A register structure and chip

Abstract

The application provides a register structure and a chip, relates to the technical field of registers, and comprises a register module, an error detection module and a channel convergence module. The register module contains multiple data bits, each data bit is equipped with multiple register channels and a voting circuit, the voting circuit performs majority voting on the outputs of each channel of the same data bit, the error detection module compares the outputs of each channel with the voting result bit by bit, and outputs a redundant comparison signal; the channel convergence module is provided with multiple channel convergence units, the redundant comparison signals of the same type of register channel are connected to the same unit, the channel signals across data bits are aggregated and a common fault alarm signal is output. The beneficial effects are as follows: relying on the cross-bit horizontal convergence topology, taking the voting result as the comparison reference, converging the bit faults according to the channels, changing the error reporting link according to the data bit into matching the number of channels, simplifying the internal error reporting wiring, saving the redundant convergence gate, reducing the chip hardware area, and improving the problems of wiring congestion and layout resource waste caused by the separate reporting of multiple data bits.

Description

Technical Field

[0001] This invention relates to the field of register technology, and in particular to a register structure and chip. Background Technology

[0002] In the field of semiconductor integrated circuit design, especially in chip design that requires compliance with automotive functional safety standards (such as ISO 26262), the safety of register structures is crucial. The register configuration in automotive electronic control units controls almost all hardware behavior. However, during actual vehicle operation, due to radioactive interference or strong electromagnetic interference, registers are highly susceptible to random state flips. Such unintended configuration changes can lead to unpredictable hardware system behavior, potentially compromising high-level safety objectives and causing serious personal injury hazards such as unintended acceleration or brake failure.

[0003] To avoid erroneous toggling of critical control registers, such as Figure 1 As shown, existing technologies typically employ a triple-redundant register protection architecture. In this architecture, because fault comparison, reporting, and testing are usually performed independently for each data bit, a large amount of testing and reporting logic needs to be configured in a register module containing multiple data bits. This results in excessive chip hardware area overhead and complex signal transmission paths. Specifically, traditional solutions require a pairwise XOR comparison between the three internal redundant registers for each individual data bit, and each data bit requires an independent fault topology containing OR gates and independent error injection logic. When a register module contains a large number of data bits (e.g., n data bits), n completely independent test and reporting circuits must be stacked at the hardware level. This multi-data-bit independent fault reporting and self-testing circuit architecture occupies a large amount of chip layout area, significantly increasing the congestion of on-chip routing resources. Summary of the Invention

[0004] To address the problems existing in the prior art, the present invention provides a register structure, comprising: a register module having multiple data bits, each data bit corresponding to multiple register channels and a voting circuit, wherein for each data bit, the voting circuit performs a majority vote on the output values ​​of its associated register channels and outputs the voting result; an error detection module connected to the register module, used to compare the output value of each register channel with the voting result for each data bit to output multiple redundant comparison signals; and a channel aggregation module connected to the error detection module, the channel aggregation module comprising multiple channel aggregation units, wherein the redundant comparison signals corresponding to the register channels of the same type in each data bit are connected to the input terminal of the same channel aggregation unit, so that the redundant comparison signals spanning multiple data bits are classified and aggregated according to the register channels through the channel aggregation units, and a common fault alarm signal is output to characterize the overall fault status of the register module.

[0005] Preferably, each data bit corresponds to three register channels, and the voting circuit is a three-vote voting circuit.

[0006] Preferably, the error detection module includes multiple XOR units; for each data bit, the two input terminals of each XOR unit are respectively connected to the output terminal of a register channel and the output terminal of the corresponding voting circuit, and the output terminal of the XOR unit outputs the redundant comparison signal.

[0007] Preferably, the three register channels are a first register channel, a second register channel, and a third register channel; the plurality of channel convergence units include a first channel convergence unit, a second channel convergence unit, and a third channel convergence unit, and the first channel convergence unit, the second channel convergence unit, and the third channel convergence unit are all OR gate circuits; the redundancy comparison signal of each data bit belonging to the first register channel is connected to the input terminal of the first channel convergence unit; the redundancy comparison signal of each data bit belonging to the second register channel is connected to the input terminal of the second channel convergence unit; and the redundancy comparison signal of each data bit belonging to the third register channel is connected to the input terminal of the third channel convergence unit.

