Function safety design method for Online NDT of sram

Abstract

The invention relates to the technical field of vehicle gauge function safety design, and discloses a function safety design method of an Online NDT for sram, which comprises an NDT controller comprising an Intfctrl module, two NDTCTRL modules, a Compare module, an Arbitintf module and an Arbit module. The CPU is used for managing the NDT controller and reading information through the APB, and meanwhile, various Master accesses the SRAM after passing through the Arbit module through the AXI; the mutual redundancy of the two NDTCTRL modules is realized; the Compare module is used for supporting error injection and result comparison; and the Arbit module is responsible for arbitrating access requests from the NDTCTRL and the AXI, so that the Online NDT test does not influence the bandwidth of the SRAM interface or occupies part of the bandwidth. According to the function safety design method for the Online NDT of the sram, mutual redundant Online NDT design is utilized on the overall architecture, an error injection mechanism is supported, and a Lock Step Logic front-back staggered configuration three-level register and phase inverter mechanism is adopted, so that the whole design is safer, more flexible and more reliable.

Description

Technical Field

[0001] The present invention relates to the technical field of automotive functional safety design, and in particular to a functional safety design method for Online NDT of SRAM. Background Art

[0002] In the automotive field, ensuring the safety and reliability of components and systems is crucial. Online NDT (Non-Destructive Testing) is a key method that can detect internal structures and defects without damaging the object being tested. It can monitor key components of the vehicle in real time or regularly, such as the engine, braking system, and chassis, to promptly identify potential problems and avoid serious safety accidents caused by component failures.

[0003] As a core storage unit, the functional safety of SRAM directly determines the reliability level of the system. In SRAM, data may be erroneous due to various reasons (such as hardware failure and electromagnetic interference). Redundancy checking adds additional check bits or check codes to the data, allowing the receiving end to detect whether the data has errors. For example, the common cyclic redundancy check (CRC) can generate a check code by performing a polynomial calculation on the data. The receiving end verifies the check code to determine the integrity of the data. If an error is detected, the system can take appropriate measures, such as requesting retransmission or performing error correction, thereby improving data reliability.

[0004] The redundant check in Online NDT can monitor the status of SRAM in real time during system operation. When a storage unit in SRAM fails, the redundant check may detect data errors, which helps to detect hardware problems in time and avoid further expansion of the fault, thereby improving the stability and availability of the entire system. In some systems with high reliability requirements, such as aerospace, industrial control and other fields, even if some data errors occur, the system needs to be able to continue to operate normally. Redundant check can be combined with error correction coding technology, which can not only detect errors, but also correct errors to a certain extent, so that the system can still maintain normal operation in the presence of a small number of errors, thereby enhancing the system's fault tolerance.

[0005] There are two main functional safety designs for online nondestructive testing (ONDT) technology currently available in the industry. The first involves integrating an ECC (Error-Correcting Code) mechanism. During NDT execution, each read operation on an SRAM address triggers an ECC check. The ECC calculates the checksum of the currently read data and compares it with the original checksum when it was stored. If there is a discrepancy, an error signal is generated, notifying the SMU or triggering an interrupt. The second approach involves integrating the NDT algorithm with redundant checking. By accessing the same address multiple times and combining it with a negation operation, redundant verification of data integrity is achieved indirectly. However, these solutions only detect SRAM data failures. When the ONLINE NDT logic circuit fails or errs, the system is completely unaware, lacks a backup circuit to fall back to, and lacks self-test support for the ONLINE NDT circuit. Furthermore, across the industry, there is currently no dual-mode redundant mutual backup approach to achieve functional safety in ONLINE NDT. Summary of the Invention

[0006] (1) Technical problems solved

[0007] To address the shortcomings of the existing technology, the present invention provides a functional safety design method for Online NDT of SRAM. This method utilizes a mutually redundant Online NDT design, supports an error injection mechanism, and adopts a three-level register + inverter mechanism with a front-to-back staggered configuration of Lock Step Logic, making the entire design safer, more flexible and reliable.

