Hardware Fault Checking

Abstract

To provide a fault check circuit which performs a fault check without software intervention, a method and a system on chip.SOLUTION: A system on chip having a fault check circuit includes: a first channel comparator to output a first channel comparator output signal indicating whether or not a first channel digital signal is outside of a first channel threshold range, wherein the first channel digital signal is A / D converted from a first channel analog signal; a second channel comparator to output a second channel comparator output signal indicating whether or not a second channel digital signal is outside of a second channel threshold range, wherein the second channel digital signal is A / D converted from a second channel analog signal; and an alarm generator circuit to combine the first and second channel comparator output signals, and output a fault check signal. The first and second channel comparators and the alarm generator circuit are implemented in hardware, and the fault check circuit performs a fault check without software intervention.SELECTED DRAWING: None

Description

Background Art

[0001] The functions of many automotive-related applications are required to be at Automotive Safety Integrity Level D (ASIL D). ASIL D corresponds to the highest class of the International Organization for Standardization (ISO) 26262 in that a malfunction can seriously endanger life or cause fatal damage, and includes the strictest level of safety measures taken to avoid unreasonable residual risks.

[0002] Analog data acquisition for engine management systems (EMS) and braking is at ASIL D. Analog data acquisition is the process of measuring an analog data signal and converting that analog data signal into digital data. In the case of ASIL-D analog data acquisition, at least two homogeneous or heterogeneous analog / digital converter (ADC) channels are used to detect random hardware failures. According to the conventional method, a central processing unit (CPU), which is also at ASIL-D, reads the values of different ADC channels and performs a fault check. This fault check allows the software to determine whether the analog data signal has been captured without any faults in order to meet the requirements of ASIL-D. If the fault check indicates a fault, the CPU causes an alarm, for example, by means of a safety management unit (SMU), for reaction. The number of analog inputs that a complex system-on-chip (SoC) has to measure exceeds 100. Even if only 10% of those signals have to be at ASIL D, a significant amount of CPU bandwidth is consumed for the fault check based on the analog / digital conversion signals output from multiple different channels.

Brief Description of the Drawings

[0003]

Figure 1

Figure 2

DETAILED DESCRIPTION OF THE INVENTION

[0004] The present disclosure relates to a failure check circuit implemented in hardware and is configured to perform a failure check without the intervention of software.

[0005] FIG. 1 shows a schematic diagram of a system-on-chip (SoC) 10 having a failure check circuit 100 according to an aspect of the present disclosure, together with a safety management unit (SMU) 20.

[0006] The failure check circuit 100 includes a first channel 110, a second channel 120, and an alarm generator circuit 130. The second channel 120 provides redundancy for the first channel 110. The first channel 110 and the second channel 120 may be of the same type or, alternatively, of different types in any suitable manner.

[0007] The first channel 110 includes a first channel analog / digital converter (ADC) 112, a first channel digital channel signal register 114, a first channel threshold range register 116, and a first channel comparator 118.

[0008] The first channel ADC 112 is configured to convert a first channel analog signal into a first channel digital signal, which is stored in the first channel digital channel signal register 114. The first channel analog signal is measured and stored using a time window that can be of any suitable length. The first channel digital signal and the first channel digital channel signal register may each be referred to herein using the reference numeral 114.

[0009] The first channel threshold range register 116 is configured to store the threshold range of the acceptable first channel digital signal value. In this case, the first channel digital signal having a value outside this range represents a failure. The register 116 is configured to store a threshold range as opposed to a single threshold because the analog portion of the first channel 110 has inherent noise. The threshold range has an acceptable range based on how safety-critical the measurement is. As the degree of safety-criticality of the application increases, the possible acceptable range becomes narrower, and as the degree of safety-criticality of the application decreases, the possible acceptable range becomes wider. The first channel threshold range register and the first channel threshold range stored therein may also be referred to herein using the reference numeral 116, respectively.

[0010] The first channel comparator 118 is configured to compare the first channel digital signal 114 with the first channel threshold range 116 and output a first channel comparator output signal SR0 indicating whether the first channel digital signal is within the first channel threshold range. For example, if the first channel threshold range 116 is 3.7V to 4.8V and the first channel digital signal 114 has a voltage value outside this threshold range (i.e., less than 3.7V or greater than 4.8V), the first channel comparator output signal SR0 will represent a failure. For example, the first channel comparator output signal SR0 can represent a failure when its value is 1 and can represent a safe state when its value is 0, although these values are merely design choices.

