Clock redundancy system and vehicle
By employing a triple-modal redundancy structure and a majority voting mechanism in the hardware fault-tolerant control unit, the reliability and MTBF issues caused by software dependence in existing clock redundancy technologies are resolved, enabling fast and reliable clock signal output that meets industrial real-time requirements.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Utility models(China)
- Current Assignee / Owner
- SHANGHAI XIAOPENG MOTORS TECH CO LTD
- Filing Date
- 2025-05-19
- Publication Date
- 2026-06-09
AI Technical Summary
Existing clock redundancy technologies rely on software configuration parameters, which pose a risk of software errors or memory failures, affecting clock reliability and MTBF time.
It adopts a triple redundancy structure, selects the normal clock signal through a majority voting mechanism using a hardware fault-tolerant control unit, and uses a hardware switch output to avoid software configuration and achieve rapid fault switching.
It improves the reliability and anti-interference capability of the clock signal, enables rapid fault switching, increases the mean time between failures (MTBF), and meets industrial real-time requirements.
Smart Images
Figure CN224341827U_ABST
Abstract
Description
Technical Field
[0001] This utility model relates to the field of clock circuit technology, specifically to clock redundancy systems and vehicles. Background Technology
[0002] Clock redundancy can effectively ensure the reliability, fault tolerance and stability of the system, which is crucial for vehicle systems, aerospace equipment and other applications with high real-time requirements.
[0003] Current clock redundancy technologies mostly employ a dual-clock driver architecture, but this relies on fixed configuration parameters for anomaly detection. The detection logic needs to be implemented through software configuration parameters, which carries the risk of software errors or memory failures. Furthermore, this software-controlled clock selection extends the MTBF (Mean Time Between Failure) and affects clock reliability. Utility Model Content
[0004] In view of this, the present invention provides a clock redundancy system and vehicle to solve the problem of poor reliability of existing clock systems.
[0005] In a first aspect, this utility model provides a clock redundancy system, including: a first clock driver, a second clock driver, a third clock driver, a hardware fault-tolerant control unit, and a hardware switch;
[0006] The first clock driver is connected to the hardware fault-tolerant control unit and the hardware switch, and is used to output the first clock signal;
[0007] The second clock driver is connected to the hardware fault-tolerant control unit and the hardware switch, and is used to output a second clock signal;
[0008] The third clock driver is connected to the hardware fault-tolerant control unit and the hardware switch, and is used to output a third clock signal;
[0009] The hardware fault-tolerant control unit is used to determine, according to a majority voting mechanism, a selection signal for selecting a normal clock signal from the first clock signal, the second clock signal, and the third clock signal;
[0010] The hardware switch is connected to the hardware fault-tolerant control unit and is used to output a corresponding normal clock signal according to the selection signal.
[0011] In some alternative implementations, the hardware fault-tolerant control unit includes: a clock counter, a phase comparator, and a redundant arbitrator;
[0012] The clock counter is connected to the first clock driver, the second clock driver, and the third clock driver, and is used to count the clock signals of the first clock signal, the second clock signal, and the third clock signal respectively, and determine the corresponding counting and voting results according to the majority voting mechanism.
[0013] The phase comparator is connected to the first clock driver, the second clock driver, and the third clock driver, and is used to compare the first clock signal, the second clock signal, and the third clock signal pairwise to determine the clock phase difference, and to determine the corresponding phase voting result according to the majority voting mechanism;
[0014] The redundant arbitrator is connected to the clock counter and the phase comparator, and is used to determine a selection signal for selecting the normal clock signal from the first clock signal, the second clock signal, and the third clock signal based on the counting voting result and the phase voting result.
[0015] In some alternative implementations, the clock counter includes: a first counter, a second counter, a third counter, and a first majority voter;
[0016] The first counter is connected to the first clock driver and is used to determine the first count value corresponding to the first clock signal;
[0017] The second counter is connected to the first clock driver and is used to determine the second count value corresponding to the second clock signal;
[0018] The third counter is connected to the first clock driver and is used to determine the third count value corresponding to the third clock signal;
[0019] The first majority voter is connected to the first counter, the second counter, and the third counter, and is used to perform majority voting on the first count value, the second count value, and the third count value to determine the corresponding counting and voting result.
