Test time shortening in circuits with redundant flip-flops

Abstract

The embodiment of the invention relates to test time shortening in a circuit with redundant flip-flops. According to one embodiment, there is provided a digital circuit having N redundant flip-flops, each flip-flop having a data input coupled to a common data signal. The digital circuit operates in a functional mode and a test mode. During a test mode, the first flip-flop is arranged as part of a test path and the N-1 flip-flops are arranged as shadow logic. A test pattern is provided at the common data signal, and the test output signal is observed at the output terminal of the first flip-flop to determine a fault within the test path of the first flip-flop. In the same cycle, the test output signal of each of the N-1 redundant flip-flops is observed through the functional path to determine a fault.

Description

Technical Field

[0001] The present disclosure relates generally to design for test and, in particular embodiments, to test time reduction in circuits using redundant flip-flops. Background Art

[0002] Integrated circuits (ICs) are generally tested for faults. In particular, the logic circuits of an integrated circuit are typically tested using a method often referred to as scan testing. During scan testing, a test pattern is shifted in through one or more trigger chains (i.e., scan chains) to stimulate one or more logic circuits. The results from the stimulated logic circuits are loaded into the scan chains and shifted out for evaluation. When the shifted-out pattern matches the expected pattern (based on the normal function of one or more logic circuits), no fault is detected and the circuit may be defect-free. When the shifted-out pattern does not match the expected pattern, a fault is detected.

[0003] An exemplary type of circuit with redundant flip-flops is a triple vote flip-flop (TVF). A triple vote flip-flop is a type of logic that uses fault-tolerant design techniques and is often used in safety-critical systems where a single failure can create a dangerous or unsafe situation. Three redundant circuit versions are implemented and their outputs are compared to detect and reduce potential errors. A triple vote flip-flop uses majority voting to determine the output. For example, when all flip-flops of a triple vote flip-flop operate normally, the contents of each flip-flop are the same and the output is equal to the contents of the flip-flop. If one of the triple vote flip-flops outputs an incorrect state, the output of the triple vote flip-flop remains correct (because the other two flip-flops output the correct value).

[0004] Therefore, the redundancy and voting mechanism in the triple voting trigger implementation provides fault tolerance. Even if one of the triggers fails, the system can still operate normally if the other two triggers are normal and consistent. The triple voting trigger can robustly detect and reduce errors and failures, ensuring that the system remains reliable under various environmental stressors and hardware failures.

[0005] In addition, the triple voting trigger can be used as a security measure to protect the system and data from unauthorized attacks and destruction, and to monitor key components of the system. If unauthorized access or tampering attempts are made, inconsistencies in the output of the triple voting trigger can signal the presence of tampering with a new signal. The triple voting trigger can be used as part of the verification process of key boot components. In this case, any inconsistency detected in the triple voting trigger output can indicate potential tampering or destruction of, for example, boot code.

[0006] Replacing a single flip-flop with a triple voting flip-flop will increase the test time in the test. This is mainly because the triple voting flip-flop involves a voting mechanism and requires three flip-flops to implement. In the standard test cycle of a single flip-flop, generally only one shift cycle is needed to capture the output of the flip-flop. However, in the case of the standard test of the triple voting flip-flop, three shift cycles are typically required to capture the output of all three flip-flops. This will inevitably increase the number of clock cycles required for the test by three times.

[0007] Therefore, while circuits with redundant flip-flops can provide increased reliability and fault tolerance, they also come with the trade-off of potentially longer test times. With the increasing adoption of circuits with redundant flip-flops within industries such as automotive, overall test durations have been extended. Therefore, it is desirable to provide improved test structures and methods of operation to reduce test times in circuits using redundant flip-flops. Summary of the invention

[0008] Technical advantages are generally achieved by embodiments of the present disclosure, which describe test time reduction in circuits using redundant flip-flops.

[0009] A first aspect relates to a digital circuit comprising N redundant flip-flops. Each of the N redundant flip-flops has a data input coupled to a common data signal. The digital circuit is configured to operate in a functional mode corresponding to conventional operation of the digital circuit and a test mode corresponding to testing of various paths of the digital circuit. During the functional mode, the digital circuit is configured to combine functional output signals of each of the N redundant flip-flops using logic gates and provide a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the digital circuit is configured to arrange a first flip-flop of N redundant flip-flops as part of a test path; arrange N-1 redundant flip-flops of the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops of the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observe a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle.

[0010] A second aspect relates to an integrated circuit comprising a digital circuit. The digital circuit comprises N redundant flip-flops. Each of the N redundant flip-flops has a data input coupled to a common data signal. The digital circuit is configured to operate in a functional mode corresponding to conventional operation of the digital circuit and a test mode corresponding to testing of various paths of the digital circuit. During the functional mode, the digital circuit is configured to combine functional output signals of each of the N redundant flip-flops using logic gates, and provide a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the digital circuit is configured to arrange a first flip-flop among N redundant flip-flops as part of a test path; arrange N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observe a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle.

[0011] A third aspect relates to a method of operating a digital circuit having N redundant flip-flops, each of the N redundant flip-flops having a data input coupled to a common data signal. The method includes operating the digital circuit in a functional mode corresponding to normal operation of the digital circuit, and operating the digital circuit in a test mode corresponding to testing various paths of the digital circuit. During the functional mode, the method includes combining functional output signals of each of the N redundant flip-flops using logic gates, and providing a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the method includes: arranging a first flip-flop among N redundant flip-flops as part of a test path; arranging N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observing a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observing a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, wherein observing the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops are during the same test cycle.