[0008] (2) Technical solution

[0009] To achieve the above objectives, the present invention provides the following technical solutions: a functional safety design method for Online NDT of SRAM, comprising an NDT controller including an Intf_ctrl module, two NDT_CTRL modules, a Compare module, an Arbit_intf module, and an Arbit module; the CPU manages the NDT controller and reads information through APB, while various Masters access SRAM through the Arbit module via AXI; the two NDT_CTRL modules achieve mutual redundancy; the Compare module supports error injection and result comparison; and the Arbit module is responsible for arbitrating access requests from NDT_CTRL and AXI, so that Online NDT testing does not affect the SRAM interface bandwidth or occupy part of the bandwidth.

[0010] Preferably, the Compare module includes two components: Fault_INJ and Result_DEC. The Fault_INJ is responsible for error injection, and the Result_DEC is responsible for result comparison and error path analysis.

[0011] Preferably, the working mechanism of the Compare module circuit is as follows:

[0012] A. Configure NDT_CTRL0 or NDT_CTRL1 to Master mode and the other to LCL Monitor mode;

[0013] B. The output of the Master is used for business. At the same time, after three beats, the output is XORed with the output of the LCL Monitor. If the result is 1, it means an error has occurred; if it is 0, it means that the work is normal.

[0014] C. The input signal is sent to the LCL Monitor after one beat, and its output is inverted after two beats and then XOR-noted with the output from the Master (three-level register);

[0015] D. Fault_INJ can inject error 0 or error 1 into the output of Master and LCL Monitor simultaneously or individually;

[0016] E. Result_DEC monitors / determines the current status of NDT_CTRL0 or NDT_CTRL1 based on the injection signals from XNOR and Fault_INJ.

[0017] Preferably, the Compare circuit data path has the following two modes:

[0018] (1) When NDT_CTRL0 is in Master mode and NDT_CTRL1 is in LCL Monitor mode;

[0019] (2) When NDT_CTRL1 is in Master mode and NDT_CTRL0 is in LCL Monitor mode.

[0020] Preferably, when NDT_CTRL0 is in Master mode and NDT_CTRL1 is in LCL Monitor mode, the circuit data path is described as follows:

[0021] A. Input data passes through MUX0 on path 1 and enters NDT_CTRL0, and its output is directly output through path 11. At the same time, the output of NDT_CTRL0 passes through MUX1 on path 5 and is sent to XOR0.

[0022] B. Input data passes through MUX1 on path 4 and enters NDT_CTRL1, and its output passes through MUX3 on path 9 and is sent to XOR1;

[0023] The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result;

[0024] D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding;

[0025] E. The output of NDT_CTRL0 passes through three levels of registers to reach XOR0. The input of NDT_CTRL1 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR1.

[0026] Preferably, when NDT_CTRL1 is in Master mode and NDT_CTRL0 is in LCL Monitor mode, the circuit data path is described as follows:

[0027] A. Input data passes through path 4 and MUX1 before entering NDT_CTRL1. Its output is directly output through path 12. At the same time, the output of NDT_CTRL1 passes through MUX3 on path 9 and is sent to XOR1.

[0028] B. Input data passes through MUX1 on path 3 and enters NDT_CTRL0. Its output passes through MUX3 on path 8 and is sent to XOR1.

[0029] The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result;

[0030] D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding;

[0031] E. The output of NDT_CTRL1 passes through three levels of registers to reach XOR1. The input of NDT_CTRL0 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR0.

