DE102013002088B4 - System and method for a signature-based redundancy comparison - Google Patents

Abstract

A redundant system comprising: a body configured to receive an input signal and generate a binary output signal; a first clock delay configured to receive the input signal and generate a delayed input signal; a first signature generator coupled to the first signature generator A second clock delay coupled to the first signature generator and configured to receive the first output signature and to generate a delayed first output signature; Checker portion coupled to the first clock delay and configured to receive the delayed input signal and generate a delayed binary output signal; a second signature generator coupled to the checker portion configured to receive the delayed binary A; receive the output signal and generate a delayed second output signature; anda comparator coupled to the second clock delay and the second signature generator, the comparator configured to receive the delayed first output signature and the delayed second output signature to generate an error signal, wherein a state of the error signal is based on a comparison of the delayed first Output signature based on the delayed second output signature.

Description

The present patent application claims inter alia the priority of the provisional US patent application US 61 / 599,129 filed on 15 February 2012.

FIELD OF THE INVENTION

Certain embodiments of the invention relate to providing diagnostic coverage in computing systems and methods. More specifically, certain embodiments of the invention relate to systems and methods for diagnostic signature generation within redundant systems to detect faults, faults, and failures, including faults, faults, and failures caused by common cause faults faults), stuck-at-faults, and cross-coupling faults.

BACKGROUND OF THE INVENTION

The integration of functions within an electronic control unit (ECU) is primarily focused around a secure microcontroller that plays a central role in accommodating critical computing, control, and control functions. As a result of submicrometer technologies, it has become economically feasible to integrate large redundant structures (eg, duplex systems) inside ECUs, microcontrollers, and other types of integrated electronic systems and computing systems, whether or not such systems now relate to safety-related computing functions and / or control and control functions or not. Typically, such systems are the basic hardware architecture upon which the security software is built (eg, applications that require the ASIL D security requirement of ISO 26262 standard).

However, typical duplex systems require hardware based comparisons of each functional output at each cycle as well as complex analysis of common cause failures based on the delay of the redundant parts by one or more clock cycles, resulting in high power consumption and large chip area in terms of Integration of duplex structures in, for example, a microcontroller leads.

Furthermore, a consequence for large duplex systems is the cost of the delay stages for the inputs and outputs, as well as complex comparator logic. For example, the cost of delay for a 2-cycle delay - assuming 1000 inputs and 1000 outputs - is 4000 flip-flops. In addition to the area needed to integrate a large number of flip-flops, power consumption becomes a limiting factor when expanding such a system, as well as operating at higher frequencies, which typically requires greater delay (ie a higher number of delay cycles).

It would be advantageous to provide solutions that reduce power consumption and area in terms of integrating redundant type structures inside high integrity electronic systems while maintaining a high degree of error detection provided by such redundant structures. It is also of interest to provide redundant structures that detect internal faults, faults and failures as well as faults, faults and failures in output lines during normal operation.

From TAHOORI, M: Reliable Computing I. Lecture. Karlsruhe Institute of Technology. In 2011, a system for redundancy comparison is known wherein a first module receives an input signal and outputs a first output signal to a comparator ("majority voter"), a second module receiving the input signal and outputting a second output signal to the comparator, and wherein Comparator compares the first output signal with the second output signal and detects an error. Out US Pat. No. 6,594,665 B1 For example, a method for locating data is known wherein a hash value for search data is generated and wherein the hash value is compared to hash values of stored data.

Various embodiments relate to a system and method for a signature-based redundancy comparison wherein the paths of the system have time diversity. This has the effect of reducing the effects of coupling factors, such as power disturbances. Therefore, it is an aspect of various embodiments to provide a system and method for signature-based redundancy comparison that reduces the effects of failures within the system.

BRIEF SUMMARY OF THE INVENTION

In accordance with an embodiment of the invention, a redundant system includes a body configured to receive an input signal and produce a binary output signal, a first clock delay configured to receive the input signal and generate a delayed input signal, a first signature generator coupled to the body and configured to receive the binary output signal and generate a first output signature, a second clock delay coupled to and configured for the first signature generator; receive the first output signature and generate a delayed first output signature, a checker portion (checker portion) coupled to the first clock delay and configured to receive the delayed input signal and generate a delayed binary output signal, a second signature generator, coupled to the checker portion and configured to receive the delayed binary output signal and generate a delayed second output signature, and a comparator coupled to the second clock delay and the second signature generator, the comparator therefor r is configured to receive the delayed first output signature and the delayed second output signature and generate an error signal, wherein a state of the error signal is based on a comparison of the delayed first output signature with the delayed second output signature.

