Scan chain self-test of lockstep cores at reset

Abstract

A system (300) includes a memory (206) configured to store test patterns. A first lockstep core (102) and a second lockstep core (104) are configured to receive a same set of test patterns. During a reset of the first lockstep core and the second lockstep core, a first scan output is generated from the first lockstep core (102) and a second scan output is generated from the second lockstep core (104). A comparator (306) can be coupled to the first lockstep core and the second lockstep core and configured to compare the first scan output and the second scan output. If the first and second scan outputs are the same, the first and second lockstep cores (102, 104) can be initialized to a similar state. The first and second lockstep cores can comprise non-resettable flip-flops.

Description

Background Technology

[0001] Electronic systems are used in a wide range of applications, including automotive, healthcare, defense, satellite, networking, communications, consumer electronics, and other electrical applications. For example, the number of electronic control units (ECUs) used in automobiles ranges from ten to over one hundred. The widespread use of electronic systems presents new challenges in meeting safety requirements, such as those for ECUs.

[0002] One way to address safety requirements is to equip electronic systems with fault tolerance and self-test capabilities. A fault-tolerant electronic system can be designed to operate the same set of operations at approximately the same time. Therefore, an electronic system can use two or more redundant systems to allow for error detection and correction. Thus, an electronic system with two or more redundant subsystems can operate in a “lockstep” manner, where each subsystem is configured to move from one well-defined state to the next in parallel and substantially concurrently. For example, when a first logic subsystem and a second logic subsystem are redundant (i.e., identical) and both receive the same inputs substantially simultaneously, the first logic subsystem and the second logic subsystem are referred to as lockstep subsystems in a lockstep operation mode. As lockstep subsystems operating in lockstep mode, it is expected that the logic value output from the first logic subsystem is the same as the logic value output from the second logic subsystem, and arrives at the output at substantially the same time.

[0003] A redundant, fault-tolerant lockstep subsystem contains sequential logic operating in a sequential operation state, where one sequential lockstep subsystem or lockstep core repeatedly operates and substantially concurrently with another. In parallel, repetitive, and substantially concurrent operation, redundant lockstep cores containing sequential logic operate in lockstep mode to improve the data integrity and overall security of the electronic system. Two or more lockstep cores operating in lockstep mode can share a common instruction stream and a synchronization clock. The results of each instruction applied in parallel to each of the multiple repetitive lockstep cores are expected to produce the same output at substantially the same time. Lockstep cores operating in lockstep mode can be integrated into a single integrated circuit die or integrated onto multiple dies in a single die package. Summary of the Invention

[0004] According to at least one embodiment of this disclosure, a system includes a memory configured to store test patterns. A first lockstep core and a second lockstep core are configured to receive the same set of test patterns. During a reset of the first lockstep core and the second lockstep core, a first scan output is generated from the first lockstep core, and a second scan output is generated from the second lockstep core. A comparator may be coupled to the first lockstep core and the second lockstep core and is configured to compare the first scan output with the second scan output.

[0005] According to at least one other embodiment of this disclosure, a method includes simultaneously applying a set of test patterns to a first plurality of scan chains and a second plurality of scan chains during the reset of a first and a second lockstep core. The first lockstep core may include the first plurality of scan chains, and the second lockstep core includes the second plurality of scan chains. A first set of scan outputs may be generated from the first plurality of scan chains, and a second set of scan outputs may be generated from the second plurality of scan chains, and the first set of scan outputs may be compared with the second set of scan outputs. If the first and second sets of scan outputs are identical, then the first and second lockstep cores may be initialized to a similar state. Attached Figure Description

[0006] Detailed descriptions of various examples will now be provided with reference to the accompanying drawings, in which:

[0007] Figure 1 Block diagrams of multi-core electronic systems operating in lockstep mode and undergoing reset, based on various examples;

[0008] Figure 2 Block diagrams of multi-core electronic systems operating in lockstep mode and undergoing reset using at least a self-test controller and test mode, based on various examples;

[0009] Figure 3 Block diagrams of multi-core electronic systems operating in lockstep mode and undergoing reset using at least a self-test controller, test mode, and scan chain, based on various examples;

[0010] Figure 4 Block diagrams illustrating non-resettable sequential logic in a multi-core electronic system operating in lockstep mode, based on various examples;

[0011] Figure 5 The timing diagrams demonstrate test modes for scan chains during core reset and lockstep initialization, based on various examples; and

[0012] Figure 6 The flowchart illustrates the test mode test of the scan chain when resetting the lockstep core, based on various examples, and the comparison of scan outputs to initialize the lockstep core. Detailed Implementation

[0013] The lockstep core may have storage elements that store the sequential state within each core. These storage elements may be or may contain registers, and consistency checks may not always be performed on the registers. However, external activities of the lockstep core can be compared to determine whether the electronic system has met safety requirements.