[0020] In some alternative implementations, the phase comparator includes: a first comparator, a second comparator, a third comparator, and a second majority voter;
[0021] The first comparator is connected to the first clock driver and the second clock driver, and is used to compare the phase difference between the first clock signal and the second clock signal to determine the first phase comparison result;
[0022] The second comparator is connected to the second clock driver and the third clock driver, and is used to compare the phase difference between the second clock signal and the third clock signal to determine the second phase comparison result;
[0023] The third comparator is connected to the third clock driver and the first clock driver, and is used to compare the phase difference between the third clock signal and the first clock signal to determine the third phase comparison result;
[0024] The second majority voter is connected to the first comparator, the second comparator, and the third comparator, and is used to perform majority voting on the first phase comparison result, the second phase comparison result, and the third phase comparison result to determine the corresponding phase voting result.
[0025] In some optional implementations, the first comparator is used to determine a first phase difference between the first clock signal and the second clock signal, and compare the first phase difference with a phase difference threshold to generate a first phase comparison result; the first phase comparison result indicates whether the first phase difference is less than the phase difference threshold.
[0026] The second comparator is used to determine the second phase difference between the second clock signal and the third clock signal, and compare the second phase difference with a phase difference threshold to generate a second phase comparison result; the second phase comparison result indicates whether the second phase difference is less than the phase difference threshold.
[0027] The third comparator is used to determine the third phase difference between the third clock signal and the first clock signal, and compare the third phase difference with a phase difference threshold to generate a third phase comparison result; the third phase comparison result indicates whether the third phase difference is less than the phase difference threshold.
[0028] In some alternative implementations, the clock redundancy system further includes: an electronic fuse;
[0029] The electronic fuse is used to solidify the phase difference threshold.
[0030] In some optional implementations, the first comparator, the second comparator, and the third comparator each include a corresponding digital phase-locked loop;
[0031] Each digital phase-locked loop is used to compare the phase difference between two input clock signals and output a voltage signal corresponding to the phase difference.
[0032] In some alternative implementations, the hardware switch is a switch matrix formed based on electronic switches.
[0033] In some alternative implementations, the inputs of the first clock driver, the second clock driver, and the third clock driver are independent of each other.
[0034] Secondly, the present invention provides a vehicle comprising: a clock redundancy system according to the first aspect above or any corresponding embodiment thereof.
[0035] The clock redundancy system provided by this utility model achieves tri-modal redundancy of clock signals based on three clock drivers. A hardware fault-tolerant control unit performs majority voting to determine the normal clock signal and controls the conduction of hardware switches to output the normal clock signal. This clock redundancy system can greatly improve the reliability of clock signals and provide stable and reliable clock signals for back-end components. Furthermore, the detection and switching logic is fully hardware-based, requiring no software configuration, has strong anti-interference capabilities, and can quickly complete fault switching, greatly improving the mean time between failures (MTBF) and meeting industrial real-time requirements. Attached Figure Description
[0036] To more clearly illustrate the technical solutions in the specific embodiments or related technologies of this utility model, the drawings used in the description of the specific embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of this utility model. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0037] Figure 1 This is a schematic diagram of a clock redundancy system according to an embodiment of the present utility model;
[0038] Figure 2 This is a comparison curve of the recovery time of two faults according to an embodiment of the present utility model;
[0039] Figure 3 This is another structural schematic diagram of the clock redundancy system according to an embodiment of the present utility model;
[0040] Figure 4 This is a schematic diagram of the phase voting result according to an embodiment of the present utility model;
[0041] Figure 5 This is a schematic diagram of a clock counter according to an embodiment of the present utility model;
[0042] Figure 6 This is a schematic diagram of a phase comparator according to an embodiment of the present invention.
[0043] Explanation of reference numerals in the attached figures:
[0044] 10. First clock driver; 20. Second clock driver; 30. Third clock driver; 40. Hardware fault-tolerant control unit; 50. Hardware switch; 60. Electronic fuse; 41. Clock counter; 42. Phase comparator; 43. Redundant arbitrator; 411. First counter; 412. Second counter; 413. Third counter; 414. First majority voter; 421. First comparator; 422. Second comparator; 423. Third comparator; 424. Second majority voter. Detailed Implementation
[0045] To make the objectives, technical solutions, and advantages of the embodiments of this utility model clearer, the technical solutions of the embodiments of this utility model will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this utility model, not all embodiments. Based on the embodiments of this utility model, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this utility model.
[0046] In the description of this utility model, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this utility model, "a plurality of" means two or more, unless otherwise explicitly specified.