In accordance with one embodiment of the invention, a method for signature-based redundancy comparison comprises receiving an input signal through a body and generating a binary output signal through the body, generating a delayed input signal based on the input signal, generating a first output signature based thereon the binary output signal, generating a delayed first output signature based on the first output signature, generating a delayed binary output signal based on the delayed input signal, generating a delayed second output signature by a checker portion based on the delayed binary output signal Comparing the delayed first output signature with the delayed second output signature by a comparator and generating an error signal, wherein a state of the error on the comparison ba Siert.

• ein Hauptteil, das dafür konfiguriert ist, ein Eingangssignal zu empfangen und ein binäres Ausgangssignal zu erzeugen;
• eine erste Taktverzögerung, die dafür konfiguriert ist, das Eingangssignal zu empfangen und
• ein verzögertes Eingangssignal zu erzeugen;
• einen ersten Signaturgenerator, der mit dem Hauptteil gekoppelt ist und dafür konfiguriert ist,
• das binäre Ausgangssignal zu empfangen und eine erste Ausgangssignatur zu erzeugen;
• eine zweite Taktverzögerung, die mit dem ersten Signaturgenerator gekoppelt ist und dafür konfiguriert ist, die erste Ausgangssignatur zu empfangen und eine verzögerte erste Ausgangssignatur zu erzeugen;
• ein Checker-Teil, das mit der ersten Taktverzögerung gekoppelt ist und dafür konfiguriert ist, das verzögerte Eingangssignal zu empfangen und ein verzögertes binäres Ausgangssignal zu erzeugen;
• einen zweiten Signaturgenerator, der mit dem Checker-Teil gekoppelt ist und dafür konfiguriert ist, das verzögerte binäre Ausgangssignal zu empfangen und eine verzögerte zweite Ausgangssignatur zu erzeugen; und
• einen Komparator, der mit der zweiten Taktverzögerung und dem zweiten Signaturgenerator gekoppelt ist, wobei der Komparator dafür konfiguriert ist, die verzögerte erste Ausgangssignatur und die verzögerte zweite Ausgangssignatur zu empfangen und ein Fehlersignal zu erzeugen, wobei ein Zustand des Fehlersignals auf einem Vergleich der verzögerten ersten Ausgangssignatur mit der verzögerten zweiten Ausgangssignatur basiert.

In accordance with one aspect, there is provided a redundant system comprising:

• a body configured to receive an input signal and generate a binary output signal;
• a first clock delay configured to receive the input signal and
• to generate a delayed input signal;
• a first signature generator coupled to and configured for the body
• receive the binary output signal and generate a first output signature;
• a second clock delay coupled to the first signature generator and configured to receive the first output signature and generate a delayed first output signature;
• a checker portion coupled to the first clock delay and configured to receive the delayed input signal and generate a delayed binary output signal;
• a second signature generator coupled to the checker portion and configured to receive the delayed binary output signal and generate a delayed second output signature; and
• a comparator coupled to the second clock delay and the second signature generator, the comparator configured to receive the delayed first output signature and the delayed second output signature to generate an error signal, wherein a state of the error signal is based on a comparison of the delayed first Output signature based on the delayed second output signature.

Advantageously, the second clock delay delays the input signal by n clock cycles, and the first clock delay delays the first output signature by those n clock cycles.

Advantageously, the main part has first circuits and the checker part has second circuits that are redundant to the first circuits.

Advantageously, the binary output signal M binary components, and wherein the first signature generator is a first Kompaktor (compressor), wherein the first Kompaktor is configured for M compacting (compressing) binary components to produce the first output signature having K binary components, where K <M.

Advantageously, the binary output signal M binary components, and wherein the first signature generator is a first compactor, wherein the first compactor is configured to a subset J of the M compacting binary components to produce the first output signature having K + (M - J) binary components, the K binary components from the compacted subset J of the M binary components are generated, and where K <J ≦ M.

Advantageously, the first compactor has a compaction matrix (compression matrix) H where y '= Hx1, where the vector y' is the first output signature and the vector x1 is the binary output of the main part.

Advantageously, the compaction matrix H the property that if the vector x1 is an all-1 vector of M One is, the vector y 'is generated, which is an all-1 vector of K ones.

Advantageously, the number of ones in each row of the compaction matrix H Odd and are the columns of the compaction matrix H in pairs different.

Advantageously, the second signature generator is a second compactor, the second compactor being configured to M compacting binary components of the delayed binary output signal to produce the delayed second output signature having K binary components, where K <M, and wherein the second compactor is the compaction matrix H having.

