Error detection system and its operation method applicable to RTL modules

Abstract

To provide an error detection system which can maintain a synchronized state even when an asynchronous signal is input into a RTL module with a single clock domain and a multiple reset, and can execute an operation of comparing two modules continuously, and to provide a method for operating the error detection system.SOLUTION: A first comparison unit 171 and a second comparison unit 172 compare a first electric signal and a second electric signal, the presence of an error in a first function block 110 or in a second function block 120 is confirmed, the result of a first comparison and the result of a second comparison are output, an error in one of the first function block 110 and the second function block 120 is confirmed on the basis of the first comparison result and the second comparison result, an error in one of the first comparison unit 171 and the second comparison unit 172 is confirmed, and one of an error report signal and a potential defect report signal is output according to the result of the confirmation.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to an error detection system applicable to an RTL (Register Transfer Level) module having a single clock domain and multiple resets, and an operation method thereof.

Background Art

[0002] Dual Core Lock step (DCLS) is a method in which two identical processor cores execute the same instruction and compare the two results of executing the same instruction to detect an error. Dual Core Lock step is an important component of a Fault Tolerant System (FTS) that can continuously execute defined functions even when hardware, software defects, malfunctions, errors, etc. occur.

[0003] That is, even if a part of the system fails, the fault tolerant system enables the entire system to continue to operate normally through the dual core lock step. Dual Core Lock step is mainly used in various fields such as aerospace, automotive, and medical equipment, and greatly contributes to maintaining the systems implemented in each field in a safe state and improving functional safety.

[0004] Such a dual core lock step requires that the two cores be completely synchronized. Not only temporal synchronization but also all inputs and external events in all dual core lock steps must be synchronized. That is, system errors cannot be detected unless all registers, memories, and other states of the two cores are always the same.

[0005] Therefore, the two synchronized cores must perform all state transitions using the same procedure, and after executing the same instruction on both cores, they must produce the same result. Furthermore, the results of the two synchronized cores are continuously compared, and if the dual-core lockstep detects a mismatch, an error is reported.

[0006] Therefore, if the system operates through asynchronous inputs (such as a reset) that change the state of the two cores regardless of the clock edge, there may be cases where the two cores cannot maintain a synchronized state. Consequently, a disadvantage is that it is not possible to determine whether the system has failed through dual-core lockstep. [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] Therefore, this invention provides an error detection system and its operating method applicable to RTL modules that can maintain a synchronized state and continuously perform comparison operations between two modules, even when an asynchronous signal is input to an RTL module having a single clock domain and multiple resets. [Means for solving the problem]

[0008] One feature of the present invention for achieving the technical objectives of the present invention is a method for operating an error detection system operated by at least one processor, comprising the steps of: a first functional block outputting a first electrical signal for one input, and a second functional block performing the same function as the first functional block outputting a second electrical signal for the same input; a first comparator and a second comparator comparing the first electrical signal and the second electrical signal, respectively, to check for the presence or absence of an error in the first functional block or the second functional block, and outputting a first comparison result and a second comparison result; and confirming an error in either the first functional block or the second functional block, or confirming an error in either the first comparator or the second comparator, based on the first and second comparison results, and outputting an error reporting signal or a potential defect reporting signal based on the confirmation result.

[0009] The step of outputting the second electrical signal may involve the first functional block outputting a delayed first electrical signal after a predetermined number of cycles, and the second functional block receiving the input signal delayed by the number of cycles and outputting the second electrical signal.

[0010] The first comparator and the second comparator can compare the delayed first electrical signal and the second electrical signal, respectively.

[0011] The step of outputting the second comparison result may further include the step of checking whether a reset signal affecting the first and second functional blocks has been activated among a plurality of reset signals; the step of controlling the state of the first and second comparators from an operating state to a standby state so as to interrupt the comparison of the delayed first and second electrical signals when the reset signal is activated; and the step of operating a counter for a preset cycle.

[0012] The step of operating the counter may further include a step of checking whether the preset cycle has elapsed based on the standby count received from the counter, and if the cycle has elapsed, controlling the state of the first comparator and the second comparator from the standby state to the operating state.

