PROCEDURE FOR VERIFYING A METER, CORRESPONDING PROCESSING SYSTEM AND COMPUTER PRODUCT

Description

DESCRIPTION of the industrial invention entitled: “Procedure for verifying a meter, corresponding processing system and "computer product" of: STMicroelectronics International NV, of Dutch nationality, acting through Swiss headquarters and branch located at Chemin du Champ-des-Filles 39, 1228 Plan-les- Ouates, Geneva, Switzerland. Designated Inventors: Roberto SCIBETTA, Ruggero MACALUSO Filed on: June 21, 2024 **** DESCRIPTION TEXT Technical field This description relates to the security mechanisms within the processing systems used in safety-critical fields, such as the automotive. More specifically, it is relevant to counter circuits, e.g., timers. Watchdog Software (SWDT, “Watchdog Timer Software”). Background Figure 1 represents a typical electronic system, such as the electronic system of a vehicle, comprising a plurality of processing systems 10, such as systems embedded or integrated circuits, e.g., a FPGA (Field Programmable Gate Array), a DSP (Digital Signal Processor) or a microcontroller (e.g., dedicated to the market automotive). For example, three processing systems 10 , 10 are shown in Figure 1 1 2 and 10 connected through a suitable communication system 20. For example, the system communication may include a vehicle control bus, such as a CAN bus (Controller Area Network), and possibly a media bus, such as a MOST bus (Media Oriented Systems Transport), connected to the vehicle control bus via a gateway. Typically, the 10 processing systems are located in different locations of the vehicle and may include, for example, an Engine Control Unit (“Engine Control Unit”), a Transmission Control Unit (TCU, “Transmission Control Unit”), an Anti-lock Braking System (ABS), a module body control module (BCM) and / or an audio system multimedia and / or navigation. Consequently, one or more of the processing systems 10 can also implement real-time control and regulation functions (“real-time”). These processing systems are usually identified as Real-Time Processing Units. Electronic Control Unit (ECU). Figure 2 represents a block diagram of an example of a system. 10 digital processing, such as a microcontroller, which can be used as a any of the processing systems 10 of Figure 1. In the example considered, the processing system 10 comprises a microprocessor 102, usually the Central Processing Unit (CPU, “Central Processing Unit”), programmed by software instructions. Usually, the software executed by the microprocessor 102 is stored in a program memory 104 not volatile, such as Flash memory or EEPROM. Thus, memory 104 is configured for storing the firmware of the processing unit 102, wherein the firmware comprises the software instructions to be executed by the microprocessor 102. Generally, Non-volatile memory 104 can also be used to store other data, such as configuration data, e.g., calibration data. The microprocessor 102 usually also has an associated volatile memory 104b, such as random-access memory (RAM). For example, The 104b memory can be used to store temporary data. As shown in Figure 2, communication with 104 memories is usually and / or 104b is performed by one or more memory controllers 100. The controller (i memory controllers 100 may be integrated into the microprocessor 102 or connected(s) to microprocessor 102 via a channel communication, such as a system bus of the processing system 10. Similarly, the memories 104 and / or 104b may be integrated with the microprocessor 102 in a single integrated circuit, or memories 104 and / or 104b may be in the form of a circuit integrated separately and connected to the microprocessor 102, e.g., by the tracks of a printed circuit board (PCB). In the example considered, the microprocessor 102 may have one or more associated peripherals / resources (hardware) 106, selected from the group of: - one or more IF communication interfaces, e.g. to exchange data via the communication system 20, such as a UART (Universal Asynchronous Interface) Receiver / Transmitter), SPI Bus (Serial Peripheral Interface), IC (Inter-Integrated Circuit), CAN (Controller Area Network) bus, and / or an Ethernet interface and / or a debug interface; and / or - one or more analog / digital AD and / or digital / analog DA converters; and / or - one or more dedicated DC digital components, such as hardware counters and / or timers, such as one or more hardware and / or software watchdog timers; and / or - one or more AC analog components, such as comparators, sensors, such as a sensor of temperature, etc.; and / or - one or more MSC mixed-signal components, such as a driver (“driver”) PWM (Pulse-Width Modulation). As a result, the digital processing system10 can support different functionality. For example, the behavior of the microprocessor 102 is determined by the firmware stored in memory 104, e.g., by software instructions that need to be performed by a microprocessor 102 of a microcontroller 10. Thus, by installing a different firmware, the same hardware (microcontroller) can be used for different applications. In this regard, safety-critical systems require robust mechanisms to detect and respond promptly to faults. Traditional hardware watchdog timers serve this purpose at the hardware level. Similarly, in intensive systems of software, a dedicated Software Watchdog Timer, SWDT, may be useful. Specifically, a SWDT acts as a sentinel, continuously monitoring by means of a counter the execution of software processes or tasks. is based on the reception of periodic signals from the monitored unit such as, for example, a software module. Consequently, if these signals cease due to a fault or a block, the SWDT intervenes, for example by restarting the monitored software module or the microprocessor 102. In general, timer or counter circuits can also be used for other safety-critical applications. For example, the Patent Application US No. 2019 / 0041440 A1 describes solutions for monitoring a signal of clock by means of a counter. In order to comply with the Automotive Safety Integrity Level, ASIL, defined According to ISO 26262, such safety-critical meters should be verified. For example, the inventors observed that, in order to verify the integrity of a counter of a timer circuit (e.g., watchdog), the counter can be set to a initial value and the system can wait for the timer to expire when the counter reaches a final value. For example, in the case of a down counter, the count value can be set to an initial value that has all bits set to '1' and the count value final can be zero. Consequently, in this way the counting operation