A high-integrity clock circuit monitoring system and method for embedded systems

Abstract

This invention belongs to the field of digital electronic system technology and relates to a high-integrity clock circuit monitoring system for embedded systems. The clock fusion unit input generates a working clock based on n clocks to be monitored. The monitoring parameter setting unit sends a counter snapshot trigger signal to the clock snapshot counter every counting cycle. The clock frequency conversion unit divides the input n clocks to be monitored and outputs the result to the clock snapshot counter. The clock snapshot counter drives n counters to count the pulses of the n divided clocks. Upon receiving the counter snapshot trigger signal, the current count values ​​of the n counters are stored in n registers, and the n counters are cleared. The count values ​​in the n registers are output to the clock status indication unit. The clock status indication unit compares the count values ​​corresponding to each of the n clocks with their respective data comparison tolerances. If the count values ​​are within the data comparison tolerances, the clock is considered normal; otherwise, the clock is considered abnormal.

Description

Technical Field

[0001] This invention relates to the field of digital electronic system applications, especially electronic systems with high safety requirements such as aerospace, high-speed trains, and atomic energy. It is an embedded system high integrity clock circuit monitoring system and method. Background Technology

[0002] In fields involving human safety, such as aerospace, high-speed rail, and nuclear energy, there are extremely high requirements for the safety and real-time performance of equipment. Electronic equipment in these systems is a crucial component in ensuring system safety. A very important metric for equipment safety is equipment integrity, which represents the probability of an undetectable failure. For example, for products performing Class A functions in the aerospace field, the integrity index of products independently undertaking related functions must reach at least 10. -9 PFH. In the field of manned spaceflight, equipment that carries functions related to personnel safety requires higher integrity requirements.

[0003] Under current security analysis theory, the integrity index of a device is determined by the integrity index of each component along the device architecture and data processing path. When a specific component of the device lacks corresponding monitoring functions, the component's integrity index is determined by the reliability of the underlying components and the component's failure mode exposure time. The overall integrity of the device is determined by the cumulative integrity value of all independent functional components involved in data processing. Therefore, the integrity index requirement for a single component is higher than the overall integrity index requirement for the device. Depending on the system complexity and the number of components, the component integrity index is generally 1 to 2 orders of magnitude higher than the overall device integrity index. Currently, the basic reliability of electronic components is generally around 10. -7 ~10 -10 The level is per working hour. Because a single component is generally composed of multiple electronic components, the basic reliability of a single component can typically only reach 10. -6 ~10 -8 At the level of per working hour, the basic reliability of a single device can only reach 10. -5 ~10 -6 The level per working hour. At this point, the equipment integrity can only reach 10. -5 ~10 -6 The per-hour workload is insufficient to independently meet the requirements for high-security features.

[0004] In current digital electronic systems, the entire system is driven by a clock circuit, and a high-integrity clock circuit is fundamental to ensuring the high integrity of digital circuit components and devices. Given the ever-increasing complexity of current digital systems, achieving high integrity for a single device (e.g., in the aerospace industry, the integrity index of equipment independently performing Class A functions must not exceed 10) is a significant challenge. -9 PFH (Power Factor High) places higher demands on the integrity of clock circuits. Taking the aerospace industry as an example, for clocks of equipment independently performing Class A functions, the integrity requirement is no greater than 10. -11 PFH. The basic reliability of currently supplied clock components is 10. -7 ~10 -9 The current clock speed is insufficient to meet the equipment's usage requirements. To solve this problem, monitoring needs to be added to the clock components of the digital circuits to ensure that faults and anomalies during clock circuit operation can be detected in a timely manner, thereby notifying the equipment or system to react promptly, controlling the output of erroneous data, and thus avoiding misleading the system. Summary of the Invention

[0005] Objective: This invention provides a high-integrity clock circuit monitoring system and method for embedded systems to ensure reliable detection of the clock circuit's operation and improve its integrity. The invention reduces the false alarm rate of clock detection faults by setting a clock pulse acquisition window to collect the number of pulses from multiple clocks per unit time, considering the jitter parameters of different clocks, and setting a judgment threshold for clock count comparison, while obtaining the actual detection results of the clock circuit. By adjusting the detection cycle, the exposure time of the detected clock's related fault modes is adjusted, thereby enabling the clock circuit to obtain different integrity indicators.