Advantageously, the redundant system further comprises an inverter coupled between the checker portion and the second signature generator, the inverter being configured to invert the delayed binary output signal to produce an inverted delayed binary output signal, the second Signature Generator is a second Kompaktor, wherein the second Kompaktor is configured to compact M binary components of the inverted delayed binary output signal to produce an inverted delayed second output signature, the K where K <M, and wherein the second compactor has a compaction matrix B, the compaction matrix B configured to generate the inverted delayed second output signature to be an inverse of the delayed first output signature.

Advantageously, the comparator is a self-testing comparator (STC).

Advantageously, the STC comprises an intermediate value-builder (IVB) circuit coupled to an allocation circuit, the IVB circuit having a plurality of XOR (Exclusive-OR) gates, and the Assignment circuit comprises at least one OR gate and at least one NAND gate, the IVB being configured to receive the delayed first output signature and the delayed second output signature, the total of 2n binary inputs and to generate n intermediate binary outputs z1, ..., zn, and the assignment circuit is configured to receive the n binary intermediate outputs z1, ..., zn and generate r error signals Errorl, ... Errorr, where r ≥ 1.

Advantageously, zi = ui ⊕ vi ⊕ a1u1 ⊕ a2u2 ⊕ ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn ⊕ Ai, where u1, ..., un and v1, ..., vn are the 2n binary inputs where ai and bi are binary values for i = 1, ..., n, and where ai Λ bj = 0, Vni = 1 ai VV nj = 1 bj = 1.

Advantageously, for r = 2, Errorl = Vni = 1 (zi ⊕ Ai),
Image available on "Original document"
where Ai are boolean constants for i = 1, ..., n.

Advantageously, the delayed first output signature and the delayed second output signature are binary complements of one another.

• einen ersten Zeitdatencodierer bzw. Temporaldatencodierer (TDE; temporal data encoder),
• der mit der zweiten Taktverzögerung und dem ersten Signaturgenerator gekoppelt ist;
• einen konfigurierbaren MISR-Komparator (CMC; configurable MISR comparator), der mit dem ersten TDE gekoppelt ist;
• einen zweiten TDE, der mit dem CMC und dem zweiten Signaturgenerator gekoppelt ist; und
• einen Fehler-Checker (Fehlerprüfer), der mit dem CMC und dem Komparator gekoppelt ist.

Advantageously, the redundant system further comprises:

• a first temporal data encoder (TDE);
• which is coupled to the second clock delay and the first signature generator;
• a configurable MISR comparator (CMC) coupled to the first TDE;
• a second TDE coupled to the CMC and the second signature generator; and
• an error checker (error checker) coupled to the CMC and the comparator.

Advantageously, the error checker is a so-called dual rail error checker (DREC).

Advantageously, the first TDE is configured to generate a first temporal signature based on an accumulated history of the delayed first output signature, the second TDE is configured to generate a second temporal signature based on an accumulated history of the delayed second output signature the CMC is configured to generate a second error signal based on a comparison of the first and second temporal signatures, and the error checker is configured to compare the second error signal and the error signal to produce a third error signal.

Advantageously, the redundant system further comprises a TDE logic unit which is configured to, when one of the first, second or third error signals indicates an error, analyze the first temporal signature and the second temporal signature to determine if the error originated from the body or the checker portion, wherein the first temporal signature and the second temporal signature are generated from the input signal, which is a predetermined test signal.

Advantageously, the checker part and the second signature generator are at least partially implemented in a combined circuit.

• Empfangen eines Eingangssignals durch ein Hauptteil und Erzeugen eines binären Ausgangssignals durch das Hauptteil;
• Erzeugen eines verzögerten Eingangssignals auf der Grundlage des Eingangssignals;
• Erzeugen einer ersten Ausgangssignatur auf der Grundlage des binären Ausgangssignals;
• Erzeugen einer verzögerten ersten Ausgangssignatur auf der Grundlage der ersten Ausgangssignatur;
• Erzeugen eines verzögerten binären Ausgangssignals auf der Grundlage des verzögerten Eingangssignals;
• Erzeugen einer verzögerten zweiten Ausgangssignatur durch ein Checker-Teil auf der Grundlage des verzögerten binären Ausgangssignals;
• Vergleichen der verzögerten ersten Ausgangssignatur mit der verzögerten zweiten Ausgangssignatur durch einen Komparator; und
• Erzeugen eines Fehlersignals, wobei ein Zustand des Fehlersignals auf dem Vergleich basiert.