[0014] For example, if one of the lockstepping cores is corrupted or experiences a hardware malfunction or error, the lockstepping core may execute incorrect instructions and / or use incorrect data, thereby producing incorrect results. The malfunction or error can be determined by comparing the output of one lockstepping core with the output of the other. However, if the output of an instruction that is typically applied between two lockstepping cores with zero or less delay matches within the core, the core will proceed to the next instruction. If the outputs do not match, possibly due to a hardware malfunction in one lockstepping core, an error is detected and a signal indicating the error is sent.

[0015] Therefore, when logic circuits or cores operate in lockstep mode, data integrity intended to meet higher security requirements in certain electronic systems can be partially achieved. To further enhance security and data integrity, lockstep cores may include a self-test controller. The self-test controller periodically self-tests the core to ensure data integrity within it. For example, the self-test controller can be configured to apply test modes, such as predefined test modes, pseudo-random test modes, or random test modes. The self-test controller can apply test modes to lockstep cores to periodically test these cores. For example, if the same test mode is applied to every lockstep core, and the scan outputs from the cores do not match, an error is detected on the lockstep core.

[0016] The logic circuitry or subsystem of a lockstep core may include storage elements or devices. Furthermore, the storage devices may include flip-flops, and those flip-flops may be non-resettable. When powered on or when a reset occurs, the logic value within the storage device may become indeterminate and may transition to an undesired state, or it may maintain a different logic value or state relative to another lockstep core within one lockstep core.

[0017] Figure 1 An electronic system 100 according to one example is depicted. The electronic system 100 may include a redundant fault-tolerant system comprising a first lockstep core 102 and a second lockstep core 104. Lockstep cores 102 and 104 may receive instructions and data from memory 106. For example, if the lockstep core is a processing core, then a common instruction stream may be sent from memory 106 to the first lockstep core 102 and the second lockstep core 104. Each of lockstep cores 102 and 104 may include volatile storage devices for storing logical states within the lockstep core. For example, storage device 103 in lockstep core 102 may include status registers RA and RB, and storage device 105 in lockstep core 104 may include status registers RC and RD. Storage device 103 may be a volatile storage device coupled with combinational and sequential logic for storing data corresponding to the internal state of lockstep core 102, and storage device 105 may be a volatile storage device coupled with combinational and sequential logic for storing data corresponding to the internal state of lockstep core 104.

[0018] One or more of these storage devices may not have a reset input and are therefore non-resettable. For example, when power is supplied to electronic system 100, registers RA and RB of storage device 103 may become initialized to logic values ​​different from those of registers RC and RD of storage device 105. Therefore, the internal logic state or value in lockstep core 102 may differ from the internal logic state or value in lockstep core 104. During startup, power-on, power-on reset, reset, or initial power supply to cores 102 and 104, the difference in logic state or value from one lockstep core 102 to another lockstep core 104 is partly due to the fact that storage devices 103 and 105 of lockstep cores 102 and 104 are respectively non-resettable, or at least non-resettable to deterministic logic values ​​or states similar to those in the first lockstep core 102 relative to the second lockstep core 104. Most storage devices or flip-flops are non-resettable.

[0019] During power-on reset, a reset signal (RESET) can be sent from the actuator or power-on reset module 110 to lockstep cores 102 and 104. The logic values ​​or states (hereinafter referred to as "logic states") of storage devices 103 and 105 of lockstep cores 102 and 104 can be read during the power-on reset operation. If the logic state stored in registers RA and RB of storage device 103 or in any memory device within the first lockstep core 102 is the same as the logic state stored in registers RC and RD of storage device 105 of the second lockstep core 104, as read by comparator 116, then lockstep cores 102 and 104 are correctly initialized upon power-on, and normal lockstep mode operation can then begin. However, because storage devices 103 and 105 can be non-resettable flip-flops, lockstep comparator 116 will determine the value of the logic state read from lockstep cores 102 and 104. The logic states may not match, even if they should, because lockstep cores 102 and 104 repeat each other, and the logic states output from lockstep cores 102 and 104 should be in lockstep and equal. If the logic states inside lockstep cores 102 and 104 do not match, then lockstep comparator 116 may send an error signal (ERROR).

