A reference source switching system and method

Abstract

The application provides a reference source switching system and method, relates to the technical field of electronics, and comprises a first branch, a second branch, a glitchless selector and a hardware controller; wherein each branch comprises a reference source selection circuit and an isolation circuit; the reference source selection circuit is used for selecting a clock signal from a plurality of reference sources according to a source selection signal sent by the hardware controller and outputting the clock signal to the isolation circuit in the branch; the isolation circuit is used for outputting the clock signal to a corresponding input end of the glitchless selector when receiving an effective enable signal from the hardware controller, and blocking the output of the clock signal when receiving an ineffective enable signal from the hardware controller; the glitchless selector is used for switching between the first input end and the second input end according to a branch selection signal sent by the hardware controller, and outputting the clock signal of the selected input end to a watchdog module. The application can realize glitchless switching.

Description

Technical Field

[0001] This application relates to the field of electronic technology, and in particular to a reference source switching system and method. Background Technology

[0002] In modern electronic systems, especially in fields with extremely high safety requirements such as automotive electronics, industrial control, and aerospace, the processor, as the core control unit, needs to be continuously monitored to prevent program crashes or system freezes caused by software errors, hardware failures, or external interference. A watchdog module, as a widely used hardware monitoring circuit, operates synchronously with the processor and triggers a system reset if it does not receive a "feed" signal from the processor within a preset time. To meet the power consumption and performance requirements of different application scenarios, the processor's reference source, such as an external crystal oscillator, often needs to be dynamically switched. In this case, the reference source switching system providing the operating clock for the watchdog module must be able to follow the processor's clock changes in real time and without interference; otherwise, the watchdog module may misjudge or malfunction, causing serious safety risks.

[0003] Related technologies typically employ multiplexers to directly switch between different reference sources. Because each reference source has a different clock period and phase, and the selection control signal may be asynchronous with any of the reference sources, voltage glitches are easily generated at the output during switching. These glitches may be misread by the watchdog module, leading to counter malfunctions or system resets. Summary of the Invention

[0004] This application is made in view of at least one of the above-mentioned technical problems existing in the prior art. This application can achieve glitch-free switching and reduce the risk of watchdog module misoperation.

[0005] In a first aspect, embodiments of this application provide a reference source switching system, including: a first branch, a second branch, a glitch-free selector, and a hardware controller; Each branch includes: a reference source selection circuit and an isolation circuit; The reference source selection circuit has an input terminal connected to multiple reference sources and a control terminal connected to the hardware controller. It is used to select a clock signal from the multiple reference sources according to the source selection signal sent by the hardware controller and output it to the isolation circuit of the branch. The isolation circuit has its input terminal connected to the output terminal of the reference source selection circuit of the branch it is in, and its control terminal connected to the hardware controller. When it receives an enable signal from the hardware controller that indicates a valid signal, it outputs the clock signal to the corresponding input terminal of the glitch-free selector. When it receives an enable signal from the hardware controller that indicates an invalid signal, it blocks the output of the clock signal. The glitch-free selector has a first input terminal connected to the output terminal of the isolation circuit in the first branch, a second input terminal connected to the output terminal of the isolation circuit in the second branch, an output terminal connected to a watchdog module, and a control terminal connected to the hardware controller. It is used to switch between the first input terminal and the second input terminal according to the branch selection signal sent by the hardware controller, and output the clock signal of the selected input terminal to the watchdog module.

[0006] Secondly, embodiments of this application provide a reference source switching method. Based on the aforementioned reference source switching system, the method includes: The hardware controller outputs an enable signal indicating invalidity to the isolation circuit of the target branch; The isolation circuit blocks the output of the clock signal when it receives an enable signal that indicates invalidity. The hardware controller outputs a source selection signal to the reference source selection circuit of the target branch; The reference source selection circuit selects one clock signal from multiple reference sources according to the source selection signal and outputs it to the isolation circuit of the branch. The hardware controller outputs a valid enable signal to the isolation circuit of the target branch; When the isolation circuit receives an enable signal indicating validity, it outputs the received clock signal to the input terminal of the glitch-free selector corresponding to the target branch. The hardware controller outputs a branch selection signal to the burr-free selector; The glitch-free selector outputs the clock signal of the input terminal corresponding to the target branch to the watchdog module according to the branch selection signal.