[0012] Embodiments may be implemented in hardware, software, or any combination thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which:

[0014] Figure 1 is a schematic diagram of an exemplary triple voting flip-flop (TVF) as an example of a redundant circuit;

[0015] Figure 2 is a schematic diagram of an embodiment integrated circuit;

[0016] Figure 3 is a schematic diagram of an exemplary triple voting flip-flop using a scan flip-flop;

[0017] Figure 4 is a schematic diagram of a triple voting flip-flop using a scan flip-flop;

[0018] Figure 5 is a schematic diagram of a triple voting trigger of an embodiment of an integrated circuit using a scan trigger;

[0019] Figure 6 is a schematic diagram of an in-situ monitoring circuit based on shadow latching for detecting timing errors implemented as an example canary implementation;

[0020] Figure 7 is a schematic diagram of an embodiment of a trigger-based in-situ monitoring circuit;

[0021] Figure 8 is a schematic diagram of an embodiment of a latch-based in-situ monitoring circuit;

[0022] Fig. 9 is an example of an integrated circuit having at least one digital circuit having redundant flip-flops; and

[0023] Fig.10 According to the embodiments disclosed herein, Fig. 9 A flow chart of an embodiment method of an integrated circuit. DETAILED DESCRIPTION

[0024] The present disclosure provides many applicable inventive concepts that can be embodied in a variety of specific contexts. Specific embodiments are merely illustrations of specific configurations and do not limit the scope of the claimed embodiments. Unless otherwise stated, features from different embodiments may be combined to form additional embodiments. Various embodiments are shown in the accompanying drawings, in which the same components and elements are identified by the same reference numerals, and repeated descriptions are omitted for brevity. The changes or modifications described in one embodiment may also be applied to other embodiments. In addition, various changes, substitutions and modifications may be made herein without departing from the spirit and scope of the present disclosure as defined by the appended claims.

[0025] Although the inventive aspects are primarily described in the context of triple vote flip-flops (TVFs) and in-situ monitor (I2SM) circuits, it should be understood that these inventive aspects may also be applied to any logic circuit utilizing redundant flip-flops, where the same data is replicated as input to multiple flip-flops and converged at a single node as a single output. Specifically, the present disclosure may be similarly applied to designs for testing digital structures that employ redundant flip-flops rather than a single flip-flop to improve system robustness while minimizing any resulting increase in test time due to the addition of additional logic without affecting the functional path of the circuit.

[0026] In an embodiment, an integrated circuit, a digital circuit with redundant flip-flops, and a method of operation are provided. The digital circuit of the integrated circuit includes N redundant flip-flops. Each of the N redundant flip-flops has a data input coupled to a common data signal. The digital circuit is configured to operate in a functional mode corresponding to a conventional operation of the digital circuit and a test mode corresponding to a test of various paths of the digital circuit. During the functional mode, the digital circuit is configured to combine the functional output signals of each of the N redundant flip-flops using logic gates, and provide a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the digital circuit is configured to arrange a first flip-flop of N redundant flip-flops as part of a test path; arrange N-1 redundant flip-flops of the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops of the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observe a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle. These and other details will be discussed in more detail below.

[0027] Figure 1 A schematic diagram of an exemplary triple voting flip-flop (TVF) 100 as an example of a redundant circuit is shown. Triple voting flip-flop 100 includes a first flip-flop 102, a second flip-flop 104, a third flip-flop 106, and a voting circuit 118. Voting circuit 118 includes AND gates 110, 112, 114, and an OR gate 120.

[0028] The triple voting flip-flop 100 uses majority voting to determine the output (D out For example, when all flip-flops 102, 104, and 106 are operating normally, the contents of each flip-flop 102, 104, and 106 are the same, and the output (D out ) is equal to the contents of flip-flops 102, 104, 106. If one of flip-flops 102, 104, 106 outputs an incorrect state, the output (D out ) continues to output the correct value (because the other two flip-flops output the correct values).

[0029] For example, if the first flip-flop 102 and the second flip-flop 104 output logic '1', the third flip-flop 106 flips and outputs logic '0', the output of the AND gate 110 is logic '1', the output of each of the AND gates 112 and 114 is logic '0', and the output of the OR gate 120 is logic '1'. If the first flip-flop 102 and the second flip-flop 104 output logic '0', and the third flip-flop 106 flips and outputs logic '1', the outputs of the AND gates 110, 112, and 114 are logic '0', and the output of the OR gate 120 is logic '0'.

[0030] Figure 2 Schematic diagram of an embodiment integrated circuit 200 is shown. Integrated circuit 200 includes scan chain 220. Scan chain 220 includes triple voting flip-flop 206 and scan flip-flops 202, 204, and 208.

[0031] When a triple voting flip-flop 206, such as triple voting flip-flop 106, replaces a single flip-flop of scan chain 220 (e.g., for redundancy), three scan shift cycles (i.e., two additional cycles) are typically required to shift the triple voting flip-flop 206. Increasing the scan shift cycles during scan testing affects load / unload and, therefore, test time. In addition, when the integrated circuit 200 is operated in-situ within the LBIST partition, the increase in scan shift cycles affects the self-test time.

[0032] The integration of triple voting triggers (such as triple voting trigger 206) into integrated circuits within the automotive industry is increasing significantly, mainly driven by the adoption of automotive safety integrity level (ASIL) standards. These standards have a significant impact on the automotive industry, especially critical systems such as airbags, anti-lock brakes, and power steering. Since failure of such systems can have serious consequences, such systems require the highest ASIL level, ASIL-D. In contrast, components with lower safety risks such as taillights meet the ASIL-A standard. Intermediate safety levels apply to components such as headlights, brake lights (ASIL-B), and cruise control (ASIL-C). Similar trends are observed in other industries such as medical, defense, and aerospace, where redundant circuit devices such as triple voting triggers can address various safety and security prerequisites.

[0033] Experts in the field estimate that approximately 5% to 8% of the flip-flops in digital circuits will be triple voting flip-flop variants. Assuming a 5% penetration of triple voting flip-flops, such introduction will cause at least a 10% increase in test time because each triple voting flip-flop adds two additional scan flip-flops. Embodiments of the present disclosure provide an improved structure and method for testing scan chain 220 using less than three shift cycles for each triple voting flip-flop in integrated circuit 200. And, as a summary, embodiments of the present disclosure provide an improved structure and method for testing logic circuits that utilize redundant flip-flops in which the same data is copied as input to multiple flip-flops and converged out as a single output at a single node. In such embodiments, a single shift cycle for each redundant flip-flop is sufficient to provide full test coverage of the logic circuit, rather than requiring a shift cycle for each redundant flip-flop.

[0034] Figure 3 A schematic diagram of an exemplary triple voting flip-flop 300 using scan flip-flops is shown. The triple voting flip-flop 300 is similar in structure to the triple voting flip-flop 100. However, the triple voting flip-flop 300 replaces the first flip-flop 102, the second flip-flop 104, and the third flip-flop 106 with a first scan flip-flop 302, a second scan flip-flop 304, and a third scan flip-flop 306, respectively. The scan flip-flops 302, 304, 306, and 310 are coupled to form a portion of a scan chain 318. The fourth scan flip-flop 310 is used to capture the output of the OR gate 120.

