Debug Circuit for Lockstep Cores in Safety Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In processing systems, especially in automotive applications, the absence of safety capabilities during debug mode can lead to catastrophic consequences, such as false safety alarms triggered by clock uncertainty and timing mismatches between main and shadow cores, which can result in uncontrolled safety alarm triggering and potential harm.
Innovation Solution
Implementing a debug and trace circuit within each processing core, synchronized to the core clock, and using asynchronous bridges to handle clock domain crossings, ensuring coherent operation and avoiding false positives by balancing delays between main and shadow cores, thus enabling unmasked safety alerts during debug mode.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If debug mode is enabled with a debugger connected to the processing system, then debug operations can be performed, but false safety alarms are triggered due to clock uncertainty and timing mismatches between main and shadow cores
Solution Approach 1:
The system separates the safety-critical functional cores from the debug/trace circuits. The functional cores (main and shadow) operate independently with their own lockstep execution, while debug and trace circuits are provided only in the main core. This segmentation prevents debug operations from interfering with shadow core execution, eliminating the source of false safety alarms.
Solution Approach 2:
A synchronizer circuit is introduced as an intermediary between the asynchronous debug clock domain and the synchronous core clock domain. The synchronizer aligns the timing of debug signals with the core clock, ensuring that debug operations do not cause timing mismatches that would trigger false safety alarms while still allowing full debug functionality.
2Reliability
If safety mechanisms are implemented with replicated cores operating in lockstep, then fault detection capability is improved, but device complexity increases
Solution Approach 1:
The main core is designed to serve multiple functions: it acts as both a safety-critical functional core and a debug/trace host. By providing full debug and trace circuitry only in the main core, the system achieves comprehensive debugging capability without requiring identical replication of debug circuits in the shadow core, thereby reducing overall device complexity while maintaining fault detection through lockstep operation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A processing system (200) includes: main (202a) and shadow (202b) processing cores configured to operate in lockstep based on a core clock (CLKcore). The main processing core (202a) includes a main functional core (308a) and a main debug circuit (206a). The shadow processing core (202b) includes a shadow functional core (308b) and a shadow debug circuit (206b). A redundancy checker circuit (208) is configured to assert an alarm signal (Salarm) when a discrepancy between outputs from the main (308a) and shadow (308b) functional cores is detected. A debug bus synchronizer circuit (212) is configured to receive input debug data in synchrony with a debug clock (CLKdebug), and provide synchronized debug data in synchrony with the core clock (CLKcore) to a debug bus (232) based on the input debug data, where the main (206a) and shadow (206b) debug circuits are configured to receive the synchronized debug data in synchrony with the core clock (CLKcore) from the debug bus (232), and where the debug clock (CLKdebug) is asynchronous with respect to the core clock (CLKcore).