[0013] The step of outputting the potential defect report signal may include the step of outputting the error report signal indicating that there is an error in either the first or second functional block if the first comparison result and the second comparison result match a preset signal, and the step of outputting the potential defect report signal indicating that there is a defect in either the first or second comparator if the first and second comparison results do not match.

[0014] After the step of outputting the potential defect reporting signal, the procedure may include checking whether an error clear signal has been received, and if the error clear signal has been received, comparing a new first electrical signal and a new second electrical signal that were input after the time the error clear signal was received.

[0015] An error detection system with another feature of the present invention for achieving the technical objectives of the present invention, comprising: one or more functional blocks that each receive an input signal at a first time point and each output an electrical signal corresponding to the input signal; a delay module connected to either the input terminal or output terminal of each of the one or more functional blocks and delaying the electrical signal or the input signal by a preset number of cycles; one or more comparators connected to the output terminal of any one of the functional blocks or the delay module and comparing the electrical signal output from the functional block with the delayed electrical signal output from the delay module and outputting the comparison result; and an error processor that determines whether an error is necessary in any one of the functional blocks or the comparator based on the comparison result output from the comparators.

[0016] The functional block may include a first functional block that outputs a first electrical signal for the input signal received at the first time, and a second functional block that receives an input signal delayed by a preset number of cycles at the first time by the delay module and outputs a second electrical signal for the second electrical signal.

[0017] The delay module may include a first delay module that delays the first electrical signal by a preset number of cycles to generate a delayed first electrical signal, and a second delay module that delays the input signal received at the first time point by the specified number of cycles and transmits the delayed input signal to the second functional block.

[0018] The system may further include a reset synchronization module that controls the operation of the first and second functional blocks.

[0019] The reset synchronization module may include a first reset synchronization module that synchronizes the reset and release of the first functional block when a first reset signal affecting the first functional block is activated, and a second reset synchronization module that synchronizes the reset and release of the second functional block when a first reset signal affecting the second functional block is activated.

[0020] The comparator may include a first comparator that compares the delayed first electrical signal with the second electrical signal and outputs a first comparison result, and a second comparator that outputs a second comparison result.

[0021] The first comparator and the second comparator each include a comparison module that compares the delayed first electrical signal and the second electrical signal to check for errors in the first functional block or the second functional block, and a control module that, when the first reset signal is input, controls the states of the first comparator and the second comparator to change from the operating state to the standby state, and aborts the comparison of the comparison module.

[0022] The first comparator and the second comparator can each further include a counter that increments a standby count for a preset cycle when the first reset signal is input.

[0023] The first comparator and the second comparator can each further include a delay device that delays the error clear signal received from the error processor by a preset cycle and transmits it to the control module.

[0024] The control module can receive the standby count from the counter and control the state of the comparison module to change from the standby state to the operating state based on the received standby count.

[0025] The error processor can include an AND gate that performs an AND operation on the first comparison result received from the first comparator and the second comparison result received from the second comparator, and outputs the result as an error report signal for either the first functional block or the second functional block.

[0026] The error processor can further include an XOR gate that performs an XOR operation on the first comparison result and the second comparison result, and outputs the operation result as a potential defect report signal for the first comparator or the second comparator.

[0027] The error processor can include an OR gate that receives response signals for the error report signal and the potential defect report signal respectively, and performs an OR operation on the received response signals to generate an error clear signal.

Advantages of the Invention

[0028] According to the present invention, by performing a comparison operation of two modules on an asynchronous reset signal through an error detection system having a dual-core lock step structure, it is possible to detect errors in ordinary modules having a single clock or multiple resets.

[0029] In addition, when an error is detected, it is possible to confirm whether the cause of the error is an error due to a safety mechanism or an error generated in the RTL module, so that it is possible to prepare for potential errors (latent faults) that may occur in the RTL module.

