SYSTEMS AND METHODS FOR PROVIDING INTEGRATED SELF-TEST CORRECTION MEASURES DURING RUNTIME

Abstract

A computer system includes functionality to provide built-in self-test (BIST) management and corrective actions during runtime. A computer system can include multiple processor cores, with at least one of these processor cores dedicated to running BIST management and corrective software. While an application is running on one processor core, the other processor core dedicated to running BIST management and corrective software can initiate BIST operations and then perform corrective actions in response to the results of those operations.

Description

TECHNICAL AREA The present disclosure relates generally to computer systems, and in particular to systems and methods for providing built-in self-test (BIST) corrective actions during runtime in computer systems. BACKGROUND Safety protocols are used to ensure safety in electrical and / or electronic systems. For example, International Organization for Standardization (ISO) 26262 is an international standard for the functional safety of electrical and / or electronic systems in motor vehicles. Such safety protocols analyze the risk (for example, the combination of the frequency of occurrence and the severity of damage) associated with electronic faults. Faults related to electronics can be random or systematic. Random faults can correspond to permanent or temporary hardware-related failures due to the loss of function of a system component. Systematic faults can correspond to design flaws, incorrect specifications, and / or suitability errors in software.Such safety protocols can analyze the electrical risks associated with a hardware component that can handle a signal in order to improve vehicle safety. SUMMARY In an arrangement, a procedure includes the following: executing computer-executable code for a first application, wherein the first application involves receiving data from a hardware component of a computer system on which the first application is executed; executing, during the runtime of the first application, computer-executable code for a second application, which causes an integrated self-test (BIST) operation to be performed on the hardware component; and executing, by the second application and during the runtime of the first application, a corrective action on the hardware component based on the results of the BIST operation. In another arrangement, a system includes the following: a first processor core; a second processor core; and a real-time address translation (RAT) circuit coupled between the second processor core and random access memory (RAM), wherein the RAT circuit is configured to translate addresses of the RAM into transactions from the second processor core; wherein the first processor core is configured to modify a setting of the RAT circuit via a hardware signal to configure the translation of addresses by the RAT circuit during the runtime of an application by the second processor core. In another arrangement, an integrated circuit (IC) comprises the following: a first processor core; a second processor core; a hardware module coupled to the first processor core and configured to transfer data to the first processor core during the runtime of a first application running on the first processor core; and a tightly coupled memory (TCM) circuit located in the second processor core and configured to store computer-executable code for integrated self-test (BIST) management software, the BIST management software being configured to cause a BIST operation to be performed on the hardware module during the runtime of the first application. BRIEF DESCRIPTION OF THE DRAWINGS Having thus described the invention in general terms, reference is now made to the accompanying drawings, in which the following applies: Fig. 1 is an illustration of an exemplary system according to some embodiments. Fig. 2 is an illustration of an exemplary architecture that, according to some embodiments, can be used for a processor core to execute security software. Fig. 3 is an illustration of an exemplary architecture for a real-time address translation circuit according to some embodiments. Fig. 4 is an illustration of an exemplary method that, according to some embodiments, can be executed by a processor core to execute security software. Fig. 5 is an illustration of an exemplary method that, according to some embodiments, can be executed by security software.Figure 6 illustrates an exemplary method that, according to some embodiments, can be carried out by security software. DETAILED DESCRIPTION The present revelation is described with reference to the accompanying figures. The figures are not drawn to scale and are provided solely for illustration of the revelation. Some aspects of the revelation are described below with reference to exemplary applications for illustration. It should be understood that numerous specific details, relationships, and procedures are set forth to provide an understanding of the revelation. The present revelation is not limited by the illustrated sequence of actions or events, since some actions may occur in different sequences and / or concurrently with other actions or events. Furthermore, not all illustrated actions or events are required to implement a methodology according to the present revelation. The Automotive Safety Integrity Level (ASIL) falls under ISO 26262 and specifies safety levels for automotive components. Compliance with ASIL may require systems to have a high level of fault detection. One example of fault detection is an integrated self-test (BIST), where hardware test modules (e.g., BIST modules) perform tests on other hardware modules (e.g., memory circuits, analog-to-digital converters). In the context of ASIL, BIST operations can be referred to as safety or functional safety. Various embodiments can include systems and methods that enable BIST operations and corrections at runtime. Some embodiments can also include a separate processor core (or multiple processor cores) for BIST management and correction, allowing other processor cores to run applications without reducing application performance. In one example, a procedure involves executing computer-executable code for a first application. This first application might include functionality for an industrial or automotive application. For instance, different ASIL levels might target systems where failures could result in injury, such as industrial machinery, airbag systems in motor vehicles, automatic braking systems, and the like. The first application might provide such functionality, and it may be desirable or even legally required to reduce failures (such as malfunctions) and detect errors before they cause injury. Furthermore, in this example, the first application can be executed on a first processor core. The first application can