[0047] In this utility model, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this utility model according to the specific circumstances.
[0048] Furthermore, to better illustrate this utility model, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this utility model can be implemented even without certain specific details. In some instances, methods, means, and elements well-known to those skilled in the art have not been described in detail, in order to highlight the main points of this utility model.
[0049] Furthermore, the technical features involved in the different embodiments of this utility model described below can be combined with each other as long as they do not conflict with each other.
[0050] This utility model embodiment provides a clock redundancy system. Figure 1 This is a schematic diagram of one structure of the clock redundancy system, such as... Figure 1 As shown, the system includes: a first clock driver 10, a second clock driver 20, a third clock driver 30, a hardware fault-tolerant control unit 40, and a hardware switch 50.
[0051] The first clock driver 10 is connected to the hardware fault-tolerant control unit 40 and the hardware switch 50, and is used to output the first clock signal A. The second clock driver 20 is connected to the hardware fault-tolerant control unit 40 and the hardware switch 50, and is used to output the second clock signal B. The third clock driver 30 is connected to the hardware fault-tolerant control unit 40 and the hardware switch 50, and is used to output the third clock signal C.
[0052] The hardware fault-tolerant control unit 40 is used to determine, according to a majority voting mechanism, a selection signal for selecting a normal clock signal from the first clock signal A, the second clock signal B, and the third clock signal C.
[0053] The hardware switch 50 is connected to the hardware fault-tolerant control unit 40 and is used to output the corresponding normal clock signal according to the selection signal.
[0054] In this embodiment, the clock redundancy system is equipped with at least three clock drivers: a first clock driver 10, a second clock driver 20, and a third clock driver 30. Each clock driver generates a corresponding clock signal to provide a system clock for other backend devices. The clock drivers can provide clock signals with output frequencies up to 3.2 GHz to meet the clock requirements of different components. The reliability of the clock redundancy system is ensured by multiple redundant clock drivers. Since the probability of a single clock driver failing is extremely low, three clock drivers are generally sufficient. The use of a Triple Modular Redundancy (TMR) structure can prevent state flipping caused by cosmic rays.
[0055] Optionally, the inputs of the first clock driver 10, the second clock driver 20, and the third clock driver 30 are independent of each other. That is, each clock driver in the clock redundancy system is independent of each other, adopts a redundant supply source, and has no related input information between them, which can effectively avoid common cause failures.
[0056] The hardware fault-tolerant control unit 40 selects the normal clock signal through a majority voting mechanism, thereby achieving hardware fault tolerance. Specifically, as shown... Figure 1As shown, for the first clock signal A, the second clock signal B, and the third clock signal C output by the three clock drivers respectively, the hardware fault-tolerant control unit 40 performs a majority vote on these clock signals, and determines which one or more of the first clock signal A, the second clock signal B, and the third clock signal C are normal, thereby determining the normal clock signal.
[0057] Furthermore, the hardware fault-tolerant control unit 40 is used to control the working state of the hardware switch 50 and generate corresponding selection signals for different normal clock signals. Among them, the selection signal is used to select one clock signal from the first clock signal A, the second clock signal B, and the third clock signal C as the normal clock signal. Therefore, there are also three types of selection signals, namely, the first clock signal A, the second clock signal B, and the third clock signal C each correspond to one selection signal.
[0058] The hardware switch 50 can adaptively adjust its gating state according to the selection signal generated by the hardware fault-tolerant control unit 40, so as to output the normal clock signal among the first clock signal A, the second clock signal B, and the third clock signal C. The normal clock signal output by the hardware switch 50 can be provided to vehicles, switching chips, aviation equipment, etc., to provide them with a stable and reliable clock signal.
[0059] Among them, the hardware switch 50 can be a multiplexer. Alternatively, the hardware switch 50 can be a crossbar switch based on electronic switches, which can achieve glitch-free switching of the clock path, switching delay ≤10ns, nanosecond-level response, ensure seamless operation, and meet industrial real-time requirements.
[0060] It is understandable that if multiple clock signals are normal, only one needs to be used as the normal clock signal. For example, if all three clock signals are normal, any one of them can be chosen as the normal clock signal. Generally, one clock driver (e.g., the first clock driver 10) can be used as the master clock driver, and the other two clock drivers (e.g., the second clock driver 20 and the third clock driver 30) can be used as backup clock drivers. If the clock signal generated by the master clock driver is normal, then the clock signal generated by the master clock driver can be used as the normal clock signal. If the master clock driver fails, then the clock signal generated by the backup clock driver will be used.
