Identification of faults in finite-state machines

Abstract

The invention relates to identification of faults in a finite-state machine. A computer-implemented method and processing module for identifying that a fault has occurred in a finite state machine (FSM) is provided. It is determined whether a set of one or more transitions that have occurred between states of the FSM is allowed. In response to determining that the set of one or more transitions is not allowed, it is identified that a failure has occurred in the FSM.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to UK patent application 2314607.9 filed on September 22, 2023, which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to identification of faults in finite state machines. Background Art

[0004] Finite state machines are known in the art. A finite state machine (FSM) represents a system as a series of finite states. A system can only be in one of a finite number of states at a time. Depending on the input received, the system can transition from being in one state to being in another state. FSMs are often used to simulate and implement circuit behavior in hardware. Outputs from states within the FSM can be used to drive individual functions in a system such as a safety-critical system.

[0005] Sometimes faults occur in a FSM due to errors in the hardware that runs the FSM. Errors in hardware can occur for a variety of reasons, such as electromagnetic interference from cosmic rays or solar flares. Some faults, known as transient faults, occur as one-time events. For example, a solar flare can cause an element of the hardware to output a 0 instead of a 1. Once the cause of a transient fault has been removed, the same error will not repeat in the hardware. A different type of fault common to hardware is a "stuck-at-fault". Once a fixed fault has occurred, the hardware will repeat the fault even after the cause of the fault has been removed. For example, a fixed fault can cause an element of the hardware to always output a 1, so it is a "stuck" 1. Fixed faults can occur due to silicon aging or manufacturing errors. In digital logic, fixed faults are classified as "stuck-at-0" (SA0) or "stuck-at-1" (SA1).

[0006] Even when there are no errors in the design of the hardware, hardware faults such as transient faults and stuck-at faults may occur during runtime. Furthermore, these faults may be difficult to detect. It is important to be able to detect such faults, especially when implementing FSMs in safety-aware (or "safety-critical") systems. Safety-aware systems often have to comply with certain safety standards. For example, in the automotive industry, systems must comply with the relevant Automotive Safety Integrity Level (ASIL). Being able to detect or mitigate hardware errors such as stuck-at faults is a requirement for implementing a certain functional safety standard such as the ISO 26262 standard.

[0007] One method for mitigating random hardware failures during runtime is to include a degree of redundancy in the system. By adding redundancy to the hardware (e.g., by duplicating parts of the hardware), it is less likely that both the primary component and the redundant component will experience random errors at the same time. However, the additional redundant units take up more silicon area in the hardware and consume more power. It is often desirable to reduce the power consumption and silicon area of ​​a computing system.

[0008] Logic built-in self-test (BIST) method is another technique for reducing errors in hardware to meet certain safety standards. Logic BIST method involves adding specific circuits to the hardware to perform self-test on the hardware. Since the entire chip (or most of it) can be tested, this type of method is invasive for both hardware and runtime applications. Logic BIST method also takes up more silicon area in hardware and may be expensive to implement. Summary of the invention

[0009] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0010] A computer-implemented method of identifying that a fault has occurred in a finite state machine (FSM) is provided, the method comprising: determining whether a set of one or more transitions that have occurred between states of the FSM are permissible; and in response to determining that the set of one or more transitions are not permissible, identifying that a fault has occurred in the FSM.

[0011] The determining may be performed in accordance with a data record comprising at least one predefined set of one or more transitions.

[0012] The determining may include comparing a set of one or more transitions that have occurred between states of the FSM to a data record including at least one predefined set of one or more transitions, and determining in response to the comparing that the set of one or more transitions is not permitted.

[0013] Each of the at least one predefined set of one or more transitions may be an allowed set of one or more transitions between states of the FSM.

[0014] Each of the at least one predefined set of one or more transitions may be a non-permissible set of one or more transitions between states of the FSM.

[0015] The first group may include a predefined allowed set of one or more transitions between states of the FSM. The second group may include a predefined non-allowed set of one or more transitions between states of the FSM. The data record may include a set of the group that includes the least predefined set among the first group and the second group.

[0016] The number of transitions in the set of one or more transitions that have occurred may be equal to the number of transitions in one of the at least one predefined set of one or more transitions in the data record.

[0017] The method may further include recording in a transition history a set of one or more transitions that have occurred between states of the FSM.

[0018] The determination may be performed according to a transition history.

[0019] The transition history can be configured to record up to a maximum number of transitions.

[0020] The number of transitions in the set of one or more transitions that have occurred may not exceed a maximum number.

[0021] The maximum number of transitions may be determined based on at least one predefined set of one or more transitions in the data record.

[0022] The determining may be performed in response to detecting that a number of transitions that have occurred is equal to a number of transitions in one of at least one predefined set of one or more transitions in the data record.

[0023] The method may be executed while the FSM is active and responding to input data.

[0024] The method may further include, in response to identifying that a fault has occurred in the FSM: replaying the FSM from a first state corresponding to a first transition in a set of one or more transitions that have occurred; and in response to determining that the same set of one or more transitions has occurred between states of the FSM, determining that the fault that has occurred is a stuck-at fault.

[0025] A processing module configured to identify that a fault has occurred in a finite state machine (FSM) is provided, the processing module comprising: a verification unit, the verification unit being configured to determine whether a set of one or more transitions that have occurred between states of the FSM is permissible; and a fault signaling unit, the fault signaling unit being configured to identify that a fault has occurred in the FSM if the verification unit indicates that the set of one or more transitions is not permissible.

[0026] The verification unit may be configured to perform said determination in accordance with a data record comprising at least one predefined set of one or more transitions.

[0027] The verification unit can be configured to perform the determination by: comparing a set of one or more transitions that have occurred between states of the FSM with a data record including at least one predefined set of one or more transitions; and in response to the comparison, determining that the set of one or more transitions is not allowed.

[0028] The verification unit may be configured to perform said determining in response to detecting that the number of transitions that have occurred is equal to the number of transitions in one of at least one predefined set of one or more transitions in the data record.

[0029] The processing module may include a memory configured to record in a transition history a set of one or more transitions that have occurred between states in the FSM.

[0030] The verification unit may be configured to perform the determination in accordance with a transition history stored in a memory.

[0031] The memory may be configured to record up to a maximum number of transitions, wherein the maximum number is determined based on at least one predefined set of one or more transitions in the data record.

[0032] The number of transitions in the set of one or more transitions that have occurred may not exceed a maximum number.

[0033] A computer readable code may be provided, the computer readable code being configured to cause any of the methods described herein to be performed when the code is executed.

[0034] An integrated circuit definition data set may be provided which, when processed in an integrated circuit manufacturing system, configures the integrated circuit manufacturing system to manufacture a process module as described herein.

[0035] The processing module may be embodied in hardware on an integrated circuit. A method of manufacturing a processing module at an integrated circuit manufacturing system may be provided. An integrated circuit definition data set may be provided, the integrated circuit definition data set, when processed in the integrated circuit manufacturing system, configures the system to manufacture the processing module. A non-transitory computer-readable storage medium may be provided, having stored thereon a computer-readable description of the processing module, the computer-readable description, when processed in the integrated circuit manufacturing system, causes the integrated circuit manufacturing system to manufacture an integrated circuit embodying the processing module.

