A fault collection and management system and method in an on-chip system

Abstract

This invention relates to a fault collection, management system, and method for an on-chip system. The system includes a register interface unit, a handshake unit, a state machine unit, a state output unit, and a fault interface unit. The register interface unit is connected to the handshake unit, the handshake unit is connected to the state machine unit, and the state machine unit is connected to the state output unit. The register interface unit implements register configuration, bus interface, and interrupt interface, etc.; the handshake unit synchronizes the bus clock signal with the internal logic signals; the fault interface unit implements fault input, detection, and classification; the state machine unit implements fault control and management, including predefined fault configuration, fault alarms, and fault responses, etc.; the state output unit implements the system's state output and response output. This invention uses a purely hardware approach to achieve the detection, collection, and processing of system faults without processor intervention, and guides the device to a safe state in a controllable manner when a fault occurs, thereby improving the safety and reliability of processor operation in the on-chip system and increasing the efficiency of system debugging.

Description

Technical Field

[0001] This invention belongs to the field of integrated circuit design technology, and particularly relates to a fault collection and management system and method in an on-chip system. Background Technology

[0002] With the continuous development of integrated circuits, the scale of on-chip systems is getting larger and larger, and the frequency of system failures during processor chip operation is getting higher and higher. It is difficult to accurately locate the source of the failure and deal with it in a timely manner, which greatly reduces the security and reliability of the system. Summary of the Invention

[0003] To address the technical problems existing in the background art, the present invention provides a fault collection and management system and method in a system-on-a-chip. It adopts a pure hardware approach to realize the detection, collection and processing of system faults without the participation of the processor, and guides the device to a safe state in a controllable manner when a device malfunctions, thereby improving the safety and reliability of the processor operation in the system-on-a-chip and improving the efficiency of system debugging.

[0004] The technical solution of this invention is as follows: This invention is a fault collection and management system in an on-chip system, characterized in that: the management system includes a register interface unit, a handshake unit, a state machine unit, a state output unit, and a fault interface unit. The register interface unit is connected to the handshake unit, the handshake unit is connected to the state machine unit, and the state machine unit is connected to the state output unit. The register interface unit implements register configuration, bus interface, and interrupt interface, etc.; the handshake unit realizes the synchronization of the bus clock signal and the internal logic signal; the fault interface unit realizes fault input, detection, and classification; the state machine unit realizes fault control and management, including the configuration of predefined faults, fault alarms, and fault responses, etc.; the state output unit realizes the status output and response output of the system.

[0005] Furthermore, the register interface unit has a standard APB bus slave interface, using a 32-bit address bus and a 32-bit data bus; after the software enables the system to enter the configuration state, the enable and response modes of critical and non-critical faults can be configured through the register interface unit, and the fault handling status can be read.

[0006] Furthermore, the handshake unit synchronizes the configuration information of critical and non-critical faults to the state machine unit and the fault interface unit; the handshake unit includes a master handshake unit and a slave handshake unit, the register interface unit is connected to the master handshake unit, the master handshake unit is connected to the slave handshake unit, and the slave handshake unit is connected to the state machine unit.

[0007] Furthermore, the fault interface unit identifies external input faults and distinguishes between non-critical and critical faults.

[0008] Furthermore, the status output unit manages to output two signals to indicate the status of the system, including fault status, normal status, and configuration status.

[0009] Furthermore, the state machine unit is internally equipped with a state machine, a watchdog timer, a safe mode request timer, and an alarm timer. The watchdog timer, safe mode request timer, and alarm timer are connected to the state machine to control and handle faults. Fault control and management are achieved through the internal watchdog timer, safe mode request timer, and alarm timer, which is implemented by the state machine.

[0010] Furthermore, the state machine includes four states, as follows:

[0011] 1) Configuration state: Used to change the default configuration of the system. The configuration state defines the global configuration, fault response, timeout, and masking of non-critical faults of the system. The relevant registers can only be accessed in write mode in the configuration state.

[0012] 2) Normal state: The state in which no faults occur, which is the default state or the state after reset;

[0013] After a critical failure occurs, the system transitions to a fault state.

[0014] After a non-critical fault that has not been masked and has timed out occurs, the system transitions to a fault state.