[0020] Non-resettable storage devices 103 and 105 may have fixed and defined lengths within their respective lockstep cores 102 and 104. Because the lengths are fixed in both storage devices 103 and 105, and are identical within storage device 103 compared to storage device 105, the amount of time required to determine that cores 102 and 104 have been initialized to the same value after a reset is fixed, and the time required for this determination is relatively short. Lockstep comparator 116 may be deactivated for a relatively short period until it is determined that the lockstep cores have been correctly initialized to the same value. Once confirmed, the reset operation stops, and normal operation resumes thereafter. Normal operation includes, for example, sending data to circuit 120 having two or more lockstep cores 102 and 104 via an input channel containing an input signal (INPUT), and sending data from circuit 120 via an output channel containing an output signal (OUTPUT).

[0021] In addition to including lockstep cores 102 and 104, and initializing these cores to common values ​​or states upon reset, a fault-tolerant electronic system that meets safety requirements may also include a self-test controller. The self-test controller for the fault-tolerant electronic system can be advantageously used for scanchain testing during power-on reset to initialize the non-resettable storage devices 103 and 105 in the lockstep cores 102 and 104.

[0022] Figure 2 The electronic system 200 includes a self-test controller 202 incorporated with lockstep cores 102 and 104. The self-test controller 202 may be a logic-in-the-loop (LBIST) controller configured on the same semiconductor substrate or die containing lockstep cores 102 and 104. In another example, the self-test controller 202 and each of lockstep cores 102 and 104 may be distributed on different dies and communicatively associated to perform self-tests on lockstep cores 102 and 104. The self-test controller 202 may include a clock generator and circuitry for applying test patterns from memory or from a pseudo-random generator. The clock generator may be configured to generate a clock signal for each test cycle. A comparator 204 may be configured to analyze scan outputs, such as test response signatures received from a compressor and decompressor (CODEC) (hereinafter referred to as "codec") 210 coupled to lockstep cores 102 and 104.

[0023] Test pattern memory 206 may store one or more test patterns. Alternatively, test patterns may be derived from a pseudo-random pattern generator (PRPG). Test patterns may be retrieved by self-test controller 202 from the PRPG and / or from test pattern memory 206 for scanning tests of lockstep cores 102 and 104. Test pattern memory 206 may include read-only memory (ROM), random access memory (RAM), and any other volatile or non-volatile memory. Test pattern memory 206 may include multiple memory locations for storing test patterns with logic values ​​1 and 0. Test patterns retrieved from test pattern memory 206 may be the same as those sent from self-test controller 202 to the scan compression circuitry of codec 210.

[0024] To perform scan testing upon power-on reset of lockstep cores 102 and 104, test patterns are applied in parallel and substantially simultaneously to lockstep cores 102 and 104 via codec 210, with possible signal path delays from one lockstep core 102 to the other lockstep core 104. At each transition of the scan clock, which is provided as part of a control signal sent from self-test controller 202, multiple test patterns with logic 1 and logic 0 values ​​are sent from self-test controller 202 as scan inputs from codec 210 to lockstep cores 102 and 104. For example, the test patterns from self-test controller 202 are decompressed via a decompressor coupled to codec 210, and the decompressor decompresses this set of test patterns into the scan inputs. The scan inputs are further applied to multiple scan chains for scan testing of lockstep cores 102 and 104.

[0025] The compressor or compactor within codec 210 receives outputs from multiple scan links and compacts these outputs into a compacted or compressed scan output, also known as a test response signature. In one instance, the compacted scan output is provided in the form of a test response signature. As shown, for example, the response signature may then be sent to comparator 204. The scan output does not necessarily have to be in the form of a test response signature, and if the scan output is not compacted, it may be in other suitable forms of scan output. If comparator 204 performs a comparison of the compacted scan output of the test response signature, the comparison or measurement is performed after the scan input has been first shifted into or loaded into, for example, a multi-input signature register (MISR) compactor or compressor.