[0061] Correspondingly, if the master clock driver does not fail, the selection signal generated by the hardware fault-tolerant control unit 40 remains unchanged, that is, the selection state of the hardware switch 50 remains unchanged; conversely, if the master clock driver fails, the selection signal generated by the hardware fault-tolerant control unit 40 changes accordingly, so that the selection state of the hardware switch 50 can be adaptively adjusted, and the clock signal of the backup clock driver is used as the normal clock signal and output to the outside.
[0062] In this embodiment, the hardware fault-tolerant control unit 40 can be implemented based on FPGA, completely replacing the software configuration mode in hardware, without software dependency. Figure 2 A graph comparing the fault recovery time of a traditional software redundancy method with the hardware redundancy method of the multi-clock driver in this embodiment is shown. Figure 2 As shown, if at t 故障 In the event of a fault, the clock redundancy system provided in this embodiment can respond quickly and complete fault recovery at time t1. 故障 The response time to t1 is approximately 2 μs (microseconds); however, traditional software solutions, due to the need to trigger interrupts, have a slower response time, and fault recovery can only be completed at a later time t2. 故障 The time to t2 is approximately 5 μs.
[0063] The clock redundancy system provided in this embodiment achieves tri-modal redundancy of the clock signal based on three clock drivers. The hardware fault-tolerant control unit 40 performs majority voting to determine the normal clock signal and controls the conduction of the hardware switch 50 to output the normal clock signal. This clock redundancy system can greatly improve the reliability of the clock signal and provide a stable and reliable clock signal for the back-end components. Furthermore, the detection and switching logic is fully hardware-based, requiring no software configuration, has strong anti-interference capabilities, and can quickly complete fault switching, greatly improving the mean time between failures (MTBF) and meeting industrial real-time requirements.
[0064] In some alternative implementations, the hardware fault-tolerant control unit 40 detects both the count and phase of the clock signal to determine a normal clock signal. Specifically, such as... Figure 3 As shown, the hardware fault-tolerant control unit 40 includes: a clock counter 41, a phase comparator 42, and a redundant arbitrator 43.
[0065] The clock counter 41 is connected to the first clock driver 10, the second clock driver 20, and the third clock driver 30. It is used to count the clock signals A, B, and C respectively, and to determine the corresponding counting and voting results according to the majority voting mechanism.
[0066] Phase comparator 42 is connected to the first clock driver 10, the second clock driver 20, and the third clock driver 30. It is used to compare the first clock signal A, the second clock signal B, and the third clock signal C in pairs to determine the clock phase difference, and to determine the corresponding phase voting result according to the majority voting mechanism.
[0067] The redundant arbitrator 43 is connected to the clock counter 41 and the phase comparator 42, and is used to determine the selection signal for selecting the normal clock signal from the first clock signal A, the second clock signal B, and the third clock signal C based on the counting and phase voting results.
[0068] In this embodiment, as Figure 3 As shown, the clock counter 41 is connected to the output terminals of the first clock driver 10, the second clock driver 20, and the third clock driver 30, thereby obtaining the first clock signal A, the second clock signal B, and the third clock signal C. Furthermore, for each clock signal, the clock counter 41 can count the clock signals separately, determine each counting result, and vote on each counting result according to the majority voting mechanism to determine the corresponding counting voting result.
[0069] The counting can be based on the rising or falling edge of the clock signal. The counting result can indicate whether the count results are the same, thereby determining whether the clock driver is normal or abnormal.
[0070] Similarly, phase comparator 42 is connected to the output terminals of the first clock driver 10, the second clock driver 20, and the third clock driver 30, thereby obtaining the first clock signal A, the second clock signal B, and the third clock signal C. The phase comparator 42 compares these clock signals pairwise to determine the corresponding phase difference. For example, it can determine the phase difference between the first clock signal A and the second clock signal B, and the phase difference between the second clock signal B and the third clock signal C.
[0071] Phase comparator 42 performs a majority vote on the phase difference of these clock signals, thereby determining the corresponding phase voting result, which can also indicate whether the clock driver has a normal phase or an abnormal phase.