involve receiving data from a hardware component, such as a memory circuit (e.g., SRAM, DRAM), an analog-to-digital converter (ADC), digital logic (e.g., sequential logic, logic gates), and / or the like. Continuing with the example, while the first application is running, another processor core can execute computer-executable code for a second application. The second application can provide functionality for BIST management and correction. For example, the second application can cause a BIST operation to be performed on the hardware component. In one example use case, the second application can transmit hardware signals or use another technique to induce a BIST circuit to perform a BIST operation on the hardware component and return the results of the BIST operation to the second application running on the second processor core. After receiving the results of the BIST operation, the second application can then execute a corrective action on the hardware component in response to the BIST results. One example of a corrective action that can be executed involves configuring a real-time address translation circuit on the first processor core to avoid memory sections identified as malfunctioning by the BIST operation. Another example involves performing an adjustment operation for a calibration operation on an ADC in response to the BIST results indicating a malfunction of the ADC. A further example involves reducing the resolution or sampling rate of the ADC in response to the BIST results. In some implementations, the corrective action may result in a degradation of some characteristic performance features of the first application, while it can still run. For example, reducing the sampling rate or resolution of the ADC may lead to some performance degradation of the first application, although the first application can still provide acceptable performance. Such a mode may be referred to as a failsafe mode in some examples. Different implementations can offer advantages over other solutions. For example, some systems can provide BIST operations at runtime but cannot provide corrective actions in response to the results of those operations. In such cases, the on-chip safety application can simply disable the system. In contrast, different implementations can allow the initial application to continue running, thus enabling the continued use of the system. Another advantage can be the separation of the execution of the BIST management and correction software from the execution of the other application. For example, some implementations can exclude the main application processor cores from the execution of the BIST management and correction software and instead offload the BIST management and correction software to one or more separate processor cores. Such an architecture can allow a main application to run without having to compete with the BIST management and correction software for processor capacity. In other words, such an architecture can enable faster processing of the main application. Fig. 1 illustrates exemplary System 100 according to some embodiments. Exemplary System 100 can be implemented as one or more integrated circuits. For example, each of the components 101-118, together with additional (not shown) components, can be integrated on the same semiconductor chip as a system-on-a-chip (SoC). In another example, processor cores 101-104 can be implemented on one semiconductor chip, and interconnect 117 and memory devices 107 and 108 can be implemented on one or more other semiconductor chips. One or more of the given semiconductor chips can be integrated into a semiconductor package, and this package can be mounted on a printed circuit board or other component. Furthermore, although Fig. 1 shows four processor cores 101-104, the scope of implementations can include a system with more or fewer processor cores. Likewise, the number of intermediate connections (for example, 117), storage devices (for example, 107, 108), and peripheral devices (for example, 118) can be scaled as needed to accommodate any suitable number and type of storage devices and / or peripherals. Each processor core 101-104 can contain any suitable processor core according to any processor architecture. For example, a given processor core can be implemented as a general-purpose processor core, a special-purpose processor, a reduced instruction set computer, a graphics processing unit, or another type of processor core. In the present example, processor core 102 can be used as the central processing unit (CPU) and configured to execute main application 132. Main application 132 might, for example, contain computer executable code that performs specific functions for an automobile, industrial machine, or other use case, where the performance of the function may be subject to regulations. As mentioned above, industrial machine operations, braking systems, airbag deployment systems, steering systems, and the like could be use cases for main application 132. Furthermore, in the present example, Read Only Memory (ROM) 113 can contain a Basic Input / Output System (BIOS) or other boot software that can be read and executed by processor core 102 at system startup. After startup, processor core 102 can read and execute computer executable code from Nonvolatile Memory (NVM) 107. The NVM 107 can, for example, store code that implements an operating system (OS), one or more applications (for example, the main application 132), and / or the like. In this example, RAM 108 can include multibank RAM or other suitable memory circuitry for use by processor cores 101-104 during runtime.Direct Memory Access (DMA) circuit 105 can be used by any of the processor cores 101-104 to write or read computer executable code and / or data to or from the NVM 107 and / or the RAM 108. The intermediate connection 117 can include a bus or other suitable set of conductors, as well as a bus controller (not shown), which can operate according to any suitable protocol. In the present example, the processor cores 101-104 can communicate with each other and, via the intermediate connection 117, with any of the other components 105-112 and 118. Analog-to-digital converter (ADC) 118 can receive analog information from on-chip or off-chip components and convert this analog information into digital data. For example, ADC 118 can convert analog input data into digital data and then provide this digital data to another component (for example, processor core 102) via the intermediate connection 117. ECC engine 112 can perform error correction code (ECC) operations to support any of the components of system 100. Firewall circuit 106 can be configured as an access management circuit. For example, firewall circuit 106 can include hardware logic configured to assign priority access levels to any of the components and processor cores 101-104 and enforce these