[0026] Comparator 204 operates with two comparator functions. The first comparator function compares the internal logic states of lockstep cores 102 and 104 during each function access operation. The second comparator function compares the test response signature of lockstep core 102 with the test response signature of lockstep core 104. During scan chain testing, comparing the test response signatures forms part of the self-test controller functionality and scan output. The internal logic states of a set of non-resettable triggers from storage device 103 within the first lockstep core 102 are scanned out from lockstep core 102 substantially synchronously with the internal logic states of a set of non-resettable triggers from storage device 105 within the second lockstep core 104. If the internal logic values ​​between lockstep cores 102 and 104 do not match after power-on reset, an error is indicated. Comparator 204 can also compare the test response signature with a expected signature stored in expected signature memory 214. Expected signature memory 214 may be the same memory as test mode memory 206, wherein the expected signature is addressed in a location within said memory that differs from the addressable test mode location. Comparator 204 can compare the scan outputs or response signatures generated from lockstep cores 102 and 104 with each other and / or with expected signatures in memory 214 to determine faults within lockstep cores 102 and 104. Furthermore, comparator 204 can compare the compacted scan output or test response signature from the first lockstep core 102 with the compacted scan output or test response signature from the second lockstep core 104. If the same pattern is applied substantially simultaneously and in parallel to both lockstep cores 102 and 104 and the compacted scan outputs differ in lockstep cores 102 and 104, then a fault can be determined in at least one lockstep core 102 or 104.

[0027] according to Figure 2 The block diagram shown illustrates that lockstep cores 102 and 104 are configured to include a scan chain implemented during a self-test upon reset. The scan chain may use compression; however, compression and decompression are not necessarily required to perform lockstep core initialization when resetting a non-resettable memory device. If compression is used, lockstep cores 102 and 104 may be coupled to a decompressor and a compressor, alternatively referred to as a compactor. The decompressor and compactor may be included within codec 210. Figure 3 This describes the functionality of the scan chain system implemented on electronic system 300 during power-on reset.

[0028] The test may involve compression. Within the compressor or compactor 302 of the electronic system 300 being tested or reset, compressor 302 may contain a multi-input signature register (MISR), or may contain multiple MISRs. One or more MISRs are activated to compress M different scan chains SC1-SCM from N different scan inputs derived from the test mode sent to decompressor 304. Variables M and N are integers greater than zero. The MISRs are configured to provide N test response signatures for the electronic circuit 300 based on the M different scan chains. As used herein, the terms "circuit" or "system," when referring to an electronic circuit or electronic system, may include a collection of active and / or passive components that form circuit functionality, such as analog circuits, control circuits, or digital circuits. For example, active and / or passive components may be fabricated on a common substrate or fabricated on multiple different substrates but packaged together. The term "MISR output" for the test response signature sent to comparator 306 refers to the data value stored in the MISR after at least one bit from each scan chain has been timed into the MISR. The MISR can contain the following circuitry: flip-flops, preceded by XOR logic at the output of each scan chain. If the contents of scan chains SC1-SCM are timed into the MISR, then the MISR can generate a complete signature. Figure 3 In this example, the scan input receives test patterns from decompressor 304. Decompressor 304 expands the test pattern sequence from, for example, N parallel feed bits to M bits.

[0029] The data in the corresponding scan chains SC1-SCM reflect the output response, specifically the output response from lockstep cores 102 and 104. The self-test controller 202 not only sends the test mode to the decompressor 304 but also sends control signals, including scan enable (SCAN EN) and scan clock (SCAN CLK), to the scan chain. Furthermore, the control signals may include MISR reset (MISR RST) and MISR clock (MISR CLK) sent to the compressor 302 and possibly to one or more shift registers 310. Electronic system 300 does not require compression of the scan chain. Instead, a complete (uncompressed) scan chain can be configured in lockstep cores 102 and 104 without any decompressor 304 or compressor 302.

[0030] Each of the plurality of SC1-SCM scan chains 1 to M can store one or more test data bits to test lockstep cores 102 and 104. Each of the plurality of SC1-SCM scan chains 1 to M in lockstep core 102 preferably has the same length and contains the same number of bits. Furthermore, each of the plurality of SC1-SCM scan chains 1 to M in lockstep core 104 preferably has the same length in lockstep core 104, and preferably has the same length as the SC1-SCM scan chains in lockstep core 102, and also contains the same number of bits as in lockstep core 102. One or more shift registers 310 can be loaded from interface 314 and can store one of N comparison signatures, where N is a variable integer greater than zero. The comparison signature is alternatively referred to as the expected signature obtained from the expected signature memory 214. The expected signature is used to verify and initialize the response signature sent as scan output from the scan chains SC1-SCM to compressor 302. Interface 314 can be implemented as a Joint Test Action Group (JTAG) interface. Other interfaces are possible, including custom interfaces (serial or parallel). In an alternative instance, shift register 310 may not be provided. Instead, the contents of the compressor 302's MISR can be directly shifted out to comparator 306 for comparison with the expected signature from the expected signature memory 214.