between the The minimum and maximum value of the counter can be checked. However, this approach is inherently time consuming and thus is unsuitable only for low-resolution counters, e.g., having 8 or 16 bits. On the other hand, as the number of bits increases, the time period may become too long to to ensure a boot time, which should usually be less than 50 milliseconds. Purpose and summary In view of the above, various forms of implementation of this description provide faster solutions for verifying meters in systems processing. According to one or more forms of implementation, the previous purpose is achieved by means of of a process having the characteristics specifically set forth in the claims which follow. The forms of implementation also concern a relative system of processing and also a corresponding IT product, which can be loaded in the memory of at least one microprocessor and which includes portions of code software to implement the process steps when the product is run on the microprocessor. As used herein, a reference to such a computer product means be equivalent to a reference to machine-readable media containing instructions to control a processing system in order to coordinate the execution of the process. A reference to “at least one microprocessor” clearly means highlight the possibility that this description can be implemented in a distributed / modular. Claims are an integral part of the technical teaching of the description provided here. As mentioned above, various forms of implementation of this descriptions are related to solutions for testing a hardware counter circuit digital. In various embodiments, the digital hardware counter circuit is part of a processing system, for example, is integrated into an integrated circuit. In various forms of implementation, the processing system also includes a microprocessor connected to the digital hardware counter circuit and a non-volatile memory that stores the firmware that must be executed by the microprocessor. Consequently, the system processing can be a microcontroller and digital hardware counter circuit can belong to a timer circuit, such as a watchdog timer, such as a watchdog timer microprocessor software. In various embodiments, the counter circuit includes a register configured to store a count value and a down or up counter digital, where the digital down or up counter is configured to determine whether a signal indicates that the digital down or up counter is enabled or disabled. For example, the signal can be provided by means of a respective enabled flag of the register. In response to a determination that the signal indicates that the digital meter is enabled, the digital counter varies the count value. Specifically, a counter back decrements the count value by a step size in response to a clock signal. Conversely, an up counter increments the count value. according to a step size in response to a clock signal. For example, in various embodiments, the counter clock signal corresponds to the clock signal of the microprocessor. Consequently, in various embodiments, the count value has a given number of bits and is incremented or decremented. For example, in various forms of implementation, the step size can be programmable by means of the register and / or can be set to one. In various embodiments, the digital counter determines whether the value of count reaches a final value. In response to a determination that the value of count reaches the final value, the digital counter asserts a trigger signal. In various embodiments, the final value is programmable via the register. Furthermore, in various embodiments, the processing system may be programmable. in order to configure whether the trigger signal is provided as a reset and / or interrupt to the microprocessor. Specifically, in various embodiments, in order to verify the circuit counter, the microprocessor is configured to execute a software module, e.g., the software module can be stored in the non-volatile memory of the system processing. Specifically, in various embodiments, the software module is configured to check a plurality of the most significant bits of the count value repeating a sequence of steps for each bit position of the plurality of bits plus significant of the counting value. For example, in various embodiments, the count value may have 16, 32 or 64 bits. In various embodiments applied to a 16-bit counter, the number of bits significant can be selected in a range between 8 and 16 bits, preferably between 8 and 14 bits, more preferably between 8 and 12 bits, e.g., 10, 11, or 12 bits. In various forms of implementation applied to a 32-bit counter, the number of most significant bits can be selected in a range between 16 and 32 bits, preferably between 16 and 30 bits, and more preferably between 16 and 28 bits, e.g., 24, 25, or 26 bits. In various embodiments applied to a 64-bit counter, the number of most significant bits can be selected in a range between 32 and 64 bits, preferably between 32 and 62 bits, and more preferably between 32 and 60 bits, e.g., 56, 57, or 58 bits. Specifically, the software module writes the counter circuit register to set the count value to a binary value. For example, in various forms of implementation, the count value can be set by directly programming the count value stored in register or writing an initial value into register, which is transferred to the count value, once the counter is reset. At this stage, the counter is preferably stopped. Specifically, in various embodiments relative to a down counter, the binary value bit in the (current) bit position is set high and the lower bits of the binary value are set low. Conversely, in various embodiments related to an up counter, the bit of the binary value in the position of bit (current) is set low and the lowest bits of the binary value are set high. In general, the highest bits can have any value. For example, in various forms In implementation, the most significant bits of the binary value are set low for a counter back, and highs for a counter forward. In various embodiments, the software module then enables the digital counter, whereby the digital counter varies the counting value. Subsequently, the software module disables the digital counter. In various embodiments, the software module is configured to immediately disable the digital counter with the next software instruction or after a given period of time, which can be implemented, for e.g., by performing one or more “nop” operations. In various embodiments, the software module then determines whether one or more bits of the counting value have a respective expected value. For