Brief Description of the Drawings

[0030] [Figure 1] It is an exemplary diagram of an error detection system according to an embodiment of the present invention. [Figure 2] It is a structural diagram of a comparator according to an embodiment of the present invention. [Figure 3] It is a structural diagram of an error processor according to an embodiment of the present invention. [Figure 4] It is a flowchart for the operation of an error detection system according to an embodiment of the present invention. [Figure 5] It is an exemplary diagram of a timing diagram according to an embodiment of the present invention. [Figure 6] It is an exemplary diagram of a timing diagram according to an embodiment of the present invention. [Figure 7] It is an exemplary diagram of a timing diagram according to an embodiment of the present invention.

Modes for Carrying Out the Invention

[0031] Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings, so that those with ordinary skill in the art to which the present invention pertains can easily implement it. However, the present invention can be implemented in various forms and is not limited to the embodiments described herein. Furthermore, in order to clearly illustrate the present invention with reference to the drawings, parts unrelated to the description have been omitted, and similar parts throughout the specification have been given similar reference numerals.

[0032] Throughout the specification, when a part "includes" a component, unless otherwise stated, it means that it may include other components rather than excluding them.

[0033] The following describes an error detection system applicable to an RTL module according to an embodiment of the present invention and its operation method, with reference to the drawings. In the embodiments of the present invention, for the sake of convenience of explanation, the "dual lock step" for functional safety is referred to as the "error detection system," but the invention is not necessarily limited to this.

[0034] Figure 1 is an illustrative diagram of an error detection system according to an embodiment of the present invention.

[0035] As shown in Figure 1, the error detection system 100, applicable to an RTL module and operated by at least one processor, includes a first function block 110 and a second function block 120 that perform the same function. In embodiments of the present invention, for convenience of explanation, the error detection system 100 is described as including a first function block 110 and a second function block 120, but it may include multiple function blocks.

[0036] Here, the first functional block 110 and the second functional block 120 can be various generic blocks that provide various functions to the system on which the error detection system 100 is mounted, such as a CPU, which is a core element in system-on-chip (SoC) design. In embodiments of the present invention, the first functional block 110 and the second functional block 120 are not limited to any particular form.

[0037] The first functional block 110 and the second functional block 120 synchronize with each other based on the input clock (CLK). The clock according to the embodiment of the present invention is a signal generated in a single clock domain (not shown), and the clock is input to all components constituting the error detection system 100.

[0038] The first functional block 110 and the second functional block 120 process the input signal according to its function and output the processing result as an electrical signal using a clock. The device for transmitting the input signal and the method by which the first functional block 110 and the second functional block 120 process the input signal and provide the electrical signal as output are already known technologies, and the embodiments of the present invention are not limited to any particular form.

[0039] Furthermore, when any of the reset signals affecting the first function block 110 and the second function block 120 are input, the first function block 110 and the second function block 120 are configured to output a pre-set electrical signal via their output ports.

[0040] Specifically, the first functional block 110 and the second functional block 120 each output an electrical signal corresponding to either 0 or 1, whichever is predetermined, when they receive the same reset signal. In this embodiment of the present invention, the first reset signal (or simply the "reset signal") among a plurality of reset signals is applied as an example.

[0041] A reset signal is also input to all components of the error detection system 100. Here, since there are various forms for the device that generates the reset signal and the way in which the components of the error detection system 100 operate based on the reset signal, the embodiments of the present invention are not limited to any particular form or method.

[0042] The first functional block 110 is linked to one of the multiple first reset synchronization modules, specifically one of the first reset synchronization modules 130 that affects the first functional block 110. The first functional block 110 then receives a synchronized reset signal from one of the multiple first reset synchronization modules that affects the first functional block 110.

[0043] Furthermore, the second function block 120 is linked to one of the second reset synchronization modules 160 that affects the second function block 120, which is one of the multiple second reset synchronization modules that transmit the reset signal. The second function block 120 then receives a synchronized reset signal from the linked second reset synchronization module 160.

[0044] At this time, the first reset synchronization module 130 synchronizes the reset release signal of the first function block 110 in accordance with the clock. Then, the second reset synchronization module 160 synchronizes the reset release signal of the second function block 120 in accordance with the input clock. The reason why the first reset synchronization module 130 and the second reset synchronization module 160 synchronize the reset signal or reset release signal is to synchronize the operating timing of the two function blocks 110 and 120 in relation to the asynchronous reset signal.