[0035] For each scan flip-flop, when the scan enable signal (SCAN_EN) is de-asserted (e.g., logic level low) at the scan enable input (SE), the scan flip-flop latches the data input signal (D) at the data input (D).in ). It outputs the latched content at the output (Q) at each clock pulse of the clock signal (CLK) at the clock input of the scan flip-flop. When the scan enable signal (SCAN_EN) is asserted (e.g., logic level high) at the scan enable input (SE), the scan flip-flop latches the content of the scan input signal (SCAN_IN) at the scan input terminal (SI), and outputs the latched content at the output (Q) at each clock pulse of the clock signal (CLK) at the clock input of the scan flip-flop. In the normal operation mode, the scan enable signal (SCAN_EN) is deasserted, and the triple voting flip-flop 300 operates similarly to the triple voting flip-flop 100.

[0036] In the capture start test and scan mode, during the shift pulse, the test pattern is first loaded into the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306 using the scan input signal (SCAN_IN). During the start pulse, the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306 latch the data input signal (D in ) and outputs the corresponding output (Q). During the capture pulse, the output of OR gate 120 is captured by fourth scan flip-flop 310, and the output of OR gate 120 is then shifted out with another shift pulse and compared with the expected output to determine whether triple voting flip-flop 300 includes a fault.

[0037] Unfortunately, the capture-time enable test may not provide complete full-speed scan coverage (about 30% fault coverage). For example, during full-speed scan testing, a slow-falling fault may not be detected at the first scan flip-flop 302. Specifically, during the shift pulse, in order to test for a slow-rising fault at the output of the first scan flip-flop 302, the first scan flip-flop 302 is loaded with a logic '0'. During the enable pulse, the data input (D in ) provides a logic '1' to the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306. If the first scan flip-flop 302 rises slowly, but the second scan flip-flop 304 and the third scan flip-flop 306 operate normally, the slow rise failure of the first scan flip-flop 302 is masked by the presence of a logic '1' at the output of the second scan flip-flop 304 and the third scan flip-flop 306.

[0038] In the shift start test and scan mode, during the shift pulse, the test pattern is first loaded into the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306 using the scan input signal (SCAN_IN). During the last shift / start pulse, the content of each of the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306 is output at the output (Q). During the capture pulse, the output of the OR gate 120 is captured by the fourth scan flip-flop 310, and then the output is shifted out and compared with the expected output to determine whether the triple voting flip-flop 300 includes a fault.

[0039] Disadvantageously, the shift-start test may not provide complete full-speed scan coverage (approximately 70% fault coverage). For example, a slowly falling fault at the first scan flip-flop 302 may not be detected during the full-speed scan test. Specifically, during the shift pulse (so that the output of the fourth scan flip-flop 310 is logic '1'), in order to test for a slowly rising fault at the output of the first scan flip-flop 302, the first scan flip-flop 302 and the second scan flip-flop 304 are loaded with logic '1'. During the last shift / start pulse, the first scan flip-flop 302 is loaded with logic '0', which causes the first scan flip-flop 302 to transition from logic '1' to logic '0', and the outputs of the second scan flip-flop 304 and the third scan flip-flop 306 remain at logic '1'. This causes the output of the OR gate 120 to remain at logic '1'. If the first scan flip-flop 302 slowly falls, but the second scan flip-flop 304 and the third scan flip-flop 306 operate normally, the slowly falling fault of the first scan flip-flop 302 is masked and may not be detected.

[0040] Figure 4 A schematic diagram of a triple voting flip-flop 400 using a scan flip-flop is shown. The triple voting flip-flop 400 is similar in structure to the triple voting flip-flop 300. However, the triple voting flip-flop 400 includes a first flip-flop 432, a second flip-flop 434, a first scan enable control circuit 450, and a second scan enable control circuit 452. The first scan enable control circuit 450 includes a first AND gate 446 and a first OR gate 442. The second scan enable control circuit 452 includes a second AND gate 448 and a second OR gate 444. The first scan flip-flop 302, the second scan flip-flop 304, the third scan flip-flop 306, and the fourth scan flip-flop 310 are coupled to form a part of a scan chain 420, which includes the first flip-flop 432 and the second flip-flop 434.

[0041] During normal operation, the operation of triple voting flip-flop 400 is similar to triple voting flip-flop 300 , and the scan enable signal (SCAN_EN) and the transmission (trans-) mode signal (TRANS_MODE) are de-asserted (eg, logic level low).

[0042] During the capture start test and in the scan mode, the triple voting flip-flop 400 operates similarly to the triple voting flip-flop 300 by maintaining the transfer mode signal (TRANS_MODE) de-asserted because the scan enable input (SE) of each of the first scan flip-flop 302, the second scan flip-flop 304, the third scan flip-flop 306, and the fourth scan flip-flop 310 receives the scan enable signal (SCAN_EN).

[0043] However, when the transfer mode signal (TRANS_MODE) is asserted (e.g., logic level high), the scan enable inputs (SE) of the first scan flip-flop 302 and the third scan flip-flop 306 are selectively controlled based on the scan input (SI) of the first flip-flop 432 and the output (Q) of the second flip-flop 434. In this way, the contents of the first scan flip-flop 302, the second scan flip-flop 304, and the third scan flip-flop 306 are independently controlled to improve full-speed scan coverage.

[0044] Figure 5 A schematic diagram of a triple voting flip-flop 500 of an embodiment of an integrated circuit using scan flip-flops is shown. The triple voting flip-flop 500 includes the same components as the triple voting flip-flop 400. However, in contrast to the triple voting flip-flop 400 in which the output (Q) of the first scan flip-flop 302 is fed to the scan input (SI) of the second scan flip-flop 304, in the triple voting flip-flop 500, the output (Q) of the first scan flip-flop 302 is directly fed to the scan input (SI) of the second flip-flop 434. Therefore, the output (Q) of the first scan flip-flop 302 bypasses the second scan flip-flop 304 and the third scan flip-flop 306 in the triple voting flip-flop 500. The triple voting flip-flop 500 may include additional components not shown, or may be configured in a manner different from that shown in FIG. Figure 5 The configuration in the configuration is arranged.

[0045] Although the second scan flip-flop 304 and the third scan flip-flop 306 are placed outside the main scan chain 520, they are still coupled to the scan path. For example, during the scan mode, the output (Q) of the second scan flip-flop 304 is fed to the scan input (SI) of the third scan flip-flop 306. In addition, the scan enable input (SE) of the third scan flip-flop 306 receives the scan enable signal (SCAN_EN) from the second OR gate 444. In an embodiment, the functional data is provided to the data input (D) of the second scan flip-flop 304, and the functional data is then passed to the data input (D) of the third scan flip-flop 306. In this way, the loading and unloading times for the scan chain 520 are equal to the loading and unloading times of the scan chain without the triple voting flip-flop because the second scan flip-flop 304 and the third scan flip-flop 306 do not enter the load path.