[0031] If compression is used, compressor 302 may contain one or possibly two or more MISRs. If two MISRs are used, the first MISR may receive the scan chain SC1-SCM output (scan output) from the first lockstep core 102, and the second MISR may receive the scan chain SC1-SCM scan output (scan output) from the second lockstep core 104. The compressed or compacted scan output from each MISR may be sent to comparator 306. Comparator 306 then compares the compacted scan output derived from one lockstep core 102 with the compacted scan output derived from the other lockstep core 104 to determine if they are the same. The scan output from core 102 is expected to be the same as the scan output from core 104 because the same scan input is sent substantially simultaneously to both cores 102 and 104, which are redundant lockstep cores. If the scan outputs from the SC1-SCM scan chain are the same, lockstep cores 102 and 104 may be initialized to the same state upon reset. If the scan output of the SC1-SCM scan chain from core 102, compared by comparator 306, differs from the scan output of the SC1-SCM scan chain from core 104, then an error or fault signal can be sent from comparator 306. Comparator 306 can also send an error or fault signal if the compacted scan output at reset does not match the expected signature from memory 214.

[0032] If one or more shift registers 310 are implemented for comparison between the expected signature and the test response signature, then interface 314 may include a processor or self-test controller. The processor or controller within interface 314 controls the loading and unloading of shift register 310 and controls data exchange between the compressor 302's MISR and shift register 310. In one instance, interface 314 retrieves the expected signature from expected signature memory 214 (e.g., a file or memory location) and loads shift register 310. In another instance, interface 314 may be provided as an on-chip controller to access the compressor 302's MISR. Loading of interface 314 relative to the compressor 302's MISR maintains bit-by-bit synchronous loading of shift register 310. Synchronizing the loading of shift register 310 and the scan output's MISR allows comparator 306 to compare the logical values ​​of each bit of the response signature with each other (within cores 102, 104) and with the expected signature to isolate faults at the bit level within one or more lockstep cores 102, 104. Comparator 306 performs bit-to-bit and / or pattern-to-pattern comparisons. Electronic system 300 can also send the output from comparator block 306 to, for example, a self-test controller 202. If any failure bit within a pattern is detected in the compared scan output, an error signal (ERROR) can be sent.

[0033] Figure 4 A storage device 400 is shown that does not have a reset input and is therefore not resettable upon power-on reset. The storage device 400 may be a flip-flop, and specifically, a non-resettable flip-flop. The storage device may be coupled together within the sequential logic of lockstep cores 102 and 104. Specifically, the non-resettable storage device 400 may be coupled to storage devices 103 and 105 of lockstep cores 102 and 104, respectively. Figure 1 These are contained together. In addition to existing in lockstep cores 102 and 104, the non-resettable storage device 400 may also be configured in registers RA and / or RB. The non-resettable storage device 400 may be configured as a scan chain SC1-SCM to receive scan inputs or test modes and generate scan outputs upon reset. Upon reset, the non-resettable storage device 400 will maintain its internal logic value or state, which is indeterminate and different within core 102 relative to core 104. However, upon reset, the indeterminate state can be refreshed from the storage device 400 of lockstep cores 102 and 104, and after reset, the indeterminate state can be made into the same deterministic state, wherein the internal state of one lockstep core is initialized to the internal state of another lockstep core through the scan chain application of the test mode scan input vector implemented via the self-test controller 202.