example, in the case of a Back counter, the software module can determine whether the bit in the bit position (current) is low or, in the case of an up counter, can determine whether the bit in the bit position (current) is high. In various embodiments, the software module can also check one or more bits lower and / or higher than the count value. For example, in the case of a down counter, the software module can determine whether one or more bits of the count value in the lowest bit positions compared to the bit position (current) are set high. Conversely, in the case of a forward counter, the module software can determine whether one or more bits of the count value in the bit positions lower than the (current) bit position are set low. In addition or Alternatively, the software module can determine whether one or more bits of the count value in the higher bit positions compared to the (current) bit position there are left unchanged. For example, in various embodiments, in the case where the bit position (current) corresponds to the bit position of the most significant bit of the value of counting, the software module can determine whether all bits of the plurality of bits are more significant of the count value have a respective expected value. Accordingly, in various forms of implementation, in response to a determination that at least one of the one or more bits of the count value does not have its expected value, The software module may report a malfunction of the hardware counter circuit digital. Conversely, in response to a determination that each of the one or more bits of the count value has its expected value, the software module selects a next bit position of the plurality of most significant bits of the count value. For example, in various embodiments, the software module checks for bit plurality most significant of the count value starting with the bit position of the most significant bit significant of the count value and selecting as the next bit position the next lowest bit position of the plurality of most significant bits of the value of count. Consequently, the previous operations allow us to verify sequentially a given number of most significant bits of the count value. In various embodiments, in order to verify the remaining least significant bits of the value of counting, the software module re-enables the digital counter and determines whether the value counting reaches the final value and / or the digital counter asserts the signal trigger. In various embodiments, before enabling the digital counter, the module software can set the count value to an initial value, which ensures that the the value of each of the least significant bits of the count value is inverted at least once time when counting from the starting value to the final value. For example, in the case of a counter down, the final value can be zero and the initial value can be correspond to a sequence of bits having the plurality of most significant bits of the value of count set low, and (at least) the most significant bit of the least significant bits remaining of the count value set high. On the other hand, in the case of a counter forward, the initial value can be zero and the final value can be a sequence of bits having the plurality of most significant bits of the count value set low, and (at least) the most significant bit of the remaining least significant bits of the count value set high. For example, in various embodiments, the software module may determine whether The digital counter asserts the trigger signal within a given period of time. For this purpose, the trigger signal can be supplied as an interrupt signal to the microprocessor and software module can monitor the interrupt signal. In response to a determination that the digital counter asserts the trigger signal, the module software can determine whether the count value matches the final value. consequently, in response to a determination that the digital meter does not assert the trigger signal or that the count value does not match the final value, the module software may report a malfunction of the digital hardware counter circuit. Brief description of the drawings Implementation forms of this disclosure will now be described with reference to the attached drawings, which are provided purely by way of example restrictive, and in which: - Figure 1 represents an example of an electronic system comprising a plurality of processing systems; - Figure 2 represents an example of a processing system, such as a microcontroller; - Figure 3 represents a processing system comprising a processing unit meter verification according to the solution described here; - Figure 4 represents a procedure for checking a meter according to the solution described here; - Figure 5 represents a counter register of a backward counter which is verified according to the solution described here; and - Figure 6 represents a counter register of an up counter which is verified according to the solution described here. Detailed description In the following description, several specific details are illustrated, for the purpose to provide an in-depth understanding of the forms of implementation. The forms of implementation may be implemented without one or more of the specific details or with other processes, components, materials, etc. In other cases, operations, materials or structures well known are not represented or described in detail to avoid making it unclear certain aspects of the forms of implementation. A reference to “an embodiment” throughout this description is intended indicate that a particular configuration, structure, or feature described with reference to the form of embodiment is included in at least one form of embodiment. Thus, the phrases like “in an embodiment” or similar that appear in various places throughout these descriptions do not necessarily all refer to the same form of implementation. Furthermore, particular conformations, structures or characteristics can be combined in any suitable way in one or more embodiments. The references used here are provided simply for convenience and not define the scope or meaning of the forms of implementation. As mentioned above, various forms of implementation of this description provide solutions to check a meter. Figure 3 represents an embodiment of a 10a processing system. comprising a microprocessor 102 and a timer circuit 108, such as a watchdog timer, for example, a software watchdog timer. In the embodiment considered, the circuit timer 108 includes a counter 1080 and one or more registers 1082. Specifically, in various embodiments, the microprocessor 102 may read