[0045] The first reset synchronization module 130 and the second reset synchronization module 160 are each composed of multiple modules. This is to provide synchronized reset signals to other functional blocks (not shown) that make up the error detection system 100, in addition to the first functional block 110 and the second functional block 120 in Figure 1.

[0046] In embodiments of the present invention, the first functional block 110 and the second functional block 120 are described as being affected by a first reset signal. Therefore, the first functional block 110 receives a first reset signal from the first reset synchronization module 130, and the second functional block 120 receives a first reset signal from the second reset synchronization module 160.

[0047] On the other hand, a first delay module 150 is connected to the output terminal of the first functional block 110. The first delay module 150 delays the output of the first functional block 110 by a preset time and transmits it to the comparator 170.

[0048] A second delay module 140 is connected to the input terminal of the second functional block 120. The second delay module 140 delays the input signal by a preset time before it is input to the second functional block 120.

[0049] Here, the first delay module 150 and the second delay module 140 control the operation timing of the first function block 110 and the second function block 120 separately, so that they operate at a point in time when there is a difference of a preset number of cycles between them. In an embodiment of the present invention, an example will be given in which the first function block 110 and the second function block 120 are controlled to operate at a point in time when there is a difference of two cycles between their operation timings.

[0050] In the embodiments of the present invention, the first delay module 150 and the second delay module 140 are described as being implemented with two D flip-flops, but the invention is not necessarily limited to this.

[0051] If the first functional block 110 and the second functional block 120 are operating at the same time without the first delay module 150 and the second delay module 140, an error occurring in one of the two functional blocks can be detected.

[0052] However, if errors occur simultaneously in both functional blocks 110 and 120, they will output the same value where the errors occurred. In this case, the comparator 170 may fail to detect the errors in both functional blocks 110 and 120 by comparing the same value.

[0053] Therefore, in the embodiment of the present invention, the first functional block 110 and the second functional block 120 perform the same function with different operating timings, allowing the comparator 170 to easily detect errors.

[0054] The comparator 170 according to an embodiment of the present invention senses whether or not there is an error in the first function block 110 or the second function block 120 by comparing two outputs. That is, the comparator 170 according to an embodiment of the present invention uses a plurality of comparators 171, 172 to compare the delayed first output of the first function block 110 with the second output of the second function block 120.

[0055] In the embodiments of the present invention, the example described is detecting that an error has occurred in either the first functional block 110 or the second functional block 120. However, other functional blocks can also be added to determine whether an error has occurred in either the first functional block 110 or the second functional block 120.

[0056] Furthermore, in the embodiments of the present invention, the comparator 170 is described as being composed of a first comparator 171 and a second comparator 172, but the number of comparators is not limited to two.

[0057] The first comparator 171 and the second comparator 172 receive the delayed first output of the first functional block 110 and the second output of the second functional block 120, respectively. The first comparator 171 and the second comparator 172 compare the delayed first and second outputs and transmit the comparison results, i.e., the first comparison result and the second comparison result, to the error processor 180.

[0058] The error processor 180 determines, based on the first and second comparison results output from the comparators 171 and 172, whether an error occurred in the first functional block 110 or the second functional block 120, or whether it is a latent defect in the comparator 170 itself.

[0059] The error processor 180 receives the first comparison result and the second comparison result from the first comparator 171 and the second comparator 172, respectively.

[0060] Then, based on the two comparison results received, the error processor 180 checks whether there is an error in either the first function block 110 or the second function block 120, or whether the error is due to a latent defect that caused the comparator 170 to malfunction.

[0061] Furthermore, the error processor 180 reports errors or potential defects to an external system (not shown) depending on the type of error it has identified.

[0062] In other words, the error processor 180 reports an "error" to the external system if the first comparator 171 and the second comparator 172 transmit the same comparison result. However, if the error processor 180 receives different comparison results from the first comparator 171 and the second comparator 172, the error processor 180 reports an "error due to a latent defect" to the external system.

