RD_2, respectively. For example, the second ECC decoder 1250 may include the same construction as that of the first ECC decoder 1240 to determine whether there is a fault in the signal output by the first ECC decoder 1240.

[0114] The second safety logic 1260 may be based on reference Figures 1 to 14 In an example embodiment, the first ECC decoder 1240 may output the first decoded read data RD_1 as a main signal to the second safety logic 1260. In addition, the second ECC decoder 1250 may output the second decoded read data RD_2 as a comparison signal to the second safety logic 1260. The second safety logic 1260 may output the second fault search signal CON_Sd_2 in response to the first decoded read data RD_1 and the second decoded read data RD_2.

[0115] Fig.17 is a conceptual diagram illustrating a vehicle 1400 including safety logic according to certain embodiments of the inventive concept.

[0116] Reference Fig.17 , the vehicle 1400 includes a processing component 1402, at least one sensor 1420, a communication interface (I / F) 1430, a drive control element 1440, an automatic navigation system 1450, and a user interface 1460. The sensor 1420 may include at least one camera device, an active scanning device (e.g., at least one light detection and ranging (LiDAR) sensor), at least one ultrasonic sensor, and at least one geospatial positioning device. The sensor 1420 may monitor at least a portion of the external environment surrounding the vehicle 1400 and generate a sensing signal.

[0117] The communication interface 1430 may include a transceiver and / or a global positioning system (GPS). The drive control element 1440 may include: a vehicle steering device configured to control the direction of the vehicle 1400; a throttle device configured to control the motor or engine of the vehicle 1400 and control acceleration and / or deceleration; a brake device configured to control the braking of the vehicle 1400; and an external lighting device.

[0118] The automatic navigation system 1450 may include a computing device configured to implement automatic control of the drive control element 1440. For example, the automatic navigation system 1450 may include a memory configured to store a plurality of program commands and at least one processor configured to execute the program commands. The automatic navigation system 1450 may be configured to control the drive control element 1440 based on a sensing signal output by the sensor 1420. The user interface 1460 may include a display indicating an instrument panel of the vehicle 1400.

[0119] In an example embodiment, the processing component 1402 may include security logic 1410. The security logic 1410 may be based on a reference Figures 1 to 14 1400 is implemented by the described embodiments. Although not shown, the vehicle 1400 may also include a configuration identical to that of each of the sensor 1420, the communication interface 1430, the drive control element 1440, the automatic navigation system 1450, and the user interface 1460 to determine whether there is a fault in a signal output by each of the sensor 1420, the communication interface 1430, the drive control element 1440, the automatic navigation system 1450, and the user interface 1460. Therefore, the vehicle 1400 may detect whether there is a fault in a signal output by at least one of the sensor 1420, the communication interface 1430, the drive control element 1440, the automatic navigation system 1450, and the user interface 1460 during runtime operation (e.g., during driving operation). In addition, the vehicle 1400 may detect whether a door included in the safety logic 1410 is faulty. Therefore, the safety of the vehicle 1400 may be further improved.

[0120] The foregoing exemplary embodiments of the inventive concept have been disclosed above with reference to the accompanying drawings. Although specific embodiments have been employed, they are used and interpreted in a general and descriptive sense only and not for purposes of limitation. It will be understood by those of ordinary skill in the art that various changes may be made to the disclosed embodiments in form and detail without departing from the spirit and scope of the inventive concept as defined in the appended claims.

Claims

1. A device comprising a safety logic, the device include: A first functional module configured to provide a main signal; a second functional module configured to provide a comparison signal; as well as The safety logic comprises: a trigger signal generator comprising at least one comparator, a feedback path, and a first multi-input gate, the at least one comparator being configured to provide a comparison result in response to the main signal and the comparison signal, the feedback path being configured to generate a first trigger signal in response to the comparison result and provide a feedback signal to the at least one comparator, and the first multi-input gate being configured to generate a second trigger signal in response to the comparison result; as well as A trigger signal monitor is configured to provide a final fault search signal in response to the first trigger signal and the second trigger signal.

2. The device according to claim 1, in, The feedback path includes: a second multi-input gate configured to generate the first trigger signal in response to the comparison result; a first delay circuit configured to delay an output of the second multi-input gate; and an inverter configured to provide the feedback signal by inverting an output of the first delay circuit.

3. The device according to claim 2, in, The first multi-input gate comprises an AND gate, and the second multi-input gate comprises an OR gate.

4. The device according to claim 2, in, The first multi-input gate comprises an OR gate, and the second multi-input gate comprises an AND gate.

5. The device according to claim 1, in, The trigger signal monitor comprises: a first XOR gate configured to provide a first error occurrence signal in response to the first trigger signal; a second XOR gate configured to provide a second error occurrence signal in response to the second trigger signal; a first output gate configured to provide a first fault search signal in response to the first error generation signal and the second error generation signal; and A second output gate is configured to provide a second fault search signal in response to the first error generation signal and the second error generation signal.

6. The device according to claim 5, in, The first output gate comprises a NAND gate, and the second output gate comprises a NOR gate.

7. The device according to claim 5, in, The trigger signal monitor comprises: a second delay circuit configured to delay the first error generation signal and provide the delayed first error generation signal to the first XOR gate; and a third delay circuit configured to delay the second error generation signal and provide the delayed second error generation signal to the second XOR gate.

8. The device according to claim 7, further comprising: include: A clock generator is configured to generate a clock signal, wherein the second delay circuit and the third delay circuit delay the first error generation signal and the second error generation signal respectively in response to the clock signal.