priority access levels. Enforcement of the priority access levels can include, for example, allowing or denying communication or action based on a priority access level. Each of the different processor cores 101-104 and the other components of system 100 can include hardware logic (not shown) configured to interact with firewall circuit 106, enabling firewall circuit 106 to manage and enforce the assigned priority access levels.The firewall circuit 106 can include memory-mapped registers (MMR) 114, into which the firewall circuit 106 can write and access data specifying priority access levels. The firewall circuit 106 can communicate with other components of the system 100 via the intermediate connection 117 and can also communicate with the processor core 101 via a hardware signal on conductor 116. Conductor 115 is a conductor separate from the intermediate connection 117, which can transmit hardware signals (for example, sideband signals) from the processor core 101 to real-time address translation (RAT) and overlay (OVLY) circuits (hereinafter RAT) 122-125. As explained below with reference to Fig. 3, the processor core 101 can configure each of the RAT circuits 122-125 based on the results of BIST operations. BIST circuits 109-111 can include hardware or firmware logic to perform BIST operations on various components of the system 100. In this example, processor core 101 is configured to execute computer-executable code to perform the functions of security software 131. Security software 131 can include BIST management and corrective actions, as described in more detail below. For example, security software 131 can manage the start and stop times of BIST components 109-111, receive the results of BIST operations from BIST components 109-111 (via the intermediate connection 117), analyze the results of the BIST operations, and execute corrective actions in response to the results of the BIST operations. Various implementations can use any suitable BIST operations. For example, PBIST circuit 111 can perform a BIST operation on memory devices, such as RAM circuit 108. PBIST circuit 111 can, for instance, have a test pattern generation function that can generate a pattern of digital bits and apply this pattern to a circuit under test (for example, RAM circuit 108) via the intermediate connection 117. For testing purposes, RAM circuit 108 can receive the bit pattern as part of a write operation, write this bit pattern to one or more memory addresses, and then read this bit pattern back to PBIST circuit 111. PBIST circuit 111 can then compare the data read from RAM circuit 108 with the known test pattern and then provide the test results to the security software 131. In another example, the logical BIST 110 can be used to test flip-flops or other combinational logic that may be present in any of the various components, such as any of the processor cores 101-104, the DMA circuit 105, the intermediate connection 117, and / or the like. The logical BIST 110 can, for example, use test patterns or other suitable tests to write data to combinational logic and then receive this data back from the combinational logic under test. The logical BIST 110 can then compare the received data with the test pattern and then provide the test results to the safety software 131. In another example, the analog BIST 109 can perform BIST operations on analog circuits, such as the ADC 118, a digital-to-analog converter (DAC, not shown), or other peripheral devices that may have analog circuitry. If the ADC 118 is the circuit under test, the analog BIST 109 can transmit a ramp signal or other suitable signal to the ADC 118 and then receive a digital output from it. The analog BIST 109 can compare the output of the ADC 118 with an expected correct output and then transmit the test results to the security software 131. The security software 131 can be configured to cause the BIST circuits 109-111 to perform BIST operations regularly or on demand. In some examples, the security software 131 can be configured to perform BIST operations several times per second during the runtime of the main application 132. The security software 131 can receive the results of the BIST operations and then, if necessary, perform corrective actions. In the present example, processor core 101 executes the security software and does not execute the main application 132. In other words, the execution of the security software 131 is offloaded to processor core 101 in this example, and the execution of other applications can be offloaded to any one or more processor cores 102-104. In this way, the processing capacity of the other processor cores 102-104 is not affected by the execution of the security software 131. Also, while the example in Fig. 1 shows only a single application 132 running on processor core 102, in various embodiments any suitable number of applications can be executed simultaneously on any one of the processor cores 102-104. Furthermore, various implementations can enable the security software 131 to execute corrective actions based on the results of the BIST operations, as described in more detail with reference to Fig. 3-6. Figure 2 illustrates an exemplary architecture that, according to some embodiments, can be used for the processor core 101 of Figure 1. In this example, the processor core 101 includes a dual-core lockstep component, represented by two separate cores 201-202. The cores 201-202 can, for example, have the same or similar hardware circuitry and can execute the same computer executable code in each clock cycle. Furthermore, the cores 201-202 can have functionality for verifying the output of each of the cores 201-202 to confirm that each of the cores 201-202 is functioning correctly. In some applications, dual-core lockstep architectures may be required due to regulations, standards bodies, or contracts. However, the concepts of the present disclosure can be adapted to be used in a processor core with only one core or with more than two cores. Each of the cores 201-202 can have less functionality than a general-purpose processor or a digital signal processor. For example, each of the cores 201-202 can be a reduced instruction set computer, and in some cases, even a version of a reduced instruction set computer with reduced functionality. However, the scope of implementations can be adapted so that any suitable processor core can be used as processor core 101. In the present example, each of the cores 201-202 can execute code individually to provide the functionality of the security software 131. Intermediate connection 204 can include conductors and logic to couple cores 201-202 to communicate with the other components. For example, tightly coupled memory (TCM) 205 can be configured so that, at least during runtime, it is accessible only by processor core 101 and not by the other cores 102-104 of Fig. 