[0063] Then, after the error processor 180 reports either an error or a potential defect to an external system and receives the accompanying ACK signal (error ACK or potential defect ACK), it transmits an error clear signal to the first comparator 171 and the second comparator 172 to indicate that the error reporting is complete. Upon receiving the error clear signal from the error processor 180, the first comparator 171 and the second comparator 172 then proceed to check for errors in other functional blocks.

[0064] The structure of the comparator 170 in such an error detection system 100 will be explained with reference to Figure 2.

[0065] Figure 2 is a structural diagram of a comparator according to an embodiment of the present invention.

[0066] As shown in Figure 2, the comparator 170 includes a first comparator 171 and a second comparator 172. In embodiments of the present invention, the first comparator 171 and the second comparator 172 are described as including the same components, that is, the same circuit pair is duplicated to embody the first comparator 171 and the second comparator 172.

[0067] The first comparator 171 and the second comparator 172 each include control modules 171-1 and 172-1, comparator modules 171-2 and 172-2, counters 171-3 and 172-3, and delayers 171-4 and 172-4, respectively.

[0068] Each control module 171-1 and 172-1 controls the state of comparators 171 and 172 to transition from the "operating" state to the "standby" state when a reset signal is input. In addition, control modules 171-1 and 172-1 receive a standby count from counters 171-3 and 172-3, and based on the received standby count, control the state of comparators 171 and 172 to either transition from the "standby" state to the "operating" state or to maintain the "standby" state.

[0069] When counters 171-3 and 172-3 receive a counter start signal from control modules 171-1 and 172-1, they increment the counter value by one based on the received clock. They then transmit the incremented value as the standby count to control modules 171-1 and 172-1.

[0070] The comparison modules 171-2 and 172-2 compare the delayed output of the first functional block 110 with the output of the second functional block 120. Then, the comparison modules 171-2 and 172-2 output the comparison results, respectively. In the embodiments of the present invention, the comparison results output by the comparison modules 171-2 and 172-2 are referred to as the "first comparison result" and the "second comparison result," but are not necessarily limited to these terms.

[0071] At this time, the comparison modules 171-2 and 172-2 can compare the delayed output of the first functional block 110 with the output of the second functional block 120, interrupt the comparison, or resume the interrupted output comparison, based on the control signals transmitted from the control modules 171-1 and 172-1.

[0072] When delay units 171-4 and 172-4 receive an error clear from the error processor 180, they delay it by a predetermined number of cycles. Then, they transmit the delayed error clear signal to control modules 171-1 and 172-1.

[0073] The reason delayers 171-4 and 172-4 delay error clearing by a predetermined number of cycles is to prepare for cases where the ACK signal is applied from an external system and is not synchronized with the clock. The error clear signal generated by the ACK signal may undergo signal transitions when it is not synchronized with the clock.

[0074] Therefore, to prevent abnormal operation due to asynchronous error clear signals, delayers 171-4 and 172-4 delay the error clear. In the embodiments of the present invention, delayers 171-4 and 172-4 are shown as being included within comparator 170, but they can also be included in an external system.

[0075] Next, the structure of the error handler according to an embodiment of the present invention will be described with reference to Figure 3.

[0076] Figure 3 is a structural diagram of an error processing device according to an embodiment of the present invention.

[0077] As shown in Figure 3, the error handler 180 will be explained using the example of including an AND gate 181, an XOR gate 182, and an OR gate 183.

[0078] The AND gate 181 performs an AND operation on the first comparison result and the second comparison result, and transmits the result to an external system as an error reporting signal. The AND gate 181 is used to check whether there is an error in either the first functional block 110 or the second functional block 120.

[0079] The XOR gate 182 performs an XOR logic operation on the first and second comparison results and transmits the result to an external system as a latent defect report signal. In other words, the XOR gate 182 determines whether an error has occurred in either the first or second comparator 171 or 172, and if an error occurs, it notifies the external system of this as a latent defect.

[0080] When the OR gate 183 receives an acknowledgment (ACK) signal from an external system indicating that it has received an error report and a potential defect report, it performs an OR logic operation and transmits an error clear signal to the first comparator 171 and the second comparator 172.