and write register(s) 1082 by means of software instructions executed by the microprocessor 102. For example, for this purpose, the timer circuit 108 may be connected to the microprocessor 102 by means of a communication system (e.g., on chip) 114 suitable. For example, in various embodiments, the microprocessor 102 includes a master communication interface configured to forward requests for reading and writing from the microprocessor 102 to the communication system 114, and for forward a response from the communication system 114 to the microprocessor 102. In various embodiments, the timer circuit 108 is connected to the communication system 114 for by means of a slave communication interface, e.g., comprising a slave interface registers and / or a peripheral bridge device. For example, this For this purpose, the communication system 114 may in fact comprise a High Speed ​​Bus Performance (AHB, “High-performance Bus”) AMBA (Advanced Microcontroller Bus Architecture), and an Advanced Peripheral Bus (APB) used for connect the timer circuit 106 to the AHB AMBA bus. For example, in this way, the microprocessor 102 may send a write and read request to timer circuit 108 in order to write and read the contents of register(s) 1082, e.g., including an address associated with a given register 1082 in the write or read request. For example, in various embodiments, register(s) 1082 may be used (can be used) to start / enable the 1080 digital hardware counter. Specifically, in response to being enabled, counter 1080 varies a value of count in response to a CLK clock signal (i.e., increment the count value for an up counter, or decrements the count value for a down counter). In various implementations, the count value is stored in the register(s) 1082. In various embodiments, in order to implement a timer, the counter 1080 can be configured to start counting from an initial value until it is reached a final value. In various embodiments, at least one of these values ​​is programmable via register 1082. For example, in the case of an up counter, the initial value can be set to zero and the final value can be programmable for half of register 1082. On the other hand, in the case of a backward counter, the initial value It can be programmable via register 1082 and the final value can be zero. However, both values ​​can also be programmable. In various embodiments, the counter 1080 is incremented (or decremented) with a counting step of one. However, in various embodiments, the step also counting can be programmed by means of register(s) 1082. Accordingly, in various embodiments, once the 1082 counter is enabled / started, counter 1080 varies the count value with a given counting step size starting from the initial value. In parallel, the counter 1080 determines whether the count value reaches the final value. In response to a determining that the count value has reached the final value, counter 1080 generates a trigger signal TRIG1. For example, in the case of a traditional hardware timer, the trigger signal TRIG1 is usually supplied as an interrupt signal to the 102 microprocessor. Conversely, In order to implement a watchdog timer, the trigger signal TRIG1 is provided as a RST reset signal to the microprocessor 102. In various embodiments, the reaction the trigger signal TRIG1 can be programmable. For example, in various forms of Implementation, the processing system 10a also includes a fault collection circuit and error handling 120 (programmable) configured to generate one or more error signals reset RST and optionally one or more IRQ interrupt signals depending on a plurality of error signals. Consequently, in this case, the trigger signal TRIG1 can correspond to an error signal supplied to the fault collection and management circuit errors 120. Alternatively, the type of reaction, e.g. interrupt or reset, can be programmable by means of register(s) 1082, e.g., by means of a respective interrupt enable flag and / or reset enable flag. Therefore, in order to implement a software watchdog timer, one or more software modules 1020 executed by microprocessor 102 are configured to reset the timer circuit 108 before counter 1080 reaches its final value. For example, in various forms of implementation, the software instruction(s) executed(s) by the microprocessor 102 may reset timer circuit 108 by programming the register 1082 and / or by means of a dedicated TRIG2 trigger signal supplied to the counter 1080. Consequently, in response to a reset, counter 1080 is configured to (re)set the count value back to the initial value and then continue with the operation of counting. Accordingly, in various embodiments, when the software module 1020 fails (or the software modules fail) to reset the timer circuit 108, the counter 1080 will reach the final value and generate the trigger signal TRIG1, which can be configured in turn, for example, to reset the microprocessor 102. In various embodiments, in addition to, or as an alternative to, being reset from the microprocessor 102, a software watchdog timer 108 can also monitor directly the operation of the microprocessor 102 in order to evaluate whether the microprocessor 102 is functioning properly, e.g., monitoring and analyzing the value of the microprocessor program counter 102. As mentioned above, various forms of implementation of this descriptions provide solutions to check a 1080 counter, e.g., the counter 1080 of the timer circuit 108, such as a hardware or software watchdog timer. Specifically, in various embodiments, the microprocessor 102 performs a 1022 counter verification software module, i.e., the firmware of the microprocessor 102 (e.g., stored in memory 104) includes the module's software instructions 1022 meter verification software (and optionally the module software instructions software 1020). Specifically, in various embodiments, the meter verification module 1022 is configured to verify that timer circuit 108 is operating properly, in particular by checking the 1080 counter included in it. In this regard, the Meter Verification Module 1020 is configured to thoroughly verify the functionality of the timer circuit 108, and to report any malfunction while occurs. In various embodiments, the meter verification module 1022 may be used to test other circuits that use a different counter than the circuit timer 108. In various embodiments, the timer verification module 1022 may be loaded and executed by the microprocessor 102 whenever the processing system 10a has need to check if the timer circuit 108 is working properly. For example, the timer verification module 1022 can be loaded and executed during a phase of bootstrap