[0015] After a non-critical fault that is not masked and whose enable timeout occurs, the system switches to alarm mode.

[0016] After a non-critical failure occurs, maintain normal operation.

[0017] 3) Alarm state: When an unmasked, non-critical fault that has timed out occurs, the system enters an alarm state, accompanied by the output of an interrupt request;

[0018] If the fault is recovered within a programmable timeout period, the system returns to normal operation and the timeout counter needs to be reinitialized.

[0019] If a critical fault occurs in the system while it is in an alarm state, the system will transition from an alarm state to a fault state, and the timeout counter will stop.

[0020] When the fault state returns to the alarm state, the timeout timer will restart;

[0021] 4) Fault Status: The system will enter a fault status when the following conditions occur:

[0022] A critical failure occurred;

[0023] When the system is in an alarm state and a non-critical fault timeout has occurred;

[0024] Non-critical faults that were not masked and were not enabled after a timeout occurred.

[0025] Furthermore, in a state machine, the transition from a normal or alarm state to a fault state is typically accompanied by the following output:

[0026] Interruption;

[0027] Changes in output management signals;

[0028] Request safe mode after a certain period of time;

[0029] Configurable Software Response: Software Response;

[0030] Software-configurable response: Hardware response.

[0031] A method for implementing the above-described on-chip system fault collection and management system is characterized by the following steps:

[0032] 1) The fault collection and management system collects predefined faults during chip operation and classifies them for management; based on the criticality of the fault, two types of faults are defined: critical faults and non-critical faults;

[0033] 2) Respond to faults without processor involvement; after the software-enabled fault collection and management system enters the configuration state, the enabling and response methods of critical and non-critical faults can be configured through registers, and the processing status of faults can be read.

[0034] Furthermore, the specific steps of step 2) are as follows:

[0035] 2.1) After the configuration information of critical and non-critical faults is synchronized to the state machine unit, when the fault interface locks a non-critical fault, the fault collection and management system enters the alarm state, the alarm timer is started, and the alarm state response is output simultaneously; before the alarm timer expires, the fault handling is completed, and the system enters the normal state; after the alarm timer expires, it enters the fault state, outputs the fault state response, and the safety mode request timer is started; before the safety mode request timer expires, if the non-critical fault is recovered, the system enters the normal state; otherwise, a safety mode request is initiated.

[0036] 2.2) When a critical fault is locked at the fault interface, the system enters a fault state and outputs a fault state response, including a non-maskable interrupt, a safe mode request, and long / short function resets. Once the critical fault is resolved, the system returns to normal operation.

[0037] 2.3) Under normal conditions, if critical and non-critical faults occur simultaneously, the fault status takes precedence over the alarm status. In the case of simultaneous occurrence of critical faults, the fault response corresponds to the worst-case scenario (if the fault is programmed, a long-term reset will respond).

[0038] 2.4) If a critical fault or a non-critical fault (unmasked and timeout disabled) is active in the alarm state, the fault collection and management system will transition from the alarm state to the fault state.

[0039] 2.5) When the fault collection and management system is already in a fault state, any critical fault that occurs will result in a hardware or software response (i.e., a long function reset or a short function reset).

[0040] 2.6) The fault collection and management system will only switch from the alarm state to the normal state when all non-critical faults (including faults captured after the fault collection and management system enters the alarm state, i.e. software or hardware recoverable faults) are cleared; otherwise, the fault collection and management system will remain in the alarm state.

[0041] 2.7) The fault collection and management system will only enter the normal state from the fault state when all critical and non-critical faults (including faults collected by the fault collection and management system after it enters the fault or alarm state) are cleared. Otherwise, the fault collection and management system will remain in the fault state (if any critical faults are pending) or return to the alarm state (if any non-critical faults are pending and have timed out).