[0081] Next, the operation method of the error detection system 100 described above will be explained with reference to Figure 4.

[0082] Figure 4 is a flowchart illustrating the operation of the error detection system according to an embodiment of the present invention.

[0083] As shown in Figure 4, the first functional block 110 and the second functional block 120 of the error detection system 100 operate and each outputs one of the pre-set electrical signals, either 0 or 1 (S100). Subsequently, the comparator 170, composed of the first comparator 171 and the second comparator 172, compares the output of the first functional block 110 with the output of the second functional block 120 to determine whether or not there is an error in either the first functional block 110 or the second functional block 120 (S101).

[0084] Then, comparison modules 171-2 and 172-2 compare the output of the input first function block 110 with the output of the second function block 120 to check if the outputs of the two function blocks match (S102). If the outputs of the two function blocks do not match, the process proceeds from step S108, which will be described later.

[0085] As a result of the verification in step S102, when the outputs of the two functional blocks match, each component of the error detection system 100 receives a reset signal as input from an external or other system (not shown in the drawing) and checks whether the reset signal has been activated (S103). That is, all components of the error detection system 100 confirm that a reset signal has been generated.

[0086] At this point, the first comparator 171 and the second comparator 172, which constitute the error detection system 100, also confirm the generation of a reset signal. In response, the control modules 171-1 and 172-1 included in the first comparator 171 and the second comparator 172, respectively, deactivate the states of the comparator modules 171-2 and 172-2 that compared the outputs, thereby controlling them to not compare the outputs (S104).

[0087] Specifically, when a reset signal is generated, the control modules 171-1 and 172-1 of the first comparator 171 and the second comparator 172, which were in the comparison state, control the first comparator 171 and the second comparator 172 from the active state to the standby state. At the same time, the control modules 171-1 and 172-1 operate the counters 171-3 and 172-3 to increment the standby count by one for a predetermined number of cycles. Therefore, the counters 171-3 and 172-3, under the control of the control modules 171-1 and 172-1, count one cycle at a time in sync with the clock signal for a predetermined number of cycles, and transmit the result to the control modules 171-1 and 172-1.

[0088] Therefore, each control module 171-1, 172-1 checks the standby count transmitted from counters 171-3, 172-3 to confirm whether a preset cycle has elapsed (S105). If the preset cycle has not elapsed, the state of comparison modules 171-2, 172-2 is maintained in an inactive state according to step S104.

[0089] However, once a preset cycle has elapsed, control modules 171-1 and 172-1 control the state of comparison modules 171-2 and 172-2 to change from an inactive state to an activated state (S106). Then, comparison modules 171-2 and 172-2 compare the output of the input first function block 110 with the output of the second function block 120 to check whether the outputs of the two function blocks match (S107).

[0090] The comparison modules 171-2 and 172-2 output whether the outputs of the two functional blocks 110 and 120 match, respectively, as the first and second comparison results. The error processor 180 then checks whether the first and second comparison results match (S108). This is because there may be no errors in the functional blocks 110 and 120, but there may be a fault in the comparators 171 and 172, so it is necessary to determine whether the error is an actual error in the functional blocks 110 and 120, or a latent error such as one in the comparators 171 and 172.

[0091] If the first comparison result and the second comparison result match, the error processor 180 outputs an error report to the external system. However, if the first comparison result and the second comparison result do not match, the error processor 180 outputs a latent error report (S109).

[0092] When the error processor 180 receives an error report or a potential defect report from an external source, it transmits a report completion signal to the comparators 171 and 172. Each comparator 171 and 172 checks whether it has received an error clear from the error processor 180 (S110), and if it has not received a report completion signal, it waits until it receives an error clear (S111).

[0093] However, upon receiving an error clear, the error detection system 100 periodically checks whether an external reset signal has been activated (S103). If the reset signal is activated, the procedure from step S104 onwards is repeated; otherwise, the procedure from step S100 onwards is repeated.