[0046] Therefore, although the second scan trigger 304 and the third scan trigger 306 are not observed during the scan shift mode, the functional path will be effectively used for observation during the scan capture mode. Therefore, in order to maintain coverage for the second scan trigger 304 and the third scan trigger 306, the output of the fourth scan trigger 310 is observed and compared with the expected result to verify the normal function of the second scan trigger 304 and the third scan trigger 306 at the beginning of the capture mode or the end of the scan shift mode.

[0047] In an embodiment, the second scan flip-flop 304 and the third scan flip-flop 306 are arranged as shadow logic (ie, they are not directly accessed but retain the data input signal (D in ) path borrows valid data; opposite to the scan input signal (SCAN_IN) path). In an embodiment, the second scan flip-flop 304 is deactivated and the third scan flip-flop 306 is tested as a shadow logic. In an embodiment, the third scan flip-flop 306 is deactivated and the second scan flip-flop 304 is arranged as a shadow logic.

[0048] Advantageously, bypassing of the second scan flip-flop 304 and the third scan flip-flop 306 in the triple voting flip-flop 500 allows a single shift cycle to test the first scan flip-flop 302 of the triple voting flip-flop 500. Furthermore, since the modification only applies to the scan mode, there is no impact on the functional paths of the integrated circuit implementing the triple voting flip-flop 500. Furthermore, although the second scan flip-flop 304 and the third scan flip-flop 306 are not directly loaded from the scan input signal (SCAN_IN) path during the scan mode, they are loaded from the data input signal (D_IN) at the end of the scan shift mode. in) path loading, which includes the same data - the data input (D) of all three scan flip-flops of the triple voting flip-flop 500 is the same. Therefore, full test coverage is achieved using the proposed modified structure.

[0049] Advantageously, the terminal scan path (i.e., the flip-flops arranged immediately before and after the triple voting flip-flop) is reused to cover the scan enable signal (SCAN_EN) and provide chain reordering, which results in minimal impact on scan stitching. All additional logic nodes are tested (i.e., no new nodes that are not tested are introduced due to this proposed design for the test structure).

[0050] Figure 6 A schematic diagram of a shadow latch-based in-situ monitoring circuit 600 for detecting timing errors implemented as an example canary implementation is shown. In general, an in-situ monitoring circuit can detect aging, voltage drop, or temperature effects in a critical path and operates as a monitoring mechanism that runs in parallel with the functional operation of the integrated circuit implementing the in-situ monitoring circuit. The main purpose of the in-situ monitoring circuit is to evaluate the health and performance of the critical path of the integrated circuit in real time without interrupting its functional operation.

[0051] The in-situ monitoring circuit is configured to track the behavior of specific critical paths in the integrated circuit. These paths may be susceptible to aging effects, voltage drops, or temperature-related changes that may affect the performance of the paths over time. The in-situ monitoring circuit may include sensors (not shown) that measure parameters within the critical paths, such as voltage levels, temperature, and signal propagation delays. These sensors are strategically placed to capture relevant data. The sensors continuously collect data related to the monitored parameters. The data may be analog or digital, depending on the design of the monitoring circuit.

[0052] The collected data is then processed by dedicated monitoring logic of the in-situ monitoring circuit. This logic compares the measured parameters with predetermined thresholds or reference values. If the monitored parameters deviate beyond acceptable limits due to, for example, aging, voltage drop or temperature effects, the monitoring logic detects an anomaly.

[0053] When an anomaly is detected, the monitoring logic issues an early flag or alarm. This alarm indicates that a critical path is being adversely affected. These early warnings allow system operators or maintenance personnel to take corrective action before the problem causes functional failure or performance degradation. Flagged anomalies can be logged and related data can be collected for additional analysis. This data helps understand the specific nature and extent of aging, voltage drop, or temperature effects.

[0054] It is critical that the in-situ monitoring circuitry is designed to operate without adversely affecting the functional operation of the integrated circuit. The monitoring sensors and logic are carefully integrated to avoid interfering with the main signals and operations of the critical paths. The monitoring circuitry should not introduce additional delays or distortions that could affect the intended functionality of the circuit.

[0055] The in-situ monitoring circuit 600 includes a conventional flip-flop 602, a shadow flip-flop 604, a delay chain 606, and an XOR gate 608. The conventional flip-flop 602 can be a timed critical flip-flop. The conventional flip-flop 602 directly receives data from the previous stage (i.e., PREVIOUSSTAGE). In contrast, the shadow flip-flop 604 receives a slightly delayed signal corresponding to the data from the previous stage. The slight delay is equal to the delay considered in the design and provided by the delay chain 606. The XOR gate 608 receives the output (Q) from the conventional flip-flop 602 at a first input terminal and compares the value with the output (Q) from the shadow flip-flop 604 at a second input terminal.

[0056] When the regular flip-flop 602 operates correctly, the shadow flip-flop 604 holds the same value as the regular flip-flop 602, and the output of the XOR gate 608 is at a logic level low (i.e., the alarm signal (ALERT) is '0'). Conversely, when the values ​​latched in the regular flip-flop 602 and the shadow flip-flop 604 do not match, the output of the XOR gate 608 is at a logic level high, and a timing error is detected (i.e., the alarm signal (ALERT) is '1').

[0057] Similar to the triple voting flip-flop 100 including redundant flip-flops, the in-situ monitoring circuit 600 includes multiple flip-flops (i.e., regular flip-flops 602 and shadow flip-flops 604) in which the same data is replicated. Similarly, due to the in-situ monitoring circuit in the integrated circuit, additional cycles are introduced in the shift cycle path. As the number of in-situ monitoring circuits in the integrated circuit increases, the additional shift cycle results in a significant penalty in test time.

[0058] Figure 7 A schematic diagram of an embodiment of a flip-flop based in-situ monitoring circuit 700 is shown. In addition to the components previously discussed with respect to the in-situ monitoring circuit 600, the in-situ monitoring circuit 700 also includes a second XOR gate 702, a first multiplexer 704, and a second multiplexer 706, which may (or may not) be arranged as shown. In addition, the in-situ monitoring circuit 700 may include additional components not shown. The in-situ monitoring circuit 700 is configured to operate in two modes: (i) a functional mode and (ii) a test mode.