[0042] This invention provides a fault collection and management system and method for on-chip systems. The system mainly includes five modules: a register interface unit, a handshake unit (master / slave), a fault interface unit, a state machine unit, and a status output unit. Specifically, the register interface unit configures registers, provides bus and interrupt interfaces, etc.; the handshake unit (master / slave) synchronizes the bus clock signal with internal logic signals; the fault interface unit handles fault input, detection, and classification; the state machine unit manages fault control, including predefined fault configuration, fault alarms, and fault responses, using internal watchdog timers, safe mode request timers, and alarm timers; and the status output unit outputs the system's status and response. This invention uses programmable hardware channels to detect and collect system faults, and guides the device to a safe state in a controllable manner when a fault occurs. The detection and collection process does not require processor involvement, and the software can configure the severity of the fault and the output response method. The system provided by this invention significantly improves the safety and reliability of processor operation in on-chip systems. Attached Figure Description

[0043] Figure 1 This is a structural block diagram of the present invention;

[0044] Figure 2 This is a state transition diagram for fault collection and management according to the present invention. Detailed Implementation

[0045] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] See Figure 1 The structure of the fault collection and management system in the on-chip system of this invention includes a register interface unit, a master handshake unit, a slave handshake unit, a state machine unit, a state output unit, and a fault interface unit. The register interface unit is connected to the master handshake unit, the master handshake unit is connected to the slave handshake unit, the slave handshake unit is connected to the state machine unit, and the state machine unit is connected to the state output unit. Wherein:

[0047] The register interface unit implements register configuration, bus interface, and interrupt interface, etc.; the register interface unit has a standard APB bus slave device interface, adopts a 32-bit address bus and a 32-bit data bus; after the software enables the system to enter the configuration state, the enable and response mode of critical and non-critical faults can be configured through the register interface unit, and the fault handling status can be read.

[0048] The handshake unit synchronizes the bus clock signal with the internal logic signal; it also synchronizes the configuration information of critical and non-critical faults to the state machine unit and the fault interface unit.

[0049] The fault interface unit realizes the input, detection and classification of faults; the fault interface unit locks the externally input faults and distinguishes the input faults as non-critical faults and critical faults.

[0050] The status output unit implements the status output and response output of the system. The status output unit manages and outputs two signals to indicate the status of the system, including fault status, normal status and configuration status.

[0051] The state machine unit implements fault control and management, including the configuration of predefined faults, fault alarms, and fault responses. Internally, the state machine unit contains a state machine, a watchdog timer, a safe mode request timer, and an alarm timer. These timers are connected to the state machine to handle fault control. Fault control and management are implemented through the internal watchdog timer, safe mode request timer, and alarm timer, and are carried out by the state machine. The state machine consists of four states, as follows:

[0052] 1) Configuration state: Used to change the default configuration of the system. The configuration state defines the global configuration, fault response, timeout, and masking of non-critical faults of the system. The relevant registers can only be accessed in write mode in the configuration state.

[0053] 2) Normal state: The state in which no faults occur, which is the default state or the state after reset;

[0054] After a critical failure occurs, the system transitions to a fault state.

[0055] After a non-critical fault that has not been masked and has timed out occurs, the system transitions to a fault state.

[0056] After a non-critical fault that is not masked and whose enable timeout occurs, the system switches to alarm mode.

[0057] After a non-critical failure occurs, maintain normal operation.

[0058] 3) Alarm state: When an unmasked, non-critical fault that has timed out occurs, the system enters an alarm state, accompanied by the output of an interrupt request;

[0059] If the fault is recovered within a programmable timeout period, the system returns to normal operation and the timeout counter needs to be reinitialized.

[0060] If a critical fault occurs in the system while it is in an alarm state, the system will transition from an alarm state to a fault state, and the timeout counter will stop.

[0061] When the fault state returns to the alarm state, the timeout timer will restart;

[0062] 4) Fault Status: The system will enter a fault status when the following conditions occur:

[0063] A critical failure occurred;

[0064] When the system is in an alarm state and a non-critical fault timeout has occurred;

[0065] Non-critical faults that were not masked and were not enabled after a timeout occurred.

[0066] In a state machine, the transition from a normal or alarm state to a fault state is typically accompanied by the following output:

[0067] Interruption;

[0068] Changes in output management signals;

[0069] Request safe mode after a certain period of time;

[0070] Configurable Software Response: Software Response;

[0071] Software-configurable response: Hardware response.

[0072] This invention also provides a fault collection and management method for an on-chip system, the specific steps of which are as follows:

[0073] 1) The fault collection and management system collects predefined faults during chip operation and classifies them for management; based on the criticality of the fault, two types of faults are defined: critical faults and non-critical faults;

[0074] 2) Respond to faults without processor involvement; the system has a standard APB bus slave interface. After the software-enabled fault collection and management system enters the configuration state, the enabling and response methods of critical and non-critical faults can be configured through registers, and the fault handling status can be read.