[0011] Similar to the first channel 110, the second channel 120 includes a second-channel ADC 122, a second-channel digital channel signal register 124, a second-channel threshold range register 126, and a second-channel comparator 128. In this embodiment, the first channel 110 and the second channel 120 are of the same type and thus operate in the same manner. Briefly, the second-channel ADC 122 is configured to convert a second-channel analog signal into a second-channel digital signal, which is stored in the second-channel digital channel signal register 124. The second-channel threshold range register 126 is configured to store a threshold range of acceptable second-channel digital signal values. The second-channel comparator 128 is configured to compare the second-channel digital signal 124 with the second-channel threshold range 126 and output a second-channel comparator output signal SR1 indicating whether the second-channel digital signal is within the second-channel threshold range.

[0012] The alarm generator circuit 130 of this embodiment includes a demultiplexer 132, at least one logic gate 134, and a multiplexer 136. The alarm generator circuit 130 combines the first-channel comparator output signal SR0 and the second-channel comparator output signal SR1 at a frequency according to the design of the application.

[0013] The demultiplexer 132 is configured to demultiplex the first-channel comparator output signal SR0 and the second-channel comparator output signal SR1 for input to one or more of the logic gates 134.

[0014] The logic gate 134 is configured to combine the first-channel comparator output signal SR0 and the second-channel comparator output signal SR1 and output a fault check signal. The logic gate 134 can have any type or number of logic gates and can be selected, for example, from among the AND gate 134-A, the OR gate 134-O, and the XOR gate 134-X. If the logic gate is a single AND gate 134-A, the alarm generator circuit 130 outputs a fault check signal indicating a fault to trigger an alarm when both the first-channel comparator 118 and the second-channel comparator 128 output channel comparator output signals SR0 and SR1 indicating a fault (for example, SR0 = 1, SR1 = 1). If the logic gate is a single OR gate 134-O, the alarm generator circuit 130 outputs a fault check signal indicating a fault to trigger an alarm when at least one of the first-channel comparator 118 and the second-channel comparator 128 outputs channel comparator output signals SR0 and SR1 indicating a fault (for example, SR0 = 0 and SR1 = 1; SR0 = 1 and SR1 = 0; or SR0 = 1 and SR1 = 1). If the logic gate is a single XOR gate 134-X, the alarm generator circuit 130 outputs a fault check signal indicating a fault to trigger an alarm when only one of the first-channel comparator 118 and the second-channel comparator 128 outputs channel comparator output signals SR0 and SR1 that are 1 (for example, SR0 = 0 and SR1 = 1; or SR0 = 1 and SR1 = 0). Of course, if only a single logic gate 134 is provided, the demultiplexer 132 and the multiplexer 136 are unnecessary.

[0015] As an alternative to the logic operation, the alarm generator circuit 130 may be designed to perform a numerical operation. An exemplary numerical operation may be a subtraction performed by a subtractor (not shown) configured to subtract the first channel comparator output signal SR0 and the second channel comparator output signal SR1 from each other, and the difference is used to determine the fault check signal. The difference may be considered equal to zero (0), simply positive (+) or negative (-), or the actual amount of the difference. Thus, if the first channel comparator output signal SR0 and the second channel comparator output signal SR1 are not equal, or if they are significantly different by a predetermined amount, the fault check signal can indicate a fault.

[0016] The multiplexer 136 is configured to select one of the output signals of the plurality of logic gates 134 and output a fault check signal. The fault check signal can be output to, for example, the SMU20, which is configured to perform an alarm action when the fault check signal indicates a fault. The alarm action can be, for example, a system reset, a system shutdown, or a system alert, but the present disclosure is not limited in this regard.

[0017] The alarm generator circuit 130 can be configured to output a fault check signal within a fault tolerance time interval (FTTI), such as 10 ms. The FTTI is the time during which a fault may exist in the system before a dangerous event occurs. Therefore, the FTTI represents the total target time that the system must meet to transition to a safe state. The FTTI is always longer than the diagnostic time interval (DTI), which is the time for detecting an error. For example, in the case of a combustion engine, since there is a mechanism between the engine and the wheels, the DTI is in the range of milliseconds. However, in the case of an electric motor, since there is no gearbox between them, the DTI is only in the range of a few hundred microseconds.