[0036] An integrated circuit manufacturing system can be provided, the integrated circuit manufacturing system comprising: a non-transitory computer-readable storage medium on which a computer-readable description of a processing module is stored; a layout processing system, the layout processing system is configured to process the computer-readable description to generate a circuit layout description of an integrated circuit embodying the processing module; and an integrated circuit generation system, the integrated circuit generation system is configured to manufacture the processing module based on the circuit layout description.

[0037] Computer program code for performing any of the methods described herein may be provided.A non-transitory computer readable storage medium may be provided on which computer readable instructions are stored which, when executed in a computer system, cause the computer system to perform any of the methods described herein.

[0038] As will be apparent to the skilled person, the above features may be combined as appropriate and may be combined with any aspect of the examples described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Examples will now be described in detail with reference to the accompanying drawings, in which:

[0040] Figure 1 An example state diagram for a finite state machine is shown.

[0041] Figure 2 A method for fault detection as described herein is shown.

[0042] Figure 3 An example transition history is shown.

[0043] Figure 4 An example transition history is shown.

[0044] Figure 5 A method 500 is shown that may be performed as part of step S240 .

[0045] Figure 6 An example state diagram for a finite state machine including conditional transitions is shown.

[0046] Figure 7 A processing module configured to identify that a failure has occurred in a finite state machine is shown.

[0047] Figure 8 A computer system is shown that implements a processing module on a graphics processing system.

[0048] Fig. 9 An integrated circuit manufacturing system for producing an integrated circuit embodying a processing module is shown.

[0049] The accompanying drawings show various examples. It will be appreciated by the skilled person that the element boundaries (e.g., boxes, groups of boxes, or other shapes) shown in the accompanying drawings represent an example of boundaries. In some examples, it may be the case that an element can be designed as multiple elements, or multiple elements can be designed as one element. Where appropriate, common reference numerals are used throughout the accompanying drawings to indicate similar features. DETAILED DESCRIPTION

[0050] The following description is presented by way of example to enable one skilled in the art to make and use the invention.The present invention is not limited to the embodiments described herein, and various modifications to the disclosed embodiments will be apparent to those skilled in the art.

[0051] Embodiments will now be described by way of example only.

[0052] exist Figure 1 An example state diagram 100 for a finite state machine (FSM) is depicted in FIG. A FSM can be in one of a finite number of states (exactly) at any given time. A FSM can transition between states in response to certain inputs. A FSM must include at least two states. In other words, a FSM includes multiple states. Figure 1 In the example shown, the FSM 100 includes four states: 110a, 110b, 110c, 110d, including an idle state 110a.

[0053] The FSM is arranged to receive inputs when it is in each state. In some states, the FSM is also arranged to produce outputs. Not all states in the FSM necessarily have outputs. For example, in Figure 1 When the FSM is in the idle state 110a, it does not output anything.

[0054] A FSM can be in only one state at a time. A FSM can transition from being in one state to being in another state in response to certain inputs. Transitions 120 define the progression of the FSM from one state to another. Figure 1 Each shaded arrow in 120 01 , 120 12 , 120 23 , 120 30 The first digit of the subscript of each label 120 depicts the state at which the transition begins, and the second digit of the subscript of each label 120 depicts the state at which the transition ends. For example, transition 120 23 is a transition from state 2 to state 3. In this example, the idle state is labeled state 0.

[0055] A transition represents a direct route from one state to another. In other words, a transition cannot involve more than two states. For example, the progression from state 1 to state 2 to state 3 involves two transitions: 12 and another transition 120 from state 2 to state 3 23 . Transitions have directions. For example, the transition from the idle state to state 1 (120 01 ) is a different transition from the transition from state 1 to the idle state. Therefore, a transition is defined by the two states between which the transition occurs and the direction in which the transition occurs.

[0056] Whether a transition occurs from the current state to another state depends on the input of the FSM. For example, in a particular FSM, the FSM may be configured to transition from the idle state to state 1 only if the FSM receives an input equal to 1 while it is in the idle state. If the FSM receives an input equal to anything other than 1 while in the idle state, for example, it may remain in the idle state. As another example, the FSM may transition from state 1 to state 2 only if it receives an input greater than 1. If the FSM receives an input not greater than 1 while in state 1, it will do nothing.

[0057] When designing an FSM, the possible transitions between states in response to certain inputs are planned by the designer. The FSM is created with the intended transitions between states in response to certain inputs. Figure 1 In the FSM of the state diagram shown, the intention is that when a certain input is received when the FSM is in the idle state, there may be a transition between the idle state and state 1. It is also intended that there may be a transition from state 3 to the idle state. Intentional transitions are predetermined transitions that are expected to occur during the normal operation of the FSM. That is, for the purpose of this document, intentional transitions are those transitions that the FSM allows according to the actual (i.e., coded) design of the FSM (regardless of whether the design reflects the desired functionality that the designer intends to create). Intentional transitions may be referred to as allowed transitions in this article. There are a finite number of allowed transitions in the FSM.

[0058] When designing an FSM and determining the allowed transitions between states, there are usually some transitions between states that are assumed not to occur, regardless of the input. Typically, an FSM is not designed to include every possible transition between states as an allowed transition. Assuming the FSM is working correctly, some transitions between states are not intended to occur under any circumstances. Figure 1Transitions that were not envisioned by the designer of the FSM are depicted with dashed arrows. For example, it is not intended that there be a transition between the idle state and state 2. In other words, when the FSM is created, there are no inputs where the transition between the idle state and state 2 is expected to occur. Similarly, there are no inputs where the transition from state 1 to state 3 is expected to occur. Unintentional transitions may be referred to as non-permitted transitions in this article. There are a finite number of non-permitted transitions.

[0059] In some examples (e.g. Figure 1 In the examples shown), either a transition is allowed or it is not allowed, i.e. there is no other type of transition. So, in these examples, a non-allowed transition can be determined from an allowed transition, and vice versa.

[0060] The allowed and impermissible transitions between states are predetermined. For example, the allowed and impermissible transitions are determined by the programmer when designing the FSM. When the FSM is active and responding to inputs, the allowed and impermissible transitions have been determined. For example, the allowed and impermissible transitions are determined during the design phase of the FSM.

[0061] Table 1 shows the Figure 1 The allowed and non-allowed transitions of the FSM of the state diagram are shown.

[0062] Allow for change Non-permissible transformation Idle state → state 1 State 1 → Idle state State 1 → State 2 State 1 → State 3 State 2 → State 3 State 2 → Idle state State 3 → Idle state State 2 → State 1 State 3 → State 1 State 3 → State 2 Idle state → state 3 Idle state → state 2

[0063] Table 1

[0064] In references such as above Figure 1 In some of the described FSMs, the admissibility of a transition is independent of any previous or future transitions occurring in the FSM.

[0065] It may be the case that the FSM is designed so that the transition between two states is conditional on one or more previous or future transitions. Such transitions may be referred to herein as conditional transitions. A conditional transition cannot be said to be permissible in itself, since its permissibility depends on a preceding or subsequent transition. The FSM is not designed for permissible transitions, but it may be considered to be designed for permissible routes, where a route may include multiple transitions. A conditional transition is part of a route that includes at least two transitions.