In accordance with one aspect, there is provided a method for a signature-based redundancy comparison, comprising the steps of:

• Receiving an input signal through a body and generating a binary output signal through the body;
• Generating a delayed input signal based on the input signal;
• Generating a first output signature based on the binary output signal;
• Generating a delayed first output signature based on the first output signature;
• Generating a delayed binary output signal based on the delayed input signal;
• Generating a delayed second output signature by a checker portion based on the delayed binary output signal;
• Comparing the delayed first output signature with the delayed second output signature by a comparator; and
• Generating an error signal, wherein a state of the error signal is based on the comparison.

Advantageously, the input signal is delayed by n clock cycles and the first output signature is delayed by these n clock cycles.

Advantageously, the first body part has first circuits and the checker part has second circuits which are redundant to the first circuits.

Advantageously, the binary output signal M comprises binary components and the first output signature K comprises binary components which have been compacted from the M binary components, where K <M.

Advantageously, a compaction matrix H has K rows and M columns, where y '= Hx1 and where the vector y' is the first output signature and the vector x1 is the binary output signal.

Advantageously, the compaction matrix H has the property that, when the vector x1 has M binary ones, the vector y 'having K binary ones is generated.

Advantageously, the number of ones in each row of the compaction matrix H Odd and are the columns of the compaction matrix H in pairs different.

Advantageously, the delayed binary output signal M binary components and has the delayed second output signature K binary components based on the M binary components using the compaction matrix H have been compacted.

Advantageously, the method further comprises inverting the delayed binary output signal to produce an inverted delayed binary output signal, wherein the inverted delayed binary output signal M comprises binary components and the inverted delayed second output signature comprises K binary components consisting of the M binary components Using a compaction matrix B, wherein the compaction matrix B is configured to generate the inverted delayed second output signature to be an inversion of the delayed first output signature.

Advantageously, the comparator is a self-testing comparator (STC), the STC having an intermediate value forming (IVB) circuit and an allocation circuit, the IVB circuit having a plurality of XOR gates and the allocation circuit having at least one OR gate and at least one NAND gate, the IVB being configured to receive the delayed first output signature and the delayed second output signature having a total of 2n binary inputs, and to generate n intermediate binary outputs z1, ..., zn, and the mapping circuit is configured to receive the n binary intermediate outputs z1, ..., zn and generate r error signals Errorl, ... Errorr, where r ≥ 1.

Advantageously, zi = ui ⊕ vi ⊕ a1u1 ⊕ a2u2 (B ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn ⊕ Ai, where u1, ..., un and v1, ..., vn are the 2n binary ones Inputs are where ai, bi, and Ai for i = 1, ..., n are binary values, and where ai Λ bj = 0, V ni = 1 ai VV nj = 1 bj = 1.

Advantageously, for r = 2, Errorl = Vni = 1 (zi ⊕ Ai),
Image available on "Original document"

Advantageously, the delayed first output signature and the delayed second output signature are binary complements of one another.

• Erzeugen einer ersten temporalen Signatur auf der Grundlage einer angesammelten Historie der verzögerten ersten Ausgangssignatur;
• Erzeugen einer zweiten temporalen Signatur auf der Grundlage einer angesammelten Historie der verzögerten zweiten Ausgangssignatur;
• Erzeugen eines zweiten Fehlersignals auf der Grundlage eines Vergleichs der ersten und zweiten temporalen Signaturen; und
• Vergleichen des zweiten Fehlersignals und des Fehlersignals, um ein drittes Fehlersignal zu erzeugen.

Advantageously, the method further comprises the following steps:

• Generating a first temporal signature based on an accumulated history of the delayed first output signature;
• Generating a second temporal signature based on a history of the delayed second output signature;
• Generating a second error signal based on a comparison of the first and second temporal signatures; and
• Comparing the second error signal and the error signal to produce a third error signal.

Advantageously, the method further comprises, when one of the first, second or third error signals indicates an error, analyzing the first temporal signature and the second temporal signature to determine if the error originated from the body or the checker portion wherein the first temporal signature and the second temporal signature are generated from the input signal that is a predetermined test signal.