[0059] The second XOR gate 702 has a first input terminal coupled to a test data signal (DATA INPUT). The second input terminal of the second XOR gate 702 is coupled to a fault input signal (FAULT INPUT), which provides coverage of the safety logic. The fault input signal (FAULT INPUT) tests the logic under normal operating conditions when, for example, aging does not adversely affect the circuit. In an embodiment, the fault input signal (FAULT INPUT) is provided and controlled by a test tool.

[0060] When the fault input signal (Fault In) is at a logic level low, the output of the second XOR gate 702 provides a test data signal (Data In) to the shadow flip-flop 604. Under normal operating conditions, when the delay chain 606 provides an allowable delay, the regular flip-flop 602 and the shadow flip-flop 604 maintain the same value, and the output of the XOR gate 608 is at a logic level low (i.e., the alarm signal (Alarm) is '0').

[0061] When the fault signal (fault input) is at a logic level high, the output of the second XOR gate 702 provides an inverted test data signal to the shadow flip-flop 604. During normal operating conditions, when delay chain 606 provides an allowable delay, the values ​​latched in regular flip-flop 602 and shadow flip-flop 604 do not match, the output of XOR gate 608 is at logic level high, and a timing error is detected (ie, alarm signal (ALARM) is '1').

[0062] In an embodiment, the test data signal (data input) and the fault input signal (fault input) are generated by a test tool. In an embodiment, the second XOR gate 702 compares the test data signal (data input) at the first input terminal with the fault input signal (fault input) at the second input terminal. In an embodiment, the output of the second XOR gate 702 is coupled to the data input (D) of the shadow flip-flop 604 through the delay chain 606.

[0063] In an embodiment, each of the first multiplexer 704 and the second multiplexer 706 has two input terminals. The selection terminal of the first multiplexer 704 is coupled to the selection terminal of the second multiplexer 706 and is configured to receive a selection signal (SCAN_EN). The first input terminal of the first multiplexer 704 is configured to receive data from a previous stage (e.g., a previous scan trigger). The second input terminal of the first multiplexer 704 is configured to receive a test data signal (data input). The first input terminal of the second multiplexer 706 is configured to receive data from an output terminal of the second XOR gate 702. The second input terminal of the first multiplexer 704 is configured to receive an output signal from an output (Q) of a conventional trigger 602. In an embodiment, the selection signal (SCAN_EN) is generated by a test tool. The selection signal (SCAN_EN) allows selection between the signals received at the input terminals of the first multiplexer 704 and the input terminals of the second multiplexer 706. During the functional mode, the selection signal (SCAN_EN) may be provided by a controller of an integrated circuit implementing the in-situ monitoring circuit 700 or a controller coupled to the in-situ monitoring circuit 700 .

[0064] During the functional mode, the selection signal (SCAN_EN) is set so that the first multiplexer 704 selects the data from the previous stage (e.g., the previous scan flip-flop) as the input of the data input (D) of the regular flip-flop 602. In addition, the selection signal (SCAN_EN) is set so that the second multiplexer 706 selects the output signal from the output (Q) of the regular flip-flop 602 as the input of the delay chain 606. Therefore, in the functional mode, the in-situ monitoring circuit 700 operates substantially like the in-situ monitoring circuit 600.

[0065] During the test mode, the select signal (SCAN_EN) is set so that the first multiplexer 704 selects the test data signal (data input) as the input to the data input (D) of the conventional flip-flop 602. In addition, the select signal (SCAN_EN) is set so that the second multiplexer 706 selects the output of the second XOR gate 702 as the input to the delay chain 606.

[0066] Therefore, to test the path including the regular flip-flop 602, the test pattern is provided as the test data signal (data input) to the regular flip-flop 602, and the expected result is observed at the output (Q) of the regular flip-flop, for example, using a scan flip-flop. During the same shift cycle, the shadow flip-flop 604 is in the shadow mode.

[0067] In an embodiment, the shadow flip-flop 604 is arranged as shadow logic (i.e., not directly accessed, but retains valid data, which is received as a slightly delayed signal of the test data signal (data input)). Therefore, although the output (Q) of the shadow flip-flop 604 is not observed using, for example, the same scan flip-flop used to test the conventional flip-flop 602, a second scan flip-flop coupled to the XOR gate 608 can be used to observe the output (Q) of the shadow flip-flop to provide test coverage of the path including the shadow flip-flop 604 without the need for additional test cycles.

[0068] Figure 8 A schematic diagram of an embodiment of a latch-based in-situ monitoring circuit 800 is shown. In addition to the components previously discussed with respect to the in-situ monitoring circuit 600, the in-situ monitoring circuit 800 also includes a second XOR gate 806 and a multiplexer 808, which may (or may not) be arranged as shown. Unlike the in-situ monitoring circuit 600, the in-situ monitoring circuit 800 does not include a delay chain 606. The in-situ monitoring circuit 800 may include additional components not shown. In the in-situ monitoring circuit 800, the conventional flip-flop 602 is represented by a first latch 802 and a second latch 804. However, it should be noted that this detailed representation does not change the operation of the conventional flip-flop 602, but is merely an example. The in-situ monitoring circuit 800 operates in two modes: (i) functional mode and (ii) test mode.

[0069] In an embodiment, the multiplexer 808 has two input terminals. The selection terminal of the multiplexer 808 is configured to receive a selection signal (SCAN_EN). The first input terminal of the multiplexer 808 is configured to receive data from the previous stage (PREVIOUS STAGE). The second input terminal of the multiplexer 808 is configured to receive a test data signal (DATA IN).

[0070] In an embodiment, the select signal (SCAN_EN) is generated by a test tool. The select signal (SCAN_EN) allows selection between signals received at the input terminals of the multiplexer 808. During the functional mode, the select signal (SCAN_EN) can be provided by a controller of an integrated circuit implementing the in-situ monitoring circuit 700 or a controller coupled to the in-situ monitoring circuit 700.

[0071] The input of the first latch 802 of the conventional flip-flop 602 is coupled to the output of the multiplexer 808. The first input terminal of the multiplexer 808 is configured to receive data from the previous stage. In contrast, the second terminal of the multiplexer 808 is configured to receive a test data signal (data input).

[0072] A first input terminal of the second XOR gate 806 is coupled to the output of the first latch 802 of the conventional flip-flop 602. A second input terminal of the second XOR gate 806 is coupled to a fault input signal (Fault In).