[0066] A route is a collection of one or more transitions. For example, a route can be just one transition. For example, a route can be a collection of transitions. For example, a route ("Route A") can be from state 1 to state 2, which in Figure 1 is shown as transition 120 12 In another example, a route can be a collection of two or more transitions. For example, a route ("Route B") can be from state 1 to state 2 to state 3, which is Figure 1 is shown as transition 120 12 and transformation 120 23 In this case, route B from state 1 to state 3 proceeds via state 2 and includes two transitions. Route and set of one or more transitions are used interchangeably herein.

[0067] Figure 6 An example state diagram 600 for a FSM is shown that will be used to further illustrate conditional transitions.

[0068] As in Figure 1 As in , some permissible routes (i.e., a predefined set of one or more transitions) are depicted with shaded arrows. Figure 1 As in , some non-permissible routes are depicted with dashed arrows. Not all non-permissible routes are shown in Figure 6 Table 2 shows the Figure 6 The state diagram 600 is shown with allowed and non-allowed paths for the FSM.

[0069] In this example, the transition 620 from state 1 610b to state 2 610c 12 If the previous transition was from state 1 to state 2, then the transition from state 2 610c to state 1 610b is allowed. Therefore, transition 620 21 is an example of a conditional transition. Another example of a conditional transition is a transition from state 3 to state 2 (transition 620 32 ). This transition is only allowed if the next transition goes back to state 3. In this example, the FSM does not allow a route from state 3 to state 2 to state 1. The only condition under which state 3 to state 2 is allowed is if the route goes back to state 3 again, so that the route becomes state 3 to state 2 to state 3. Similarly, in this example, the transition from idle state to state 3 is only allowed if the transition is followed by a return to idle state. So, the route from state 3 to idle state to state 3 ("route C") is allowed. However, the route from idle state to state 3 to state 2 ("route D"), for example, is not allowed.

[0070] Collection Number an allowed set of one or more transitions 1 Idle state → state 1 2 State 1 → State 2 3 State 1 → State 2 → State 1 4 State 2 → State 3 5 State 3 → State 2 → State 3 6 State 3 → Idle state 7 Idle state → State 3 → Idle state

[0071] Table 2-1

[0072] Collection Number An inadmissible set of one or more transitions 1 State 1 → Idle state 2 State 1 → State 3 3 State 2 → Idle state 4 State 3 → State 2 → State 1 5 State 3 → State 1 6 Idle state → state 3 → state 2 7 Idle state → state 2

[0073] Table 2-2

[0074] In some of the above examples, conditional transitions are described as being dependent on subsequent transitions. For example, the transition from idle state to state 3 is permitted only in the case where the next transition is from state 3 to idle state. Conditional transitions can be equivalently described as being dependent on the previous transition (i.e., with the previous transition as a condition). For example, saying that the transition from idle state to state 3 is permitted only in the case where the transition back to idle state is permitted is the same as saying that the transition from state 3 to state 2 is permitted only in the case where the previous transition is from state 2 to state 3. Any other previous transition to state 3 will not be permitted when the transition from state 3 to state 2 is followed. In other words, once FSM is in state 3, it can only be reached there via permitted transitions in the case where the previous transition is from idle state to state 3 or in the case where the previous transition is from state 2 to state 3. At this point in time, it is not possible to determine whether any error has occurred in FSM. It is known that the route from idle state to state 3 and then to state 2 is not permitted, and the route from state 2 to state 3 and then to state 2 is permitted. So, once the FSM is in state 3, the transition from state 3 to state 2 is permissible only if it is preceded by a transition from state 2 to state 3. Thus, the transition from state 3 to state 2 can be considered dependent on the preceding state (i.e., how the FSM entered state 3). In this case, the transition from the idle state to state 3 may not be listed as a conditional transition, since the conditionality has been transferred to the transition from state 3 to state 2 being dependent on the preceding transition. Thus, the lists of permissible and non-permissible routes may be written differently depending on whether the conditional transition is described with respect to a preceding transition or a subsequent transition.

[0075] All features described above with reference to permissible transitions and non-permissible transitions apply equally to permissible routes and non-permissible routes. For example, either a route is permissible or it is non-permissible. There is no other type of route. Therefore, non-permissible routes can be determined from permissible routes, and vice versa. Permissible routes and non-permissible routes in a FSM are predetermined during the design phase of the FSM.

[0076] Whether the FSM includes a conditional transition can be determined by looking at the length of an allowed route or a non-allowed route. For example, if all routes (allowed routes or non-allowed routes) are only one transition long (i.e., the routes are a collection of only one transition), then there are no conditional transitions in the FSM. If there are routes (allowed routes or non-allowed routes) that include two or more transitions, then the FSM includes at least one conditional transition.

[0077] The inventors have recognized that by checking whether a set of one or more transitions that have occurred between states of the FSM is permissible, the occurrence of a fault in the FSM can be identified. If a set of one or more transitions occurs in the FSM that is not intended to occur during normal operation of the FSM (i.e., the set is not permissible), it can be determined that there is a fault in the FSM, i.e., a fault has occurred in the operation of the FSM. The determined fault is not an error in the design of the FSM. Rather, it is a fault that has occurred after the FSM has been designed and tested (e.g., debugged). For example, if Figure 1 If an FSM is run and a transition occurs from state 1 to state 3, this indicates that a fault has occurred in the FSM because there is no input where the transition from state 1 to state 3 is assumed to occur. Although this method cannot determine whether an allowed set of one or more transitions have occurred from one state to another for the right reason (e.g., in response to a correct input), it can note a set of one or more transitions that have occurred in the FSM that are never assumed to have occurred regardless of the input. Detecting faults in the FSM based on a non-allowable set of one or more transitions helps meet industrial safety standards, such as ISO26262. In addition, detecting an impermissible set of one or more transitions that have occurred is simple to implement and does not significantly negatively affect the performance of the FSM, for example in terms of latency, power consumption, and / or silicon area.

[0078] For FSMs in which the admissibility of each transition is independent of the other transitions, the set of one or more transitions described herein need only contain one transition. For FSMs containing conditional transitions, independently looking at one transition that has occurred in the FSM will not necessarily be sufficient to determine whether the transition is admissible. It may be necessary to consider a set of two or more transitions that have occurred.

[0079] Now refer to Figure 2 and Figure 5 A method 200 for identifying that a fault has occurred in a FSM is described. This method may be performed by Figure 7 700 is executed by the processing module 700 shown in FIG. As described in more detail below, the processing module 700 includes a verification unit 710, a fault signaling unit 720 and a memory 730. The verification unit 710 and the fault signaling unit 720 can be implemented with hardware, software or a combination thereof. The method described herein identifies a fault after it has occurred, i.e., the method identifies errors in past (i.e., historical) transitions. The transitions that have occurred between the states of the FSM are referred to as past transitions in this article.

[0080] The following fault detection method 200 may be used with a FSM that includes conditional transitions or a FSM that does not have conditional transitions.

[0081] Method 200 can be implemented in parallel with the operation of the FSM. In other words, the method does not need to interfere with the activity of the FSM. This avoids adding delay to the normal operation of the FSM.

[0082] The fault detection method described herein is applicable to a FSM that has already been designed. In other words, the FSM is no longer in the design phase. For example, the FSM is not being debugged. Therefore, the permissible routes and non-permissible routes have been determined. As an optional step before step S210, the permissible routes may be determined. Additionally or alternatively, non-permissible routes may be determined. Non-permissible routes may be determined from permissible routes (and vice versa).