[0032] (3) Beneficial effects

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] The present invention utilizes a mutually redundant Online NDT design to more reliably support SRAM data detection. This not only detects SRAM data failures and errors, but also errors in the Online NDT circuit itself. Furthermore, the dual-mode redundancy of the Online NDT circuit also supports the timely replacement of backup circuits, giving the device an "extra life" in scenarios with low functional safety requirements. This is known as the Lock-Step mode. The Online NDT supports an error injection mechanism and employs a three-level register + inverter mechanism with a front-to-back staggered configuration of Lock Step Logic. This means that it can support self-detection of the Online NDT circuit, making the entire design safer, more flexible, and reliable, while also improving the functional safety level of the entire design. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a schematic diagram of the solution architecture of the present invention;

[0036] Figure 2 Schematic diagram of redundant and comparative circuits of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0038] See also Figure 1 To achieve flexible and reliable online NDT functional safety design, the present invention proposes a functional safety design method for online NDT for SRAM. The NDT controller includes an Intf_ctrl module, two NDT_CTRL modules, a Compare module, an Arbit_intf module, and an Arbit module. The CPU manages the NDT controller and reads information through the APB. At the same time, various masters access the SRAM through the Arbit module via the AXI interface. The two NDT_CTRL modules achieve mutual redundancy, the Compare module supports error injection and result comparison, and the Arbit module is responsible for arbitrating access requests from the NDT_CTRL and AXI interfaces. This ensures that online NDT testing does not affect the SRAM interface bandwidth or occupy part of the bandwidth.

[0039] like Figure 2As shown, Compare consists of two components: Fault_INJ is responsible for fault injection; Result_DEC is responsible for result comparison and error path analysis.

[0040] The working mechanism of the Compare module circuit is as follows:

[0041] A. Configure NDT_CTRL0 or NDT_CTRL1 to Master mode and the other to LCL Monitor mode;

[0042] B. The output of the Master is used for business. At the same time, after three beats, the output is XORed with the output of the LCL Monitor. If the result is 1, it means an error has occurred; if it is 0, it means that the work is normal.

[0043] C. The input signal is sent to the LCL Monitor after one beat, and its output is inverted after two beats and then XOR-noted with the output from the Master (three-level register);

[0044] D. Fault_INJ can inject error 0 or error 1 into the output of Master and LCL Monitor simultaneously or individually;

[0045] E. Result_DEC monitors / determines the current status of NDT_CTRL0 or NDT_CTRL1 based on the injection signals from XNOR and Fault_INJ.

[0046] The compare circuit data path has the following two modes:

[0047] (1) When NDT_CTRL0 is in Master mode and NDT_CTRL1 is in LCL Monitor mode, the circuit data path is described as follows:

[0048] A. Input data passes through MUX0 on path 1 and enters NDT_CTRL0, and its output is directly output through path 11. At the same time, the output of NDT_CTRL0 passes through MUX1 on path 5 and is sent to XOR0.

[0049] B. Input data passes through MUX1 on path 4 and enters NDT_CTRL1, and its output passes through MUX3 on path 9 and is sent to XOR1;

[0050] The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result;

[0051] D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding;

[0052] E. The output of NDT_CTRL0 passes through three levels of registers to reach XOR0. The input of NDT_CTRL1 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR1.

[0053] (2) When NDT_CTRL1 is in Master mode and NDT_CTRL0 is in LCL Monitor mode, the circuit data path is described as follows:

[0054] A. Input data passes through path 4 and MUX1 before entering NDT_CTRL1. Its output is directly output through path 12. At the same time, the output of NDT_CTRL1 passes through MUX3 on path 9 and is sent to XOR1.

[0055] B. Input data passes through MUX1 on path 3 and enters NDT_CTRL0. Its output passes through MUX3 on path 8 and is sent to XOR1.

[0056] The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result;

[0057] D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding;

[0058] E. The output of NDT_CTRL1 passes through three levels of registers to reach XOR1. The input of NDT_CTRL0 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR0.

[0059] The present invention utilizes a mutually redundant Online NDT design to more reliably support SRAM data detection. It can not only detect SRAM data failures and errors, but also detect errors in the Online NDT circuit itself. In addition, the dual-mode redundancy of the Online NDT circuit also supports the timely replacement of the backup circuit, giving the device "an extra life" in scenarios with low functional safety requirements. This is the Lock-Step mode. Online NDT supports an error injection mechanism and adopts a three-level register + inverter mechanism with a front-to-back staggered configuration of Lock Step Logic. This means that it can support self-detection of the Online NDT circuit, making the entire design safer, more flexible and reliable, and also improving the functional safety level of the entire design.