[0073] The second XOR gate 806 compares the slightly delayed data from the previous stage at the first input terminal with the fault input signal (fault input) at the second input terminal. The output of the second XOR gate 806 is provided as an input to the shadow flip-flop 604. In contrast to the in-situ monitoring circuit 600 that uses the delay chain 606 to provide the delayed data from the previous stage, the in-situ monitoring circuit 800 generates the delayed data for the shadow flip-flop 604 according to the output of the first latch 802 of the conventional flip-flop 602.

[0074] During the functional mode, the select signal (SCAN_EN) is set so that the multiplexer 808 selects the data from the previous stage (PREVIOUS STAGE) as the input to the data input (D) of the conventional flip-flop 602. During the functional mode, the fault input signal is set to a logic level low (i.e., '0'). As such, the output of the second XOR gate 806 corresponds to a slightly delayed signal corresponding to the output of the first latch 802 of the conventional flip-flop 602 (i.e., the output of the second XOR gate 806 depends only on the value of the output of the first latch 802). Therefore, in the functional mode, the in-situ monitoring circuit 800 operates substantially like the in-situ monitoring circuit 600.

[0075] During the test mode, the select signal (SCAN_EN) is set so that the multiplexer 808 selects the test data signal (data input) as the input to the first latch 802 of the conventional flip-flop 602. Therefore, to test the path including the conventional flip-flop 602, the test pattern is provided to the conventional flip-flop 602 as the test data signal (data input), and the expected result is observed at the output (Q) of the conventional flip-flop using, for example, a scan flip-flop. During the same shift cycle, the shadow flip-flop 604 is in the shadow mode.

[0076] In an embodiment, the shadow flip-flop 604 is arranged as shadow logic (i.e., not directly accessed, but retains valid data, which is received as a slightly delayed signal of the test data signal (data input)). Therefore, although the output (Q) of the shadow flip-flop 604 is not observed using, for example, the same scan flip-flop used to test the conventional flip-flop 602, a second scan flip-flop coupled to the XOR gate 608 can be used to observe the output (Q) of the shadow flip-flop to provide test coverage of the path including the shadow flip-flop 604 without the need for additional test cycles.

[0077] Fig. 9An example of an integrated circuit 900 having at least one digital circuit 902 having redundant flip-flops 904a-904n is shown. As shown, in the integrated circuit 900, the same data (input data (INPUT DATA)) is copied to each data input (D) of the N redundant flip-flops 904a-904n of the digital circuit 902, and is gathered into a single output (output data (OUTPUT DATA)) at a single node through a logic gate 906 coupled to the output (Q) of the N redundant flip-flops 904a-904n of the digital circuit 902.

[0078] In an embodiment, the integrated circuit 900 is a circuit in a commercial or consumer application. In an embodiment, the integrated circuit 900 is a circuit in an electronic device. In an embodiment, the integrated circuit 900 is a circuit in a safety-critical system that utilizes redundant flip-flops 904a-904n as a fault-tolerant design technique where a single failure could create a dangerous or unsafe condition. In an embodiment, the integrated circuit 900 is a circuit in a system that utilizes redundant flip-flops 904a-904n as a safety measure to protect the system and data from unauthorized attacks and corruption, and to monitor critical components of the system.

[0079] In an embodiment, the integrated circuit 900 is implemented in an automotive system to meet the automotive safety integrity level (ASIL) standard. For example, the integrated circuit 900 can be part of an airbag, anti-lock brake, power steering, headlight and brake light, cruise control, or an autonomous driving system.

[0080] In an embodiment, digital circuit 902 includes N redundant flip-flops 904a-904n. In an embodiment, digital circuit 902 is a triple voting flip-flop, such as, for example, triple voting flip-flop 500. In such embodiments, N is equal to 3. In an embodiment, digital circuit 902 is an in-situ monitoring circuit, such as, for example, flip-flop-based in-situ monitoring circuit 700 or latch-based in-situ monitoring circuit 800. In such embodiments, N is equal to any number greater than 1.

[0081] Fig.10A flow chart of an embodiment method 1000 for operating an integrated circuit 900 according to embodiments disclosed herein is shown. In an embodiment, the data input to each of the redundant flip-flops 904a-904n is a common digital signal (input data). In an embodiment, the data output from each of the redundant flip-flops 904a-904n is configured to have the same output (output data) during normal operating conditions of the digital circuit 902. In an embodiment, during the functional mode of the digital circuit 902, the outputs of the redundant flip-flops 904a-904n are combined using a logic gate 906. In an embodiment, during the functional mode of the digital circuit 902, the outputs of the redundant flip-flops 904a-904n are compared using a logic gate 906, and a single output (output data) is determined to provide a fault-tolerant, digital circuit 902 in a safety-critical system.

[0082] At step 1002, digital circuit 902 of integrated circuit 900 operates in functional mode. During functional mode, logic gates 906 are used to combine the outputs of redundant flip-flops 904a-904n and determine a single output (output data) to provide a fault tolerant, digital circuit 902 in a safety critical system.

[0083] At step 1004, the digital circuit 902 of the integrated circuit 900 operates in a test mode. During the test mode of the digital circuit 902, one of the redundant flip-flops 904a-904n is part of a test path. In such embodiments, the N-1 redundant flip-flops 904a-904n are not part of the test path, but are configured as shadow logic. In an embodiment, the N-1 redundant flip-flops 904a-904n receive the same test data as the flip-flops in the redundant flip-flops 904a-904n that are configured as part of the test path. In an embodiment, the outputs of the flip-flops in the redundant flip-flops 904a-904n that are configured as part of the test path and one or more outputs of the N-1 redundant flip-flops 904a-904n that are not part of the test path are observed during the same shift cycle.

[0084] Advantageously, during the test mode, all redundant flip-flops 904a-904n are tested during the same shift cycle by using smart scan connectivity and sequencing to save test cycles. In an embodiment, the proposed test configuration does not affect the functional path of the digital circuit 902. In an embodiment, the terminal scan path is reused for scan enable over-ride and scan chain sequencing. In an embodiment, the N-1 redundant flip-flops 904a-904n are arranged during the test mode to minimize scan stitching. In an embodiment, as proposed herein, any additional logic or node that is part of the arrangement of the N-1 redundant flip-flops 904a-904n during the test mode is tested. In an embodiment where the digital circuit 902 is a triple voting flip-flop, one scan multiplexer is saved for one unit of the triple voting flip-flop unit.