[0083] In step S210, the FSM is run. Running the FSM means that the FSM is active and responds to input data. Running the FSM is different from designing and testing the FSM during the design phase. For example, the FSM is not tested in the debugging phase.

[0084] At step S220, the method waits for a transition to occur. That is, the FSM is allowed to fend for itself. Eventually, a transition will occur between the states of the FSM.

[0085] The method may perform a check every clock cycle or at a predetermined interval to see if a transition has occurred. For example, the method may check every predetermined interval whether a transition has occurred. This may be performed every clock cycle even if (for example) a transition may only occur every 10 clock cycles.

[0086] At step S230, a record of transitions that have occurred in the FSM is maintained in the transition history. Step S230 may be automatically performed when a transition occurs. In an example, a check to see if a transition has occurred may be performed in response to detecting at step S230 that a transition has been recorded in the transition history. Performing the step of recording a transition in the transition history (i.e., step S230) may cause the system to proceed to step S235 or S240 without the need to perform a check every clock cycle or perform an active step of waiting for a transition to occur.

[0087] The transition history may be stored in memory. For example, the transition history may be stored in memory-mapped registers. This may be suitable when method 200 is being executed in software. In another example, the transition history may be stored in memory local to the hardware. In some examples, the transition history may be made visible to the software so that it may be updated or calibrated depending on the application of the FSM.

[0088] In an example, a transition may be recorded by recording the two states between which the transition occurred. For example, the transition history may be an ordered list of states that the FSM has been in. Figure 3An example transition history holding four states is shown. The most recent state is on the left side of the figure. In this example, the transition history is a history of states. Each past transition that has occurred can be determined from the order of the states in the history. In the case where the transition history stores each state, the transition history must hold at least two states in order to record the transition. Figure 3 Each past transition 120 has been marked.

[0089] In another example, the transition history can be an ordered list of transitions. For example, Figure 3 The transformation history in can store 120 transformations 23 , 120 12 and 120 01 Instead of states. When transitions are stored instead of two states between which past transitions occurred, less than one entry is taken up in the history.

[0090] The transition history can be configured to record up to a maximum number of transitions. Figure 3 In , the transition history is configured to record up to a maximum of four transitions corresponding to five states. Figure 3 There is space in the memory of for more than one state (and therefore more than one transition) to be recorded.

[0091] Once a transition has occurred between states of the FSM, the method may optionally check at step S235 whether a predetermined condition is satisfied before proceeding to step S240. Some examples of such predetermined conditions are given below.

[0092] In one example, the predetermined condition is whether the FSM is in a default state. For example, the fault detection method may wait for the FSM to reach a default state (such as an idle state) before proceeding to step S240 to determine whether a route to the default state is permissible. Steps S220 and S230 may be looped until the FSM reaches the default state, which satisfies the predetermined condition at step S235. The method may then proceed to step S240 to determine whether a route to the default state is permissible.

[0093] In another example, the predetermined condition may relate to the number of transitions that have been recorded in the transition history. For example, the method may wait for a certain number of transitions to have occurred before checking whether they are permissible. Steps S230 and S220 may be performed in a loop until the transition history has recorded a predetermined number of transitions under the condition at step S235.

[0094] Once the predetermined conditions (if any) have been met at step S235, the method proceeds to step S240.

[0095] In step S240, the processing module 700 (particularly the verification unit 710) determines whether the set of one or more transitions that have occurred between the states of the FSM is permissible. The transition history can be used in step S240 to check the permissibility of multiple sets of one or more past transitions after they have occurred. In some examples, rather than checking the permissibility of each set of one or more past transitions as soon as it occurs (i.e., before the next set of one or more transitions occurs) in step S240, multiple sets of one or more past transitions can be recorded in the transition history, and each set of one or more past transitions in the history can then be checked with reference to the transition history in step S240.

[0096] Once each set of one or more past transitions in the history has been determined to be permissible or impermissible at step S240, the history may be cleared to make room for the new transition. Alternatively, the oldest recorded set of one or more transitions may be discarded from the history to make room for the new transition. If a set of one or more transitions is determined to be impermissible, its transition history may be temporarily stored in a buffer for further analysis, as will be described in more detail below.

[0097] exist Figure 5 Details of an example implementation of step S240 are shown in FIG.

[0098] In step S541, the set of one or more past transitions is compared with a list of at least one predetermined set of one or more transitions (also referred to herein as a predetermined route). The at least one route is predetermined in the sense that it is known prior to the execution of the FSM.

[0099] The at least one predetermined route may be an allowed route. The at least one predetermined route may be a non-allowed route. In some examples, the list may include only allowed routes or only non-allowed routes. The set of one or more past transitions is compared to each entry of the list (or the entries of the list if the list includes only one entry) to determine whether the set of one or more past transitions matches any entry. This can be performed in any suitable manner. For example, the set of one or more past transitions may be compared to each entry in the list until a match is found. Alternatively, the set of one or more past transitions may be compared only to entries in the list that start with the state at which the set of one or more past transitions starts.

[0100] If the FSM does not include any conditional transitions, then the intended route will include only one transition. In this case, the permissible route is equivalent to the permissible transition, and the non-permissible route is equivalent to the non-permissible transition. Figure 1The allowed paths of the FSM of the state diagram 100 shown are the same as the allowed transitions in the left-hand column of Table 1 and are used for Figure 1 The non-permissible paths of the FSM of the illustrated state diagram 100 are the same as the non-permissible transitions in the right-hand column of Table 1.

[0101] If the FSM includes at least one conditional transition, the list will include at least one predetermined route containing two or more transitions. For example, set number 5 in Table 2-1 shows an allowable route containing two transitions.

[0102] One or more lists may be stored in software or hardware. Although lists are mentioned herein, it should be understood that, as an alternative to lists (e.g., arrays, lookup tables, or databases), any type of data record may be used to indicate which routes are permissible and which routes are not permissible.

[0103] At S542, a determination is made as to whether the set of one or more past transitions matches an entry of the list. The set of one or more past transitions may only be determined to match an entry of the list if the set of one or more past transitions and the entry of the list contain the same number of transitions. For example, a set of past transitions including state 1 to state 2 cannot be matched with a predefined route including transitions from state 1 to state 2 to state 3. In addition to being of the same length, the set of past transitions and the predefined route also need to contain the same transitions in order to match each other.

[0104] If, in step S542, it is found that the set of one or more past transitions matches the predefined route, the method proceeds to step S545 to determine whether the set of one or more past transitions is permissible. Depending on whether the list includes permissible routes or non-permissible routes, different conclusions will be made as to whether the set of one or more past transitions is permissible. In the case where the list includes routes of only one type (permissible or non-permissible), the response to determining that the set of one or more past transitions is on the list will be the same each time. In other examples, the list may include at least one permissible route and at least one non-permissible route. In this case, in order to determine whether the set of one or more past transitions is permissible, a further step of determining whether the set of one or more past transitions matches an permissible route or a non-permissible route is necessary.

[0105] In an example, the list includes all allowed routes in the FSM and / or all non-allowed routes in the FSM. In the case where the list includes all allowed routes or all non-allowed routes or both, it can always be determined whether a set of one or more past transitions that have occurred is allowed or non-allowed based on a comparison between the set of one or more past transitions and each entry on the list.