1. In some examples, processor core 101 can read computer-executable code from memory circuit 107 at system startup and then load this code into TCM 205. Processor core 101 (for example, cores 201-202) can then access the computer-executable code from TCM 205 to execute the security software 131. During the execution of the security software 131, it can cause the processor core 101 to access universal timer 207, whereby the security software 131 can use universal timer 207 to schedule the BIST operations by the BIST circuits 109-111. The security software 131 can use watchdog timer 206 to confirm that a BIST operation has not exceeded a time limit, or that the time between two BIST operations has not exceeded a time limit. MMR circuit 208 can be configured to store the results of BIST operations, error codes for comparison with the BIST operation results, and the state of components (operational, idle), and / or the like. MMR circuit 208 can include memory addresses that can be allocated for use by cores 201-202 as well as the other cores 102-104 of System 100. Event scheduler 209 can include hardware or firmware logic capable of reading and writing data to and from MMR circuit 208, as well as sending and receiving control signals (for example, BIST_REQ) to manage BIST operations. In other words, the safety software 131 can be configured to use event scheduler 209 to transmit signals to BIST circuits 109-111 to start and stop BIST operations, and to receive signals from BIST circuits 109-111. The control signals are described in more detail with reference to Figure 4-6. The event scheduler 209 can communicate with the BIST circuits 109-111 via the intermediate connection 204 and 117 and / or via conductors separate from the intermediate connection 204 and 117. Processor core 101 also includes interrupt control 203, which can be configured to communicate with the other processor cores 102-104. For example, the safety software 131 can generate an interrupt for one or more of the other processor cores 102-104 when BIST operation results occur. The interrupt control 203 can communicate with the other processor cores 102-104 via the intermediate connections 204 and 117 or, if necessary, via another conductor. Fig. 3 illustrates an exemplary architecture of the RAT circuit 122 from Fig. 1 according to some embodiments. Furthermore, while the description of Fig. 3 refers to the RAT circuit 122, the architecture and operation can be adapted for use in any RAT circuit, such as any of the circuits 122-125 from Fig. 1. The RAT circuit 122 can be configured to intercept transactions to and from the processor core 102, allowing address translation logic 301 to analyze the address data and, if necessary, modify the address based on one or more range configurations 302. The RAT circuit 122 can translate addresses intended for the RAM circuit 108, the NVM 107, memory-mapped peripherals, and other targets within or coupled to the system 100. In an example use case, the security software 131 may determine that a specific address range in the RAM circuit 108 is faulty. In response, the security software 131 can establish range configuration 302, which is configured to cause addresses to be changed from faulty addresses to addresses specified in range configuration 302. For example, if the security software 131 determines that an address range AAAA-BBBB in the RAM circuit 108 is faulty, the security software 131 can determine to use a different address range within the RAM circuit 108, such as the address range CCCC-DDDD. The security software 131 can use sideband signals on conductor 115 to write to the range configuration 302. The input address field can identify the faulty address range by its starting address AAAA, the output address field can identify the replaced address range by its starting address CCCC, and the range size field can identify either the size of the replaced or the size of the faulty address range. In other words, a starting address plus a range size can result in an address range. The range control field can specify whether the range configuration 302 is active and available for use. Address translation logic 301 can receive an address in an incoming transaction from processor core 102, where this address may be associated with a read operation, a write operation, or another suitable operation. Address translation logic 301 can parse this incoming transaction and determine whether the transaction's address data refers to the faulty address range. If the transaction's address data does not refer to the faulty address range, address translation logic 301 can output the transaction as an outgoing transaction without modifying the address data. However, if the transaction's address data does refer to the faulty address range, address translation logic 301 can output the transaction as an outgoing transaction with the address data modified to an address within the replaced address range. Although Fig. 3 shows only one scope configuration 302, it is understood that a given RAT circuit 122-125 can include any suitable number of scope configurations, some of which may be active or inactive. Furthermore, the security software 131 running on the processor core 101 can configure scope configuration 302 in response to BIST operation results. For example, the security software 131 can request access from the firewall circuit 106 to write to scope configuration 302. The firewall circuit 106 can include hardware logic configured to allow the processor core 101 to write to the RAT circuit 122, if necessary. Accordingly, the firewall circuit 106 can then change the priority access state of the processor core 101 so that the processor core 101 is permitted to write to the RAT circuit 122.For example, firewall circuit 106 can contain an authorization grant as data in MMR circuit 114 and allow access to MMR circuit 114 via conductor 116. Any of the processor cores 101-104 and the DMA circuit 105 can be able to read the contents of MMR circuit 114 to determine that processor core 101 has priority access to write to a given RAT circuit 122-125. Assuming that processor core 101 is granted priority access to write to the RAT circuit 122, the security software 131 can write to the fields of range configuration 302 (or any other range configuration not shown) to identify a faulty address range and a replacement address range. As mentioned above, in some examples, conductor 115 may be disconnected from intermediate connection 117 and may carry sideband signals. In other words, processor core 101 may use sideband signals instead of in-band signals to write to the fields in a range configuration. However, other implementations may use any suitable technique for configuring a range configuration. Fig. 4 illustrates exemplary method 400, which, according to some embodiments, can be executed by the processor core 101 