[0007] This application provides a reference source switching system and method that achieves glitch-free switching of the reference source by constructing a dual-branch ping-pong architecture consisting of a first branch and a second branch, and utilizing the isolation circuits within the branches in coordination with the glitch-free selector at the end. During the switching process, by disabling the enable signal of the target branch's isolation circuit, glitches generated by the front-end reference source selection circuit at the moment of switching are physically blocked, ensuring that the watchdog module always receives a clean and stable clock signal, avoiding false resets or system logic disorder caused by glitches. When the first branch provides the clock to the watchdog module, the second branch is in a background standby state, and vice versa. During this process, the watchdog module always has one and only one branch continuously providing it with an uninterrupted clock, eliminating the need to pause monitoring and then restart as in traditional solutions, thus achieving seamless switching. By having the source select signal, enable signal, and tributary select signal sent directly by a hardware controller independent of the main processor, deep physical and logical isolation can be achieved. This ensures that even if the main processor is in extreme states such as crashing, freezing, or register corruption, the watchdog module can still obtain the correct reference clock and maintain the system reset capability, greatly improving the fault tolerance and security level of the entire chip system. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a schematic diagram of a reference source switching system provided in one embodiment of this application; Figure 2 This is a schematic diagram of a reference source switching system provided in another embodiment of this application; Figure 3 This is a schematic diagram of a reference source switching system provided in another embodiment of this application; Figure 4 This is a flowchart of a reference source switching method provided in one embodiment of this application. Detailed Implementation

[0010] To enable those skilled in the art to better understand the technical solutions of the embodiments of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0011] like Figure 1 As shown in the figure, this application provides a reference source switching system, including: a first branch, a second branch, a glitch-free selector, and a hardware controller.

[0012] Each branch includes: a reference source selection circuit (a first reference source selection circuit and a second reference source selection circuit) and an isolation circuit (a first isolation circuit and a second isolation circuit).

[0013] The reference source selection circuit has multiple reference sources connected to its input and a hardware controller connected to its control terminal. It is used to select one clock signal from the multiple reference sources and output it to the isolation circuit of the corresponding branch according to the source selection signal sent by the hardware controller.

[0014] The number of reference sources can be from 2 to 8, and more than 8 can be used when more operating modes need to be covered; the reference source selection circuits of the first branch and the second branch are preferably connected to the same multiple reference sources so that any reference source can be output through any branch.

[0015] An isolation circuit, whose input is connected to the output of the reference source selection circuit of the branch, and whose control is connected to the hardware controller, is used to output the clock signal to the corresponding input of the glitch-free selector when it receives an enable signal from the hardware controller that indicates validity, and to block the output of the clock signal when it receives an enable signal from the hardware controller that indicates invalidity.

[0016] The glitch-free selector has its first input terminal connected to the output terminal of the isolation circuit in the first branch, its second input terminal connected to the output terminal of the isolation circuit in the second branch, its output terminal connected to the watchdog module, and its control terminal connected to the hardware controller. It is used to switch between the first input terminal and the second input terminal according to the branch selection signal sent by the hardware controller, and output the clock signal of the selected input terminal to the watchdog module.

[0017] The first and second branches use the same layout and trace length to minimize the physical delay deviation introduced by the two branches to the clock signal and ensure the consistency of the clock phase before and after switching.

[0018] The output of the reference source selection circuit is directly electrically connected to the input of the isolation circuit, without any complex combinational logic circuits inserted in between, to prevent the introduction of unnecessary parasitic capacitance or delay in the wiring.

[0019] Through a dual-branch symmetrical architecture, the system can implement a ping-pong mechanism of foreground operation and background preparation. When the first branch is providing a reference clock for the watchdog module, the hardware controller can fully utilize the idle nature of the second branch, pre-configuring the clock source and frequency division parameters of the second branch in the background, and instantly switching over by a glitch-free selector once the target clock stabilizes. This architecture fundamentally avoids clock interruptions during switching, ensuring the continuity of watchdog module monitoring.

[0020] If the system needs to support more input reference sources or meet higher security requirements, it can be expanded into a multi-branch structure including a first branch, a second branch, a third branch, etc. In this case, to maintain consistency with the simplification approach of this application, a tree structure composed of cascaded multi-level two-to-one glitch-free selectors is preferred to complete the convergence of multiple branches. That is, each level only exchanges between two stable clocks, instead of using multi-to-one glitch-free selectors with complex internal arbitration logic. This keeps the combinational logic depth on the final path at a low level even when the number of branches increases.

[0021] This application embodiment constructs a dual-branch ping-pong architecture consisting of a first branch and a second branch, and utilizes the isolation circuits within the branches to work in conjunction with the glitch-free selector at the end, enabling glitch-free switching of the reference source. During the switching process, by disabling the enable signal of the target branch isolation circuit, glitches generated by the front-end reference source selection circuit at the moment of switching are physically blocked, thereby ensuring that the watchdog module always receives a clean and stable clock signal, avoiding false resets or system logic disorder caused by glitches.