[0094] Next, the timing diagrams resulting from the operation of the error detection system described above will be explained with reference to Figures 5 to 7. In the embodiment of the present invention, the point in time when the reset is activated corresponds to the low state in the timing diagram, and the point in time when the reset is deactivated and the functional blocks 110 and 120 operate corresponds to the high state.

[0095] Figures 5 to 7 are illustrative diagrams of timing diagrams according to embodiments of the present invention.

[0096] First, as shown in Figure 5, each component of the error detection system 100, namely the first functional block 110, the second functional block 120, the first reset synchronization module 130, and the second reset synchronization module 160, are synchronized with each other after a preset clock cycle following the deactivation of the reset.

[0097] In other words, when the reset is deactivated by the first reset synchronization module 130 and the second reset synchronization module 160, and the operation of the two functional blocks 110 and 120 is synchronized after a preset clock cycle, there is a difference of 2 cycles in the timing at which the operation of each component starts (1, 2). Furthermore, there is a difference of 2 cycles in the timing of the input signals applied to the first functional block 110 and the second functional block 120 through the second delay module 140 (3, 4). Thus, the input signals applied to the first functional block 110 and the second functional block 120 and the output signals output from the first functional block 110 and the second functional block 120 are all the same, with a difference of 2 cycles.

[0098] Then, as shown in Figure 6, the comparator 170 compares the delayed first output signal, which is obtained by delaying the first output of the first functional block 110 by 2 cycles in the first delay module 150, with the second output signal of the second functional block 120 (5).

[0099] If the first functional block 110 or the second functional block 120 malfunctions due to some influence (6), the comparator 170 will detect this (7). Therefore, the comparison result obtained when the comparator 170 detects an error is processed by the error processor 180, and the error can be notified to other external systems.

[0100] At this time, the comparator 170 needs to be prepared for the case where the first functional block 110 and the second functional block 120 have multiple resets. That is, as shown in Figure 7, it is assumed that the reset signal activated by the reset signal source at the first time point (8) is activated and the first functional block 110 and the second functional block 120 are in a reset state.

[0101] Since the reset signal activated at the first time point affects the first function block 110 and the second function block 120, the outputs of the first function block 110 and the second function block 120 output the values ​​that were set at the first time point. However, in the case of the first delay module 150, it maintains the previously processed value, that is, the value output from the first function block 110 before the first time point when the reset signal was activated (9).

[0102] Therefore, the input pair input to the comparator 170 may process different signals, resulting in the comparator 170 receiving the input as a result. This can cause the comparator 170 to mistakenly perceive an error in either the first or second function block 110, even though the first and second function blocks 110 and 120 are operating normally, because the input pair is comparing different signals.

[0103] The comparator 170 suspends its comparison operation until a preset cycle has passed through the method described above, and then, when the reset signal is activated, it switches from the standby state to the operating state and resumes the comparison operation. Thus, in the embodiment of the present invention, the comparator 170 can perform the comparison operation of two functional blocks 110 and 120 in response to an asynchronous reset signal, and dual lockstep can be commonly applied to modules having a single clock and multiple resets.

[0104] Although embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concepts of the present invention as defined in the following claims also fall within the scope of the present invention. [Explanation of symbols]

[0105] 110: First Functional Block 120: Second Functional Block 171: First comparator 172: Second comparator

Claims

1. A method for operating an error detection system that operates with at least one processor, A first functional block outputs a first electrical signal to one input, and a second functional block that performs the same function as the first functional block outputs a second electrical signal to the same input. The first comparator and the second comparator each compare the first electrical signal and the second electrical signal, check for errors in the first or second functional block, and output the first comparison result and the second comparison result, and The process includes the step of checking for errors in either the first or second functional block, or checking for errors in either the first or second comparator, based on the first and second comparison results, and outputting an error reporting signal or a potential defect reporting signal depending on the result of the check. The step of outputting the second electrical signal is: The first functional block outputs a delayed first electrical signal with a delay of a preset number of cycles, and the second functional block receives an input signal delayed by the same number of cycles and outputs the second electrical signal. The step of outputting the second comparison result is: A step of confirming whether the reset signal affecting the first and second functional blocks among multiple reset signals has been activated. When the reset signal is activated, the state of the first comparator and the second comparator is controlled from an operating state to a standby state so as to interrupt the comparison of the delayed first electrical signal and the second electrical signal, and A method of operation, including the step of operating a counter for a predetermined cycle.