[0006] Technical solution one of the present invention:

[0007] An embedded system high integrity clock circuit monitoring system includes: a clock fusion unit, a monitoring parameter setting unit, a clock frequency conversion unit, a clock snapshot counter, and a clock status indication unit;

[0008] The clock fusion unit is connected to n clocks to be monitored at its input terminal. It generates a working clock based on the n clocks to be monitored. The working clock includes a driving clock clk_0 and other clocks obtained by dividing and multiplying clk_0. The driving clock clk_0 drives the monitoring parameter setting unit, the clock frequency conversion unit, the clock snapshot counter, and the clock status indication unit to work; N≥1;

[0009] The monitoring parameter setting unit provides a parameter setting interface, through which the counting period, the frequency conversion coefficient of each of the n clocks, and the data comparison tolerance are set; and the frequency conversion coefficient and the data comparison tolerance are output to the clock frequency conversion unit and the clock status indication unit, respectively.

[0010] The monitoring parameter setting unit sends a counter snapshot trigger signal to the clock snapshot counter every counting cycle;

[0011] The clock frequency conversion unit divides the input n clocks to be monitored according to the frequency conversion coefficients of each of the n clocks, and outputs the n divided clocks to the clock snapshot counter;

[0012] The clock snapshot counter receives n divided clocks and drives n counters to count the pulses of the n divided clocks; when it receives the counter snapshot trigger signal, it stores the current count value of the n counters into n registers, then clears the n counters to zero and restarts the pulse counting; the count value in the n registers is output to the clock status indicator unit.

[0013] The clock status indicator unit compares the count value corresponding to each of the n clocks with its respective data comparison tolerance. If the count value is within the data comparison tolerance, the clock is judged to be normal; otherwise, the clock is indicated to be abnormal.

[0014] Furthermore, the clock fusion unit generates the working clock as follows: when there is only one clock to be monitored, an auxiliary clock is added as the clock input to be monitored by the clock fusion unit, and one of the two clocks is selected as the working clock;

[0015] When there are multiple clocks to be monitored, the clock fusion unit selects the clock with the highest priority as the working clock according to a predefined order.

[0016] Furthermore, the system also includes a watchdog timer; the monitoring parameter setting unit also uses the working clock to feed the watchdog timer. When the working clock fails, the watchdog timer outputs a reset signal to reset the monitoring parameter setting unit, the clock frequency conversion unit, the clock snapshot counter, and the clock status indicator unit; and the clock status indicator unit indicates that n clocks are in a fault state.

[0017] Furthermore, after the clock fusion unit completes the reset, it selects another clock as the working clock.

[0018] Furthermore, the clock frequency conversion unit divides the input n clocks to be monitored into n clocks with the same frequency or n clocks with a certain frequency ratio according to the frequency conversion coefficients of the n clocks.

[0019] Technical solution two of the present invention:

[0020] A method for monitoring a high-integrity clock circuit in an embedded system, the method being implemented through the system, the method comprising the following steps:

[0021] Step 1: Select the clock to be monitored; set the counting period T and calculate the counting tolerance range;

[0022] Step 2: Set data comparison tolerance and frequency transformation coefficients;

[0023] Step 3: Count the pulses of each of the n frequency-divided clocks to be monitored;

[0024] Step 4: After the counting time reaches the counting period T, lock the counting results of all counters;

[0025] Step 5: Compare the counting results of each clock to be monitored to see if they are within the corresponding counting tolerance range; if they are within the range, proceed to Step 7; if they are not within the range, proceed to Step 6.

[0026] Step Six: Indicate that the clock to be monitored is faulty, clear the counter corresponding to the clock to be monitored to zero, and proceed to Step Three;

[0027] Step 7: Compare the proportional relationship of the counting results of each clock to be monitored. If the counting results of all clocks to be monitored satisfy the following relationship in pairwise comparisons, proceed to Step 8; otherwise, proceed to Step 9.

[0028] (Counter'CLK1-ToleranceCLK1) / (Counter'CLK2+ToleranceCLK2)≦Counter'CLK1 / Counter'CLK2≦(Counter'CLK1+ToleranceCLK1) / (Counter'CLK2-ToleranceCLK2);

[0029] Counter'CLK1 and Counter'CLK2 are the count results of clock CLK1 and clock CLK2, respectively; ToleranceCLK1 and ToleranceCLK2 are the tolerance levels of clock CLK1 and clock CLK2, respectively.