[0008] Preferably, the channel aggregation module further includes multiple latching trigger units, and the output terminals of the first channel aggregation unit, the second channel aggregation unit and the third channel aggregation unit respectively output the common fault alarm signal after passing through one of the latching trigger units.

[0009] Preferably, the entire register module is configured with only one error injection circuit, which is configured between the output of the first channel convergence unit, the second channel convergence unit, or the third channel convergence unit and the corresponding latch trigger unit.

[0010] Preferably, the channel aggregation module further includes an alarm master unit, which includes a cascaded first OR gate and a second OR gate; the input of the first OR gate is connected to the output of the latch trigger unit corresponding to the first channel aggregation unit and the second channel aggregation unit respectively; the input of the second OR gate is connected to the output of the first OR gate and the output of the latch trigger unit corresponding to the third channel aggregation unit respectively, and the output of the second OR gate is used to output a global fault alarm signal.

[0011] The present invention also provides a chip characterized by including the register structure as described above.

[0012] The above technical solution has the following advantages or beneficial effects: By reconstructing the comparison and reporting topology of register protection, it breaks the physical limitation of closed-loop error reporting within a single data bit in traditional solutions. The error detection module directly uses the voting result as the comparison benchmark, while the channel aggregation module realizes horizontal channel-level cascaded aggregation across data bits. This architecture converges and normalizes the bit-level fault signals of all data bits in the register module according to the register channel dimension, reducing the number of error reporting paths for multi-bit registers from an order of magnitude positively correlated with the number of data bits to a fixed order of magnitude corresponding to the number of register channels. This greatly simplifies the error reporting network inside the register module, eliminates redundant bit-by-bit aggregation gate circuits, significantly reduces the hardware area overhead of the chip, and solves the technical problems of on-chip wiring congestion and excessive consumption of layout resources caused by independent fault reporting of multiple data bits. Attached Figure Description

[0013] Figure 1 This is a topology diagram of a register protection circuit based on independent comparison of single data bits and bit-by-bit error injection in the existing technology. Figure 2 This is a register structure topology diagram provided for an embodiment of the present invention. Detailed Implementation

[0014] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The present invention is not limited to this embodiment; other embodiments that conform to the spirit of the present invention may also fall within the scope of the present invention.

[0015] In a preferred embodiment of the present invention, based on the aforementioned problems existing in the prior art, a register structure is provided, comprising: a register module 1, which has multiple data bits, each data bit corresponding to multiple register channels and a voting circuit 11, wherein for each data bit, the voting circuit performs a majority vote on the output values ​​of its associated register channels and outputs the voting result; an error detection module 2, connected to the register module 1, which compares the output value of each register channel with the voting result for each data bit to output multiple redundant comparison signals; and a channel aggregation module 3, connected to the error detection module 2, which includes multiple channel aggregation units 31, wherein redundant comparison signals corresponding to register channels of the same type in each data bit are connected to the input terminal of the same channel aggregation unit 31, so that the redundant comparison signals spanning multiple data bits are classified and aggregated according to register channels through the channel aggregation units 31, and a common fault alarm signal is output to characterize the overall fault state of the register module.

[0016] Specifically, in this embodiment, the register module integrates multiple parallel data bits (such as...) for controlling the behavior of the core hardware. Figure 2 Data bits Bit0 to data bits n Each data bit is horizontally connected in three parallel paths to three D flip-flops 12. Each D flip-flop 12 is a register channel. In order to prevent single-point failure from compromising security objectives, each data bit is not composed of a single flip-flop in the hardware entity, but is physically extended into multiple parallel register channels.

[0017] When data is output or read by system functions, the voting circuit 11 corresponding to each data bit will extract the current output value of each associated register channel in real time, perform majority voting through hard core logic, and output the non-flipped value with the highest consistency as the current voting result.

[0018] Error detection module 2 no longer performs pairwise comparisons between registers within the same data bit in the traditional scheme. Instead, it directly pulls out the output of each register channel and performs real-time consistency verification with the voting result that has been determined to be the correct value. When a channel experiences a random single-point flip due to external radioactive interference, the output of that channel will not match the voting result. The error detection module generates a redundant comparison signal accordingly.