• eine Einrichtung zum Empfangen eines Eingangssignals durch ein Hauptteil und eine Einrichtung zum Erzeugen eines binären Ausgangssignals durch das Hauptteil;
• eine Einrichtung zum Erzeugen eines verzögerten Eingangssignals auf der Grundlage des Eingangssignals;
• eine Einrichtung zum Erzeugen einer ersten Ausgangssignatur auf der Grundlage des binären Ausgangssignals;
• eine Einrichtung zum Erzeugen einer verzögerten ersten Ausgangssignatur auf der Grundlage der ersten Ausgangssignatur;
• eine Einrichtung zum Erzeugen eines verzögerten binären Ausgangssignals auf der Grundlage des verzögerten Eingangssignals;
• eine Einrichtung zum Erzeugen einer verzögerten zweiten Ausgangssignatur durch ein Checker-Teil auf der Grundlage des verzögerten binären Ausgangssignals;
• eine Einrichtung zum Vergleichen der verzögerten ersten Ausgangssignatur mit der verzögerten zweiten Ausgangssignatur; und
• eine Einrichtung zum Erzeugen eines Fehlersignals, wobei ein Zustand des Fehlersignals auf dem Vergleich basiert.

In accordance with one aspect, a system for signature-based redundancy comparison includes:

• means for receiving an input signal through a body and means for generating a binary output signal through the body;
• means for generating a delayed input signal based on the input signal;
• means for generating a first output signature based on the binary output signal;
• means for generating a delayed first output signature based on the first output signature;
• means for generating a delayed binary output signal based on the delayed input signal;
• means for generating a delayed second output signature by a checker portion based on the delayed binary output signal;
• means for comparing the delayed first output signature with the delayed second output signature; and
• means for generating an error signal, wherein a state of the error signal is based on the comparison.

list of figures

• 1 Fig. 10 is a schematic diagram of a duplex system in accordance with an embodiment of the invention;
• 2 Fig. 10 is a schematic diagram of a linear compactor in accordance with an embodiment of the invention;
• 3 Fig. 10 is a schematic diagram of a duplex system in accordance with an embodiment of the invention;
• 4 Fig. 12 is a schematic diagram of a self-testing comparator in accordance with an embodiment of the invention;
• 5 FIG. 12 is a schematic diagram of the intermediate value forming device and the self-testing comparator allocation circuit included in FIG 4 illustrated in accordance with an embodiment of the invention; and
• 6 FIG. 10 is a schematic diagram of a duplex system in accordance with one embodiment of the invention. FIG.

DETAILED DESCRIPTION OF THE INVENTION

1 is a schematic diagram of a duplex system 100 in accordance with an embodiment of the invention. In the exemplary embodiment as illustrated, the duplex system is 100 a component of a safety-related component (component) 101 (eg, a microcontroller), but the duplexing system may be used with any type of high integrity computing system, such as banking systems or banking services systems, as well as other types of security related systems, such as an electronic control unit (ECU) ) (or it may be a component of these). For example, ECUs are used in various types of machinery and machinery, electronics, avionics, and automotive systems.

The duplex system 100 has a main part 100 , a checker part or checker part 104 . a first signature generator 106 , a second signature generator 108 , a duplex system comparator (DSC) 110 , an optional first clock delay (DLn) 112 and an optional second clock delay (DLn) 114 on. The main part 102 may be a processing unit such as a central processing unit (CPU). However, the scope of the invention also extends to a body comprising any combination of hardware and software designed to perform any type of electronic function. The checker part 104 is designed to be the same type of electronic function or electronic functions as the main body 102 perform. In one embodiment, this is the checker part 104 a copy of the main part 102 but in other embodiments, the checker part performs 104 the same function (s) for a functional input (s) as the main part 102 but is not an exact hardware and / or software copy of the main part 102 , In another embodiment, the checker part 104 and the second signature generator 108 be at least partially implemented or optimized together. The body and the checker part may be collectively called the redundant parts of the duplex system 100 be designated. Although the clock delays are optional, they can be used to reduce the effects of common cause failures by adding time diversity in the two paths.

Although the exemplary embodiment as illustrated is a duplex system 100 The scope of the invention also extends to redundant systems in general, such as a redundant system having a plurality of compute nodes in a cluster. The redundant parts may include any subset of the plurality of compute nodes that is greater than or equal to any combination of two compute nodes. In another embodiment, the redundant system may include redundant nodes in two or more clusters. The scope of the invention is not limited to duplex systems.

The first signature generator 106 receives an output from the body 102 and the second signature generator 108 receives an output from the checker part 104 , The first signature generator 106 processes the output from the main body 102 to generate a first output signature, and the second signature generator 108 processes an output from the checker part 104 to generate a second output signature.

In one embodiment of the invention, the first signature generator is 106 a first Kompaktor (compressor), the M binary inputs from the main body 102 receives and K generates binary outputs, and is the second signature generator 108 a second compactor, the M binary inputs from the checker part 104 and K produces binary outputs, where K <M. The signature generators will be described in more detail below.