[0030] Step 8: Indicate that the clock to be monitored is correct, clear the counter corresponding to the clock to be monitored to zero, and proceed to Step 3;

[0031] Step 9: If there are two clocks to be monitored and one of them is an auxiliary clock, determine that at least one of the two clocks to be monitored is faulty, and proceed to Step 10;

[0032] If the number of clocks to be monitored is not less than three, compare all the clocks to be monitored in pairs. Clocks to be monitored that conform to the relationship in step seven are judged to be correct, and the corresponding clocks to be monitored proceed to step eight. Clocks to be monitored that do not conform to the relationship in step seven when compared with the correct clocks are judged to be faulty, and the corresponding clocks to be monitored proceed to step six. If all the clocks to be monitored do not conform to the relationship in step seven when compared in pairs, at least n-1 clocks to be monitored are judged to be faulty, and the process proceeds to step ten.

[0033] Step 10: All monitored clocks indicate a fault, and the system is reset via watchdog timer.

[0034] Furthermore, in step one, the counting tolerance range ΔCounter = ΔF*T; ΔF is the frequency drift range of the monitoring clock.

[0035] Furthermore, data comparison tolerance [CON] min CON max ];CON min =F*T-ΔCounter, CON max =F*T+ΔCounter; F is the counting frequency corresponding to the counting cycle.

[0036] Furthermore, ToleranceCLKi = FXMhz * T * FtMax; FXMhz is the clock jitter frequency of CLKi, and FtMax is the maximum clock error of CLKi, in PPM. i is an integer, with a value range of [1 to n].

[0037] The present invention has the following beneficial effects:

[0038] 1. High integrity of the operating clock in a digital electronic system is fundamental to the overall integrity of the digital electronic system. The system and method proposed in this invention can achieve real-time monitoring of the system's operating clock to ensure that the system's operating clock is in a reliable working state.

[0039] 2. The method proposed in this invention can flexibly set the upper and lower limit thresholds of the clock cycle counting range, without restricting the operating frequency and performance (jitter and frequency drift) of the monitoring clock. It can be widely applied to various scenarios with high clock integrity requirements and can effectively control the occurrence of missed clock faults and false alarms.

[0040] 3. The method proposed in this invention can flexibly set the clock detection period and the number of clocks involved in the result determination, thereby supporting the use requirements of clocks with different integrity indicators. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the composition of an embedded system high integrity clock circuit monitoring system proposed in this invention;

[0042] Figure 2 This is a schematic diagram of the process for a high-integrity clock circuit monitoring method for embedded systems proposed in this invention. Detailed Implementation

[0043] The present invention will now be described in detail with reference to specific implementation processes. The following embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0044] An embedded system high-integrity clock circuit monitoring system includes: a clock fusion unit, a monitoring parameter setting unit, a clock frequency conversion unit, a clock snapshot counter, a clock status indicator unit, and a watchdog timer. Figure 1 As shown.

[0045] Clock Fusion Unit: This functional module generates the working clock for the monitoring logic function block by fusing the clocks involved in the detection (including...). Figure 1 The clock fusion unit (including clk_0 and other clocks divided and multiplied by clk_0) drives the operation of the monitoring parameter setting unit, clock frequency conversion unit, clock snapshot counter, and clock status indication unit. This unit can select different implementation schemes according to the application scenario. When the monitored system has only one working clock, an auxiliary clock can be added as the input clock of the fusion unit, and one of the two clocks can be selected as the working clock source for the monitoring logic function block. If there are multiple working clocks in the system, the clock fusion unit can select one of the clock sources as the working clock source for the logic function block through a predefined sequence. When this clock fails (e.g., no output), the watchdog in the trigger circuit is reset, setting the state of all monitored clocks to a fault state and triggering the reset of all monitoring logic function blocks except the clock fusion unit, without causing clock resident system output error data. After the system resets, the clock fusion unit will select another clock as the working clock source for the monitoring logic function.

[0046] Monitoring Parameter Setting Unit: This unit provides a parameter setting interface. Through this interface, the frequency conversion coefficient (Rat), counting period (T), and data comparison tolerances [CONmin, CONmax] for each clock can be set. The monitoring parameter setting unit transmits the frequency conversion coefficient of each monitored system clock to the clock frequency conversion unit. The monitoring parameter setting unit generates a counter snapshot trigger signal according to the counting period. The monitoring parameter setting unit is also responsible for the watchdog timer operation. Once the working clock clk_0 of the monitored logic function block fails (e.g., no clock), the watchdog timer will output a reset signal, resetting the state of all function units except the clock fusion unit. During normal operation, the monitoring test setting unit will use the working clock to drive the watchdog timer operation.