2. The operating method according to claim 1, wherein the first comparator and the second comparator compare the delayed first electrical signal and the second electrical signal, respectively.

3. After the step of operating the counter, A step of checking whether the preset cycle has elapsed based on the waiting count received from the counter, and The operating method according to claim 1, further comprising the step of controlling the state of the first comparator and the second comparator from the standby state to the operating state after the aforementioned cycle has elapsed.

4. The step of outputting the aforementioned potential defect reporting signal is: The steps include: outputting the error reporting signal to indicate that there is an error in either the first or second functional block when the first comparison result and the second comparison result match a preset signal; and The operating method according to claim 1, comprising the step of outputting the potential defect reporting signal indicating that there is a defect in either the first comparator or the second comparator when the first comparison result and the second comparison result do not match.

5. After the step of outputting the aforementioned potential defect report signal, A step to confirm whether an error clear signal has been received, and The operation method according to claim 1, further comprising the step of receiving the error clear signal and comparing a new first electrical signal input after the time the error clear signal is received with a new second electrical signal.

6. An error detection system, A functional block including a first functional block that outputs a first electrical signal in response to an input signal received at a first time point, and a second functional block that receives an input signal delayed by a preset number of cycles at the first time point and outputs a second electrical signal in response to a second electrical signal. A delay module comprising: a first delay module connected to either the input or output terminal of the first and second functional blocks, which delays the first electrical signal by a preset number of cycles and generates a delayed first electrical signal; and a second delay module which delays the input signal received at a first time by the specified number of cycles and transmits the delayed input signal to the second functional block. A comparator is connected to the output terminal of any one of the aforementioned functional blocks or the delay module, and includes a first comparator that compares the delayed first electrical signal with the second electrical signal and outputs a first comparison result, and a second comparator that outputs a second comparison result, and Includes an error handler that determines whether or not an error has occurred in any of the functional blocks or in the comparator, based on the comparison results output from each of the comparators, The first comparator and the second comparator are, A comparison module that compares the delayed first electrical signal with the second electrical signal to check for errors in the first or second functional block, and When a first reset signal is input, the control module controls the state of the first and second comparators from the operating state to the standby state, and stops the comparison of the comparator module. An error detection system, including...

7. The error detection system according to claim 6, further comprising a reset synchronization module for controlling the operation of the first and second functional blocks.

8. The aforementioned reset synchronization module is When a first reset signal affecting the first functional block is activated among multiple reset signals, a first reset synchronization module synchronizes the reset and release of the first functional block, and The error detection system according to claim 7, further comprising a second reset synchronization module that synchronizes the reset and release of the second functional block when the first reset signal affecting the second functional block is activated.

9. The first comparator and the second comparator are, The error detection system according to claim 6, further comprising a counter that, when the first reset signal is input, increases a standby count for a preset cycle.

10. The first comparator and the second comparator are, The error detection system according to claim 9, further comprising a delay device that, upon receiving an error clear signal from the error processor, delays the signal by a predetermined number of cycles before transmitting it to the control module.

11. The control module is The error detection system according to claim 9, which receives the standby count from the counter and controls the state of the comparison module from the standby state to the operating state based on the received standby count.

12. The aforementioned error handler is The error detection system according to claim 6, comprising an AND gate that performs an AND operation on a first comparison result received from the first comparator and a second comparison result received from the second comparator, and outputs it as an error reporting signal for either the first or second functional block.

13. The aforementioned error handler is The error detection system according to claim 12, further comprising an XOR gate that performs an XOR operation on the first comparison result and the second comparison result and outputs the operation result as a potential defect report signal to the first comparator or the second comparator.

14. The aforementioned error handler is The error detection system according to claim 13, comprising an OR gate that receives the error reporting signal and the response signal to the latent defect reporting signal, respectively, and performs an OR operation on the received response signals to generate an error clear signal.

Images