In one embodiment of the invention, the second clock delay delays 114 the functional input (s) (also referred to as the input signal) to the checker part 104 by n clock cycles, allowing for time diversity between the redundant parts 102 and 104 will be added. Adding time diversity between the redundant parts helps to statistically reduce the effects of coupling factors. Typical coupling factors are, for example, power supply disturbances that affect the intrinsic timing parameters of, for example, all gates of the redundant parts, resulting in disruption of setup times and hold times. The first clock delay 112 delays receipt of the first output signature from the first signature generator 106 has been generated by the DSC 110 which makes it the DSC 110 it is possible to compare corresponding output signatures to see if there is an error.

The DSC 110 compares the two delayed output signatures and generates an error signal of a particular state based on the comparison. The DSC 110 will be discussed in more detail below.

During operation receive the bulk 102 and the second delay 114 an input signal. The second delay 114 delays the input signal by n clock cycles to produce a delayed input signal. The main part 102 processes the input signal to produce a binary output which M has binary components, and the checker part 104 processes the delayed input signal to produce a delayed binary output signal M having delayed binary components. The first signature generator 106 compacts the binary output signal to produce a first output signature which K has binary components. The second signature generator 108 compacts the delayed binary output signal to produce a delayed second output signature which K has binary components. The first clock delay 112 delays the first output signature to produce a delayed first output signature. The DSC 110 compares the delayed first output signature with the delayed second output signature and generates an error signal of a particular state based on the results of this comparison.

In one embodiment of the invention, an internal safety monitor (ISM) receives an internal safety monitor (ISM). 116 the error signal and generates an internal error notification signal and / or an external error notification signal based at least in part on the state of the error signal.

In one embodiment of the invention, one or more components may be internal to the safety-related component 101 the internal error notification signal from the ISM 116 and can be deactivated or activated based on the state of the signal (eg, high, low or dual rail) or activated to operate in a reduced functional mode. The external error message signal can be received from an external safety monitor or external safety monitor (ESM). 118 be received. The ESM 118 may generate a "safe-state" control signal or a safe-state control signal based on the received external error notification signal.

In another embodiment of the invention, one or more components may be external to the safety-related component 101 lies, the safe-state control signal from the ESM 118 and may also be disabled or activated based on the state of the signal (eg, high, low, or dual rail) or activated to operate in a reduced functional mode.

2 is a schematic diagram of a linear compactor 200 in accordance with an embodiment of the invention. The first signature generator 106 and / or the second signature generator 108 can or can be considered the linear compactor 200 be implemented. The linear compactor 200 as illustrated, has seven 2-input XOR gates 201-207 on. The compactor 200 receives an M-component input signal (ie, an M-dimensional input signal) x having M = 6 binary input components, and generates a K-component output signal (ie, a K-dimensional output signal) y having 4 output binary components. The input signal x may be equivalent to the binary output signal from the main part 102 or it may be equivalent to the delayed binary output signal from the Checker part 104 is generated, like this one in 1 are illustrated.

Although the linear compactor 200 as illustrated, seven 2-input XOR gates 201-207 with specific cross-connections between the XOR gates, the input signal components, and the output signal components to produce a 4-component output signal from a 6-component input signal, the scope of the invention also extends to linear compactors having any number of XORs With no restrictions on the cross-references of the XOR gates, and the K-component outputs from M-component inputs, where K <M.

The M-dimensional input x = x1, ..., xM, can be represented as an M-dimensional column vector, and the K-dimensional output y = y1, ..., yK can be represented as a K-dimensional column vector, where y = H · x, (1) and H is a (K, M) matrix with K Lines and M Columns is. The matrix H is the compaction matrix (compression matrix) of the linear compactor 200 , As an example of an exemplary embodiment for the following discussion, consider a compaction matrix with M = 6 and K = 4, where
Image available on "Original document"

For the components y1, y2, y3, y4 of the compacted output vector y, it follows from the formulas (2) and (3): y1 = x4⊕x5⊕x6, y2 = x1⊕x4⊕x5, y3 = x2⊕x4⊕x6 , y4 = x3 ⊕ x5 ⊕ x6,

For example, an input vector x = 1,0,1,0,1,1 is compacted (condensed) into a corresponding output vector y = H x = 0,0,1,1.

The linear compactor 200 has the property that if the number of ones in each row of the compaction matrix H is odd and if all columns of H in pairs are different, as in the Kompaktmatrix H of equation (2), the compacted output vector y (x) of the inverted input vector x = x1, ..., xM is equal to the inverted compacted output vector y (x) of the output vector y (x). Besides, the linear compactor has 200 the property that an input vector image available on "original document"
is compacted into an output vector image available on "original document".