[0019] In the subsequent reporting path, the channel aggregation module 3 breaks away from the traditional bit-level error aggregation tree and adopts a horizontal convergence topology that spans data bits. Internally, the channel aggregation module 3 has a fixed number of channel aggregation units 31 for each register channel category. Redundant comparison signals triggered by register channels in different data bits that belong to the same physical attribute category are all connected to the same channel aggregation unit 31 across the data bit boundaries, achieving module-level large-scale aggregation and centralized output of a common fault alarm signal.

[0020] This embodiment modifies the comparison and interleaving network of fault signals, reconstructing the original vertically closed-loop error reporting path within a single data bit into a horizontally channel-level convergent path spanning all data bits. This design completely decouples the number of error reporting paths in a multi-data-bit register from the total number of data bits, greatly simplifies the error reporting tree topology within the register module, significantly reduces the layout area occupied by the internal fault collection circuitry, and effectively solves the technical problem of excessive hardware logic overhead in multi-bit safety register designs.

[0021] In another preferred embodiment of the present invention, the register structure, based on the above-described channel topology, further provides a hardware coordination scheme for triple redundancy configuration and XOR comparison.

[0022] Specifically, each data bit corresponds to three register channels, and the voting circuit 11 is a three-vote voting circuit; the error detection module 2 includes multiple XOR units; for each data bit, the two input terminals of each XOR unit are respectively connected to the output terminal of a register channel and the output terminal of the corresponding voting circuit 11, and the output terminal of the XOR unit outputs a redundant comparison signal.

[0023] Specifically, in this embodiment, each data bit of register module 1 strictly adopts a triple-redundant storage architecture, that is, it contains three independent register channels. When performing data operations, the three-voting circuit 11 performs a majority vote on the parallel outputs of these three register channels, either selecting one out of two or one out of three, thereby ensuring that even if any register channel experiences an occasional flip failure, the three-voting circuit 11 can still output the correct voting result, ensuring that the hardware control logic does not undergo unexpected deflection.

[0024] To achieve accurate detection of single-point failures while maintaining circuit area simplicity, the error detection module 2 directly uses a basic two-level XOR unit as the comparison core. One end of each XOR unit is connected to the output line of its respective register channel, and the other end is directly connected to the output terminal of the three-vote circuit 11.

[0025] When any redundant register channel fails randomly, causing the data to be inconsistent with the majority voting result, or when the internal logic gate of the three-vote voting circuit itself suffers random hardware damage, resulting in an abnormal voting result, the two input terminals of the corresponding XOR unit generate a level difference, and the output terminal of the XOR unit then flips to a high level, generating a redundant comparison signal.

[0026] Traditional solutions, which only compare redundant registers, offer no coverage for failures in the voting circuit itself, often resulting in security blind spots where the redundant registers are correct but the final output voting result is incorrect. This embodiment introduces an XOR cell comparison topology based on the voting result as a reference, enabling precise and real-time capture of any single-channel register flips. It also comprehensively incorporates random hardware circuit failures of the three-vote voting circuit itself into the security monitoring coverage. This solution significantly improves the chip's random hardware diagnostic coverage and eliminates security risks caused by voting failures without introducing additional complex detection logic.

[0027] In another preferred embodiment of the invention, the register structure further clarifies the specific cascaded circuitry for channel convergence and state stability maintenance.

[0028] Specifically, the three register channels are the first register channel, the second register channel, and the third register channel; the multiple channel convergence unit 31 includes the first channel convergence unit 311, the second channel convergence unit 312, and the third channel convergence unit 313, and the first channel convergence unit 311, the second channel convergence unit 312, and the third channel convergence unit 313 are all OR gate circuits.

[0029] The redundant comparison signals belonging to the first register channel in each data bit are all connected to the input terminal of the first channel aggregation unit 311.

[0030] The redundant comparison signals belonging to the second register channel in each data bit are all connected to the input of the second channel aggregation unit 312.

[0031] The redundant comparison signals belonging to the third register channel in each data bit are all connected to the input of the third channel aggregation unit 313.

[0032] The channel aggregation module 3 also includes multiple latching trigger units 32. The output terminals of the first channel aggregation unit 311, the second channel aggregation unit 312 and the third channel aggregation unit 313 respectively output a common fault alarm signal after passing through a latching trigger unit 32.