to execute the security software 131. Method 400 is an exemplary method applied to a single BIST operation. It is understood that method 400 can be executed for any suitable BIST operation in the system 100. For example, for a particular BIST operation to be executed by the analog BIST circuit 109, the security software 131 can execute one instantiation of method 400, and for a particular BIST operation to be executed by the PBIST circuit 111, the security software 131 can execute another instantiation of method 400, and the different instantiations of method 400 can be executed in parallel. In action 402, the safety software 131 can check the universal timer 207 to determine if it is time to execute the BIST operation. Action 402 can be executed at each clock cycle, every X clock cycles (where X is a suitable integer), or at another suitable time. Action 402 can be repeated if the value of the universal timer 207 does not indicate that it is time to execute the BIST operation. If it is time to execute the BIST operation, procedure 400 proceeds to action 404, in which the event scheduler 209 activates the BIST_REQ signal on intermediate connection 117. In this example, the BIST_REQ signal includes an identifier [comp_id] that identifies the specific component being tested for the BIST operation. The other processor cores 102-104 and the DMA circuit 105 can receive the signal via the intermediate connection 117 and can then respond with an acknowledgment signal BIST_ACK[comp_id], which is received by the event scheduler 209. Each of the processor cores 102-105 and the DMA circuit 105 can, after receiving the BIST_REQ signal, execute any code sections that require the use of the identified component before responding with the acknowledgment signal. Once the appropriate acknowledgment signals have been received, the security software 131 can use the event scheduler 209 to activate the BIST_IN_PROG[comp_id] signal on the intermediate connection 117 during action 408. While the BIST_IN_PROG[comp_id] signal is active, the other processor cores 102-104 and the DMA circuit 105 are configured to treat the identified component as unavailable. Action 408 may also include disabling the BIST_REQ signal. In some examples, action 408 may also involve the security software 131 writing a device state (for example, idle) to the MMR circuit 208 to indicate that the specific component is unavailable. BIST circuits 109-111 can be configured to analyze the BIST signals from event scheduler 209 and, if necessary, execute a BIST operation. For example, if the signal BIST_IN_PROG[comp_id] identifies ADC 118, analog BIST circuit 109 can be configured to initiate a BIST operation for ADC 118 upon receiving this signal. Similarly, the other BIST circuits 110-111 can be configured to ignore the signal BIST_IN_PROG[comp_id] if it identifies a component that cannot be tested by that particular BIST circuit. If the signal BIST_IN_PROG[comp_id] identifies RAM circuit 108, PBIST circuit 111 can be configured to start a BIST operation upon receiving the signal, while the other BIST circuits 109-110 can be configured to ignore the signal.The signal BIST_IN_PROG[comp_id] identifies a combinational logic, then the logical BIST 110 can be configured to start a BIST operation on the identified component, while the other BIST circuits 109 and 111 can be configured to ignore the signal. In this example, the appropriate BIST circuit 109, 110, or 111 can then execute a BIST operation on the identified component, while the safety software 131 waits at action 410 for the BIST_DONE signal to be received by the event scheduler 209. Once the appropriate BIST circuit has completed the BIST operation, it can activate the BIST_DONE signal received by the event scheduler 209. In this example, each of the BIST circuits 109-111 can be configured to generate a BIST_FAIL signal if a component fails a BIST operation. Conversely, each of the BIST circuits 109-111 can be configured to indicate that a component has successfully passed a BIST operation by activating the BIST_DONE signal without activating the BIST_FAIL signal. If, during action 412, the security software 131 determines that the BIST_FAIL signal was not received, it can proceed to action 416. In action 416, the security software 131 causes the event scheduler 209 to disable the BIST_IN_PROG signal, thereby releasing the component for use by the other processor cores 102-104 and the DMA circuit 105. In some examples, action 416 may also include the security software 131 writing a device state (for example, ready) to the MMR circuit 208 to indicate that the specific component is available. Action 416 may also include the security software 131 updating its counter for the next scheduled BIST operation. However, if, in this example, the security software 131 determines that the event scheduler 209 received the BIST_FAIL signal during action 412, the security software 131 can proceed to action 414. Action 414 may involve the security software 131 writing to the MMR circuit 208 to indicate an error and an error code, where an error code may be received with the BIST_FAIL signal. The security software 131 may also cause the event scheduler 209 to disable the BIST_IN_PROG signal. Furthermore, the security software 131 may also cause the interrupt controller 203 to generate an interrupt on one (or all) of the processor cores 102-104 and the DMA circuit 105. The interrupt may indicate the unavailability of the device that failed the BIST operation.The appropriate one (or all) processor cores 102-104 and the DMA circuit 105 can then take appropriate action in response to receiving the interrupt. Interrupts are described in more detail with reference to Fig. 6. Action 414 can also include the execution of a corrective action. For example, the safety software 131 can compare the error code in the BIST_FAIL signal with error codes stored in the MMR circuit 208. The MMR circuit 208 can, for example, contain several error codes that are assigned to appropriate corrective actions, and the safety software 131 can use a received error code as a key in the MMR circuit 208 to determine an appropriate corrective action. After the safety software 131 has completed an appropriate corrective action, it can optionally indicate the availability of the component, for example, by writing a device state (e.g., ready) to the MMR circuit 208, by creating an interruption, or by another technique. Exemplary corrective actions are described with reference to Figures 5-6. Fig. 5 illustrates exemplary method 500, which, according to some embodiments, can be executed by the safety software 131 running on the processor core 101. Method 500 illustrates an example of controlling a BIST operation to be performed on the RAM circuit 108 and of executing a corrective action based on the results of the BIST operation. In