[0018] More channels can be provided than the two channels 110 and 120. For example, a third channel having a third-channel comparator implemented in hardware can be provided. The third-channel comparator compares a third-channel digital signal with a third-channel threshold range and is configured to output a third-channel comparator output signal indicating whether the third-channel digital signal is outside the third-channel threshold range. The third-channel digital signal will be analog / digitally converted from a third-channel analog signal. Also, the alarm generator circuit will be configured to combine the first-channel comparator output signal, the second-channel comparator output signal, and the third-channel comparator output signal in any applicable manner, such as by a specific majority decision method.

[0019] The first-channel comparator 118, the second-channel comparator 128, and the alarm generator circuit 130 are implemented in hardware. Thus, the fault check circuit 100 is configured to perform a fault check without the intervention of software.

[0020] FIG. 2 shows a flowchart 200 of a method for performing a fault check according to an aspect of the present disclosure.

[0021] In step 210, the first-channel comparator 118 compares the first-channel digital signal 114 with the first-channel threshold range 116.

[0022] In step 220, the first-channel comparator 118 outputs a first-channel comparator output signal SR0 indicating whether the first-channel digital signal 114, which is analog / digitally converted from the first-channel analog signal, is outside the first-channel threshold range 116.

[0023] In step 230, the second-channel comparator 128 compares the second-channel digital signal 124 with the second-channel threshold range 126.

[0024] In step 240, the second channel comparator 128 outputs a second channel comparator output signal SR1 indicating whether the second channel digital signal 124 obtained by analog / digital conversion from the second channel analog signal is outside the second channel threshold range 126.

[0025] In step 250, the alarm generator circuit 130 combines the first channel comparator output signal SR0 and the second channel comparator output signal SR1.

[0026] In step 260, the alarm generator circuit 130 outputs a fault check signal based on this combination.

[0027] The fault check circuit 100 is configured to perform fault checks in the ASIL D manner using hardware instead of software. When a fault occurs, an alarm is directly triggered by the hardware without the involvement of software or the CPU.

[0028] The technology of the present disclosure can also be described in the following embodiments.

[0029] Example 1. The fault check circuit includes a first channel comparator configured to compare a first channel digital signal obtained by analog / digital conversion from a first channel analog signal with a first channel threshold range and output a first channel comparator output signal indicating whether the first channel digital signal is outside the first channel threshold range, a second channel comparator configured to compare a second channel digital signal obtained by analog / digital conversion from a second channel analog signal with a second channel threshold range and output a second channel comparator output signal indicating whether the second channel digital signal is outside the second channel threshold range, and an alarm generator circuit configured to combine the first channel comparator output signal and the second channel comparator output signal and output a fault check signal. The first channel comparator, the second channel comparator, and the alarm generator circuit are implemented in hardware, and the fault check circuit is configured to perform fault checking without software intervention.

[0030] Example 2. The fault check circuit described in Example 1 further includes a first channel threshold range register configured to store the first channel threshold range and a second channel threshold range register configured to store the second channel threshold range.

[0031] Example 3. The fault check circuit described in Example 2, wherein the first channel comparator, the first channel threshold range register, and a first analog / digital converter (ADC) configured to convert the first channel analog signal into a first channel digital signal are provided within the first channel, and the second channel comparator, the second channel threshold range register, and a second ADC configured to convert the second channel analog signal into a second channel digital signal are provided within the second channel.

[0032] Example 4. The fault check circuit described in Example 3, wherein the first channel and the second channel are of the same type.

[0033] Example 5. A fault check circuit as described in Example 3, wherein the first channel and the second channel are different types.

[0034] Example 6. A fault check circuit as described in Example 1, wherein the alarm generator circuit is configured to output a fault check signal to a safety management unit (SMU), and the safety management unit is configured to perform an alarm action based on the fault check signal.

[0035] Example 7. A fault check circuit as described in Example 1, wherein the alarm generator circuit has a logic gate configured to combine the first channel comparator output signal and the second channel comparator output signal.

[0036] Example 8. A fault check circuit as described in Example 7, wherein the logic gate is an AND gate, an OR gate, or an XOR gate.