[0033] Specifically, in this embodiment, the three register channels corresponding to each data bit are defined at the module level as the first register channel, the second register channel, and the third register channel (e.g., ...). Figure 2The flip-flop outputs A, B, and C are arranged vertically for each data bit. Correspondingly, the channel aggregation module has three multi-input OR gate circuits arranged vertically in parallel within the module, serving as the first channel aggregation unit 311, the second channel aggregation unit 312, and the third channel aggregation unit 313, respectively.

[0034] The input connections of these three multi-input OR gates form a horizontal parallel convergence matrix spanning all data bits: all XOR unit outputs that compare with the first register channel are horizontally connected in parallel to the input pins of the first channel convergence unit 311; all XOR unit outputs that compare with the second register channel are horizontally connected in parallel to the input pins of the second channel convergence unit 312; and all XOR unit outputs that compare with the third register channel are horizontally connected in parallel to the input pins of the third channel convergence unit 313.

[0035] Since logic flips caused by high-frequency noise or X-ray breakdown often manifest as instantaneous pulse faults on the order of microseconds or even nanoseconds, to prevent the fault signal from being lost during the reporting process, each of the single-ended output lines of the first, second, and third channel convergence units is connected in series with a latch trigger unit 32 driven by a hardware clock (e.g., Figure 2 (e.g., a D flip-flop in a circuit). Once a specific channel of any data bit flips, the corresponding channel convergence OR gate will output a high level, and the latch trigger unit cascaded after it will stably maintain this high-level fault state, thereby continuously outputting a common fault alarm signal.

[0036] This embodiment employs multi-input OR gates for parallel lateral convergence across data bits of the same channel, combined with latch trigger units for state maintenance. It replaces the massive and deep bit-by-bit error reporting or gate trees of traditional solutions with three fixed channel-level convergence links. This architecture significantly reduces on-chip combinational logic gate overhead and saves global routing resources while providing an extremely high data loss prevention mechanism, ensuring 100% capture of sudden single-point transient interference.

[0037] In another preferred embodiment of the invention, the register structure is configured with an error injection and self-test mechanism that can significantly reduce self-test overhead.

[0038] Specifically, the entire register module is configured with only one error injection circuit, which is configured between the output of any one of the first channel aggregation unit 311, the second channel aggregation unit 312 or the third channel aggregation unit 313 and the corresponding latch trigger unit 32.

[0039] Specifically, in this embodiment, the traditional solution uses a bit-by-bit independent error reporting path. In order to verify whether there are latent faults in the reporting path itself that prevent error reporting, a set of error injection logic must be forcibly added to the error reporting circuit of each data bit (i.e., one error injection logic needs to be added to each result bit, and n bits require n sets of error injection logic). This bit-by-bit error injection logic control must rely heavily on the participation of software behavior, causing the system software to spend a very long time polling and sequentially injecting and clearing n error injection points in each power-on startup cycle, which seriously slows down the system's startup self-test efficiency.

[0040] In this embodiment, since all data bit fault paths have been horizontally converged at the first, second, and third channel convergence units according to the channel dimension, all the first register channel reporting paths, second register channel reporting paths, and third register channel reporting paths in the entire register module have been naturally unified into three physical nodes before entering the latch trigger unit.

[0041] Therefore, this embodiment no longer sets error annotation points bit by bit, but only selects one of the output terminals of the first channel aggregation unit 311, the second channel aggregation unit 312, or the third channel aggregation unit 313 (e.g., Figure 2 The error injection circuit is configured at the ErrorInjection input terminal between the first channel convergence unit 311 and the corresponding latch trigger unit 32.

[0042] During the chip power-on self-test phase, the system software only needs to issue a single error injection command to the register module. The error injection circuit will forcibly inject a fault high level into the corresponding latch trigger unit. If the subsequent system can correctly receive the common fault alarm signal, it can be confirmed that the fault latching and reporting path at the module level is completely normal and the latent fault has been successfully avoided.

[0043] This embodiment achieves self-testing by deploying a single fault injection circuit at a specific channel-level aggregation node, covering all register reporting paths of the entire module with minimal hardware layout overhead. The software only needs to perform a fault injection process once per power-on cycle for a single module to eliminate all latent faults, compressing the self-testing behavior that originally required repeating n times into a single execution. This significantly shortens the system's power-on self-testing time and effectively solves the technical problem of excessive software runtime consumption in traditional testing schemes.