action 502, the security software 131 can cause the PBIST circuit 111 to perform a BIST operation on the RAM circuit 108. For example, as described above in relation to procedure 400, the security software 131 can cause the event scheduler 209 to output appropriate signals and can also write an appropriate operating state (for example, idle) to the MMR circuit 208. In action 504, the safety software 131 determines whether the RAM circuit 108 has successfully passed the BIST operation (for example, no errors from any address ranges). For instance, in the example of procedure 400, receiving a BIST_DONE signal without receiving a BIST_FAIL signal can indicate that the RAM circuit 108 has passed successfully. Conversely, receiving a BIST_FAIL signal can indicate that the RAM circuit 108 has failed (for example, indicating a malfunction of one or more address ranges). If the security software 131 determines that the RAM circuit 108 has successfully passed the BIST operation, the security software 131 can proceed to action 506. Action 506 may involve updating a counter to wait for another BIST operation, skipping to the next test, or taking another appropriate action. If, during action 504, the security software 131 determines that the RAM circuit 108 has failed, the event scheduler 209 may have received a BIST_FAIL signal with an error code and stored this error code in the MMR circuit 208. The security software 131 can then proceed with action 508 in response to the results of the BIST operation. Action 508 may involve logging the results of the BIST operation to another component, such as the memory circuit 107 or another suitable storage device. Furthermore, in response to the results of the BIST operation indicating a malfunction or otherwise a failed BIST operation, the security software 131 may proceed to action 510. Action 510 may involve the security software 131 flushing an error address buffer (not shown) in the processor core 101 and further executing a corrective action. The execution of a corrective action may involve programming a RAT circuit, as discussed above with reference to Fig. 3. In this example, instead of performing a memory repair directly on the RAM circuit 108, the security software 131 may write to a range configuration in a RAT circuit on a processor core or a DMA circuit. Although not shown in Procedure 500, the corrective action may further include writing a suitable component state (for example, ready for operation), thereby enabling System 100 to use RAM Circuit 108 as normal. Furthermore, Method 500 can include any suitable programming for a RAT circuit, such as RAT circuit 122. For example, the example in Fig. 3 discusses replacing a faulty address range with a replacement address range of the same size. However, some embodiments can replace a faulty address range or multiple faulty address ranges with a memory block or multiple memory blocks that may be larger than the sum of the faulty address ranges. For example, one embodiment can include activating an otherwise disabled RAM bank and using this activated RAM bank for transactions that would otherwise be directed to a faulty address range. The use of the activated RAM bank can involve suitable programming of a RAT circuit. Furthermore, the corrective action with respect to RAM circuit 108 can involve different handling of several different faulty address ranges. For example, an address range of size X may be faulty, and an address range of size Y may also be faulty, and the security software 131 may, if necessary, allocate substitute address ranges of different sizes. In fact, the scope of the implementations may involve programming a RAT circuit in any suitable way to handle a faulty address range. In another example, the security software 131 can determine that there is not as much available spare memory space, or that there is more available memory space than bad memory space. In such an example, the security software 131 can cause the interrupt controller 203 to generate an interrupt signal on one (or all) of the processor cores 102-104 and the DMA circuit 105. The interrupt signal can cause suitable software or firmware to operate in a failsafe mode. Figure 6 illustrates exemplary method 600, which, according to some embodiments, can be executed by the safety software 131 running on the processor core 101. The method 600 in this example can be used to handle a detected malfunction with respect to an analog component. For example, an analog BIST circuit 109 can perform a BIST operation on an ADC, a DAC, or another analog device, and method 600 illustrates how the success or failure of this device can be handled. In action 602, the safety software 131 causes a BIST operation to be performed by a BIST circuit on an analog component, in this case an ADC. The safety software 131 can cause suitable signals to be transmitted and received, and suitable component states to be stored, as described above with reference to Fig. 4. In action 604, the safety software 131 receives the results of a BIST operation and determines whether the ADC passed or failed. As described above with reference to Fig. 4, a BIST_FAIL signal can indicate a malfunction and may be accompanied by an error code. Conversely, a BIST_DONE signal without a BIST_FAIL signal can indicate that the component passed successfully (for example, that it did not malfunction). Assuming the component passed, the security software 131 can proceed to action 606. This might involve waiting or jumping to the next BIST operation, such as returning to action 602 or performing a different BIST operation. Conversely, if the security software 131 determines that the component failed action 604, it can proceed to one or more of actions 612, 618, 622, or 628. In an example, actions 612, 618, 622, and 628 represent error codes stored in the MMR circuit 208. These codes can be searched by the security software 131 using a received error code as a search term or key. Continuing with the example, any of the following actions 614, 620, 624, 630 and 626 can be corrective actions that may be associated with error codes in the MMR circuit 208. If the error code in Action 612 corresponds to a malfunction with high integral nonlinearity (INL) and high differential nonlinearity (DNL), the corresponding corrective action in Action 614 may involve readjusting a capacitor in the ADC. The safety software 131 can perform the adjustment operation on the capacitor and then retest the ADC in Action 616. If the error code in action 618 corresponds to a malfunction with high INL and low DNL, ​​the appropriate corrective action may involve calibrating a component of the ADC. For example, in action 620, safety software 131 may perform a recalibration of a filter or low-frequency sub-circuit. Once action 620 has been performed, safety software 131 may retest the ADC in action 616. Following