[0037] Example 9. A fault check circuit as described in Example 1, wherein the alarm generator circuit has a subtractor configured to subtract the first channel comparator output signal from the second channel comparator output signal.

[0038] Example 10. A fault check circuit as described in Example 1, wherein the alarm generator circuit has a plurality of logic gates configured to combine the first channel comparator output signal and the second channel comparator output signal to output a plurality of individual logic gate signals.

[0039] Example 11. In the fault check circuit as described in Example 10, the alarm generator circuit has a demultiplexer and a multiplexer. The demultiplexer is configured to demultiplex the first channel comparator output signal and the second channel comparator output signal for input to the plurality of logic gates, and the multiplexer is configured to select one of the plurality of logic gates and output an individual logic gate signal.

[0040] Example 12. In the fault check circuit described in Example 10, the plurality of logic gates have any one of an AND gate, an OR gate, and an XOR gate.

[0041] Example 13. A fault check circuit described in Example 1, further comprising a third-channel comparator implemented in hardware, the third-channel comparator comparing a third-channel digital signal obtained by analog / digital conversion from a third-channel analog signal with a third-channel threshold range and outputting a third-channel comparator output signal indicating whether the third-channel digital signal is outside the third-channel threshold range. In this case, the alarm generator circuit is configured to combine the first-channel comparator output signal, the second-channel comparator output signal, and the third-channel comparator output signal by means of a specific majority decision.

[0042] Example 14. A fault check circuit described in Example 1, wherein the alarm generator circuit is configured to output a fault check signal to a safety management unit (SMU) within a fault tolerance time interval (FTTI).

[0043] Example 15. A system-on-chip (SoC) having a fault check circuit that performs the fault check described in Example 1 and a safety management unit (SMU) configured to perform an alarm action based on a fault check signal.

[0044] Example 16. In the SoC described in Example 15, the alarm action is a system reset, a system shutdown, or a system alert.

[0045] Example 17. A method for performing a fault check, comprising: comparing a first-channel digital signal obtained by analog / digital conversion from a first-channel analog signal with a first-channel threshold range, and outputting a first-channel comparator output signal indicating whether the first-channel digital signal is outside the first-channel threshold range; a first-channel comparator; comparing a second-channel digital signal obtained by analog / digital conversion from a second-channel analog signal with a second-channel threshold range, and outputting a second-channel comparator output signal indicating whether the second-channel digital signal is outside the second-channel threshold range; a second-channel comparator; combining the first-channel comparator output signal and the second-channel comparator output signal, and an alarm generator circuit that outputs a fault check signal based on this combination, wherein the first-channel comparator, the second-channel comparator, and the alarm generator circuit are implemented in hardware, and this method is implemented without the intervention of software.

[0046] Example 18. The method according to Example 17, wherein the combination includes a multiplexer selecting one of a plurality of logic gates and outputting a logic gate signal of the selected logic gate.

[0047] Example 19. The method according to Example 17, further comprising a safety management unit (SMU) that performs an alarm action based on the fault check signal.

[0048] Example 20. The method according to Example 19, wherein the fault check signal indicates a fault if the first-channel comparator output signal and the second-channel comparator output signal are not equal.

[0049] Although the foregoing description has been presented with exemplary embodiments, it should be apparent that the term "exemplary" is used herein only to mean an example rather than the best or optimal. Accordingly, the present disclosure is intended to cover alternatives, modifications, and equivalents, and these can be included within the scope of the present disclosure.

[0050] Although specific embodiments have been shown and described in this specification, as will be apparent to those skilled in the art, various alternative and / or equivalent implementations can be used in place of the specific embodiments shown and described without departing from the scope of the present disclosure. The present disclosure is intended to cover any modification or variation of the specific embodiments discussed herein.

Claims

1. A fault check circuit, wherein the fault check circuit compares a first channel digital signal obtained by analog / digital conversion from a first channel analog signal with a first channel threshold range, and outputs a first channel comparator output signal indicating whether or not the first channel digital signal is outside the first channel threshold range; a first channel comparator configured to compares a second channel digital signal obtained by analog / digital conversion from a second channel analog signal with a second channel threshold range, and outputs a second channel comparator output signal indicating whether or not the second channel digital signal is outside the second channel threshold range; a second channel comparator configured to an alarm generator circuit configured to combine the first channel comparator output signal and the second channel comparator output signal to output a fault check signal; and has the first channel comparator, the second channel comparator, and the alarm generator circuit are implemented in hardware, and the fault check circuit is configured to perform a fault check without the intervention of software. Fault check circuit.