[0075] See Figure 2 The specific state transitions for fault collection and management in this invention are as follows:

[0076] 2.1) After the configuration information of critical and non-critical faults is synchronized to the state machine unit, when the fault interface locks a non-critical fault, the fault collection and management system enters the alarm state, the alarm timer is started, and the alarm state response is output simultaneously; before the alarm timer expires, the fault handling is completed, and the system enters the normal state; after the alarm timer expires, it enters the fault state, outputs the fault state response, and the safety mode request timer is started; before the safety mode request timer expires, if the non-critical fault is recovered, the system enters the normal state; otherwise, a safety mode request is initiated.

[0077] 2.2) When a critical fault is locked at the fault interface, the system enters a fault state and outputs a fault state response, including a non-maskable interrupt, a safe mode request, and long / short function resets. Once the critical fault is resolved, the system returns to normal operation.

[0078] 2.3) Under normal conditions, if critical and non-critical faults occur simultaneously, the fault status takes precedence over the alarm status. In the case of simultaneous occurrence of critical faults, the fault response corresponds to the worst-case scenario (if the fault is programmed, a long-term reset will respond).

[0079] 2.4) If a critical fault or a non-critical fault (unmasked and timeout disabled) is active in the alarm state, the fault collection and management system will transition from the alarm state to the fault state.

[0080] 2.5) When the fault collection and management system is already in a fault state, any critical fault that occurs will result in a hardware or software response (i.e., a long function reset or a short function reset).

[0081] 2.6) The fault collection and management system will only switch from the alarm state to the normal state when all non-critical faults (including faults captured after the fault collection and management system enters the alarm state, i.e. software or hardware recoverable faults) are cleared; otherwise, the fault collection and management system will remain in the alarm state.

[0082] 2.7) The fault collection and management system will only enter the normal state from the fault state when all critical and non-critical faults (including faults collected by the fault collection and management system after it enters the fault or alarm state) are cleared. Otherwise, the fault collection and management system will remain in the fault state (if any critical faults are pending) or return to the alarm state (if any non-critical faults are pending and have timed out).

[0083] The basic definition of this invention is as follows:

[0084] Hardware-recoverable faults: This fault indication is an edge- and level-sensitive signal. The indication remains valid until the fault cause is detected; that is, if a fault signal of 0 indicates a fault, the status flag will remain valid until the fault signal becomes 0. When the fault signal becomes 1, the status automatically disappears. Typically, fault signals are latched into an external module of the fault collection and management system. The state of the fault collection and management system changes randomly based on the input fault signal. No software is required within the fault collection and management system to recover the fault state.

[0085] Software-recoverable faults: The fault indication signal is a valid signal without a defined duration. The fault signal is captured in the fault collection and management system, and the fault recovery process executes the software recovery procedure (clearing the status / flag register).

[0086] Long-function reset: Initializes flash memory and most digital systems.

[0087] Short-function reset: Initialization of most digital systems.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fault collection and management system for an on-chip system, characterized in that: The management system includes a register interface unit, a handshake unit, a state machine unit, a state output unit, and a fault interface unit. The register interface unit is connected to the handshake unit, the handshake unit is connected to the state machine unit, and the state machine unit is connected to the state output unit. The register interface unit implements register configuration, bus interface, and interrupt interface. The handshake unit implements synchronization between the bus clock signal and the internal logic signal. The fault interface unit implements fault input, detection, and classification; the state machine unit implements fault control and management, including predefined fault configuration, fault alarms, and fault responses; the state output unit implements the system's state output and response output; the state machine includes four states, as follows: 1) Configuration state: Used to change the default configuration of the system. The configuration state defines the global configuration, fault response, timeout, and masking of non-critical faults of the system. The relevant registers can only be accessed in write mode in the configuration state. 2) Normal state: The state in which no faults occur, which is the default state or the state after reset; After a critical failure occurs, the system transitions to a fault state. After a non-critical fault that has not been masked and has timed out occurs, the system transitions to a fault state. After a non-critical fault that is not masked and whose enable timeout occurs, the system switches to alarm mode. After a non-critical failure occurs, maintain normal operation. 3) Alarm state: When an unmasked, non-critical fault that has timed out occurs, the system enters an alarm state, accompanied by the output of an interrupt request; If the fault is recovered within a programmable timeout period, the system returns to normal operation and the timeout counter needs to be reinitialized. If a critical fault occurs in the system while it is in an alarm state, the system will transition from an alarm state to a fault state, and the timeout counter will stop. When the fault state returns to the alarm state, the timeout timer will restart; 4) Fault Status: The system will enter a fault status when the following conditions occur: A critical failure occurred; When the system is in an alarm state and a non-critical fault timeout has occurred; Non-critical faults that were not masked and were not enabled after a timeout occurred.