And if the linear compactor 200 the property has that columns of H have an odd number of ones, and if all columns of H are pairwise different, as in the compaction matrix H of equation (2), then the compaction matrix has the properties that hi ≠ 0, hi ⊕ hj ≠ 0, and hi ⊕ hj ⊕ hk ≠ 0 for i ≠ j ≠ k

In other words, an input vector x 'that differs from an input vector x in 1 or 2 or 3 bit positions will result in a compacted output vector y' that differs from the compacted output vector of the input vector x. This is advantageous because internal Very often faults or failures lead to 1-bit errors, 2-bit errors or 3-bit errors, whereby the input vector x of the Kompaktors in 1, 2 or 3 bits is changed. Each of these errors is detected with a 100% probability when the compacted outputs of linear compactors having these characteristics are detected by the DSC 110 be compared.

The compaction matrix H can also be used as the transfer function of signature generators 106 and 108 be designated. In one embodiment of the invention, the transfer function of the first signature generator 106 equal to the transfer function of the second signature generator 108 , But the scope of the present invention also extends to signature generators having different transfer functions. Thus, the transfer function of the second signature generator 108 for example, the inverted transfer function of the first signature generator 106 be. In another embodiment, the signature generator (s) may also implement a non-linear transfer function. Thus, for example, the output vector of the signature generator (s) may also be the vector of check bits of a Berger code. The determination of check bits of a Berger code is known to a person skilled in the art and is described, for example, in US Pat Berger, JM, "A Note on Error Detection Codes for Asymmetric Channels;" Information and Control, Vol. 4, 1961, pages 68-73 described. In another embodiment, the signature generator (s) may also include delay elements, as in the case of the convolution compressor incorporated in Mrugalsi, G. et al., "Fault Diagnosis in Designs with Convolutional Compactors" Proc. ITC 2004, Essay 17.2, pages 498-507 is described.

In another embodiment of the invention, the compactor receives 200 the M-component input signal x and compacts a subset of the M input binary components. For example, if the linear compactor compacts J binary input components to produce K output components, then the output signal y will have "K + (M-J)" binary components, where K <J ≤ M.

3 is a schematic diagram of a duplex system 300 in accordance with an embodiment of the invention. Elements of the duplex system 300 identical to the elements of the duplex system 100 are, have the same reference numerals. The duplex system 300 includes a data diversification unit (DDU). In one embodiment of the invention, the DDU is an inverter 302 ,

During operation, the inverter inverts 302 the delayed binary output signal x2 from the checker part 104 is received to generate a signal x2 '. The second signature generator 108 may be a linear compactor with a compaction matrix H. Then the second signature generator generates 108 a delayed second output signature y2, where y2 = Hx2 '. The first signature generator 106 may also be a linear compactor with the same compaction matrix H as the second signature generator 108 and processes the binary output signal x1 from the main part 102 is received to produce a first output signature y1 ', where y1' = Hx1. If the number of ones in each row of the matrix H is odd, as in the compaction matrix H of equation (2), then the all-1 vector x1 = 1, ..., 1 with M ones in the All-1 vector y1 '= 1, ..., 1 compacted with K ones. Since the compactor is linear, the XOR (Exclusive OR Sum) sum of two vectors x and x 'is compacted into the XOR sum of the corresponding output vectors of the compactor. An inverted vector / x can be considered as a component-wise XOR sum of the vector x and the all-1 vector. Therefore, the compacted output vector of the inverted input vector of the second signature generator is equal to the inverted compacted output vector of the first signature generator. If there are no errors in the output data (as represented by the output signatures), then y2 = / y1 (ie, y1 inverted) and the DSC 110 is implemented as a two-rail checker.

If the DSC 110 In one embodiment, if y2 = / y1, then the error signal will be a binary low, otherwise the error signal will be binary high. But, as will be discussed in more detail below, the DSC 110 may also generate a dual rail error signal having a state based on whether y2 = / y1 or not.

In one embodiment of the invention, the transfer function of the first signature generator 106 not equivalent to the transfer function of the second signature generator 108 , Since the input signal to the second signal generator 108 , x2 ', an inversion of the input signal x1 to the first signal generator 106 is, then, assuming that there are no data errors in any of the two input signals, the transfer function of the second signature generator 108 from the transfer function of the first signature generator 106 are derived to result in y2 = / y1 by methods known to those skilled in the art.

A duplex system, such as the duplex system 300 that has an inverter 302 together with signature generators having different Having transfer functions allows the integration of information diversity between the signature generators. In fact, the addition of information diversity reduces the effects of so-called "common mode" errors (ie, errors common to the signature generators having equivalent transfer functions and paired identical inputs) that may otherwise not be detected.