2. The fault check circuit further includes a first channel threshold range register configured to store the first channel threshold range; and a second channel threshold range register configured to store the second channel threshold range. The fault check circuit according to claim 1.

3. The first channel comparator, the first channel threshold range register, and a first analog / digital converter (ADC) configured to convert the first channel analog signal into the first channel digital signal are provided within the first channel, and the second channel comparator, the second channel threshold range register, and a second analog / digital converter configured to convert the second channel analog signal into the second channel digital signal are provided within the second channel. The fault check circuit according to claim 2.

4. The first channel and the second channel are of the same type. The fault check circuit according to claim 3.

5. The first channel and the second channel are of different types. The fault check circuit according to claim 3.

6. ​ The alarm generator circuit is configured to output the fault check signal to a safety management unit (SMU), and the safety management unit is configured to perform an alarm action based on the fault check signal. The fault check circuit according to claim 1.

7. The alarm generator circuit has a logic gate configured to combine the first channel comparator output signal and the second channel comparator output signal. The fault check circuit according to claim 1.

8. The logic gate is an AND gate, an OR gate, or an XOR gate. The fault check circuit according to claim 7.

9. The alarm generator circuit has a subtractor configured to subtract the first channel comparator output signal from the second channel comparator output signal. The fault check circuit according to claim 1.

10. The alarm generator circuit has a plurality of logic gates configured to combine the first channel comparator output signal and the second channel comparator output signal to output a plurality of individual logic gate signals. The fault check circuit according to claim 1.

11. The alarm generator circuit has a demultiplexer and a multiplexer. The demultiplexer is configured to demultiplex the first channel comparator output signal and the second channel comparator output signal so as to be input to the plurality of logic gates. The multiplexer is configured to select one of the plurality of logic gates and output the individual logic gate signal. The fault check circuit according to claim 10.

12. The plurality of logic gates have any one of an AND gate, an OR gate, and an XOR gate. The fault check circuit according to claim 10.

13. The fault check circuit further has a third channel comparator implemented in hardware. The third channel comparator compares a third channel digital signal obtained by analog / digital conversion from a third channel analog signal with a third channel threshold range and outputs a third channel comparator output signal indicating whether the third channel digital signal is outside the third channel threshold range. The alarm generator circuit is configured to combine the first channel comparator output signal, the second channel comparator output signal, and the third channel comparator output signal by performing a specific majority vote. The fault check circuit according to claim 1.

14. The alarm generator circuit is configured to output the fault check signal to a safety management unit (SMU) within a fault tolerance time interval (FTTI). The fault check circuit according to claim 1.

15. A system-on-chip (SoC), wherein the system-on-chip (SoC) A fault check circuit that performs the fault check according to claim 1, A safety management unit (SMU) configured to perform an alarm action based on a fault check signal, A system-on-chip (SoC) having the above.

16. The alarm action is a system reset, a system shutdown, or a system alert. The system-on-chip according to claim 15.

17. A method for performing a fault check, the method comprising: A step in which a first channel comparator compares a first channel digital signal obtained by analog / digital conversion from a first channel analog signal with a first channel threshold range, and outputs a first channel comparator output signal indicating whether the first channel digital signal is outside the first channel threshold range; A step in which a second channel comparator compares a second channel digital signal obtained by analog / digital conversion from a second channel analog signal with a second channel threshold range, and outputs a second channel comparator output signal indicating whether the second channel digital signal is outside the second channel threshold range; A step in which an alarm generator circuit combines the first channel comparator output signal and the second channel comparator output signal, and outputs a fault check signal based on the combination; having The first channel comparator, the second channel comparator, and the alarm generator circuit are implemented in hardware, and the steps are performed without software intervention. Method.

18. The combination includes a multiplexer selecting one of a plurality of logic gates and outputting a logic gate signal of the selected logic gate. The method according to claim 17. **Claim 19**: The method further includes a step in which a safety management unit (SMU) performs an alarm action based on the fault check signal. The method according to claim 17. **Claim 20** The fault check signal indicates a fault if the first channel comparator output signal and the second channel comparator output signal are not equal. The method according to claim 19.

Images