2. The fault collection and management system in the on-chip system according to claim 1, characterized in that: The register interface unit has a standard APB bus slave device interface, using a 32-bit address bus and a 32-bit data bus; after the software enables the system to enter the configuration state, the enable and response modes of critical and non-critical faults can be configured through the register interface unit, and the fault handling status can be read.

3. The fault collection and management system in the on-chip system according to claim 1, characterized in that: The handshake unit synchronizes the configuration information of critical and non-critical faults to the state machine unit and the fault interface unit. The handshake unit includes a master handshake unit and a slave handshake unit. The register interface unit is connected to the master handshake unit, the master handshake unit is connected to the slave handshake unit, and the slave handshake unit is connected to the state machine unit.

4. The fault collection and management system in the on-chip system according to claim 1, characterized in that: The fault interface unit locks in externally input faults and distinguishes between non-critical and critical faults.

5. The fault collection and management system in the on-chip system according to claim 1, characterized in that: The status output unit manages and outputs two signals to indicate the status of the system, including fault status, normal status, and configuration status.

6. The fault collection and management system in the on-chip system according to claim 1, characterized in that: The state machine unit is internally equipped with a state machine, a watchdog timer, a safe mode request timer, and an alarm timer. The watchdog timer, safe mode request timer, and alarm timer are connected to the state machine to control and process faults. Fault control and management are achieved through the internal watchdog timer, safe mode request timer, and alarm timer, which is implemented by the state machine.

7. A method for implementing the fault collection and management system in an on-chip system as described in claim 1, characterized in that: The method includes the following steps: 1) The fault collection and management system collects predefined faults during chip operation and classifies them for management; based on the criticality of the fault, two types of faults are defined: critical faults and non-critical faults; 2) Respond to faults without processor involvement; After the software-enabled fault collection and management system enters the configuration state, the enabling and response methods of critical and non-critical faults can be configured through registers, and the fault processing status can be read. 2.1) After the configuration information of critical and non-critical faults is synchronized to the state machine unit, when the fault interface locks a non-critical fault, the fault collection and management system enters the alarm state, the alarm timer starts, and the alarm state response is output simultaneously; before the alarm timer expires, the fault handling is completed, and the system enters the normal state; after the alarm timer expires, it enters the fault state, outputs the fault state response, and the safety mode request timer starts; before the safety mode request timer expires, if the non-critical fault is recovered, the system enters the normal state; otherwise, a safety mode request is initiated. 2.2) When a critical fault is locked at the fault interface, the system enters a fault state and outputs a fault state response, including a non-maskable interrupt, a safe mode request, and a long and short function reset; when the critical fault is recovered, the system enters a normal state. 2.3) Under normal conditions, if critical and non-critical faults occur simultaneously, the fault status takes precedence over the alarm status in the fault collection and management system; when critical faults occur simultaneously, the fault response corresponds to the worst-case scenario. 2.4) If a critical or non-critical fault is active in the alarm state, the fault collection and management system will switch from the alarm state to the fault state. 2.5) When the fault collection and management system is already in a fault state, any critical fault that occurs will cause a hardware or software response; 2.6) The fault collection and management system will only transition from the alarm state to the normal state when all non-critical faults are cleared; otherwise, the fault collection and management system will remain in the alarm state. 2.7) The fault collection and management system will only transition from a fault state to a normal state when all critical and non-critical faults are cleared. Otherwise, the fault collection and management system will remain in a fault state or return to an alarm state.

Images