[0106] For example, if the list includes all permissible routes, and a comparison between the set of one or more past transitions and the list shows that the set of one or more past transitions is the same as one of the entries on the list, then the set of one or more past transitions is determined to be permissible. If the set of one or more past transitions does not match any entry on the list, it may be determined that the set of one or more past transitions is not one of the permissible routes. Therefore, the set of one or more past transitions must be non-permissible.

[0107] In another example, the list includes all non-permissible routes. If a comparison between the set of one or more past transitions and the list shows that the set of one or more past transitions is the same as one of the entries on the list, then the set of one or more past transitions is determined to be non-permissible. If the set of one or more past transitions does not match any entry on the list, it can be determined that the set of one or more past transitions is not one of the non-permissible routes. Therefore, the set of one or more past transitions must be permissible.

[0108] The list does not have to include all the allowed routes in the FSM or all the non-allowed routes in the FSM to be able to infer that the set of one or more past transitions is allowed within a certain error limit. For example, there may be thousands of allowed routes and thousands of non-allowed routes in a large FSM. It may be the case that not all allowed routes or non-allowed routes are included in the list. Among the thousands of allowed routes and non-allowed routes, there may be a subset of those routes that are more likely to occur. The list may only include the allowed routes or non-allowed routes that are most likely to occur. In other words, the list may include all allowed routes or non-allowed routes minus the routes that are extremely unlikely to occur. When performing a comparison with such a list, for example, with a list of most likely allowed routes, there is a chance that the set of one or more past transitions that have occurred is not on the list but is still allowed. The conclusion on whether the set of one or more past transitions is allowed can be based on the probability that the set of one or more past transitions is allowed or not.

[0109] The list may include which route type (permissible or non-permissible) is least likely to exist. This applies regardless of whether the list includes all permissible routes and / or all non-permissible routes or only a subset thereof. For example, if the FSM has a total of five permissible routes and a total of fifteen non-permissible routes, the list may be chosen to include all permissible routes, rather than all non-permissible routes. This may make it faster to determine whether a set of one or more past transitions is permissible. Figure 1 In the example FSM 100 shown in Table 1, a set of past transitions is preferably compared to the list including allowed routes because the list including allowed routes contains fewer entries than the list including non-allowed routes.

[0110] In another example, a set of one or more past transitions may be compared to a list of the fewest entries starting from a first state included in the set of one or more past transitions. For example, there may be more allowed routes starting from a particular state than non-allowed routes starting from that state, but the total number of allowed routes in the FSM may be less than the total number of non-allowed routes in the FSM. In this case, it is preferred to compare the set of one or more past transitions to a longer list of non-allowed routes rather than a shorter list of allowed routes because there are fewer non-allowed routes starting from a first state in the set of one or more past transitions than allowed routes starting from the first state. In other words, it is preferred that the set of one or more past transitions be compared to a list of the fewest entries associated with the set of one or more past transitions.

[0111] If it is determined in step S542 that the set of past transitions does not match a predefined set, for example because the set of past transitions is not the same length as any predefined set, or because the past transitions are not the same as transitions in any predefined set, the method proceeds to step S543.

[0112] Step S543 checks whether the set of past transitions is likely to be permissible if the FSM is to continue to another state. For example, if the set of past transitions only includes transitions from state 1 to state 2, but the list includes a permissible set of transitions as state 1 to state 2 to state 3, then the set of past transitions is likely to be permissible if it continues to state 3. Therefore, step S543 checks whether the set of past transitions matches a subset of the predetermined set of transitions.

[0113] If the set of one or more past transitions matches a subset of the predetermined route, then at step S544 the method waits for the FSM to transition into a further state. Once the FSM transitions into a further state, the further state is added to the set of past transitions. This can be done by recording the further state in a transition history. The process then repeats again from step S541, but this time with an updated set of past transitions including the further transition from step S544. In this way, the method can be adapted to check conditional transitions in a set of one or more past transitions.

[0114] If, in step S543, the set of one or more past transitions is not found to match the subset of the predetermined route, then in step S545, it may be determined as described above whether the set of one or more past transitions is permissible. For example, if the list includes permissible transitions, and in step S542 the set of past transitions is not found to match the permissible transitions, then step S543 is to check whether the set of past transitions cannot match the permissible transitions if it is allowed to continue to further transitions. If the set of past transitions does not match the subset of the permissible routes, then there is no chance that the set of past transitions is permissible regardless of the next transition made by the FSM. In this case, the set of past transitions may be classified as permissible or non-permissible, depending on whether the list contains an permissible set or a non-permissible set of transitions.

[0115] In step S250, in response to determining that the set of one or more past transitions is not allowed, the processing module 700 (particularly the fault signaling unit 720) identifies that a fault has occurred in the FSM. For example, in step S250, if the set of one or more past transitions is determined to be not allowed, an error message may be generated. The error message may be picked up by a control system in the hardware or external to the hardware. If the set of one or more past transitions is determined to be allowed, no error message is generated.

[0116] In other examples, the processing module 700 may react differently to identifying that a fault has occurred in the FSM. For example, in addition to or in lieu of generating an error message, if a set of one or more past transitions is determined to be non-permissible, then optionally in step S260, the method may further include replaying the FSM from a state starting from the set of one or more past transitions. If the FSM displays a set of one or more transitions that is the same as the non-permissible set of one or more past transitions, it may be determined that the fault that produced the first non-permissible set of one or more past transitions is a fixed fault. If during replay, the FSM displays a set of one or more transitions that is different from the non-permissible set of one or more past transitions, it may be determined that the fault that produced the first non-permissible set of one or more past transitions is a transient fault. This information may be submitted to the control system together with the fault signaling.

[0117] Steps S220 to S260 may then be repeated for the next transition occurring in the FSM at step S220. Where multiple transitions are recorded in the transition history before proceeding to step S240, steps S240 to S260 are repeated for each transition in the transition history.

[0118] In some examples, it may not be necessary to record every transition in the transition history. For example, if the FSM does not include any conditional transitions, and so each set or route described above contains only one transition, the method may determine whether the transition that has occurred is permissible each time a transition occurs. Once a transition has been determined to be permissible or not, the transition may be discarded.

[0119] There are some constraints that apply to the size of the set that may be determined to be allowed based on the size of the transition history and the lists of allowed and non-allowed routes, as will be explained below.

[0120] The number of past transitions in the set that can be determined to be permissible is constrained to be equal to or greater than the number of transitions in the smallest predefined set in the list. This is because it can be determined whether a set of one or more past transitions is permissible only if there is at least one predefined set in the list that contains the same number of transitions as the set of one or more past transitions.

[0121] For example, if the FSM is designed so that the only permissible routes in the FSM are those that include two transitions (e.g., state 1 to state 2 to state 3), then it is not possible to determine whether a set in which only one transition has occurred (e.g., state 1 to state 2) is permissible because the list to which the set will be compared does not include sets with only one transition.

[0122] Therefore, one of the predetermined conditions that may be checked in step S235 is whether the number of past transitions in the set of one or more past transitions is equal to the number of transitions in at least one predefined route. Steps S220 and S230 may loop until this condition is met.

[0123] If the list of permissible routes or non-permissible routes includes a route containing only one transition, then a set containing only one past transition will satisfy this condition. If the FSM does not contain any conditional transitions, it will always be the case that the number of transitions in the set of one or more past transitions is equal to or greater than the number of transitions in the minimum predetermined route, since the minimum predetermined route contains one transition.