[0034] Figure 5This diagram illustrates an example timing diagram 500 used for scanning chain testing and comparing scan outputs upon reset. On the left side of Figure 500, various interface signals are shown. Interface signals may include a scan clock (SCAN CK) 502 to clock data from the scan chain whenever a scan unit of the scan chain is enabled via scan enable (SCAN EN) 504. A MISR reset (MISR RST) 506 can reset... Figure 3 The compressor 302 shown in the figure has one or more MISRs. The MISR clock (MISR CLK) 508 can time data to and from the MISR of the compressor 302. The scan clock can shift the test mode of the logic state within each lockstep core 102, 104 to the MISR compressor. Then, the MISR compressor can receive a reset (MISR RST) 506, so that it receives a scan output on its input. Then, the MISR shifts the scan output when it receives the MISR CLK 508 synchronized with the scan clock. The shifted MISR output is applied to comparator 306 ( Figure 3 This determines whether a match occurs between the scan output in or from cores 102 and 104 and the expected scan output. If no match occurs, the error signal (PASS / FAIL) 510 is changed to an appropriate value and can be sent from comparator 306, which signals that lockstep cores 102 and 104 have not been initialized at reset.

[0035] If lockstep cores 102 and 104 are initialized during reset (CORE_RST) 512 when CORE RST 512 transitions to the appropriate logic value, the initialization may involve a comparison between one MISR output and another MISR output, such that the scan outputs derived from each lockstep core are compared to each other. Therefore, initialization can be performed during the lockstep core reset (RESET) 514. The lockstep core reset includes a RESET cycle 514, in which lockstep cores 102 and 104 are initialized to the same internal logic state. If the lockstep cores are initialized to the same internal logic state for subsequent operation in lockstep operation mode, where instructions are executed in a repetitive and lockstep manner within lockstep cores 102 and 104 after reset, it is expected that the lockstep cores will be initialized to the same internal state before functional operation. If comparator 306 further compares the scan output response signatures from lockstep cores 102 and 104 with the expected signatures, additional fault detection can be applied.

[0036] Figure 6This is a flowchart illustrating an example method 600 for performing a self-test of one or more lockstep cores. The lockstep core may be part of an electronic system, which includes a self-test controller and other components for performing the self-test of the core during a core reset. These other components may contain compressed logic for initializing the lockstep core as a safety device. The core is a hard macro or an intellectual property (IP) device containing a non-resettable memory or a flip-flop that refreshes the non-resettable memory with the correct logic value when powered on. Therefore, by using components already available for scan testing, the non-resettable memory of the lockstep core is initialized to the same value upon reset. For example, a self-test controller and scan chains can be used to initialize the lockstep core, but these chains and the controller are still required during normal periodic testing. A test mode from the self-test controller is used to refresh the non-resettable memory in both lockstep cores to the same value upon reset. Because the scan chain length of the lockstep core is fixed, the initialization time of the two lockstep cores 102 and 104 is the same and finite. For example, if the scan chain length of the lockstep core under test is 64, 128, or 256 scan units or memory devices, then the core will be initialized in the same number of cycles determined by the scan shift frequency. If the scan clock's scan shift frequency is 100 MHz or greater, then depending on the scan length, the core can be initialized within 640 ns, 1.28 ms, or 2.56 ms from the time cores 102 and 104 are powered on, activated, or triggered upon reset. Lockstep cores do not need to begin operational functionality until they are initialized with a self-test controller and a scan chain used to refresh the state within the lockstep core to determine equal states between lockstep cores.

[0037] Lockstep cores initialized with a self-test controller and scan chains upon reset offer high compliance in terms of safety and also provide the ability to initialize the lockstep core upon reset before enabling two lockstep core functions. Comparator logic can be enabled upon reset, and the lockstep core will be initialized in a short time while reusing existing self-test controllers and associated scan chains. Initialization of the lockstep core begins at block 601. At block 602, it is determined whether the lockstep core is experiencing a power-on reset condition, or any condition where a reset has occurred but the storage of memory logic state values ​​within the core is non-resettable. If a reset condition has occurred (e.g., during power-on of the electronic system), then the scan chains will receive the test mode at 604, and scan clock signal 606 and scan enable signal 608 trigger each scan chain to shift the test mode through multiple scan chains, and generate scan outputs from those chains within two or more lockstep cores, as shown by block 610.

[0038] At box 617, it is determined whether all test modes have been applied to the scan chain. If not, the scan process at box 604 and the scan output generated at box 610 are repeated. For example, the scan output from the scan chain is applied to the MISR, and the MISR performs its serial shift. At box 616, the scan output or response signature from the scan chain is then compared. Comparison 616 is made between scan outputs derived from one lockstep core to another. Next, at box 618, it is determined whether the scan output (response signature) of one lockstep core is the same as the scan output (response signature) of another lockstep core. If the scan outputs of the lockstep cores are the same, initialization can end, as shown by box 620, and normal functional operation of the lockstep cores can then begin, as shown by box 622. At box 618, if the scan output (response signature) of one lockstep core is different from the scan output (response signature) of another lockstep core, an error signal 624 is generated, indicating that proper initialization of similar logic state values ​​within the lockstep core has not been achieved. Furthermore, if the scan output (response signature) of one or two lockstep cores differs from the expected signature, then a 624 error signature is generated and sent, and proper initialization of the expected logic state values ​​inside the lockstep core is not achieved.