the 10a processing system, at periodic intervals, or on demand, for example for debugging or diagnostic purposes. Specifically, when executed by the microprocessor 102, the software instructions of the counter verification module 101 cause the microprocessor 102 to implement a 500 procedure to check a meter. In this regard, Figure 4 represents a flowchart of a form for the implementation of procedure 500 to verify a meter. In particular, the solution Described herein is a procedure for testing a hardware digital counter which, according to the considered forms of implementation of the present solution, can be a a backward counter or a forward counter. In order to provide a more complete understanding in depth, this solution is described with reference to an example of a 8-bit down counter, whose corresponding register, e.g., register 1082, It includes 8 bits to store a respective CNT count value and is illustrated in Figure 5. In addition, an example of a forward counter is also referred to. 8 bit, whose corresponding register comprises 8 bits and is shown in Figure 6. Accordingly, in the embodiment considered, as represented, for e.g., in Figures 5a and 6a, the register arranged to store the count value CNT It comprises 8 bits, which are numbered from 0 to 7 as represented by the labels B …B, where bit B corresponds to the most significant bit (MSB, “Most Significant Bit”) 0 7 7 and bit B corresponds to the least significant bit (LSB). In various embodiments, the procedure described here can be used to evaluate the functionality of counters comprising a different number of bits, such as 16-bit counters, 32 or 64 bits. Therefore, the example should not be interpreted in a restrictive sense. After a start phase 5000, in a phase 5002 an index N is initialized to a first value. Basically, the index N indicates the current bit position of a bit of the CNT count value to be checked. For example, in various embodiments, the verification starts with the MSB bit, e.g., the B bit for an 8-bit counter, where the index N is set to a value to indicate the MSB bit. For example, in various embodiments, the index N is set to the bit index X of the MSB bit. For example, since the index of the LSB bit is usually zero, index N can be set to the total number of bits of the value of CNT counting minus 1, e.g., 7 for an 8-bit counter. So, in the example considered, the index N is set to 7 in step 5002. In general, the verification can also start with any other bit, such as the LSB bit, for which the index N can be set to zero. Subsequently, in a step 5004 the procedure sets the count value CNT to a binary value T having the same number of bits as the count value CNT and, for example, for this purpose the verification module 1022 can program the register 1082 by means of a written request. In particular, in implementation forms relating to the verification of back meters, the value T has set to '1' (high) the bit indicated by index N, e.g., the MSB, e.g., the bit B, and all lower bits (compared to bit position N) set to '0' (low). In general, the highest bits (compared to bit position N) can be set to any value, but preferably also the highest bits are set to '0'. For for example, in various embodiments, the value T written to the count value CNT during phase 5004 it is equal to 2^N, where N indicates the index of the bit to be analyzed. For example, a possible configuration of the CNT count value after The execution of this step 5004 in an 8-bit down counter is illustrated in Figure 5a, where the count value CNT is set to the binary value “1000000”. On the other hand, in implementation forms related to the verification of forward meters, the value T has set to '0' the bit indicated by index N, e.g., the MSB, e.g., the bit B, and all lower bits (compared to bit position N) set to '1'. In general, the higher bits (compared to bit position N) can be set to a value any, but preferably also the highest bits are set to '1'. For example, in various embodiments, the value T written to the count value CNT of a counter forward is equal to 2^N – 1. For example, a possible configuration of the value of CNT count after performing this step 5004 in an 8-bit up counter is illustrated in Figure 6a, where the count value CNT is set to the binary value '01111111'. Next, in a step 5006 the counter is enabled so that it starts counting, for example, by programming register 1082. In particular, upon receiving a signal starting, a backward counter starts counting in descending order, then decrementing by 1 (or a given step size) the binary number of the value of CNT counts every time a clock pulse is detected. In contrast, a counter forward starts counting in ascending order, incrementing by 1 (or a given size (of step) the binary number of the CNT count value each time a clock pulse. Next, in a step 5008, the counter is left to count for an amount of predetermined time and, after the predetermined amount of time has elapsed, the counter 1080 is stopped, e.g., by writing register 1082. In general, the amount of time for which the counter is left to count is chosen in such a way as to allow the counter to decrease, or increase, the count value CNT at least once time. For example, depending on the clock frequency of the microprocessor and the frequency of the CLK clock signal used by the counter 1080, the software module 1022 can execute a given number of no operation or nop (no operation) instructions or other software instructions, which do not interfere with the counting operation of the counter 1080. In case the clock frequency of the counter 1080 matches at least at the microprocessor clock frequency, step 5008 can also stop immediately the 1080 counter, because the 1080 counter counts at least once while a single software instruction is executed by the microprocessor 102. For example, possible CNT count values ​​after step 5008 are illustrated in Figures 5b and 6b, which respectively represent cases related to a counter backwards and one counter forwards. Subsequently, in a step 5010, the value of the counter CNT is read, e.g., by reading register 1082, and one or more bits of the CNT count value are compared with the values expected. Specifically, in various embodiments, the 1022 verification form is configured to determine whether the bit at index N has a respective expected value. In various embodiments, the verification module 1022 is also configured to determine whether the bit at index N-1 has a respective expected value. Similarly, the verification module 1022 can determine whether one or more of the (and possibly all) highest and / or lowest bits have a respective expected value. For example, in