[0072] Figure 4 A schematic diagram of the phase voting results is shown. For example... Figure 4 As shown, the phase difference between the first clock signal A and the second clock signal B is Δ1, which is relatively small; while the phase difference between the second clock signal B and the third clock signal C is Δ2, which is also relatively small (at this time, the phase difference between the first clock signal A and the third clock signal C is also relatively large). Therefore, it can be determined that the third clock signal C is abnormal and cannot be used as a normal clock signal.
[0073] Regarding the above counting and phase voting results, the redundant arbitrator 43 can comprehensively consider the two results and determine which of the first clock signal A, the second clock signal B, and the third clock signal C is the normal clock signal, thereby generating the corresponding selection signal.
[0074] For example, both the counting and phase voting results indicate which clock signals are abnormal. The redundant arbitrator 43 can comprehensively eliminate abnormal clock signals based on the counting and phase voting results, and finally select the clock signal with normal counting and phase. For example, if the counting of the first clock signal A is abnormal, and as... Figure 4 As shown, the phase difference between the third clock signal C and the first clock signal A and the second clock signal B is relatively large (the phase difference between the first clock signal A and the second clock signal B is relatively small), so the phase of the third clock signal C is abnormal. Therefore, the redundant arbitrator 43 can determine that the second clock signal B should be used as the normal clock signal at this time.
[0075] In this embodiment, the hardware fault-tolerant control unit 40 detects both the count and phase of the clock signal, and can select the optimal normal clock signal.
[0076] Optionally, such as Figure 5 As shown, the clock counter 41 includes: a first counter 411, a second counter 412, a third counter 413, and a first majority voter 414.
[0077] The first counter 411 is connected to the first clock driver 10 and is used to determine the first count value corresponding to the first clock signal A; the second counter 412 is connected to the first clock driver 10 and is used to determine the second count value corresponding to the second clock signal B; the third counter 413 is connected to the first clock driver 10 and is used to determine the third count value corresponding to the third clock signal C.
[0078] The first majority voter 414 is connected to the first counter 411, the second counter 412, and the third counter 413, and is used to perform majority voting on the first count value, the second count value, and the third count value to determine the corresponding counting and voting results.
[0079] In this embodiment, corresponding counters are set for the first clock signal A, the second clock signal B, and the third clock signal C, namely, the first counter 411, the second counter 412, and the third counter 413, respectively, to count the clock signals. These counters can be implemented based on flip-flops and registers; however, this embodiment does not limit the specific form of the counters.
[0080] The first majority voter 414 can perform a majority vote on the first count value, the second count value, and the third count value to determine which count value is abnormal. For example, if one of the count values is different from the other two, it can be determined that the former count value is abnormal. The first majority voter 414 can be implemented based on circuits such as XOR gates, and this embodiment does not limit it to this.
[0081] In this embodiment, multiple counters can count each clock signal separately without affecting each other; combined with the first majority voter 414, it can output the counting and voting results indicating which clock signal(s) are normal or abnormal, which facilitates subsequent comprehensive judgment.
[0082] Optionally, see Figure 6 As shown, the phase comparator 42 includes: a first comparator 421, a second comparator 422, a third comparator 423, and a second majority voter 424.
[0083] The first comparator 421 is connected to the first clock driver 10 and the second clock driver 20, and is used to compare the phase difference between the first clock signal A and the second clock signal B to determine the first phase comparison result; the second comparator 422 is connected to the second clock driver 20 and the third clock driver 30, and is used to compare the phase difference between the second clock signal B and the third clock signal C to determine the second phase comparison result; the third comparator 423 is connected to the third clock driver 30 and the first clock driver 10, and is used to compare the phase difference between the third clock signal C and the first clock signal A to determine the third phase comparison result.
[0084] The second majority voter 424 is connected to the first comparator 421, the second comparator 422, and the third comparator 423, and is used to perform majority voting on the first phase comparison result, the second phase comparison result, and the third phase comparison result to determine the corresponding phase voting result.
[0085] In this embodiment, the first comparator 421 can determine the phase difference between the first clock signal A and the second clock signal B, thereby obtaining the corresponding phase comparison result, that is, determining the first phase comparison result, which is related to the phase difference between the first clock signal A and the second clock signal B.
[0086] Similarly, the second comparator 422 can determine the phase difference between the second clock signal B and the third clock signal C, and thus generate the corresponding second phase comparison result; the third comparator 423 can determine the phase difference between the third clock signal C and the first clock signal A, and thus generate the corresponding third phase comparison result.