[0039] In the foregoing discussion and claims, the terms “comprising” and “including” are used in an open manner and should therefore be interpreted as meaning “including but not limited to…”. Furthermore, the term “coupled” means an indirect or direct connection. Thus, if a first device is coupled to a second device, the connection can be a direct connection or an indirect connection via other devices and connections. Similarly, devices coupled between a first component or location and a second component or location can be a direct connection or an indirect connection via other devices and connections. Elements or features “configured to” perform a task or function can be configured by the manufacturer at the time of manufacture (e.g., programmed or structurally designed) to perform a function and / or can be configured (or reconfigured) by the user after manufacture to perform a function and / or other additional or alternative functions. Configuration can be achieved through firmware and / or software programming of the device, through the construction and / or layout of the device’s hardware components and interconnects, or combinations thereof. Additionally, the use of the phrase “grounded” or similar terms in the foregoing discussion is intended to include base plate grounding, grounding, floating grounding, virtual grounding, digital grounding, common grounding, and / or any other form of grounding connection suitable for or appropriate to the teachings of this disclosure. Unless otherwise stated, “approximately,” “about,” or “generally” preceding a value means + / - 10% of the stated value.

[0040] The foregoing discussion is intended to illustrate the principles and various embodiments of this disclosure. Those skilled in the art will understand numerous variations and modifications upon fully understanding the foregoing disclosure. The appended claims are intended to be construed as covering all such variations and modifications.

Claims

1. A system comprising: A memory configured to store test modes; The first lockstep core has a first lockstep core memory; The second lockstep core has a second lockstep core memory; A self-test controller, operably coupled to the first lockstep core and the second lockstep core, is configured to: After the start events of the first lockstep core and the second lockstep core, the first lockstep core memory and the second lockstep core memory are initialized using the same group of the test mode; A first scan output is generated from the first lockstep core in response to the initialization of the first lockstep core memory; and A second scan output is generated from the second lockstep core in response to the initialization of the second lockstep core memory; and A comparator coupled to the first lockstep core and the second lockstep core, and configured to compare the first scan output with the second scan output.

2. The system according to claim 1, wherein: The first lockstep core memory includes a first plurality of scan chains, and the second lockstep core memory includes a second plurality of scan chains.

3. The system of claim 2, wherein the operable start event includes at least one of the following: startup, power-on, power-on reset, reset, or initial power supply to the core.

4. The system of claim 2, further comprising a multi-input signature register coupled to the first and second plurality of scan chains and configured to forward the first and second scan outputs to the comparator.

5. The system of claim 2, wherein the comparator is further configured to generate an error signal when the first scan output does not match the second scan output; The self-test controller is coupled to the comparator; and The self-test controller is configured to forward a control signal to the first lockstep core and the second lockstep core after receiving the error signal, so as to stop the operation of the first lockstep core and the second lockstep core.

6. The system of claim 1, wherein the comparator is configured to be deactivated after the operable start event, and wherein the self-test controller is configured to enable the comparator after performing the initialization action.

7. The system according to claim 1, wherein: The first lockstep core memory includes a first scan chain; The second lockstep core memory includes a second scan chain; The first scan chain includes a first non-resettable trigger having an input to the group configured to receive a test mode; and The second scan chain includes a second non-resettable trigger having an input to the group configured to receive a test mode.

8. The system according to claim 1, further comprising: A first multi-input signature register is coupled between the comparator and the first lockstep core comprising M first scan chains, where M is a variable positive integer; A second multi-input signature register is coupled between the comparator and the second lockstep core, which comprises M second scan chains; and The M first scan chains and the M second scan chains are coupled to receive N test modes in parallel, where N is a variable positive integer.