action 616, action 608 can be used to check whether the retest results in a pass or fail (for example, a malfunction). If the BIST results indicate a fail, the safety software 131 can proceed to action 610, which involves indicating the unavailability of the component under test (the ADC). The safety software 131 can indicate the unavailability by, for example, generating an interrupt via the interrupt controller 203, which is received by one (or all) of the processor cores 102-104 and the DMA circuit 105. Returning to action 608, if the results of the BIST operation indicate that the component being tested has passed, the security software 131 can proceed to action 606. If the error code in action 622 corresponds to a dynamic error (for example, a non-repeating bit flip), the appropriate corrective action may involve reconfiguring the component under test to operate at a lower sampling rate in action 624. For example, security software 131 may include functionality to reprogram the settings of the component under test in action 624. If the error code in action 628 corresponds to an effective number of bits (ENOB), the appropriate corrective action may involve reconfiguring the component under test to operate at a lower resolution. For example, security software 131 may include functionality to reprogram the settings of the component under test in action 630.In other words, if it is detected that a setting, such as sampling rate or resolution, is causing a malfunction at a first level, the security software 131 can reprogram the settings of the component under test to be lower. The security software 131 in this example can follow one or both of actions 624 and 630 by proceeding to action 626. Action 626 can involve the interrupt controller 203 generating an interrupt to one (or all) of the processor cores 102-104 and the DMA circuit 105. Then, the appropriate (or all) of the processor cores 102-104 and the DMA circuit 105 can respond to the interrupt, for example, by changing software or firmware settings to accommodate the lower sampling rate and / or lower resolution. After actions 624 and 630, the security software 131 can then proceed to actions 616, 608, 610 and / or 606 (described above). One advantage of some implementations is that the security software 131, running on processor core 101, can execute procedures 400, 500, and 600 while the main application 132 is running on processor core 102. Thus, in the example of System 100, the main application 132 does not compete with the security software 131 for processing power. Another advantage of some implementations is that some detected malfunctions receive corrective action while the main application 132 is running on processor core 102, enabling continuous operation and, in some cases, even a longer lifespan by avoiding the need to scrap System 100. Additionally, while the examples in Figures 5-6 relate to corrective actions that can be taken with respect to RAM and an analog component, the scope of the implementations can include any corrective action to be performed on a component in response to a BIST operation. For example, if a combinational logic circuit fails a BIST operation performed by the logic BIST circuit 110, the safety software 131 can indicate that the combinational logic circuit is unavailable. For example, the safety software 131 can generate an interrupt. The interrupt can cause a suitable (or all) of the processor cores 102-104 and the DMA circuit 105 to operate in a failsafe mode. The term "semiconductor chip" is used herein. A semiconductor device can be a discrete semiconductor device, such as a bipolar transistor; several discrete devices, such as a pair of power FET switches, fabricated together on a single semiconductor chip; or a semiconductor chip can be an integrated circuit with multiple semiconductor devices, such as the multiple capacitors in an ADC. The semiconductor device can include passive devices (such as resistors, inductors, and filters), sensors, and / or active devices, such as transistors. The semiconductor device can be an integrated circuit in which hundreds or thousands of transistors are coupled to form a functional circuit, such as a microprocessor or a memory device.The semiconductor component can also be referred to here as a semiconductor device or integrated circuit (IC) chip. The term "semiconductor package" is used herein. A semiconductor package has at least one semiconductor chip electrically coupled to terminals and a package that protects and covers the semiconductor chip. In some arrangements, multiple semiconductor chips can be packaged together. For example, a power metal oxide semiconductor (MOS) field-effect transistor (FET) and a second semiconductor device (for example, a gate driver chip or a control chip) can be packaged together to form a single packaged electronic device. Additional components, such as passive components like capacitors, resistors, and inductors or coils, can be integrated into the packaged electronic device. The semiconductor chip is mounted to a package substrate that provides conductive traces.A section of the conductive traces forms the terminals for the packaged device. In wire-bonded integrated circuit packages, bond wires couple conductive traces of a package substrate to bond pads on the semiconductor chip. The semiconductor chip can be mounted on the package substrate with one side of the device facing away from the substrate and one back facing the substrate, and is mounted on a chip pad of the package substrate. The semiconductor device can have a package formed by a thermosetting epoxy resin molding process or by using epoxies, plastics, or resins that are liquid at room temperature and subsequently cured. The package can provide a hermetic seal for the packaged device.The package can be formed in a mold using an encapsulation process, whereby a section of the substrate's conductors remains uncovered during encapsulation, with these exposed conductor sections forming the terminals for the semiconductor package. The semiconductor package may also be referred to as an "integrated circuit package," "microelectronic component package," or "semiconductor component package." While various examples of the present disclosure have been described above, it should be understood that they are presented only as examples and not as limitations. Numerous modifications to the disclosed examples can be made in accordance with the present disclosure without departing from the spirit or scope of the disclosure. Modifications to the described embodiments and other embodiments are possible within the scope of the claims. Thus, the breadth and scope of the present invention should not be limited by any of the examples described above. Rather, the scope of the disclosure should be defined in accordance with the following claims and their equivalents.