[0124] Each time steps S220 and S230 occur, the transition that just occurred may be added to the set of one or more past transitions to be tested at step S240. Once it has been determined that the set of one or more past transitions is at least long enough to compare the set to at least one predefined route in the list, the method may proceed to step S240.

[0125] As explained above, the transitions that have occurred can be recorded in the transition history. When the FSM contains at least one conditional transition, it may be necessary to record the transitions that have occurred in the transition history (e.g., in step S230). The maximum number of transitions that the transition history can record defines the maximum number of transitions in the set of past transitions that can be determined as allowed. If this is not the case, it may not be possible to determine whether a set of transitions is allowed because the entire length of the set is not recorded in the transition history. For example, if the transition history is only able to record the last four transitions, a set of five transitions that have occurred cannot be determined as allowed.

[0126] Preferably, the maximum number of transitions that the transition history can record is the same as the number of transitions in the maximum predefined set of transitions in the list.

[0127] Example

[0128] Now it will be based on Figure 6 The state diagram 600 is shown in the context of the examples of the FSM described above with reference to Figure 2 and Figure 5 Describe the steps. Figure 4 An example transition history including six states and recording five transitions is shown. In this example, the maximum number of transitions that can be represented in the transition history is 5. Figure 4 The sets indicated in are example sets that may be determined to be permissible.

[0129] The FSM is run at step 210. The first transition that will occur at step S220 in this example is the transition from the idle state to state 1. Therefore, the first set includes one transition 620 01 In step S230 this transition is recorded in the transition history.

[0130] In this example, the predetermined condition checked at step S235 is whether the number of past transitions that have occurred is equal to the number of transitions in one of at least one predefined set of one or more transitions. In this case, since the allowed transitions and non-allowed transitions for the FSM shown in Tables 2-1 and 2-2 include at least one set with only one transition, any set that includes one past transition satisfies the requirement of being at least as long as one of the predetermined sets in the list. Therefore, the method may proceed to the step involving Figure 5 The steps shown are step S240.

[0131] In step S541, the first set is compared with the list in Table 2-1 or Table 2-2 (or both) to determine whether the first set is allowed. Taking Table 2-1 as an example, transition 620 01matches set number 1 in the list of allowed transitions. Therefore, the answer to step S542 is "yes". In step S545, including transition 620 01 The first set of is determined to be permissible because the predetermined set matched therewith in step S542 is an permissible set. Therefore, in step S250, no fault is identified, for example, no error message is generated, and the method repeats from step S220.

[0132] The same process applies to Figure 4 The depiction includes a transition 620 12 Each transition is added to the transition history as it occurs.

[0133] The third set determined to be allowed includes two transitions: transition 620 32 and transformation 620 21 Initially, it is not known that the third set will contain two transitions. The method starts by considering the third set to contain only the transition from state 3 to state 2.

[0134] In step S541, including transition 620 32 The third set is compared with a predetermined set of one or more transitions. As can be seen from Table 2-1, there are two allowed sets of transitions starting from state 3: set 5 and set 6. Set 6 includes only one transition, while set 5 includes two transitions. In step S542, it is determined that the third set does not match set 6. It is also determined that the third set does not match set 5 because the lengths of the third set and set 5 are different. Therefore, the answer to step S542 is "no". However, even if the third set does not match set 6, if the FSM continues to transition from state 2 back to state 3, it may still match set 5. At this point, the system cannot determine whether the FSM is faulty.

[0135] Since the answer to step S542 is "no", the method proceeds to step S543, where it is determined whether the third set matches a subset of the predetermined set. The transition from state 3 to state 2 does match a subset of the fifth set. Therefore, the answer to step S543 is "yes".

[0136] Therefore, the method proceeds to step S544 and waits for further transitions to occur. This is equivalent to returning to Figure 2 The next transition to occur is the transition from state 2 to state 1. This transition is recorded in the transition history at step S230. A further transition is added to the third set. Therefore, the third set now includes transition 620. 32 and transformation 620 21 .

[0137] The method then returns to step S541 and repeats. At step S542, there are no entries on the list in Table 2-1 that match the third set of transitions from state 3 to state 2 to state 1. Therefore, the answer to step S542 is "no". At step S543, the third set of transitions is compared to subsets of predetermined sets. The third set does not match any subset of the predetermined sets in Table 2-1. In other words, if the FSM proceeds to make another transition, there are no other entries in Table 2-1 that would cause the third set of transitions to be permissible. Therefore, the answer to step S543 is "no". At step S545, the transition 620 is included. 32 and transformation 620 21 The third set is determined to be inadmissible.

[0138] At step S250, a fault in the FSM is identified and an error message may be generated.

[0139] As indicated by this example, the set of one or more past transitions determined to be permissible may have varying lengths depending on the list of predefined sets of transitions. The set length may also increase as the method proceeds through steps S541 to S544. The transition history allows the method to track past transitions, which may require determining whether a set of multiple transitions is permissible.

[0140] Now refer to Figure 7 A processing module 700 is described for identifying that a fault has occurred in a FSM. The processing module 700 may be part of hardware for emulating a finite state machine. In another example, the processing module may be implemented separately from the hardware for emulating a FSM. The processing module is configured to perform the steps of method 200 (including method 500).

[0141] The processing module includes a verification unit 710. The verification unit is configured to determine whether a set of one or more transitions that have occurred between states of the FSM is allowed. The verification unit receives data indicating transitions that have occurred between states of the FSM during runtime from the FSM. The verification unit is also able to access a list of at least one predefined set of one or more transitions. Since the list is predetermined before running the FSM, the processing module 700 can store the list in a local memory or register within the processing module. The verification unit is configured to determine whether a set of one or more transitions that have occurred between states of the FSM is allowed according to a list of at least one predefined set of one or more transitions. For example, the verification unit can compare a set of one or more transitions that have occurred between states of the FSM with a list of at least one predefined set of one or more transitions. In response to the comparison, the verification unit can determine whether the set of one or more transitions is allowed or not. For example, if the verification unit compares a set of one or more transitions that have occurred with a list of non-allowed sets of one or more transitions, and determines that the set that has occurred matches the non-allowed set, the verification unit determines that the set that has occurred is not allowed.

[0142] As explained above, the size of the set of one or more transitions that may be determined to be permissible depends on the size of the predefined sets in the list of one or more predefined sets of one or more transitions. If the list of at least one predefined set of one or more transitions does not contain a set with the same number of transitions as the set of transitions that have occurred, the verification unit cannot determine the permissibility of the set of transitions that have occurred in the FSM. Therefore, the verification unit may be configured to perform the determination in response to detecting that the number of transitions that have occurred is equal to the number of transitions in one of the at least one predefined sets of one or more transitions.

[0143] The processing module may include a memory 730. The memory is configured to record in a transition history a set of one or more transitions that have occurred between states of the FSM. The memory may have a maximum capacity and so can only record a maximum number of transitions. Preferably, the maximum number of transitions that the memory can record is determined based on at least one predefined set of one or more transitions. For example, the maximum number of transitions that the memory can record is equal to the number of transitions in the maximum predefined set. Preferably, the verification unit may determine that the number of transitions in the set of one or more transitions that are allowed does not exceed the maximum number of transitions that the memory can record.

[0144] The verification unit is thus configured to perform the above steps and with respect to Figure 5 Steps S541 to S545 of step S240 are described.