9. A system comprising: A memory configured to store test modes; The first lockstep core includes a first plurality of non-resettable triggers; The second lockstep core includes a second plurality of non-resettable triggers; A self-test controller is operatively coupled to the first lockstep core and the second lockstep core; The self-test controller is configured to, after the start events of the first lockstep core and the second lockstep core, cause the group using the test mode to initialize the first plurality of non-resettable triggers, and cause the first lockstep core to generate a first scan output in response to the initialized first plurality of non-resettable triggers; and The self-test controller is configured to, after the start event of the first lockstep core and the second lockstep core, cause the group using the test mode to initialize the second plurality of non-resettable triggers, and cause the first lockstep core to generate a second scan output in response to the initialized second plurality of non-resettable triggers; as well as The comparator is configured to: be deactivated after the start event, be activated after initialization of the first and second plurality of non-resettable triggers, receive the first scan output and the second scan output as inputs, and compare the first scan output and the second scan output.

10. The system of claim 9, wherein the first plurality of non-resettable triggers are coupled in series, and wherein the second plurality of non-resettable triggers are coupled in series.

11. The system of claim 9, further comprising: A processor, wherein the processor includes the first lockstep core, the second lockstep core, the memory, and the self-test controller; The first lockstep core and the second lockstep core are each configured to receive a common instruction stream.

12. The system of claim 9, wherein the self-test controller is coupled between the memory, the first and second plurality of non-resettable flip-flops, and the comparator, and The comparator is configured to generate a signal based on a comparison between the first and second scan outputs and send the signal to the self-test controller.

13. The system of claim 9, further comprising a expected scan output memory configured to store expected scan outputs and coupled to the comparator; The comparator is configured to compare the first scan output with the expected scan output, and to compare the second scan output with the expected scan output; and The comparator is configured to generate an error signal if (1) the first and second scan outputs are different, (2) the first scan output is different from the expected scan output, or (3) the second scan output is different from the expected scan output.

14. A method comprising: After the start events of the first lockstep core and the second lockstep core, the group of test modes is applied simultaneously using the built-in self-test controller to initialize both the first plurality of scan chains and the second plurality of scan chains, wherein the first lockstep core includes the first plurality of scan chains and the second lockstep core includes the second plurality of scan chains. In response to the initialization of the first plurality of scan chains, the first lockstep core is used to generate a first set of scan outputs; In response to the initialization of the second plurality of scan chains, a second set of scan outputs is generated using the second lockstep core; Compare the first set of scan outputs with the second set of scan outputs; and In response to the comparison step determining that the first group of scan outputs and the second group of scan outputs are the same, the first and second lockstep cores are enabled.

15. The method of claim 14, wherein the group test mode is applied without resetting the plurality of triggers within the first and second lockstep cores.

16. The method of claim 14, further comprising: Compare the first set of scan outputs with a set of expected scan outputs; Compare the second set of scan outputs with the expected set of scan outputs; In response to the step of comparing with the expected scan output of the group, it is determined that the first and second group scan outputs are the same as the expected scan output of the group, and the first and second lockstep cores are enabled to start functional operation.

17. The method of claim 14, wherein an error signal is generated in the following circumstances: (1) the first group of scan outputs is different from the second group of scan outputs, (2) the first group of scan outputs is different from the expected scan output of the group, or (3) the second group of scan outputs is different from the expected scan output of the group.

18. The method of claim 14, further comprising: Load the first group of scan outputs into the first multi-input signature register; Load the second group of scan outputs into the second multi-input signature register; The first multi-input signature register is updated by timing at least one bit from the first set of scan outputs; The second multi-input signature register is updated by timing at least one bit from the second group of scan outputs; Compare the output from the first multi-input signature register with the expected scan output of the group; and Compare the output from the second multi-input signature register with the expected scan output of the group.

19. A method comprising: During the start events of the first and second lockstep cores, the first lockstep core includes a first scan chain and the second lockstep core includes a second scan chain: The self-test controller is used to apply a test mode to initialize the first scan chain; and The test mode is applied using the self-test controller to initialize the second scan chain, wherein the first scan chain includes a first set of non-resettable triggers, and the second scan chain includes a second set of non-resettable triggers.

20. The method of claim 19, further comprising: In response to the initialization of the first scan chain, the first scan output is generated using the first lockstep core; In response to the initialized second scan chain, the second lockstep core generates the second scan output; Compare the first scan output with the second scan output; and In response to the comparison determining that the first scan output is the same as the second scan output, the first lockstep core and the second lockstep core are enabled to begin functional operation.

Images