9. The device according to claim 8, further comprising: include: An error injector is configured to provide an error signal in response to the clock signal, wherein the first XOR gate further provides the first error generation signal in response to the error signal, and the second XOR gate further provides the second error generation signal in response to the error signal.

10. The device according to claim 9, in, The error injector includes a clock divider configured to divide the clock signal.

11. The device according to claim 1, further comprising: include: a controller configured to control the first functional module and the second functional module; as well as An interrupt generator is configured to generate an interrupt signal in response to the final fault search signal and provide the interrupt signal to the controller.

12. The device according to claim 1, in, The first functional module senses the temperature of the device and provides a temperature sensing value as the main signal, and The second functional module provides a critical temperature value as the comparison signal.

13. A device comprising a security logic, wherein the security logic include: a trigger signal generator configured to provide a first trigger signal and a second trigger signal in response to a main signal and a comparison signal, wherein each of the main signal and the comparison signal includes a plurality of bits; and a trigger signal monitor configured to provide a final fault search signal in response to monitoring the first trigger signal and the second trigger signal, Wherein, the trigger signal generator comprises: a plurality of comparators configured to compare the main signal with the comparison signal bit by bit and generate a comparison result; a feedback path configured to perform a first gate operation in response to the comparison result, generate the first trigger signal, and provide a feedback signal to each of the plurality of comparators in response to the first trigger signal; and A first multi-input gate is configured to perform a second gate operation and generate the second trigger signal in response to the comparison result.

14. The device according to claim 13, in, The trigger signal generator provides the first trigger signal and the second trigger signal in response to the main signal and the comparison signal during run-time of the device.

15. The device according to claim 13, further comprising: include: A clock generator is configured to provide a clock signal, wherein the feedback path provides the feedback signal in response to the clock signal.

16. The device according to claim 15, further comprising: include: An error injector is configured to generate an error signal in response to the clock signal, wherein the trigger signal monitor is configured to monitor the first trigger signal and the second trigger signal in response to the error signal.

17. The device according to claim 15, in, The feedback path includes: a first delay circuit configured to delay the first trigger signal in response to the clock signal; and An inverter is configured to provide the feedback signal by inverting an output of the first delay circuit.

18. The device according to claim 15, in, The trigger signal monitor comprises: a first XOR gate configured to provide a first error occurrence signal in response to the first trigger signal; a second delay circuit configured to delay the first error generation signal in response to the clock signal and provide the delayed first error generation signal to the first XOR gate; a second XOR gate configured to provide a second error occurrence signal in response to the second trigger signal; a third delay circuit configured to delay the second error generation signal in response to the clock signal and provide the delayed second error generation signal to the second XOR gate; and A plurality of output gates are configured to provide the final fault search signal in response to the first error generation signal and the second error generation signal.

19. The device according to claim 18, in, The plurality of output gates include: a NAND gate configured to provide a first fault search signal in response to the first error generation signal and the second error generation signal; and A NOR gate is configured to provide a second fault search signal in response to the first error generation signal and the second error generation signal.

20. A device comprising a security logic, the security logic include: a plurality of comparators, each receiving at least one bit of the main signal and at least one bit of the comparison signal, and configured to compare the main signal with the comparison signal on a bit-by-bit basis to generate a comparison result; a feedback path configured to generate a first trigger signal in response to the comparison result, and further configured to generate a feedback signal in response to a clock signal and the first trigger signal, wherein the feedback signal is provided to each of the plurality of comparators; a first multi-input gate configured to perform a first gate operation on the comparison result to generate a second trigger signal; an error injector configured to generate an error signal in response to the clock signal; and a trigger signal monitor configured to monitor the first trigger signal and the second trigger signal in response to the clock signal and the error signal, and to provide a final fault search signal, the final fault search signal providing information indicating whether the main signal is correctly correlated with the comparison signal and information indicating whether at least one of the plurality of comparators, the feedback path, the first multi-input gate, and the trigger signal monitor is faulty.

21. A method of operating a device comprising safety logic, the method include: determining whether the main signal is correctly correlated with the comparison signal, and generating a first trigger signal and a second trigger signal in response to the determination result of whether the main signal is correctly correlated with the comparison signal; as well as generating a final fault search signal in response to the first trigger signal and the second trigger signal, Wherein, determining whether the main signal is correctly correlated with the comparison signal includes: using a comparator to generate a comparison result in response to the comparison of the main signal with the comparison signal, and using a feedback path to generate the first trigger signal and a feedback signal in response to the comparison result, wherein the feedback signal is applied to the comparator, and The final fault search signal provides information indicating whether the main signal is correctly correlated with the comparison signal and information indicating whether at least one of the logic gates used in determining whether the main signal is correctly correlated with the comparison signal is faulty.

22. The method according to claim 21, in, The main signal includes a first plurality of bits, and the comparison signal includes a second plurality of bits, the comparator includes a plurality of comparators, and A determination of whether the primary signal is correctly correlated with the comparison signal is made using the plurality of comparators that respectively compare one of the first plurality of bits to another of the second plurality of bits.

23. The method according to claim 21, further comprising: include: The comparison result is applied to a first multi-input gate to make the first multi-input gate output the second trigger signal.

24. The method according to claim 23, further comprising: include: The comparison result is applied to a second multi-input gate of the feedback path to make the second multi-input gate output the first trigger signal.

Images