[0044] In another preferred embodiment of the present invention, the register structure provides an alarm reporting circuit that can completely avoid single-point latent faults and achieve error-free injection at the hardware topology level.

[0045] Specifically, the channel aggregation module 3 also includes an alarm unit, which includes a cascaded first OR gate 331 and a second OR gate 332; the input of the first OR gate 331 is connected to the output of the latch trigger unit 32 corresponding to the first channel aggregation unit 311 and the second channel aggregation unit 312, respectively.

[0046] The input of the second OR gate 332 is connected to the output of the first OR gate 331 and the output of the latch trigger unit 32 corresponding to the third channel convergence unit 313. The output of the second OR gate 332 is used to output a global fault alarm signal.

[0047] The output of the first OR gate 331 forms the first alarm path, and the output of the latch trigger unit 32 corresponding to the third channel aggregation unit 313 forms the second alarm path. The first alarm path and the second alarm path output a common fault alarm signal in parallel and independently, so as to completely avoid single-point latent faults through the hardware isolation of the first alarm path and the second alarm path.

[0048] Specifically, in this embodiment, in order to fundamentally eliminate the risk of missed reports caused by single-point damage to the error reporting network itself without relying on frequent software calls for error injection tests, the alarm unit adopts an asymmetric dual-path parallel reporting topology.

[0049] Specifically, the outputs of the latch trigger units 32 corresponding to the first channel aggregation unit 311 (corresponding to register channel A) and the second channel aggregation unit 312 (corresponding to register channel B) are connected to the two inputs of the first OR gate 331, and the outputs of the first OR gate 331 are aggregated to form the first alarm path (corresponding to...). Figure 2 In the node ①Alarm0 channel). The output of the latch trigger unit 32 corresponding to the third channel convergence unit 313 (corresponding to register channel C) does not enter the first OR gate 331, but is used as the second alarm path (corresponding to Figure 2 Node ②Alarm1 channel in the middle maintains independent physical and electrical routing.

[0050] The first alarm path and the second alarm path are connected in parallel to the second OR gate 332 (corresponding to...). Figure 2 In the final stage OR gate ③), the output of the second OR gate 332 leads to the final global fault alarm signal of the system.

[0051] Assuming a random failure occurs within the alarm network, such as damage to the first OR gate on the first alarm path (resulting in a constant zero failure, preventing any alarm signal from channel A or channel B from being transmitted to subsequent stages via the first alarm path), the first alarm path is in a latent fault state. Since this solution completely physically isolates the second alarm path of the third channel, when subsequent external interference causes accumulated failures within the register module that exceed its error correction capability (i.e., the register corresponding to channel C also experiences a flip failure), the XOR error signal of channel C will be completely unaffected by the damage to the first OR gate 331, and will successfully report the global fault alarm signal to the software directly through the independent second alarm path and the final-stage second OR gate 332.

[0052] This embodiment constructs a fully hardware-isolated first alarm path and a second alarm path by cascading a first OR gate 331 and a second OR gate 332. The physical redundancy of the dual paths overcomes the failure bottleneck of traditional single-node reporting OR gates. This solution ensures that even if the reporting logic circuit itself experiences a local single-point failure, it will not lead to missed reports of subsequent multi-point cumulative failures. Therefore, the hardware architecture is completely immune to and avoids the devastating impact of single-point latent faults on the reporting of critical control information. This allows the system to unconditionally meet the highest functional safety integrity level diagnostic coverage indicators without setting or calling error injection self-test procedures.

[0053] In another preferred embodiment of the invention, a chip is provided that includes a highly secure register structure as described in any of the foregoing embodiments.

[0054] Specifically, in this embodiment, the chip can be a microcontroller (MCU), a system-on-a-chip (SoC), or a main control graphics or logic processor in an automotive electronic control unit (ECU). This chip integrates one or more of the aforementioned register structures within the silicon wafer, specifically for storing critical low-level hardware configurations, security boundary parameters, or external interface control words.