[0022] When the first branch provides the clock to the watchdog module, the second branch is in a background standby state, and vice versa. During this process, the watchdog module always has one and only one branch continuously providing it with an uninterrupted clock, eliminating the need for pausing and restarting monitoring as in traditional solutions, thus achieving seamless switching. By having a hardware controller independent of the main processor directly send source selection, enable, and branch selection signals, deep physical and logical isolation is achieved. This ensures that even if the main processor experiences extreme conditions such as crashes, freezes, or register corruption, the watchdog module can still obtain the correct reference clock and maintain system reset capability, greatly improving the fault tolerance and security level of the entire chip system.

[0023] In one embodiment of this application, such as Figure 2 As shown, each branch also includes a frequency divider circuit (a first frequency divider circuit and a second frequency divider circuit).

[0024] The frequency divider circuit is connected between the output of the isolation circuit and the input of the glitch-free selector, and is used to divide the clock signal.

[0025] The system clock provided by the processor is typically very high-frequency, while the watchdog timer module's counting period is usually in the millisecond or microsecond range, making it impossible to directly use a high-frequency clock for counting. The function of the frequency divider circuit is to down-convert the high-frequency input reference clock to a low-frequency clock signal suitable for the watchdog timer module's counting requirements. The frequency divider circuit preferably uses a synchronous divider composed of a synchronous counter and comparison logic. The synchronous counter is uniformly driven by the clock signal of its branch, and the clock edges of each stage of the flip-flops are aligned, thus avoiding propagation delay and jitter accumulated at each stage. Furthermore, the synchronous divider has a status bit to indicate whether the division ratio update is complete, which can be read by the hardware controller. In applications where clock accuracy and jitter requirements are not high, the frequency divider circuit can also use a binary counter composed of asynchronous cascaded D flip-flops, with the division ratio configured by the hardware controller to achieve a fixed-rate down-conversion.

[0026] Placing the frequency divider circuit after the isolation circuit means that the frequency divider receives a clean, glitch-free signal. If the frequency divider were placed before the isolation circuit, glitches from the front-end switching might trigger erroneous toggling of the internal counter, leading to malfunctions in the divided output logic. Isolating before dividing fundamentally avoids this potential problem. Placing the frequency divider circuit before the glitch-free selector means that the two clock signals received by the glitch-free selector are already down-clocked and stable clocks with the same frequency. This gives the glitch-free selector at the end more timing margin when handling two-to-one switching.

[0027] By adding a frequency divider circuit between the isolation circuit and the glitch-free selector in each branch, a more accurate watchdog reference clock configuration can be achieved. By placing the frequency divider circuit after the isolation circuit and before the glitch-free selector, the input signal of the frequency divider circuit is physically filtered by the isolation circuit, completely isolating the glitches generated during switching of the front-end multiplexer. This avoids output frequency errors caused by glitches triggering erroneous toggling of the internal counter of the frequency divider, further ensuring the accuracy and reliability of the down-frequency output.

[0028] In one embodiment of this application, the frequency divider circuit is a prescaler.

[0029] A prescaler typically refers to a primary down-division module located at the front end of the clock distribution chain, possessing high-speed response capabilities. Compared to a general-purpose frequency divider with arbitrarily programmable ratios, the division ratio of a prescaler is selected from a limited number of discrete levels. For example, it can be selected from eight levels using a 3-bit division parameter. The corresponding division ratio is the value of the division parameter plus one; that is, when the division parameter is 0 to 7, the division ratio is 1 to 8 respectively. Therefore, its circuit structure is extremely simple, with fewer stages, and it can handle extremely high input clock frequencies. Implementing the frequency divider circuit as a prescaler better adapts to high-frequency reference source scenarios and completes down-division within a very short delay, ensuring that the clock signal has a suitable and stable frequency before reaching the glitch-free selector.

[0030] The prescaler can be replaced by a cascaded flip-flop divider chain, or a complex frequency modulation circuit. For example, a pure hardware frequency divider network consisting of multiple cascaded D flip-flops, such as a divide-by-two or divide-by-four network, a fractional divider, or a clock pulse extraction circuit.

[0031] Because the prescaler has extremely high frequency response characteristics and minimal circuit delay, it can quickly and stably perform initial frequency reduction on clean high-frequency clock signals from the isolation circuit, providing a pre-processed clock with moderate frequency and clear edges for the subsequent glitch-free selector.

[0032] In one embodiment of this application, the reference source selection circuit is a multiplexer.

[0033] By implementing the front-end reference source selection circuit as a multiplexer, hardware implementation costs and clock transmission quality can be further optimized. Although voltage glitches are inevitably generated when the multiplexer switches between different phase clock sources, this system uses isolation circuits to physically block these glitches, limiting them to the front end of a specific branch and preventing them from propagating to subsequent stages. Thus, high-performance multi-source selection can be achieved using a standard multiplexer without additional glitch-free logic.