[0087] The first comparator 421, the second comparator 422, and the third comparator 423 each include a corresponding digital phase-locked loop (DPLL). Each DPLL is used to compare the phase difference between two input clock signals and output a voltage signal corresponding to the phase difference. For example, the DPLL in the first comparator 421 can compare the phases of the first clock signal A and the second clock signal B, and thus obtain the phase difference between the two as a voltage signal. Generally, the larger the phase difference, the higher the voltage value of the generated voltage signal.
[0088] Furthermore, similar to the first majority voter 414, the second majority voter 424 can also determine the corresponding phase voting result by performing a majority vote on the first phase comparison result, the second phase comparison result, and the third phase comparison result. The second majority voter 424 can also be implemented based on circuits such as XOR gates, and this embodiment does not limit it to this.
[0089] Optionally, each comparator, such as the first comparator 421, the second comparator 422, and the third comparator 423, generates a result indicating whether the clock signal is abnormal by comparing it with a preset phase difference threshold.
[0090] Specifically, the first comparator 421 is used to determine the first phase difference between the first clock signal A and the second clock signal B, and compare the first phase difference with a phase difference threshold to generate a first phase comparison result; the first phase comparison result indicates whether the first phase difference is less than the phase difference threshold.
[0091] The second comparator 422 is used to determine the second phase difference between the second clock signal B and the third clock signal C, and compare the second phase difference with a phase difference threshold to generate a second phase comparison result; the second phase comparison result indicates whether the second phase difference is less than the phase difference threshold.
[0092] The third comparator 423 is used to determine the third phase difference between the third clock signal C and the first clock signal A, and compare the third phase difference with the phase difference threshold to generate a third phase comparison result; the third phase comparison result indicates whether the third phase difference is less than the phase difference threshold.
[0093] In this embodiment, a phase difference threshold is preset. Optionally, such as... Figure 3 As shown, the clock redundancy system also includes an electronic fuse 60, which is used to fix the phase difference threshold. The phase difference threshold is configured once via the electronic fuse (eFuse), ensuring high reliability as the data is unaffected by external interference; furthermore, no external memory or dynamic configuration is required.
[0094] Taking the first comparator 421 as an example, after determining the first phase difference between the first clock signal A and the second clock signal B, it can compare the first phase difference with a phase difference threshold to generate a comparison result indicating whether the first phase difference is less than the phase difference threshold, i.e., the first phase comparison result.
[0095] For example, the voltage value corresponding to the phase difference threshold can be determined, and this voltage value can be used as the reference voltage of the operational amplifier. This voltage value is then compared with the voltage signal corresponding to the first phase difference, and the operational amplifier can output the corresponding first phase comparison result. This first phase comparison result only needs to indicate whether the first phase difference is less than the phase difference threshold; therefore, it can be represented by high or low levels. For example, a high level indicates that the first phase difference is greater than the phase difference threshold (an anomaly), and a low level indicates that the first phase difference is less than the phase difference threshold (normal).
[0096] The working principle of the other second comparators 422 and third comparators 423 is similar to that of the first comparator 421 mentioned above, and will not be described again here.
[0097] In this embodiment, each comparator outputs a phase comparison result indicating whether the phase difference is less than the phase difference threshold. This phase comparison result has only two states: yes and no. This allows the second majority voter 424 to easily determine which clock signal is abnormal based on the three phase comparison results, making it easy to achieve majority voting based on simple circuit results.
[0098] Based on the same concept, this embodiment also provides a vehicle, which includes any of the clock redundancy systems provided in the above embodiments. This vehicle also possesses the beneficial effects of the aforementioned clock redundancy systems, which will not be elaborated upon here.
[0099] Although embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations should all be covered within the protection scope of the present invention.
Claims
1. A clock redundancy system, characterized in that, include: The system comprises a first clock driver (10), a second clock driver (20), a third clock driver (30), a hardware fault-tolerant control unit (40), and a hardware switch (50). The first clock driver (10) is connected to the hardware fault-tolerant control unit (40) and the hardware switch (50) to output the first clock signal; The second clock driver (20) is connected to the hardware fault-tolerant control unit (40) and the hardware switch (50) and is used to output a second clock signal; The third clock driver (30) is connected to the hardware fault-tolerant control unit (40) and the hardware switch (50) and is used to output a third clock signal; The hardware fault-tolerant control unit (40) is used to determine, according to a majority voting mechanism, a selection signal for selecting a normal clock signal from the first clock signal, the second clock signal, and the third clock signal; The hardware switch (50) is connected to the hardware fault-tolerant control unit (40) and is used to output a corresponding normal clock signal according to the selection signal.