[0047] Clock frequency conversion unit: After obtaining the frequency conversion coefficient from the monitoring parameter setting unit, this unit divides the input clock according to the coefficient and outputs each divided clock to the clock snapshot counting unit for clock pulse counting. Through the conversion by the time-frequency conversion unit, the clocks participating in the comparison are converted into clocks of the same frequency or clocks with a specific proportional relationship.

[0048] Clock snapshot counter: This unit receives the output clock from the clock frequency conversion unit and drives the counter of each clock to accumulate counts starting from zero. When the clock counting cycle ends, the clock snapshot unit receives a trigger signal from the monitoring parameter setting unit. At this time, each clock counter stores its current count value in the snapshot register of the corresponding clock, then clears the counter of each clock to zero and restarts the pulse accumulation count for that clock. The contents of the clock snapshot counter are pushed to the clock status indication unit.

[0049] Clock Status Indication: After receiving the count result (Counter_n) of each clock snapshot counter, the clock status indication unit compares Counter_n with the clock's CONmin and CONmax. If CONmin ≤ Counter_n ≤ CONmax, the clock is operating normally; otherwise, the clock is faulty. After the judgment is completed, the clock status indication unit updates the status indication of the corresponding clock. When an abnormality occurs in the working clock (clk0), the watchdog timer will trigger a reset operation. At this time, all monitored clocks should indicate a fault state.

[0050] Watchdog: The watchdog is responsible for monitoring the working status of the operating clock (clk_0) to ensure the validity of the monitoring results for each clock. Before the watchdog can operate normally, its enabled state is set by the monitoring parameter setting unit.

[0051] This patent ensures high clock integrity in embedded systems by comparing multiple clock frequencies per unit time. The number of clocks to be compared is selected based on the detection rate and isolation rate requirements. For scenarios requiring only identification without isolation, two clock sources are sufficient. For scenarios requiring isolation of fault sources, at least three clock sources are needed for voting and isolation. For single-clock-source applications, a clock with the same frequency as the source can be used for monitoring. For multi-clock-source applications, the frequency can be proportionally converted based on the frequency relationship between the multiple clock sources before comparison. Since clocks in engineering applications will have a certain jitter range, this factor should be considered during the comparison process. For a specific clock, the count value per unit time T is CounterXMhz, and JiterXMhz is the clock drift per unit time, FXMhz*T*[1-JiterXMhz]≦CounterXMhz≦FXMhz*T*[1-JiterXMhz]. To simplify implementation, two parameters can be set: Counter'XMhz = FXMhz * T and Tolerance = FXMhz * T * FtMax. FtMax represents the maximum clock error (PPM), and FXMhz is the clock jitter frequency. The choice of the counting period needs to be calculated and should not be too small. Too small a period will result in the Tolerance value not being reflected (too small a deviation). Too large a period will result in an excessively large Tolerance. Taking a 50PPM clock as an example, in the worst case, a deviation will occur every 2000 pulse cycles. For a 10MHz clock, this takes 200µs. When the period is set to 1s, the Tolerance should be 5000, which will lose sensitivity to short-term clock fluctuations. In this case, a timing period of 1ms is more suitable, and the Tolerance should be 5. The effective comparison equation for the two clocks is as follows:

[0052] (Counter'CLK1-ToleranceCLK1) / (Counter'CLK2+ToleranceCLK2)≦Counter'CLK1 / Counter'CLK2≦(Counter'CLK1+ToleranceCLK1) / (Counter'CLK2-ToleranceCLK2)

[0053] If the above equations are satisfied, both clocks are working normally. If the equations are not satisfied, then at least one of the two clocks is faulty.

[0054] Clock isolation requires at least three clock comparisons.

[0055]

[0056] A method for monitoring high-integrity clock circuits in embedded systems, such as Figure 2 As shown, it includes the following steps:

[0057] 1. Based on the integrity requirements of the monitoring clock, select the number of clocks to be compared. Based on the counter bit width, select the counting period (T) and counting tolerance range ΔCounter = ΔF * T for the monitoring clock. ΔF is the frequency drift range of the monitoring clock. Proceed to step 2;

[0058] 2. Calculate the comparison tolerance range [CONmin, CONmax] of the comparator counter. CONmin = F*T - ΔCounter, CONmax = F*T + ΔCounter. Proceed to step 3; F is the frequency corresponding to the counting period T.