[0034] The multiplexer can also be replaced by a tri-state gate array, a transmission gate array, or a pure combinational logic network, etc.

[0035] In one embodiment of this application, the isolation circuit is a clock gating unit.

[0036] The clock gating unit preferably includes an enable signal latch and an AND gate. The enable signal latch samples the enable signal during the period when the clock signal is at an invalid level to avoid the enable signal's own toggling introducing narrow pulses at the output. When the hardware controller sends an invalid enable signal to the clock gating unit, its internal AND gate is directly forced low, and the output will remain constant at a low level, completely cutting off the backward propagation of the clock pulse. Even if a small voltage glitch occurs during the switching of the front-end multiplexer, as long as the enable signal is low, these glitches will absolutely not be able to cross the logic barrier of the AND gate.

[0037] The clock gating unit can be replaced by a basic logic gate isolation circuit, a high-impedance isolation circuit, or a latch with enable control, etc.

[0038] In one embodiment of this application, the glitch-free selector is a 2-to-1 glitch-free multiplexer.

[0039] Traditional multi-input glitch-free multiplexers (such as 8-to-1 and 16-to-1) require highly complex internal synchronous arbitration logic to handle phase differences between different sources, resulting in a large number of gate circuits stacked along the path and a significant increase in clock delay. This application's embodiment simplifies the complex wide-angle gating to a one-to-one handover at the end using a dual-branch ping-pong structure. The internal logic depth of the 2-to-1 glitch-free multiplexer is extremely small, thus ensuring that the final handover process introduces almost no additional delay, maximizing the preservation of the clock signal's high precision and low jitter characteristics.

[0040] Specifically, each of the two input terminals of the 2-to-1 glitch-free multiplexer is equipped with a synchronous flip-flop chain. Each synchronous flip-flop chain is driven by the clock signal of the other input terminal. The outputs of the two synchronous flip-flop chains are cross-feedback to the input logic of the other, and control the AND gate of their respective channels. Thus, the 2-to-1 glitch-free multiplexer completes the switching in a first-off-then-on manner. That is, the AND gate of the other channel is only opened after it is confirmed that the currently conducting channel has been turned off. Therefore, at most one clock signal can be conducted to the output terminal at any given time, and the turning-on and turning-off actions both occur during the period when the corresponding clock signal is at an invalid level, avoiding the formation of narrow pulses at the output terminal.

[0041] It should be noted that the glitch-free 2-to-1 multiplexer can also adopt other circuit forms that can realize the first-to-break and then-to-connect, such as a handshake switching circuit controlled by a state machine, or an interlocking switching circuit composed of latches and gate circuits.

[0042] In one embodiment of this application, a hardware controller is configured to output an enable signal indicating invalidity to the isolation circuit of the target branch to disable the isolation circuit; output a source selection signal to the reference source selection circuit of the target branch; output an enable signal indicating validity to the isolation circuit of the target branch to enable the isolation circuit; determine whether the output of the target branch meets a preset stability condition, and if so, output a branch selection signal to a glitch-free selector; wherein the target branch is a first branch or a second branch.

[0043] The first step in the switching process by the hardware controller is to physically shut down the target branch. The hardware controller sends an invalid enable signal to the isolation circuit of the target branch, forcing the isolation circuit into a blocking state. Specifically, the hardware controller sets its corresponding control register to 0 and hardwires a low-level signal to the enable pin of the clock gating unit. Upon receiving the low-level signal, the clock gating unit's output is forcibly locked to a low level.

[0044] Since the isolation circuit of the target branch has been turned off, any cross-clock domain glitches, pulse defects, or phase conflicts generated by the front-end multiplexer during source switching are completely blocked at the front end of the isolation circuit and will not affect the subsequent circuits.

[0045] The hardware controller sends a valid enable signal to the isolation circuit of the target branch to remove the physical blockage and allow the selected reference clock to enter the subsequent stage.

[0046] After activating the isolation circuit, the hardware controller does not switch immediately. Instead, it waits for the output of the target branch to reach a stable state. Only after stability is confirmed does it issue a branch selection signal, driving the glitch-free selector at the end to complete the handover. After receiving the clock signal again, the internal counter of the frequency divider circuit needs several cycles to fully synchronize and generate a stable output frequency. If the hardware controller switches the glitch-free selector directly without waiting for the frequency divider to stabilize, the watchdog module will receive an unstable frequency or phase-disordered clock momentarily, leading to counting errors.