[0060] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A functional safety design method for online NDT of SRAM, characterized by: An NDT controller consisting of an Intf_ctrl module, two NDT_CTRL modules, a Compare module, an Arbit_intf module, and an Arbit module; The CPU manages the NDT controller and reads information through the APB. Meanwhile, various masters access the SRAM through the AXI and the Arbit module. The two NDT_CTRL modules achieve mutual redundancy; The Compare module is used to support error injection and result comparison; The Arbit module is responsible for arbitrating access requests from NDT_CTRL and AXI, so that the Online NDT test does not affect the SRAM interface bandwidth or occupies part of the bandwidth.

2. The functional safety design method for Online NDT of SRAM according to claim 1, characterized in that: The Compare module includes two components: Fault_INJ and Result_DEC. The Fault_INJ is responsible for error injection, and the Result_DEC is responsible for result comparison and error path analysis.

3. The functional safety design method for Online NDT of SRAM according to claim 2, characterized in that: The working mechanism of the Compare module circuit is as follows: A. Configure NDT_CTRL0 or NDT_CTRL1 to Master mode and the other to LCL Monitor mode; B. The output of the Master is used for business. At the same time, after three beats, the output is XORed with the output of the LCL Monitor. If the result is 1, it means an error has occurred; if it is 0, it means that the work is normal. C. The input signal is sent to the LCL Monitor after one beat, and its output is inverted after two beats and then XOR-noted with the output from the Master (three-level register); D. Fault_INJ can inject error 0 or error 1 into the output of Master and LCL Monitor simultaneously or individually; E. Result_DEC monitors / determines the current status of NDT_CTRL0 or NDT_CTRL1 based on the injection signals from XNOR and Fault_INJ.

4. The functional safety design method for Online NDT of SRAM according to claim 1 or 3, characterized in that: The Compare circuit data path has the following two modes: (1) When NDT_CTRL0 is in Master mode and NDT_CTRL1 is in LCL Monitor mode; (2) When NDT_CTRL1 is in Master mode and NDT_CTRL0 is in LCL Monitor mode.

5. The functional safety design method for Online NDT of SRAM according to claim 4, characterized in that: When NDT_CTRL0 is in Master mode and NDT_CTRL1 is in LCL Monitor mode, the circuit data path is described as follows: A. Input data passes through MUX0 on path 1 and enters NDT_CTRL0, and its output is directly output through path 11. At the same time, the output of NDT_CTRL0 passes through MUX1 on path 5 and is sent to XOR0. B. Input data passes through MUX1 on path 4 and enters NDT_CTRL1, and its output passes through MUX3 on path 9 and is sent to XOR1; The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result; D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding; E. The output of NDT_CTRL0 passes through three levels of registers to reach XOR0. The input of NDT_CTRL1 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR1.

6. The functional safety design method for Online NDT of SRAM according to claim 4, characterized in that: When NDT_CTRL1 is in Master mode and NDT_CTRL0 is in LCL Monitor mode, the circuit data path is described as follows: A. Input data passes through path 4 and MUX1 before entering NDT_CTRL1. Its output is directly output through path 12. At the same time, the output of NDT_CTRL1 passes through MUX3 on path 9 and is sent to XOR1. B. Input data passes through MUX1 on path 3 and enters NDT_CTRL0. Its output passes through MUX3 on path 8 and is sent to XOR1. The outputs of C, XOR0 and XOR1 pass through XNOR0 and enter Result_DEC to complete the processing of the comparison result; D. Fault_INJ can inject errors into XOR0 or XOR1 and send the error information to Result_DEC for error decoding; E. The output of NDT_CTRL1 passes through three levels of registers to reach XOR1. The input of NDT_CTRL0 (LCL Monitor) passes through one level of registers, and its output passes through two levels of registers and an inverter to reach XOR0.

Images