[0085] In an embodiment where digital circuit 902 is a triple voting flip-flop, the reduction in shift length is achieved by using shadow logic. In an embodiment, the shadow logic can be inserted at the synthesis / gate level or RTL level by a connect / disconnect script. In such an embodiment, the script can be easily updated to include the new scan connectivity. The scan input on the triple voting flip-flop terminal (i.e., the neighboring flip-flop of the triple voting flip-flop) can be extracted by the script and used for gating purposes.

[0086] In various embodiments, by implementing shadow logic on N-1 redundant flip-flops among the N redundant flip-flops, the digital circuit 902 achieves full coverage while minimizing test cycles. In an embodiment, the proposed arrangement for the test pattern has minimal overhead.

[0087] Note that all steps outlined in the flowcharts of the various methods are not required, but are optional. In addition, changes to the arrangement of steps, removal of one or more steps and path connections, and addition of steps and path connections are similarly contemplated.

[0088] A first aspect relates to a digital circuit comprising N redundant flip-flops. Each of the N redundant flip-flops has a data input coupled to a common data signal. The digital circuit is configured to operate in a functional mode corresponding to conventional operation of the digital circuit and a test mode corresponding to testing of various paths of the digital circuit. During the functional mode, the digital circuit is configured to combine functional output signals of each of the N redundant flip-flops using logic gates and provide a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the digital circuit is configured to arrange a first flip-flop among N redundant flip-flops as part of a test path; arrange N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observe a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle.

[0089] In a first embodiment of the digital circuit according to the first aspect, the digital circuit is a triple voting flip-flop, and N is equal to three.

[0090] In the second implementation form of the digital circuit according to the first aspect as such or any of the preceding implementation forms of the first aspect, the digital circuit is an in-situ monitoring circuit.

[0091] In a third implementation form of the digital circuit according to the first aspect or any of the preceding implementation forms of the first aspect, N is equal to two.

[0092] In a fourth implementation form of the digital circuit according to the first aspect or any of the preceding implementation forms of the first aspect, the in-situ monitoring circuit is a trigger-based or latch-based trigger, and wherein the in-situ monitoring circuit is a canary-type in-situ monitoring circuit for detecting timing errors in an integrated circuit.

[0093] In a fifth implementation form of the digital circuit according to the first aspect or any of the preceding implementation forms of the first aspect, the digital circuit is part of an integrated circuit in an automotive system. The automotive system is an airbag, anti-lock brake, power steering, headlights and brake lights, cruise control, or an autopilot system.

[0094] In a sixth implementation form of the digital circuit according to the first aspect or any of the preceding implementation forms of the first aspect, the operation of N-1 redundant flip-flops among the N redundant flip-flops conforms to shadow logic inserted at the synthesis / gate level by a connect / disconnect script.

[0095] A second aspect relates to an integrated circuit comprising a digital circuit. The digital circuit comprises N redundant flip-flops. Each of the N redundant flip-flops has a data input coupled to a common data signal. The digital circuit is configured to operate in a functional mode corresponding to conventional operation of the digital circuit and a test mode corresponding to testing of various paths of the digital circuit. During the functional mode, the digital circuit is configured to combine functional output signals of each of the N redundant flip-flops using logic gates, and provide a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the digital circuit is configured to arrange a first flip-flop among N redundant flip-flops as part of a test path; arrange N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observe a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle.

[0096] In a first embodiment of the integrated circuit according to the second aspect, the digital circuit is a triplet flip-flop and N is equal to three.

[0097] In a second implementation form of the integrated circuit according to the second aspect as such or in any preceding implementation form of the second aspect, the digital circuit is an in-situ monitoring circuit.

[0098] In a third implementation form of the integrated circuit according to the second aspect or any preceding implementation form of the second aspect, N is equal to two.

[0099] In a fourth implementation form of the integrated circuit according to the second aspect or any of the previous implementation forms of the second aspect, the in-situ monitoring circuit is a flip-flop based or latch based flip-flop. The in-situ monitoring circuit is a canary implementation of an in-situ monitoring circuit for detecting timing errors in an integrated circuit.

[0100] In a fifth implementation form of the integrated circuit according to the second aspect or any of the previous implementation forms of the second aspect, the integrated circuit is an integrated circuit in an automotive system. The automotive system is an airbag, anti-lock brake, power steering, headlight and brake light, cruise control, or an autonomous driving system.

[0101] In a sixth implementation form of the integrated circuit according to the second aspect or any of the preceding implementation forms of the second aspect, the operation of N-1 redundant flip-flops among the N redundant flip-flops conforms to shadow logic inserted at the synthesis / gate level by a connect / disconnect script.

[0102] A third aspect relates to a method of operating a digital circuit having N redundant flip-flops, each of the N redundant flip-flops having a data input coupled to a common data signal. The method includes operating the digital circuit in a functional mode corresponding to normal operation of the digital circuit, and operating the digital circuit in a test mode corresponding to testing various paths of the digital circuit. During the functional mode, the method includes combining functional output signals of each of the N redundant flip-flops using logic gates, and providing a single functional output signal in a fault-tolerant, safety-critical system based on the combination. During a test mode, the method includes: arranging a first flip-flop among N redundant flip-flops as part of a test path; arranging N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at a common data signal; observing a test output signal at an output terminal of the first flip-flop to determine a fault within the test path including the first flip-flop; and observing a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, wherein observing the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops are during the same test cycle.

[0103] In a first implementation form of the method according to the third aspect, the digital circuit is a triple voting flip-flop and N is equal to three.

[0104] In the second implementation form of the method according to the third aspect as such or any of the preceding implementation forms of the third aspect, the digital circuit is an in-situ monitoring circuit.

[0105] In a third implementation form of the method according to the third aspect or any preceding implementation form of the third aspect, N is equal to 2.

[0106] In a fourth implementation form of the method according to the third aspect or any of the preceding implementation forms of the third aspect, the in-situ monitoring circuit is a flip-flop based or latch based flip-flop. The in-situ monitoring circuit is a canary type in-situ monitoring circuit for detecting timing errors in integrated circuits.

[0107] In a fifth implementation form of the method according to the third aspect or any of the preceding implementation forms of the third aspect, the digital circuit is part of an integrated circuit in an automotive system. The automotive system is an airbag, anti-lock brake, power steering, headlights and brake lights, cruise control, or an autonomous driving system.