embodiments relating to the verification of back meters with a step size of one, the expected value of the CNT count value bit in position N is equal to '0', while the expected value of the count value bit CNT in position N–1 (and any other possible lower bits) is equal to '1'. Conversely, in embodiments relating to the verification of forward meters with a size of step of one, the expected value of the count value bit CNT in position N is equal to '1', while the expected value of the CNT count value bit in position N–1 (and other possible lower bits) is equal to '0'. Conversely, the value of the highest bits highs usually remain unchanged. Thus, in various embodiments, in a 5010 step the value of the bit in position N and optionally the value of one or more lower bits of the CNT count value are compared with their respective expected values. Essentially, in comparison to the T value, the values expected N bit and lower bits have been reversed. Consequently, in various forms of implementation, the software module 1022 may be configured to check whether the bit or bits they have been inverted, that is, they have changed value from '0' to '1', and vice versa from '1' to '0'. In various embodiments, even the values ​​of one or more bits higher than the value of CNT counts are compared with respective expected values. Specifically, in comparison at the value T, the expected values ​​of the higher bits should remain unchanged. Consequently, In various embodiments, the software module 1022 may be configured to check whether one or more of the highest bits have remained unchanged. In response to a determination that at least one of the one or more bits of the value of CNT count does not have its expected value (output “N” of verification phase 5010), e.g., at least one of the bits in positions N and N–1 has not been inverted, the procedure continues in a 5020 error phase, where a malfunction of the counter is reported, and the process ends at a late stage 5022. Conversely, in response to a determination that each of the one or more bits of the CNT count value has its respective expected value (output “Y” of the verification phase 5010), e.g., both bits in positions N and N–1 have been inverted, the process 500 continues in a 5012 phase. Specifically, in step 5012, the value of the N index is changed / modified at order to select a next bit of the CNT count value to be checked, i.e., the current bit position N indicates a next bit position to check. example, when starting with the MSB (phase 5002), the change in index N can understand to decrease the value of the index N by one. However, it can also be used any other rule to sequentially select a given number of bits more significant of the CNT count value. For example, in various embodiments, the The solution described here allows you to check meters by first checking the MSB, and then iteratively selecting the following lowest bits to check until the last desired bit is not verified. For example, in various embodiments, while the index X indicates the position of the MSB, an index Y can be used to indicate the position of the last bit of the value of CNT counting to be checked. For example, since Y = 0, all bits of the value of CNT counts can be verified. Consequently, in various embodiments, a given number of bits is verified more significant than the count value CNT. For example, in various embodiments, The count value can have 16, 32 or 64 bits. In various embodiments applied to a 16-bit counter, the number of most significant bits to check can be selected in a range between 8 and 16 bits, preferably between 8 and 14 bits, and more preferably between 8 and 12 bits, e.g., 10, 11, or 12 bits. In various embodiments applied to a 32-bit counter bit, the number of most significant bits to check can be selected in a range between 16 and 32 bits, preferably between 16 and 30 bits, and more preferably between 16 and 28 bits, for e.g., 24, 25, or 26 bits. In various embodiments applied to a 64-bit counter, the number of most significant bits to be checked can be selected in a range between 32 and 64 bits, preferably between 32 and 62 bits, and more preferably between 32 and 60 bits, e.g., 56, 57, or 58 bit. Consequently, as will be described in more detail later, in various implementations, not all bits of the CNT count value are verified by means of of the steps from 5004 to 5010, but only a given number of the most significant bits of the value of CNT counting, where this given number is at least two and less than the number of bits of the counting value CNT, for which a given number Y of least significant bits are not verified in steps 5004 to 5010. For example, in various embodiments, the index / the Y number can be 2, 3, 4, 6 or 8. For example, this can be useful when the 1080 counter uses a CLK clock signal having a frequency that is equal to or greater than the frequency of the clock signal of the microprocessor 102, because in this way various counting operations can be performed by the counter 1080, first that the verification module 1022 can stop the counter again in phase 5008. Accordingly, in a 5014 step, the verification module determines whether they should further bits may be checked, e.g., whether the first index N is greater than the second index Y. In response to a determination that additional bits need to be checked (output “Y” of verification phase 5014), e.g., when N > Y, verification module 1022 returns at step 5004, thereby performing a further iteration of procedure 500. Of consequently, in various embodiments a given number of most significant bits of the value CNT counting are verified sequentially. For example, in the embodiment considered, the verification module 1022 repeats steps 5004 to 5014 until the index N is reaches the value of index Y i.e., N = Y (or until a malfunction in phase 5010). In various embodiments, phases 5012 and 5014 may also be reversed, that is, the verification module 1022 can first determine whether they need to be verified additional bits and can then set index N to the next value. On the other hand, in response to a determination that the given number has been verified of MSB bits (output “N” of check phase 5014), e.g., when index N is less than or equal to index Y, the process 500 continues in a phase 5016. In general, step 5016 is purely optional and is used when a given number of least significant bits was verified separately. Consequently, in various forms of implementation, the procedure can also proceed directly to the end-of-phase 5022. In effects, as mentioned above, steps 5004 to 5014 verify the reversal of bits of a given number of bits more significant