Claims

A method comprising: executing computer-executable code for a first application, wherein the first application involves receiving data from a hardware component of a computer system on which the first application is executed; concurrently with the execution of the computer-executable code for the first application, executing computer-executable code for a second application that causes an integrated self-test (Built-in Self-Test, BIST) operation to be performed on the hardware component; and executing, by the second application and during the runtime of the first application, a corrective action on the hardware component based on the results of the BIST operation. Method according to claim 1, wherein receiving data from the hardware component involves performing a read operation on a random access memory (RAM) circuit. The method of claim 2, wherein performing the corrective action comprises: configuring an address translation circuit of a processor core configured to execute the first application, wherein configuring the address translation circuit comprises causing the address translation circuit to translate an address in the read operation based on the BIST operation. The method of claim 1, wherein receiving data from the hardware component includes receiving data from an analog-to-digital converter (ADC). Method according to claim 4, wherein performing the corrective action includes: adjusting a capacitor of the ADC based on a result of the BIST operation. The method of claim 4, wherein performing the corrective action comprises: causing the ADC to operate at a sampling rate lower than a sampling rate specified by the BIST operation in order to cause a malfunction, and transmitting an interrupt signal to a processor core executing the first application to indicate the corrective action. The method of claim 4, wherein performing the corrective action comprises: causing the ADC to operate at a resolution lower than that specified by the BIST operation in order to cause a malfunction, and transmitting an interrupt signal to a processor core executing the first application to indicate the corrective action. The method of claim 1, wherein performing the corrective action comprises: transmitting an interrupt signal to a processor core executing the first application to indicate an emergency operating mode of the first application. A system comprising: a first processor core; a second processor core; and an address translation circuit coupled between the second processor core and a memory circuit, wherein the address translation circuit is configured to translate addresses of the memory circuit into transactions from the second processor core; wherein the first processor core is configured to modify a setting of the address translation circuit via a hardware signal to configure the translation of addresses by the address translation circuit during the runtime of an application by the second processor core. System according to claim 9, further comprising: an access management circuit coupled to the first processor core and the second processor core, wherein the access management circuit is configured to grant access to the first processor core to change the setting of the address translation circuit. System according to claim 9, wherein the first processor core comprises a dual-core lockstep component. System according to claim 9, further comprising: an intermediate connection configured to couple the second processor core to the memory circuit, wherein the second processor core is configured to access the memory circuit for transactions from the second processor core via the intermediate connection, further comprising the first processor core being configured to transmit the hardware signal on a conductor separate from the intermediate connection. System according to claim 9, wherein the first processor core is configured to: execute computer-executable code to cause the first processor core to perform a test on the memory circuit, receive a result of the test, and change the setting of the address translation circuit in response to the result of the test. System according to claim 9, wherein the second processor core is configured to execute the application, and wherein the application is connected to the transactions from the second processor core, further wherein the first processor core is configured to execute another application which causes the first processor core to change the setting of the address translation circuit via the hardware signal, further wherein the runtime of the application overlaps with the runtime of the other application. System according to claim 14, wherein the first processor core includes a tightly coupled memory circuit, wherein the tightly coupled memory circuit is configured to store computer executable code of the other application, and wherein the second processor core is configured to load the computer executable code into the tightly coupled memory circuit during system startup. Integrated circuit (IC) comprising: a first processor core; a second processor core; a hardware module coupled to the first processor core and configured to transfer data to the first processor core during the runtime of a first application running on the first processor core; and a tightly coupled memory (TCM) circuit located in the second processor core and configured to store computer-executable code for integrated self-test (BIST) management software, the BIST management software being configured to cause a BIST operation to be performed on the hardware module during the runtime of the first application. IC according to claim 16, wherein the TCM circuit is further configured to store computer-executable code for performing corrective actions on the hardware module in response to the BIST operation and during the runtime of the first application. IC according to claim 17, wherein the hardware module comprises an analog-to-digital converter (ADC), and wherein the computer-executable code for performing the corrective actions includes computer-executable code for performing a calibration operation or an adjustment operation on the ADC. IC according to claim 17, wherein the hardware module comprises an analog-to-digital converter (ADC), and wherein the computer-executable code for performing the corrective measures includes computer-executable code for reducing a resolution or a sampling rate of the ADC. IC according to claim 17, wherein the hardware module comprises a working memory (RAM) circuit, and wherein the first processor core includes a real-time address translation circuit configured to translate an address within the RAM circuit for transactions from the RAM circuit, and wherein the computer executable code for performing the corrective actions includes computer executable code for configuring the real-time address translation circuit.

Images