[0047] More specifically, the 2-to-1 glitch-free multiplexer relies on the edges of the two input clocks to complete the handshake of disconnection before connection. If the branch selection signal is switched before the target branch's clock has actually started oscillating—for example, if the target branch's isolation circuit is not yet turned on, the reference source is not yet selected, or the output of the frequency divider circuit remains at a static level—the handshake process cannot proceed. The output of the glitch-free selector will stop toggling, the watchdog module will lose its clock and be unable to count, thus losing its monitoring capability or triggering a false reset. Therefore, it is a necessary step in the embodiments of this application for the hardware controller to turn on the target branch's isolation circuit and confirm that the target branch's output is running and has reached stability before switching the branch selection signal.

[0048] Accordingly, in one embodiment of this application, before the hardware controller outputs the branch selection signal to the glitch-free selector, it also detects the activity of the clock signal output by the target branch. That is, it counts the number of level transitions of the clock signal by a counter. Only when a preset number of level transitions (e.g., at least 3 times) are counted is it determined that the clock of the branch has actually started oscillating and the branch selection signal is output. If the preset number of level transitions are not counted within the preset timeout period, the current switch is abandoned and the current branch continues to provide the clock for the watchdog module.

[0049] In one embodiment of this application, the stability condition includes: the status bit of the frequency divider circuit in the target branch indicates that it is not busy.

[0050] When the frequency divider circuit receives the newly configured division factor and input clock and starts working, the hardware controller does not blindly wait for a fixed period of time. Instead, it actively polls or captures the physical level signal of the internal status register of the frequency divider circuit through a hardware state machine. Only after clearly determining that the status bit has changed from busy to non-busy will it finally trigger the final-stage glitch-free selector to switch. This precise synchronization mechanism based on physical feedback effectively avoids the hidden danger of sending a spurious clock to the glitch-free selector due to output instability during the frequency divider relocking period, further ensuring the accuracy of the clock phase and frequency of the final output to the watchdog module.

[0051] In one embodiment of this application, after the hardware controller outputs a valid enable signal to the isolation circuit of the target branch and before outputting a branch selection signal to the glitch-free selector, it outputs a frequency division parameter to the frequency division circuit of the target branch and a reset signal to the frequency division circuit to return the counter of the frequency division circuit to its initial state. This is because during the isolation circuit's off period, the counter of the frequency division circuit remains at the residual count value at the moment of off. If it is not reset and starts counting again, the width of the first clock pulse output after restarting may be less than a complete frequency division cycle, forming a distorted pulse. By resetting the counter while configuring the frequency division parameter, it can be ensured that each pulse output after restarting is a complete cycle.

[0052] In one embodiment of this application, the hardware controller includes a finite state machine and a configuration register. The finite state machine progresses state by state in the following order: turning off the target branch isolation circuit, switching the target branch reference source, turning on the target branch isolation circuit, configuring the frequency division parameters and determining the stability condition, and switching the branch selection signal. The transition of each state is conditional upon the completion flag or state bit feedback of the previous state. The configuration register is used to store the target reference source number and the target frequency division parameters.

[0053] The switching request from the hardware controller originates from the clock management unit of the chip containing the processor. When the clock management unit switches the processor's core clock source, it synchronously sends a switching request carrying the target reference source number to the hardware controller, causing the watchdog module's reference source to automatically follow the processor's clock changes. After receiving the request, the hardware controller automatically advances the aforementioned state machine, without accepting direct writes from the processor to the steps in the above sequence. Therefore, even if the processor is in a runaway, crashed, or malfunctioning register state, it cannot interfere with or interrupt the switching sequence.

[0054] In one embodiment of this application, the enable signal of the isolation circuit is issued by the hardware controller. This enable signal belongs to a different clock domain than the clock signal of the branch it inhabits. Therefore, the enable signal needs to be synchronized in the clock domain of the branch it inhabits before it becomes effective. To this end, the isolation circuit also outputs an enable status bit to indicate whether the enable signal has become effective in the clock domain of the branch it inhabits. After changing the enable signal, the hardware controller first reads the enable status bit to confirm that the change has taken effect before proceeding to the next state. Specifically, after outputting an invalid enable signal, the hardware controller first confirms that the invalid enable signal has become effective in the clock domain of the target branch and that the isolation circuit has indeed entered the blocking state before outputting a source selection signal to switch the reference source. Otherwise, if the reference source is switched before the invalid enable signal becomes effective, the glitches generated at the moment of switching may still propagate to the subsequent stage through the still-operational isolation circuit. Similarly, after outputting a valid enable signal, the hardware controller also first confirms that the valid enable signal has taken effect before configuring the frequency division parameters and determining the stability condition.