[0145] The processing module also includes a fault signaling unit 720. The fault signaling unit is configured to communicate with the verification unit. The fault signaling unit may also be configured to communicate with the verification memory 730. The fault signaling unit identifies that a fault has occurred in the FSM in response to an indication from the verification unit. For example, if the verification unit indicates that a set of one or more transitions that have occurred between states of the FSM is not allowed, the fault verification unit identifies that a fault has occurred in the FSM. Figure 2 As indicated in step S250 of , when the fault signaling unit identifies that a fault has occurred in the FSM, it may output an error message. For example, the fault signaling unit may signal to a system external to the processing module that a fault has occurred in the FSM.

[0146] The system can respond to such error messages in any suitable manner. In one example, the fault signaling unit can be further configured to classify the type of fault that has occurred in the FSM. For example, in response to identifying that a fault has occurred in the FSM, the fault signaling unit can replay the FSM from the first state corresponding to the first transition in the set of one or more transitions determined by the verification unit to be not allowed. For example, if the set of one or more transitions that are not determined to be allowed includes a transition from state 1 to state 3, the fault signaling unit can run the FSM again from state 1. If the same transition occurs in the FSM (for example, the FSM proceeds to state 3 from state 1 again), it can be determined that the fault that has occurred in the FSM is a fixed fault. If the same error does not occur, it can be determined that the fault that has occurred in the FSM is a transient fault. In the replay of the FSM, the input data used when the set of one or more transitions is not allowed can be used again when the FSM is started from the first state.

[0147] Figure 8 A computer system in which the processing modules described herein may be implemented is shown. The computer system includes a CPU 902, a GPU 904, a memory 906, a neural network accelerator (NNA) 908, and other devices 914 (e.g., a display 916, a speaker 918, and a camera 922). The processing module 700 is implemented on the GPU 904. In other examples, one or more of the depicted components may be omitted from the system, and / or the processing module 700 may be implemented on the CPU 902 or within the NNA 908. The components of the computer system may communicate with each other via a communication bus 920.

[0148] Figure 7The processing module of FIG. 1 is shown as comprising a number of functional blocks. This is merely schematic and is not intended to define a strict division between different logical elements of such an entity. Each functional block may be provided in any suitable manner. It will be understood that intermediate values ​​described herein as being formed by a processing module need not be physically generated by the processing module at any point, and may merely represent logical values ​​that conveniently describe the processing performed by the processing module between its input and output.

[0149] The processing modules described herein may be embodied in hardware on an integrated circuit. The processing modules described herein may be configured to perform any of the methods described herein. In general, any of the functions, methods, techniques, or components described above may be implemented in software, firmware, hardware (e.g., fixed logic circuits), or any combination thereof. The terms "module," "function," "component," "element," "unit," "block," and "logic" may be used herein to generally represent software, firmware, hardware, or any combination thereof. In the case of software implementation, a module, function, component, element, unit, block, or logic represents a program code that, when executed on a processor, performs a specified task. The algorithms and methods described herein may be performed by one or more processors that execute code, which causes the processor to perform the algorithm / method. Examples of computer-readable storage media include random access memory (RAM), read-only memory (ROM), optical disks, flash memory, hard disk storage, and other memory devices that may use magnetic, optical, and other technologies to store instructions or other data and may be accessed by a machine.

[0150] As used herein, the terms computer program code and computer readable instructions refer to any kind of executable code for a processor, including code expressed in machine language, interpreted language, or scripting language. Executable code includes binary code, machine code, byte code, code that defines an integrated circuit (e.g., hardware description language or netlist), and code expressed in programming language code such as C, Java, or OpenCL. Executable code can be, for example, any kind of software, firmware, script, module, or library that, when properly executed, processed, interpreted, compiled, run in a virtual machine or other software environment, causes a processor of a computer system supporting the executable code to perform the tasks specified by the code.

[0151] A processor, computer or computer system may be any kind of device, machine or special purpose circuit, or a collection or part thereof, which has processing capabilities so that it can execute instructions. A processor may be or include any kind of general or special purpose processor, such as a CPU, GPU, NNA, system on chip, state machine, media processor, application specific integrated circuit (ASIC), programmable logic array, field programmable gate array (FPGA), etc. A computer or computer system may include one or more processors.

[0152] The present invention is also intended to cover software that defines the configuration of hardware as described herein, such as HDL (Hardware Description Language) software, such as for designing integrated circuits or for configuring programmable chips to perform desired functions. That is, a computer-readable storage medium having computer-readable program code in the form of an integrated circuit definition data set encoded thereon may be provided, which, when processed (i.e., run) in an integrated circuit manufacturing system, configures the system to manufacture a processing module configured to perform any of the methods described herein, or to manufacture a processing module including any of the devices described herein. The integrated circuit definition data set may be, for example, an integrated circuit description.

[0153] Thus, a method of manufacturing a process module as described herein at an integrated circuit manufacturing system may be provided. Furthermore, an integrated circuit definition data set may be provided which, when processed in an integrated circuit manufacturing system, enables the method of manufacturing a process module to be performed.

[0154] The integrated circuit definition data set may be in the form of computer code, for example, as a netlist, code for configuring a programmable chip, as a hardware description language that defines hardware suitable for fabrication at any level in an integrated circuit, including as register transfer level (RTL) code, as a high-level circuit representation (e.g., Verilog or VHDL), and as a low-level circuit representation (e.g., OASIS (RTM) and GDSII). The higher-level representation (e.g., RTL) that logically defines hardware suitable for fabrication in an integrated circuit may be processed at a computer system configured to generate a manufacturing definition of the integrated circuit in the context of a software environment that includes definitions of circuit elements and rules for combining those elements to generate a manufacturing definition of the integrated circuit so defined by the representation. As is typically the case with software executed at a computer system to define a machine, one or more intermediate user steps (e.g., providing commands, variables, etc.) may be required to configure the computer system to generate a manufacturing definition of the integrated circuit to execute code that defines the integrated circuit to generate the manufacturing definition of the integrated circuit.

[0155] Now refer to Fig. 9An example of processing an integrated circuit definition data set at an integrated circuit manufacturing system to configure the system into a manufacturing process module is described.

[0156] Fig. 9 An example of an integrated circuit (IC) manufacturing system 1002 is shown, which is configured to manufacture a processing module as described in any example herein. In particular, the IC manufacturing system 1002 includes a layout processing system 1004 and an integrated circuit generation system 1006. The IC manufacturing system 1002 is configured to receive an IC definition data set (e.g., defining a processing module as described in any example herein), process the IC definition data set, and generate an IC (e.g., which embodies a processing module as described in any example herein) based on the IC definition data set. The processing of the IC definition data set configures the IC manufacturing system 1002 to manufacture an integrated circuit that embodies a processing module as described in any example herein.

[0157] The layout processing system 1004 is configured to receive and process an IC definition data set to determine a circuit layout. Methods for determining a circuit layout based on an IC definition data set are known in the art and may, for example, involve synthesizing RTL code to determine a gate-level representation of a circuit to be generated, for example, in terms of logic components (e.g., NAND, NOR, AND, OR, MUX, and FLIP-FLOP components). By determining location information for the logic components, the circuit layout may be determined by the gate-level representation of the circuit. This may be done automatically or with user involvement in order to optimize the circuit layout. When the layout processing system 1004 has determined the circuit layout, it may output the circuit layout definition to the IC generation system 1006. The circuit layout definition may be, for example, a circuit layout description.