2. The clock redundancy system according to claim 1, characterized in that, The hardware fault-tolerant control unit (40) includes: a clock counter (41), a phase comparator (42), and a redundant arbitrator (43); The clock counter (41) is connected to the first clock driver (10), the second clock driver (20), and the third clock driver (30), and is used to count the clock signals of the first clock signal, the second clock signal, and the third clock signal respectively, and determine the corresponding counting and voting results according to the majority voting mechanism. The phase comparator (42) is connected to the first clock driver (10), the second clock driver (20), and the third clock driver (30), and is used to compare the first clock signal, the second clock signal, and the third clock signal pairwise to determine the clock phase difference, and to determine the corresponding phase voting result according to the majority voting mechanism; The redundant arbiter (43) is connected to the clock counter (41) and the phase comparator (42) and is used to determine the selection signal for selecting the normal clock signal from the first clock signal, the second clock signal and the third clock signal based on the counting voting result and the phase voting result.
3. The clock redundancy system according to claim 2, characterized in that, The clock counter (41) includes: a first counter (411), a second counter (412), a third counter (413), and a first majority voter (414); The first counter (411) is connected to the first clock driver (10) and is used to determine the first count value corresponding to the first clock signal; The second counter (412) is connected to the first clock driver (10) and is used to determine the second count value corresponding to the second clock signal; The third counter (413) is connected to the first clock driver (10) and is used to determine the third count value corresponding to the third clock signal; The first majority voter (414) is connected to the first counter (411), the second counter (412), and the third counter (413) and is used to perform majority voting on the first count value, the second count value, and the third count value to determine the corresponding counting and voting results.
4. The clock redundancy system according to claim 2, characterized in that, The phase comparator (42) includes: a first comparator (421), a second comparator (422), a third comparator (423), and a second majority voter (424); The first comparator (421) is connected to the first clock driver (10) and the second clock driver (20) and is used to compare the phase difference between the first clock signal and the second clock signal to determine the first phase comparison result; The second comparator (422) is connected to the second clock driver (20) and the third clock driver (30) and is used to compare the phase difference between the second clock signal and the third clock signal to determine the second phase comparison result; The third comparator (423) is connected to the third clock driver (30) and the first clock driver (10) and is used to compare the phase difference between the third clock signal and the first clock signal to determine the third phase comparison result; The second majority voter (424) is connected to the first comparator (421), the second comparator (422), and the third comparator (423) and is used to perform majority voting on the first phase comparison result, the second phase comparison result, and the third phase comparison result to determine the corresponding phase voting result.
5. The clock redundancy system according to claim 4, characterized in that, The first comparator (421) is used to determine the first phase difference between the first clock signal and the second clock signal, and compare the first phase difference with a phase difference threshold to generate a first phase comparison result; The first phase comparison result indicates whether the first phase difference is less than the phase difference threshold; The second comparator (422) is used to determine the second phase difference between the second clock signal and the third clock signal, and compare the second phase difference with a phase difference threshold to generate a second phase comparison result; The second phase comparison result indicates whether the second phase difference is less than the phase difference threshold; The third comparator (423) is used to determine the third phase difference between the third clock signal and the first clock signal, and compare the third phase difference with the phase difference threshold to generate a third phase comparison result; The third phase comparison result indicates whether the third phase difference is less than the phase difference threshold.
6. The clock redundancy system according to claim 5, characterized in that, The clock redundancy system also includes: an electronic fuse (60); The electronic fuse (60) is used to solidify the phase difference threshold.
7. The clock redundancy system according to claim 4, characterized in that, The first comparator (421), the second comparator (422), and the third comparator (423) each include a corresponding digital phase-locked loop; Each digital phase-locked loop is used to compare the phase difference between two input clock signals and output a voltage signal corresponding to the phase difference.
8. The clock redundancy system according to claim 1, characterized in that, The hardware switch (50) is a switch matrix formed based on electronic switches.
9. The clock redundancy system according to claim 1, characterized in that, The inputs of the first clock driver (10), the second clock driver (20), and the third clock driver (30) are independent of each other.
10. A vehicle, characterized in that, The vehicle includes: a clock redundancy system as described in any one of claims 1 to 9.