[0055] See attached document Figure 3 This application provides a reference source switching system. The system employs a dual-branch symmetrical ping-pong architecture, mainly including the first branch (Path A, Figure 3 The upper part), the second branch (Path B, Figure 3 The lower half), and the burr-free selector at the end, wherein the hardware controller is in Figure 3 Not shown, its control terminals are respectively connected to the selection control terminals of the first multiplexer and the second multiplexer, the enable terminals of the first clock gating unit and the second clock gating unit, the configuration terminals of the first prescaler and the second prescaler, and the control terminal of the glitch-free selector, and are connected to the status bit output of the first prescaler and the second prescaler to read the frequency division configuration status.

[0056] The first branch includes a first multiplexer (MUX), a first clock gating unit (CG), and a first prescaler (pre_div_a) connected in series.

[0057] The multiple inputs of the first multiplexer are connected to multiple reference clock sources (such as...). Figure 3 As shown, clk_in0 to clk_in7 are a total of 8 reference sources. This multiplexer is controlled by the first source selection signal (CLK_SRC_SEL_A) issued by the hardware controller, which is used to select one clock signal from the multiple reference sources for output.

[0058] The input of the first clock gating unit is connected to the output of the first multiplexer, and its control terminal is used to receive the first enable signal (CG_EN_A) issued by the hardware controller. When the first enable signal is valid, CG is turned on, allowing the first branch front-end clock signal to pass through; when the first enable signal is invalid, CG forces a low level output, physically and completely blocking the transmission of the previous stage signal to the next stage.

[0059] The input of the first prescaler (pre_div_a) is connected to the output of the first CG, and its configuration terminal receives the first division parameter (PRE_DIV_NUM_A[2:0]) sent by the hardware controller. The first prescaler performs down-division processing on the input clock according to the division parameter and outputs the final first branch clock signal.

[0060] The circuit structure of the second branch is completely symmetrical to that of the first branch, serving as a system redundancy or hot backup branch.

[0061] It includes a second multiplexer that is controlled by a second source selection signal (CLK_SRC_SEL_B) to select one clock from clk_in0 to clk_in7.

[0062] The output of the second multiplexer is isolated by the second clock gating unit, and the second CG is controlled by the second enable signal (CG_EN_B).

[0063] The output of the second CG is connected to the second prescaler (pre_div_b), which receives the second division parameters (PRE_DIV_NUM_B[2:0]) sent by the hardware controller, performs the division process, and outputs the second branch clock signal.

[0064] The glitch-free selector is a 2-to-1 glitch-free multiplexer. Its first input is connected to the output of the prescaler (pre_div_a) in the first branch, and its second input is connected to the output of the prescaler (pre_div_b) in the second branch. Its control terminal receives the branch selection signal (A_B_SEL) sent by the hardware controller. The output of the 2-to-1 glitch-free multiplexer is used to connect to the watchdog module of the application processor.

[0065] In actual operation, assuming the system is currently clocked by the first branch, the hardware controller needs to switch the reference source to the target reference source of the second branch. The system will then perform the following steps: The hardware controller first invalidates the second enable signal (CG_EN_B) (e.g., sets it to 0), shuts down the second clock gating unit, and physically disconnects the front and rear stage connections of the second branch.

[0066] With the CG disabled, the hardware controller sends the CLK_SRC_SEL_B signal of the target reference source to the second multiplexer to complete the front-end clock source switching.

[0067] After the multiplexer selection stabilizes, the hardware controller sets CG_EN_B to active, turns on the second CG, and the stable target clock enters the second prescaler.

[0068] The hardware controller writes the target frequency division value to PRE_DIV_NUM_B[2:0]. According to this embodiment, the prescaler will generate a brief synchronization state after configuration. The hardware controller will automatically poll the status bit inside the second prescaler. When the status bit indicates that it is not busy, it means that the prescaler output clock of the second branch has been completely stabilized.

[0069] After confirming that the target branch signal is stable, the hardware controller switches the final branch selection signal A_B_SEL from the current state to the target state. At this time, the glitch-free 2-to-1 multiplexer smoothly and seamlessly transfers the reference clock from the first branch to the second branch.

[0070] like Figure 4 As shown, this application provides a reference source switching method based on any of the above embodiments of the reference source switching system. The method includes: Step 401: The hardware controller outputs an enable signal indicating invalidity to the isolation circuit of the target branch.

[0071] Before configuring any front-end components of the target branch, the path behind the target branch is first completely cut off by physical signals. This physically blocks the isolation circuit of the target branch, establishing an isolated environment for the subsequent routing operation that will inevitably produce glitches.

[0072] Step 402: When the isolation circuit receives an enable signal indicating invalidity, it blocks the output of the clock signal.

[0073] As a physical valve, the isolation circuit, when closed, will not cause any change in the subsequent stage even if the front-end signal is in a state of high-frequency fluctuation.

[0074] Step 403: The hardware controller outputs a source selection signal to the reference source selection circuit of the target branch.