[0059] 3. Synchronously start the pulse counting of the system working clock (clk1, clk2...clkn). Proceed to step 4;

[0060] 4. After the counting time reaches the counting period T, lock the results of all system operating clocks. Proceed to step 5;

[0061] 5. Compare the count result Counter_n of each system clock cycle to see if it is within the tolerance limit [CON min CON max Within the specified range. If not within the range, proceed to step 6. If within the range, proceed to step 8.

[0062] 6. Indicate a fault in the monitoring clock, then proceed to step 7;

[0063] 7. Clear the counter of the locked system clock, and then proceed to step 3;

[0064] 8. Compare the proportional relationship of the counting results of each system's working clock. If the proportional relationship of the two clock counts conforms to the proportional relationship of clock frequencies (relationship 1, including tolerance), then proceed to step 9. Otherwise, proceed to step 6.

[0065] 9. Clear the counter of the locked system clock, and then proceed to step 10;

[0066] 10. Indicate the monitoring clock is correct, then proceed to step 3;

[0067] To address the inconsistency in system operating clock frequencies, and to facilitate comparison of frequency counts between clocks, the system operating clock frequencies being compared can be converted to make comparisons between different frequency count values ​​easier.

[0068] When the sampling clock operates at a high frequency and the counting period is long, in order to avoid the clock counter bit width being too long, the clock frequency used for comparison can be converted to a suitable frequency before comparison. However, the tolerance recognition capability should not be reduced due to the frequency change.

[0069] Because clock devices experience frequency drift during operation, and this drift is random at any given time, the effective counting range of the clock is defined per unit time to ensure that the clock state criteria conform to the actual operating characteristics of the clock. The effective counting range is [CONmin, CONmax]. CONmin = F*T - ΔCounter, CONmax = F*T + ΔCounter. Here, F is the clock counting frequency, T is the clock counting period, and the counting tolerance range ΔCounter = ΔF*T. ΔF is the frequency drift range of the counting clock.

[0070] When the monitored system's operating clock (clk1, clk2...clkn) and the counting clock use the same clock source (clk0), clock frequency drift exceeding the limit will not be reflected in the counting results. To avoid this problem, after checking the clock counting range of the monitored system, a comparison of the proportional relationship between the counting results of two different clocks can effectively prevent this fault from being missed. The comparison equation for the correctness of the proportional relationship between the two clocks is as follows: (Counter CLK1 -ΔCounter CLK1 ) / (Counter CLK2 +ΔCounter CLK2 )≦Counter CLK1 / Counter CLK2 ≦(Counter CLK1 +ΔCounter CLK1 ) / (Counter CLK2 -ΔCounter CLK2 If the above equations are satisfied, both clocks are working normally. If the equations are not satisfied, then at least one of the two clocks is faulty.

[0071] The embodiments disclosed herein are merely preferred embodiments of the present invention. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the present invention, and are not intended to limit the present invention. Any modifications and variations made by those skilled in the art within the scope of this specification should fall within the protection scope of the present invention.

Claims

1. A high-integrity clock circuit monitoring system for embedded systems, characterized in that: The system includes: a clock fusion unit, a monitoring parameter setting unit, a clock frequency conversion unit, a clock snapshot counter, and a clock status indication unit; The clock fusion unit is connected to n clocks to be monitored at its input terminal. It generates a working clock based on the n clocks to be monitored. The working clock includes a driving clock clk_0 and other clocks obtained by dividing and multiplying clk_0. The driving clock clk_0 drives the monitoring parameter setting unit, the clock frequency conversion unit, the clock snapshot counter, and the clock status indication unit to work; N≥1; The monitoring parameter setting unit provides a parameter setting interface, through which the counting period, the frequency conversion coefficient of each of the n clocks, and the data comparison tolerance are set; and the frequency conversion coefficient and the data comparison tolerance are output to the clock frequency conversion unit and the clock status indication unit, respectively. The monitoring parameter setting unit sends a counter snapshot trigger signal to the clock snapshot counter every counting cycle; The clock frequency conversion unit divides the input n clocks to be monitored according to the frequency conversion coefficients of each of the n clocks, and outputs the n divided clocks to the clock snapshot counter; The clock snapshot counter receives n divided clocks and drives n counters to count the pulses of the n divided clocks; when it receives the counter snapshot trigger signal, it stores the current count value of the n counters into n registers, then clears the n counters to zero and restarts the pulse counting; the count value in the n registers is output to the clock status indicator unit. The clock status indicator unit compares the count value corresponding to each of the n clocks with its respective data comparison tolerance. If the count value is within the data comparison tolerance, the clock is judged to be normal; otherwise, the clock is indicated to be abnormal.