than the count value CNT, but the bits less significant remaining (if any) remain unverified, e.g., because it may be It is impossible to precisely control the counting operation of the 1080 counter. by means of software instructions starting (step 5006) and stopping (step 5008) the counter 1080. Consequently, in various forms of implementation, in phase 5016 the operation of 1080 counter count for remaining least significant bits should be checked, for example, the bits between the bit indicated by the index Y and the LSB. For example, in a counter having index Y set equal to 2, the last 3 bits should be verified. For this reason, the verification module 1022 sets the count value CNT at a given initial value, starts the counter 1080, and the counter is left counting until the counter expires, that is, until it reaches a final count value, thereby asserting the trigger signal TRIG1. Accordingly, the initial value and / or the final value should be selected to ensure that, while the counter is counting from the initial value to the final value, it check for at least one bit reversal for each of the remaining least significant bits from check. For example, in various embodiments, a 1080 down counter may be configured to count from a programmable starting value to a final value (e.g., fixed) corresponding to zero, that is, the counter generates the trigger signal TRIG1 when all bits of the CNT count value are '0'. Therefore, in this case, at least the bit in position Y should be set to '1', i.e., the verification module 1022 can set the CNT count value to any value that is greater than 2ˆY, for example, at least the bit in position Y can be set to '1', and thus can do start counter 1080, e.g., by programming register 1082. For example, this is also represented in Figures 5c and 5d, which represent a possible form of implementation for the initial value and final value of the CNT count value for a counter backward with Y = 2. For example, in Figure 5c, the initial value is set to the binary value “0000 0100”. Conversely, in various embodiments, a 1080 forward counter can be configured to count from an initial (e.g., fixed) value of zero to a programmable final value. Therefore, in this case, the verification module 1022 can reset the CNT count value and can set the final value of the counter 1080 to a value that is greater than 2ˆY, e.g., having at least the bit in the Y position set to '1'. Afterwards, the verification module can start the 1080 counter, for e.g., programming register 1082. For example, this is also represented in the Figures 6c and 6d, which represent a possible implementation for the initial value and for the final value of the count value CNT for an up counter with Y = 2. For For example, in Figure 6d, the final value is set to the binary value “0000 0111”. Conversely, in the case of a 1080 forward counter configured to generate the signal trigger TRIG1 when all bits of the CNT count value are '1' or when it is an overflow condition is reached, that is, when the count value CNT reaches zero, the (Y+1) least significant bits of the CNT count value can be set to '0' and the remaining most significant bits of the count value CNT can be set to '1'. Accordingly, in various forms of implementation, once the verification module 1022 has programmed the initial value and / or the final value, the verification module 1022 does start the counter 1080. In various embodiments, setting the initial value and / or final of the 1080 counter in phase 5016 is purely optional. In fact, when The bits of counter 1080 are checked sequentially in steps 5004 to 5014 from bit MSB, CNT count value can already have a suitable value and the verification module 1022 can just restart counter 1080 in step 5016. Therefore, once it has started the 1080 counter, the module check 1022 can check in a step 5018 whether the counter 1080 reaches the value final. In general, during this operation the processing system 10a, e.g., the fault collection and error handling circuit 120, should be configured so such that the trigger signal TRIG1 does not generate a RST reset of the microprocessor 102, otherwise the verification would be interrupted. For example, in various embodiments, the processing system 10a, e.g., the fault collection and error handling circuit 120, is configured such that the trigger signal TRIG1 generates a microprocessor IRQ interrupt 102. Of Consequently, in this case, the verification module 1022 can monitor in step 5018 the respective interrupt signal. In addition or alternatively, in various forms of implementation, the 1022 verification form can monitor the count value in order to determine whether the count value CNT has reached its final value. Preferably, both operations are combined, i.e., the software module 1022 monitors the IRQ interrupt signal, because this ensures that the counter 1080 is capable of generating the trigger signal TRIG1, and therefore the count value CNT, because this ensures that the TRIG1 trigger signal is generated when the value of CNT count reaches final (expected) value. Consequently, when the test shows a malfunction (output “N” of the verification phase 5018), e.g., in response to a determination that the interrupt signal IRQ was not generated or CNT count value does not reach the value of final count, e.g., within a given time period, the audit form 1022 can proceed to error step 5020. Conversely, when the verification is successful (output “Y” of verification phase 5018), e.g., in response to a determination that the IRQ interrupt signal has been generated and that the CNT count value reaches the final count value, it is considered that the counter is working properly and the execution of procedure 500 ends in the late 5022 phase. In light of the above, this solution provides advantageously a software security control mechanism intended to evaluate the functionality of a counter by checking whether the bits of the count value CNT have had a reversal e.g., from 0 to 1 or vice versa, during the counter operation. Specifically, in various embodiments, a reversal is sequentially verified of individual bits of a given number of most significant bits. Optionally, the operation of the counter for the remaining least significant bits is verified by performing an operation counting for these least significant bits. Naturally, while maintaining the basic principles of the solution described here, the Construction details and embodiments may vary, even in appreciable, compared to what has been described and illustrated here, purely as a example, without thereby departing from the scope of this solution, as defined by the claims that follow.