[0075] The hardware controller sends a multi-bit binary code to the ordinary multiplexer of the target branch via a bus or dedicated control line. The multiplexer internally performs the physical switching of the multiplexer based on this code, but because the CG is off, the glitches cannot cross the CG.

[0076] Step 404: The reference source selection circuit selects one clock signal from multiple reference sources according to the source selection signal and outputs it to the isolation circuit of the branch.

[0077] Step 405: The hardware controller outputs a valid enable signal to the isolation circuit of the target branch.

[0078] The front-end reference source selection has been switched, the internal logic is stable, and no new glitches are generated. The hardware controller now issues a valid enable signal, which is equivalent to opening a safety valve to allow the stable target clock signal to enter the subsequent stage of the target branch.

[0079] Step 406: When the isolation circuit receives an enable signal indicating that it is valid, it outputs the received clock signal to the input terminal of the glitch-free selector corresponding to the target branch.

[0080] The system has two branches in the following states: the original working branch (such as branch A) is providing a clock to the watchdog timer, and the target branch (such as branch B) has been turned on and selected. The hardware controller is about to switch between the two ready inputs.

[0081] Step 407: The hardware controller outputs a branch selection signal to the glitch-free selector.

[0082] Since the front-end routing and valve opening have already been completed, the timing control of the hardware ensures that when the glitch-free selector makes its final switch, its input has already received a stable target branch clock signal.

[0083] Step 408: The glitch-free selector outputs the clock signal of the input terminal corresponding to the target branch to the watchdog module according to the branch selection signal.

[0084] This method effectively filters out glitches generated during front-end multiplexer switching by using the physical blocking function of isolation circuits when switching the front-end reference source, ensuring the purity of the clock signal received by the subsequent watchdog module. Simultaneously, after confirming the target branch signal is ready, a smooth handover is performed using a glitch-free 2-to-1 multiplexer at the end, ensuring uninterrupted watchdog clock operation throughout the switching process and achieving real-time monitoring with zero blind spots. Furthermore, the entire switching sequence is executed autonomously by a hardware controller independent of the main processor, without any software intervention. Even if the main processor experiences extreme failures such as runaway or deadlock, this hardware control process can still independently complete the reference source switching, ensuring the watchdog module always has system reset capability, greatly improving the fault tolerance and functional safety level of the chip system.

[0085] In one embodiment of this application, after outputting the received clock signal to the input terminal of the glitch-free selector corresponding to the target branch, and before the hardware controller outputs the branch selection signal to the glitch-free selector, the method further includes: The hardware controller determines whether the output of the target branch meets the preset stability conditions. If so, it executes the output of the branch selection signal to the glitch-free selector.

[0086] The frequency divider circuit has an internal status register bit indicating whether its output is busy or unlocked. The hardware controller polls this status bit via a physical connection. When the status bit changes from busy to non-busy, the stability condition is considered met. If there is no feedback status bit in the target branch, the hardware controller internally configures a fixed-period delay counter. The hardware controller starts this counter after enabling the target branch's clock cycle (CG) and waits for a preset number of clock cycles sufficient to cover the frequency divider's stability. After the count is complete, the stability condition is considered met, and then the branch selection signal is sent. For branches configured with high-performance frequency dividers or phase-locked loops (PLLs), the hardware controller receives the phase-locked signal directly via a physical line and uses the rising edge or high-level active state of this lock signal as the basis for determining whether the stability condition has been met.

[0087] This closed-loop feedback verification mechanism effectively ensures that the clock signal received at the target input of the glitch-free selector that performs the final handover has undergone sufficient stabilization time, thus avoiding the occurrence of unstable abnormal pulses received by the subsequent watchdog module due to the transition state at the moment of frequency divider resynchronization or circuit opening.

[0088] The aforementioned reference source switching system can be applied to embodied intelligent platforms. In embodied intelligent robots, when the main processor malfunctions due to high-load computing or electromagnetic interference, the watchdog module based on this solution can still autonomously switch the reference source without software intervention by utilizing independent underlying hardware logic. This eliminates the risk of synchronization failure caused by processor paralysis, thus providing hardware-level reliability assurance for the robot to perform emergency stops or enforce safe states.

[0089] In this application, "vehicle" can refer to "automobile," "vehicle," or "complete vehicle," or other similar terms, including general motor vehicles such as sedans, SUVs, MPVs, buses, trucks, and other freight or passenger vehicles; water transport vehicles including various boats and vessels; and aircraft, including hybrid vehicles, electric vehicles, gasoline vehicles, plug-in hybrid vehicles, fuel cell vehicles, and other alternative fuel vehicles. Hybrid vehicles refer to vehicles with two or more power sources, and electric vehicles include pure electric vehicles and range-extended electric vehicles; this application does not specifically limit their use.