[0055] When the chip is in a harsh environment with strong electromagnetic pulses, such as when a vehicle is in motion, the register structure integrated inside the chip can automatically perform the aforementioned multi-channel parallel storage of data bits, majority voting output, XOR detection based on voting benchmark, and cross-data bit horizontal channel-level aggregation.

[0056] By receiving the common fault alarm signal or global fault alarm signal output by the channel aggregation module from this register structure, the system software can accurately determine which register channel has triggered a single point of failure.

[0057] Since the three-vote mechanism can still maintain the original voting result output when a single point of failure occurs, the software can choose to directly read and reconfigure the disturbed safety register module after receiving the report, thereby dynamically truncating the failure evolution within the hardware architecture and preventing a single point of random failure from spreading into multiple potential faults.

[0058] This embodiment significantly enhances the chip's fault tolerance and autonomous diagnostic capabilities against random failures by physically integrating a high-security register structure within the chip. Without occupying valuable on-chip wiring resources and large-scale logic gate arrays, it significantly improves the overall functional safety level of the chip, providing a highly cost-effective and area-advantageous hard-core security solution for high-security semiconductor applications.

[0059] The above are merely preferred embodiments of the present invention and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should recognize that any equivalent substitutions and obvious changes made using the content of this specification and illustrations should be included within the protection scope of the present invention.

Claims

1. A register structure, characterized in that, include: The register module has multiple data bits, each data bit corresponding to multiple register channels and a voting circuit. For each data bit, the voting circuit performs a majority vote on the output values ​​of each of the associated register channels and outputs the voting result. The multiple register channels corresponding to each data bit belong to different categories. An error detection module, connected to the register module, is used to compare the output value of each register channel with the voting result for each data bit, so as to output multiple redundant comparison signals; A channel aggregation module is connected to the error detection module. The channel aggregation module includes multiple channel aggregation units. The redundant comparison signals corresponding to the register channels of the same category in each of the data bits are connected to the input terminal of the same channel aggregation unit. The redundant comparison signals spanning multiple data bits are classified and aggregated according to the category of the register channel through the various channel aggregation units, and a common fault alarm signal is output to characterize the overall fault status of the register module.

2. The register structure according to claim 1, characterized in that, Each of the data bits corresponds to three register channels, and the voting circuit is a three-vote voting circuit.

3. The register structure according to claim 1, characterized in that, The error detection module includes multiple XOR units; For each data bit, the two inputs of each XOR unit are respectively connected to the output of a register channel and the output of the corresponding voting circuit, and the output of the XOR unit outputs the redundant comparison signal.

4. The register structure according to claim 2, characterized in that, The three register channels are the first register channel, the second register channel, and the third register channel; The plurality of channel convergence units include a first channel convergence unit, a second channel convergence unit, and a third channel convergence unit, wherein the first channel convergence unit, the second channel convergence unit, and the third channel convergence unit are all OR gate circuits; The redundant comparison signals belonging to the first register channel in each of the data bits are all connected to the input terminal of the first channel aggregation unit; The redundant comparison signals belonging to the second register channel in each of the data bits are all connected to the input terminal of the second channel aggregation unit; The redundant comparison signals belonging to the third register channel in each of the data bits are all connected to the input terminal of the third channel aggregation unit.

5. The register structure according to claim 4, characterized in that, The channel aggregation module also includes multiple latching trigger units. The output terminals of the first channel aggregation unit, the second channel aggregation unit, and the third channel aggregation unit each output the common fault alarm signal after passing through one of the latching trigger units.

6. The register structure according to claim 5, characterized in that, The entire register module is configured with only one error injection circuit, which is configured between the output of the first channel convergence unit, the second channel convergence unit, or the third channel convergence unit and the corresponding latch trigger unit.

7. The register structure according to claim 5 or 6, characterized in that, The channel aggregation module also includes an alarm control unit, which includes a cascaded first OR gate and a second OR gate. The input terminals of the first OR gate are respectively connected to the output terminals of the latch trigger units corresponding to the first channel convergence unit and the second channel convergence unit; The input terminal of the second OR gate is connected to the output terminal of the first OR gate and the output terminal of the latch trigger unit corresponding to the third channel convergence unit, respectively. The output terminal of the second OR gate is used to output a global fault alarm signal.

8. A chip, characterized in that, Includes the register structure as described in any one of claims 1 to 7.

Images