2. The system according to claim 1, characterized in that: The clock fusion unit generates the working clock as follows: when there is only one clock to be monitored, an auxiliary clock is added as the clock input to be monitored by the clock fusion unit, and one of the two clocks is selected as the working clock. When there are multiple clocks to be monitored, the clock fusion unit selects the clock with the highest priority as the working clock according to a predefined order.

3. The system according to claim 2, characterized in that: The system also includes a watchdog timer; the monitoring parameter setting unit also uses the working clock to feed the watchdog timer. When the working clock fails, the watchdog timer outputs a reset signal to reset the monitoring parameter setting unit, the clock frequency conversion unit, the clock snapshot counter, and the clock status indicator unit; and the clock status indicator unit indicates that n clocks are in a fault state.

4. The system according to claim 3, characterized in that: After the clock fusion unit completes the reset, it selects another clock as the working clock.

5. The system according to claim 1, characterized in that: The clock frequency conversion unit divides the input n clocks to be monitored into n clocks with the same frequency or n clocks with a certain frequency ratio according to the frequency conversion coefficients of the n clocks.

6. A method for monitoring a high-integrity clock circuit in an embedded system, wherein the method is implemented using the system described in any one of claims 1-5, characterized in that: The method includes the following steps: Step 1: Select the clock to be monitored; set the counting period T and calculate the counting tolerance range; Step 2: Set data comparison tolerance and frequency transformation coefficients; Step 3: Count the pulses of each of the n frequency-divided clocks to be monitored; Step 4: After the counting time reaches the counting period T, lock the counting results of all counters; Step 5: Compare the counting results of each clock to be monitored to see if they are within the corresponding counting tolerance range; if they are within the range, proceed to Step 7; if they are not within the range, proceed to Step 6. Step Six: Indicate that the clock to be monitored is faulty, clear the counter corresponding to the clock to be monitored to zero, and proceed to Step Three; Step 7: Compare the proportional relationship of the counting results of each clock to be monitored. If the counting results of all clocks to be monitored satisfy the following relationship in pairwise comparisons, proceed to Step 8; otherwise, proceed to Step 9. (Counter'CLK1-ToleranceCLK1) / (Counter'CLK2+ToleranceCLK2)≦Counter'CLK1 / Counter'CLK2≦(Counter'CLK1+ToleranceCLK1) / (Counter'CLK2-ToleranceCLK2); Counter'CLK1 and Counter'CLK2 are the count results of clock CLK1 and clock CLK2, respectively; ToleranceCLK1 and ToleranceCLK2 are the tolerance levels of clock CLK1 and clock CLK2, respectively. Step 8: Indicate that the clock to be monitored is correct, clear the counter corresponding to the clock to be monitored to zero, and proceed to Step 3; Step 9: If there are two clocks to be monitored and one of them is an auxiliary clock, determine that at least one of the two clocks to be monitored is faulty, and proceed to Step 10; If the number of clocks to be monitored is not less than three, compare all the clocks to be monitored in pairs. Clocks to be monitored that conform to the relationship in step seven are judged to be correct, and the corresponding clocks to be monitored proceed to step eight. Clocks to be monitored that do not conform to the relationship in step seven when compared with the correct clocks are judged to be faulty, and the corresponding clocks to be monitored proceed to step six. If all the clocks to be monitored do not conform to the relationship in step seven when compared in pairs, at least n-1 clocks to be monitored are judged to be faulty, and the process proceeds to step ten. Step 10: All monitored clocks indicate a fault, and the system is reset via watchdog timer.

7. The method according to claim 6, characterized in that: In the first step, the counting tolerance range ΔCounter = ΔF * T; ΔF is the frequency drift range of the monitoring clock.

8. The method according to claim 7, characterized in that: Data comparison tolerance [CON] min CON max ];CON min =F*T-ΔCounter, CON max =F*T+ΔCounter; F is the counting frequency corresponding to the counting cycle.

Images