Claims

1. A method (500) for testing a digital hardware counter circuit (108), wherein the counter circuit (108) includes a register (1082) configured to store a count value (CNT) and a digital down or up counter (1080), wherein the digital down or up counter (1080) is configured to: - determine whether a signal indicates that the digital down or up counter (1080) is enabled or disabled, - in response to a determination that the signal indicates that the digital down or up counter (1080) is enabled, vary the count value (CNT): a) in the case of a down counter (1080), decrementing the count value (CNT) by a step size in response to a clock signal (CLK), or b) in the case of an up counter (1080), incrementing the count value (CNT) by a step size in response to a clock signal (CLK), wherein the count value (CNT) has a given number of bits (X);- determine whether the count value (CNT) reaches a final value; and - in response to a determination that the count value (CNT) reaches the final value, assert a trigger signal (TRIG1);wherein the method comprises performing the following steps by means of software instructions executed by a microprocessor (102): - checking a plurality of most significant bits of the count value (CNT) by repeating the following steps for each bit position (N) of the plurality of most significant bits of the count value (CNT): - writing (5004) the register (1082) to set the count value (CNT) to a binary value (T), wherein: a) in the case of a down counter (1080), the bit of the binary value (T) in bit position (N) is set high and the lowest bits of the binary value (T) are set low, or b) in the case of an up counter (1080), the bit of the binary value (T) in bit position (N) is set low and the lowest bits of the binary value (T) are set high; - enable (5006) the digital down or up counter (1080), whereby the digital down or up counter (1080) varies the count value (CNT);- disabling (5008) the digital down or up counter (1080); - determining (5010) whether one or more bits of the count value (CNT) have a respective expected value, determining (5010) including: a) in the case of a down counter (1080), determining whether the bit in bit position (N) is low, or b) in the case of an up counter (1080), determining whether the bit in bit position (N) is high, - in response to a determination that at least one of the one or more bits of the count value (CNT) does not have its respective expected value, reporting (5020) a malfunction of the digital hardware counter circuit (108); and - in response to a determination that each of the one or more bits of the count value (CNT) has its respective expected value, selecting a next bit position (N) of the plurality of most significant bits of the count value (CNT).; 2. A method according to Claim 1, wherein: a) in the case of a down counter (1080), the most significant bits of the binary value (T) are set low, or b) in the case of an up counter (1080), the most significant bits of the binary value (T) are set high.

3. A method according to Claim 1 or Claim 2, wherein the method verifies the plurality of most significant bits of the count value (CNT) by starting with the bit position (X) of the most significant bit of the count value (CNT) and selecting as the next bit position (N) the next lowest bit position of the plurality of most significant bits of the count value (CNT).

4. A method according to any preceding claim, wherein determining (5010) whether one or more bits of the count value (CNT) have a respective expected value, comprises: a) in the case of a down counter (1080), determining whether one or more bits of the count value (CN) in the lower bit positions compared to the bit position (N) are set high, or b) in the case of an up counter (1080), determining whether one or more bits of the count value (CN) in the lower bit positions compared to the bit position (N) are set low.

5. A method according to any preceding claim, wherein determining (5010) whether one or more bits of the count value (CNT) have a respective expected value, comprises: - in the case where the bit position (N) corresponds to the bit position of the most significant bit of the count value (CNT), determining (5010) whether all bits of the plurality of most significant bits of the count value (CNT) have a respective expected value.

6. A method according to any preceding claim, comprising: - checking the remaining least significant bits of the count value (CNT): - enabling (5006) the digital down or up counter (1080), - determining (5018) whether the count value (CNT) reaches the final value and / or the digital down or up counter (1080) asserts the trigger signal (TRIG1).

7. The method of claim 6, wherein determining (5018) whether the count value (CNT) reaches the final value and / or the digital down or up counter (1080) asserts the trigger signal (TRIG1) comprises: - determining whether the digital down or up counter (1080) asserts the trigger signal (TRIG1) within a given period of time; - in response to a determination that the digital down or up counter (1080) asserts the trigger signal (TRIG1), determining whether the count value (CNT) corresponds to the final value; - in response to a determination that the digital down or up counter (1080) does not assert the trigger signal (TRIG1) or that the count value (CNT) does not correspond to the final value, reporting (5020) a malfunction of the digital hardware counter circuit (108).

8. The method according to Claim 6 or Claim 7, wherein the trigger signal (TRIG1) is provided as an interrupt signal (IRQ) to the microprocessor (102) and determining whether the digital down or up counter (1080) asserts the trigger signal (TRIG1) comprises monitoring the interrupt signal (IRQ).

9. A method according to any of the preceding claims 6 to 8, comprising, prior to enabling (5006) the digital down or up counter (1080), setting the count value (CNT) to an initial value, which ensures that the value of each of the least significant bits of the count value (CNT) inverts at least once when counting from the initial value to the final value.

10. The method of Claim 9, wherein: a) in the case of a down counter (1080), the final value corresponds to zero and the initial value corresponds to a bit sequence having the plurality of the most significant bits of the count value (CNT) set low, and the most significant bit of the remaining least significant bits of the count value (CNT) set high; or a) in the case of an up counter (1080), the initial value corresponds to zero and the final value corresponds to a bit sequence having the plurality of the most significant bits of the count value (CNT) set low, and the most significant bit of the remaining least significant bits of the count value (CNT) set high.

11. A computing system (10) comprising: - a digital hardware counter circuit (108); - a microprocessor (102) connected to the digital hardware counter circuit (108); - a non-volatile memory (104) storing a computing product to be loaded into the memory of the microprocessor (102), wherein the computing product comprises portions of software code which, when executed by the microprocessor, implement the steps of the method according to any of Claims 1 to 10.

12. A computer product that can be loaded into the memory of at least one processor (102), wherein the computer product comprises portions of software code that, when executed by the at least one processor, implement the steps of the method according to any of Claims 1 to 10.