[0158] As is known in the art, the IC generation system 1006 generates the IC according to the circuit layout definition. For example, the IC generation system 1006 may implement a semiconductor device manufacturing process to generate the IC, which may involve a multi-step sequence of photolithography and chemical processing steps during which electronic circuits are gradually formed on a wafer made of semiconductor material. The circuit layout definition may be in the form of a mask that can be used in a photolithography process to generate the IC according to the circuit definition. Alternatively, the circuit layout definition provided to the IC generation system 1006 may be in the form of a computer readable code that the IC generation system 1006 may use to form a suitable mask for generating the IC.

[0159] The different processes performed by the IC manufacturing system 1002 may all be implemented at one location, such as by one party. Alternatively, the IC manufacturing system 1002 may be a distributed system such that some processes may be performed at different locations and may be performed by different parties. For example, some of the following stages may be performed at different locations and / or by different parties: (i) synthesizing RTL code representing an IC definition data set to form a gate-level representation of a circuit to be generated; (ii) generating a circuit layout based on the gate-level representation; (iii) forming a mask based on the circuit layout; and (iv) using the mask to manufacture the integrated circuit.

[0160] In other examples, processing of the integrated circuit definition data set at the integrated circuit manufacturing system may configure the system to manufacture the processing module without processing the IC definition data set to determine the circuit layout. For example, the integrated circuit definition data set may define the configuration of a reconfigurable processor such as an FPGA, and processing of the data set may configure the IC manufacturing system to generate (e.g., by loading the configuration data into the FPGA) the reconfigurable processor having the defined configuration.

[0161] In some embodiments, the integrated circuit manufacturing definition data set, when processed in the integrated circuit manufacturing system, can cause the integrated circuit manufacturing system to produce a device as described herein. Fig. 9 Configuring an integrated circuit manufacturing system in the manner described may enable the manufacture of an apparatus as described herein.

[0162] In some examples, the integrated circuit definition data set may include software that runs on, or in combination with, hardware defined at the data set. Fig. 9 In the example shown in , the IC production system may also be configured by the integrated circuit definition data set to load firmware onto the integrated circuit according to the program code defined at the integrated circuit definition data set when manufacturing the integrated circuit, or to otherwise provide the integrated circuit with program code for use with the integrated circuit.

[0163] When compared to known implementations, the implementation of the concepts set forth in this application in devices, equipment, modules and / or systems (and in the methods implemented herein) may result in performance improvements. Performance improvements may include one or more of improved computing performance, reduced latency, increased throughput and / or reduced power consumption. During the manufacture of such devices, devices, modules and systems (e.g., in integrated circuits), a trade-off may be made between performance improvements and physical implementations to improve manufacturing methods. For example, a trade-off may be made between performance improvements and layout area to match the performance of known implementations, but using less silicon. For example, this may be accomplished by reusing functional blocks in a serial manner or sharing functional blocks between elements of devices, devices, modules and / or systems. In contrast, the concepts set forth in this application that result in improvements in the physical implementations of devices, devices, modules and systems (e.g., reduced silicon area) may be weighed against performance improvements. This may be accomplished, for example, by manufacturing multiple instances of a module within a predefined area budget.

[0164] Applicants hereby independently disclose each individual feature described herein and any combination of two or more such features, to the extent that such feature or combination can be implemented based on the specification as a whole in view of the common general knowledge of a person skilled in the art, regardless of whether such feature or combination of features solves any problem disclosed herein. In view of the foregoing description, it will be clear to a person skilled in the art that various modifications can be made within the scope of the invention.

Claims

1. A computer-implemented method of identifying that a failure has occurred in a finite state machine (FSM), the method comprising: determining whether a set of one or more transitions that have occurred between states of the FSM is permissible; as well as In response to determining that the set of one or more transitions is not permissible, it is identified that a failure has occurred in the FSM. 2 . The method of claim 1 , wherein the determining is performed in accordance with a data record comprising at least one predefined set of one or more transitions.

3. The method of claim 2, wherein the determining comprises: comparing the set of one or more transitions that have occurred between states of the FSM to the data record comprising the at least one predefined set of one or more transitions; as well as The set of one or more transitions is determined to be impermissible responsive to the comparing.

4. A method as claimed in claim 2 or 3, wherein a first group includes a predefined allowed set of one or more transitions between states of the FSM, and a second group includes a predefined non-allowed set of one or more transitions between states of the FSM, and the data record includes a set of the group including the least predefined set among the first group and the second group.

5. The method of any one of claims 2 to 4, wherein the number of transitions in the set of one or more transitions that have occurred is equal to the number of transitions in one of the at least one predefined set of one or more transitions in the data record.

6. A method as claimed in any preceding claim, further comprising recording in a transition history the set of one or more transitions that have occurred between states of the FSM. The method of claim 6 , wherein the determining is performed in accordance with the transition history.

8. A method as claimed in claim 6 or 7, wherein the transition history is configured to record up to a maximum number of transitions.

9. The method of claim 8, wherein the number of transitions in the set of one or more transitions that have occurred does not exceed the maximum number.

10. A method as claimed in claim 8 or 9 when dependent on claim 2, wherein the maximum number of transitions is determined based on the at least one predefined set of one or more transitions in the data record.

11. The method of claim 2, wherein: The determining is performed in response to detecting that a number of transitions that have occurred is equal to a number of transitions in one of the at least one predefined set of one or more transitions in the data record.

12. A method as claimed in any preceding claim, wherein the method is performed while the FSM is active and responding to input data.

13. The method of any preceding claim, further comprising, in response to identifying that a fault has occurred in the FSM: replaying the FSM from a first state corresponding to a first transition in the set of one or more transitions that have occurred; and In response to determining that an identical set of one or more transitions have occurred between states of the FSM, it is determined that the fault that has occurred is a stuck-at fault.

14. A processing module configured to identify that a fault has occurred in a finite state machine (FSM), the processing module comprising: a verification unit configured to determine whether a set of one or more transitions that have occurred between states of the FSM is permissible; as well as A fault signaling unit is configured to identify that a fault has occurred in the FSM if the verification unit indicates that the set of one or more transitions is not allowed.

15. The processing module of claim 14, wherein the verification unit is configured to perform the determination in accordance with a data record comprising at least one predefined set of one or more transitions.

16. The processing module of claim 15, wherein the verification unit is configured to perform the determination by: comparing the set of one or more transitions that have occurred between states of the FSM to the data record comprising the at least one predefined set of one or more transitions; and The set of one or more transitions is determined to be impermissible responsive to the comparing.

17. A processing module as claimed in claim 15 or 16, wherein the verification unit is configured to perform the determination in response to detecting that the number of transitions that have occurred is equal to the number of transitions in one of the at least one predefined set of one or more transitions in the data record.

18. The processing module of any one of claims 14 to 17, further comprising a memory configured to record in a transition history the set of one or more transitions that have occurred between states in the FSM.

19. The processing module of claim 18, wherein the verification unit is configured to perform the determination in accordance with the transition history stored in the memory.

20. A computer readable code configured to cause the method of any one of claims 1 to 13 to be performed when the code is run.

21. An integrated circuit definition data set which, when processed in an integrated circuit manufacturing system, configures the integrated circuit manufacturing system to manufacture a processing module as claimed in any one of claims 14 to 19.

Images