[0090] It should be understood that in the embodiments of this application, the processor may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0091] It should also be understood that the memory mentioned in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Specifically, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0092] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, the memory (storage module) is integrated into the processor.

[0093] It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

[0094] In addition to the data bus, this bus may also include a power bus, a control bus, and a status signal bus. However, for clarity, all buses are labeled "bus" in the diagram.

[0095] It should also be understood that the first, second, third, fourth and various numerical designations used herein are merely for descriptive convenience and are not intended to limit the scope of this application.

[0096] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0097] In implementation, each step of the above method is completed through hardware logic circuits. Specifically, the reference source switching timing of this application is implemented by hardware logic circuits in a hardware controller independent of the processor, and is not implemented by the processor executing software instructions, so that the timing can still be fully executed when the processor fails.

[0098] In implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software. The steps of the method disclosed in the embodiments of this application can be directly implemented by a hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0099] In the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0100] Those skilled in the art will recognize that the various illustrative logical blocks (ILBs) and steps described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0102] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0103] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A reference source switching system, characterized in that, include: First branch, second branch, burr-free selector and hardware controller; Each branch includes: a reference source selection circuit and an isolation circuit; The reference source selection circuit has an input terminal connected to multiple reference sources and a control terminal connected to the hardware controller. It is used to select a clock signal from the multiple reference sources according to the source selection signal sent by the hardware controller and output it to the isolation circuit of the branch. The isolation circuit has its input terminal connected to the output terminal of the reference source selection circuit of the branch it is in, and its control terminal connected to the hardware controller. When it receives an enable signal from the hardware controller that indicates a valid signal, it outputs the clock signal to the corresponding input terminal of the glitch-free selector. When it receives an enable signal from the hardware controller that indicates an invalid signal, it blocks the output of the clock signal. The glitch-free selector has a first input terminal connected to the output terminal of the isolation circuit in the first branch, a second input terminal connected to the output terminal of the isolation circuit in the second branch, an output terminal connected to a watchdog module, and a control terminal connected to the hardware controller. It is used to switch between the first input terminal and the second input terminal according to the branch selection signal sent by the hardware controller, and output the clock signal of the selected input terminal to the watchdog module.

2. The system as described in claim 1, characterized in that, Each branch also includes: a frequency divider circuit; The frequency divider circuit is connected between the output of the isolation circuit and the input of the glitch-free selector, and is used to perform frequency division processing on the clock signal.

3. The system as described in claim 2, characterized in that, The frequency divider circuit is a prescaler.

4. The system as described in claim 1, characterized in that, The reference source selection circuit is a multiplexer.

5. The system as described in claim 1, characterized in that, The isolation circuit is a clock gating unit.

6. The system as described in claim 1, characterized in that, The burr-free selector is a 2-to-1 burr-free multiplexer.

7. The system as described in claim 2, characterized in that, The hardware controller is configured to output an enable signal indicating invalidity to the isolation circuit of the target branch to disable the isolation circuit; output a source selection signal to the reference source selection circuit of the target branch; and output an enable signal indicating validity to the isolation circuit of the target branch to enable the isolation circuit. Determine whether the output of the target branch meets the preset stability condition. If so, output the branch selection signal to the glitch-free selector; wherein the target branch is the first branch or the second branch.

8. The system as described in claim 7, characterized in that, in, The stability condition includes: the status bit of the frequency divider circuit in the target branch indicates that it is not busy.

9. A reference source switching method, characterized in that, Based on the reference source switching system according to any one of claims 1-8, the method includes: The hardware controller outputs an enable signal indicating invalidity to the isolation circuit of the target branch; The isolation circuit blocks the output of the clock signal when it receives an enable signal that indicates invalidity. The hardware controller outputs a source selection signal to the reference source selection circuit of the target branch; The reference source selection circuit selects one clock signal from multiple reference sources according to the source selection signal and outputs it to the isolation circuit of the branch. The hardware controller outputs a valid enable signal to the isolation circuit of the target branch; When the isolation circuit receives an enable signal indicating validity, it outputs the received clock signal to the input terminal of the glitch-free selector corresponding to the target branch. The hardware controller outputs a branch selection signal to the burr-free selector; The glitch-free selector outputs the clock signal of the input terminal corresponding to the target branch to the watchdog module according to the branch selection signal.

10. The method as described in claim 9, characterized in that, After outputting the received clock signal to the input terminal of the glitch-free selector corresponding to the target branch, and before the hardware controller outputs a branch selection signal to the glitch-free selector, the method further includes: The hardware controller determines whether the output of the target branch meets the preset stability condition. If so, it executes the step of outputting a branch selection signal to the glitch-free selector.

Images