[0108] Although the specification has been described in detail, it should be understood that various changes, substitutions and modifications may be made without departing from the spirit and scope of the present disclosure as defined by the appended claims. In different figures, the same elements are represented by the same reference numerals. In addition, the scope of the present disclosure is not intended to be limited to the specific embodiments described herein, because it will be readily understood by those of ordinary skill in the art from this disclosure that existing or later developed processes, machines, manufactures, material compositions, means, methods or steps can perform substantially the same functions as the corresponding embodiments described herein or achieve substantially the same results. Therefore, the appended claims are intended to include these processes, machines, manufactures, material compositions, means, methods or steps within their scope.

[0109] Accordingly, the specification and drawings are to be regarded only as illustrative of the present disclosure as defined by the appended claims and to cover any and all modifications, variations, combinations or equivalents within the scope of the present disclosure.

Claims

1. A digital circuit comprising: N redundant flip-flops, each of the N redundant flip-flops having a data input coupled to a common data signal, the digital circuit being configured to operate in a functional mode and a test mode, the functional mode corresponding to normal operation of the digital circuit and the test mode corresponding to testing of various paths of the digital circuit, wherein the digital circuit is configured during the functional mode to: combining a functional output signal of each of the N redundant flip-flops using logic gates; and providing a single functional output signal in a fault tolerant, safety critical system based on the combination, and wherein the digital circuit is configured during the test mode to: arranging a first flip-flop of the N redundant flip-flops as part of a test path; arranging the N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing the N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at the common data signal; observing a test output signal at an output terminal of the first flip-flop to determine a fault within a test path including the first flip-flop; and A test output signal of each of the N-1 redundant flip-flops is observed to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle. 2 . The digital circuit of claim 1 , wherein the digital circuit is a triple voting flip-flop, and N is equal to 3. 3 .

3. The digital circuit of claim 1, wherein the digital circuit is an in-situ monitoring circuit. The digital circuit according to claim 3 , wherein N is equal to 2.

5. The digital circuit according to claim 3, wherein the in-situ monitoring circuit is a trigger-based or latch-based trigger, and wherein the in-situ monitoring circuit is a canary-type in-situ monitoring circuit, which is used to detect timing errors in integrated circuits.

6. The digital circuit of claim 1, wherein the digital circuit is part of an integrated circuit in an automotive system, wherein the automotive system is an air bag, anti-lock brakes, power steering, headlights and brake lights, cruise control, or an autonomous driving system.

7. The digital circuit of claim 1, wherein operations of the N-1 redundant flip-flops among the N redundant flip-flops conform to shadow logic, which is inserted at the synthesis / gate level through a connect / disconnect script.

8. An integrated circuit comprising a digital circuit, the digital circuit comprising: N redundant flip-flops, each of the N redundant flip-flops having a data input coupled to a common data signal, the digital circuit being configured to operate in a functional mode and a test mode, the functional mode corresponding to normal operation of the digital circuit and the test mode corresponding to testing of various paths of the digital circuit, wherein the digital circuit is configured during the functional mode to: combining a functional output signal of each of the N redundant flip-flops using logic gates; and providing a single functional output signal in a fault tolerant, safety critical system based on the combination, and wherein the digital circuit is configured during the test mode to: arranging a first flip-flop of the N redundant flip-flops as part of a test path; arranging the N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing the N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at the common data signal; observing a test output signal at an output terminal of the first flip-flop to determine a fault within a test path including the first flip-flop; and A test output signal of each of the N-1 redundant flip-flops is observed to determine a fault within the N-1 redundant flip-flops, the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops being observed in the same test cycle. 9 . The integrated circuit of claim 8 , wherein the digital circuit is a triple-voted flip-flop and N is equal to 3.

10. The integrated circuit of claim 8, wherein the digital circuit is an in-situ monitoring circuit. The integrated circuit of claim 10 , wherein N is equal to 2.

12. The integrated circuit of claim 10, wherein the in-situ monitoring circuit is a flip-flop based or latch based flip-flop, and wherein the in-situ monitoring circuit is a canary implementation of an in-situ monitoring circuit, the in-situ monitoring circuit being used to detect timing errors in the integrated circuit.

13. The integrated circuit of claim 8, wherein the integrated circuit is an integrated circuit in an automotive system, wherein the automotive system is an air bag, anti-lock brakes, power steering, headlights and brake lights, cruise control, or an autonomous driving system.

14. The integrated circuit of claim 8, wherein operations of the N-1 redundant flip-flops among the N redundant flip-flops conform to shadow logic inserted at a synthesis / gate level by a connect / disconnect script.

15. A method of operating a digital circuit having N redundant flip-flops, each of the N redundant flip-flops having a data input coupled to a common data signal, the method comprising: operating the digital circuit in a functional mode, the functional mode corresponding to normal operation of the digital circuit, wherein during the functional mode, the method comprises: combining a functional output signal of each of the N redundant flip-flops using logic gates; and providing a single functional output signal in a fault-tolerant, safety-critical system based on the combination; and operating the digital circuit in a test mode, the test mode corresponding to testing of various paths of the digital circuit, wherein during the test mode, the method comprises: arranging a first flip-flop of the N redundant flip-flops as part of a test path, arranging the N-1 redundant flip-flops among the N redundant flip-flops as shadow logic by bypassing the N-1 redundant flip-flops among the N redundant flip-flops from the test path, the N redundant flip-flops receiving a test pattern at the common data signal, observing a test output signal at an output terminal of the first flip-flop to determine a fault within a test path including the first flip-flop, and Observe a test output signal of each of the N-1 redundant flip-flops to determine a fault within the N-1 redundant flip-flops, wherein observing the test output signal at the output terminal of the first flip-flop and the test output signal of each of the N-1 redundant flip-flops is during the same test cycle.

16. The method of claim 15, wherein the digital circuit is a triple voting flip-flop and N is equal to 3.

17. The method of claim 15, wherein the digital circuit is an in-situ monitoring circuit. The method of claim 17 , wherein N is equal to 2.

19. The method of claim 17, wherein the in-situ monitoring circuit is a flip-flop based or latch based flip-flop, and wherein the in-situ monitoring circuit is a canary type in-situ monitoring circuit used to detect timing errors in an integrated circuit.

20. The method of claim 15, wherein the digital circuit is part of an integrated circuit in an automotive system, wherein the automotive system is an air bag, anti-lock brakes, power steering, headlights and brake lights, cruise control, or an autonomous driving system.

Images