4 FIG. 12 is a schematic representation of a self-testing comparator (STC) 400 in accordance with one embodiment of the invention. The DSC 110 as he is in 1 and 3 can be illustrated as the STC 400 be implemented. The STC 400 can receive and compare inputs that have either been inverted with respect to each other or not.

The STC 400 has a first combinational circuit (switching network) 402 and a second combinatorial circuit (switching network) 404 on. In the exemplary embodiment as illustrated, the first combinational circuit is 402 an intermediate value forming device (IVB) circuit 402 comprising 2n binary inputs u1, v1, u2, v2, ... un, vn and n binary outputs z1, ..., zn. The n output signals z1, ..., zn are called intermediate signals. In one embodiment, the signal y1 that is from the DSC 110 is received, as in 3 1, the components v1, v2 ... vn, and the signal y2 generated by the DSC 110 is received, has the components u1, u2 ... un. The IVB circuit 402 is designed so that the intermediate values are determined as z1 = u1 ⊕ v1 ⊕ a1u1 ⊕ a2u2 ⊕ ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn ⊕ A1z2 = u2 ⊕ v2 ⊕ a1u1 ⊕ a2u2 ⊕ ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn ⊕ A2 ⋮ zn = un ⊕ vn ⊕ a1u1 ⊕ a2u2 ⊕ ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn ⊕ If a1 ... an, b1,. .., bn, and A1, ..., An are binary coefficients with the following conditions: ai Λ bj = 0 for i = 1, ..., n and V ni = 1 ai VV nj = 1 bj = 1, where ⊕ is the logical exclusive OR operation, Λ is the logical AND operation (AND operation), V is the logical OR operation (OR operation), and V ni = 1 ai the logical SUMMATION (OR) operation (SUMMATIONS (OR) operation). In one embodiment of the invention, Ai are Boolean constants. The intermediate values of the self-testing comparator (STC) of the exemplary embodiment are determined by linear equations from the input values. In the exemplary embodiment as illustrated, the second combinational circuit is 404 an assignment circuit 404 , The assignment circuit 404 is designed so that the r outputs Errorl, ..., Errorr - where r ≥ 1 - are determined from the intermediate values such that, if for all i ∈ {1, ..., n} either zi = Ai or zi = Ai ⊕ 1, the error output signals will not indicate an error. But if this condition is not met, then the error outputs will indicate an error.

For example, if r = 2, then the mapping circuit may be 404 be designed so that Errorl = V ni = 1 (zi ⊕ Ai),
Image available on "Original document"

Thus, if zi = Ai for i = 1, ..., n, Errorl = 0 and Error2 = 1, and if zi = Ai ⊕ 1 for i = 1, ..., n, Errorl = 1 and Error2 = 0. But if none of these conditions holds then either of the error output signals will be high (ie the value 1 or both of the error outputs will be low (ie, the value 0 exhibit).

5 is a schematic diagram of the IVB 402 and the assignment circuit 404 of the STC 400 as he is in 4 is illustrated in accordance with an embodiment of the invention. In the exemplary embodiment as illustrated, the IVB 402 XOR gate 501 - 506 and assigns the assignment circuit 404 an OR gate 507 and a NAND gate 508 on.

In the exemplary embodiment as illustrated, n = 4, a1 = a2 = a3 = a4 = 0, b1 = 1, b2 = b3 = b4 = 0, r = 2 and A1 = A2 = A3 = A4 = 0 . Even though 5 exemplifying a specific implementation, the scope of the present invention extends to any combination of inputs, outputs, and corresponding values of a1 ...; b1 ... bn; and A1, ... An.

For the exemplary embodiment as illustrated, a1u1 ⊕ a2u2 ⊕ ... ⊕ anun ⊕ b1v1 ⊕ b2v2 ⊕ ... ⊕ bnvn = v1, and the intermediate values are determined as z1 = u1, z2 = u2 ⊕ v2 ⊕ v1, z3 = u3 ⊕ v3 ⊕ v1z4 = u4 ⊕ v4 ⊕ v1.

The error signals are Error1 = z1 Vz2 Vz3 Vz4Error2 = z ₁ Λ z ₂ Λ z ₃ Λ z ₄

As can be seen, all become XOR gates 501 - 506 during normal operation (ie operation without a fault) completely tested by all possible values 00 . 01 . 10 and 11 be applied to the inputs of the XOR gates.

The input values of the OR gate 507 and the NAND gate 508 are as long as no error occurs, 0,0,0,0 or 1,1,1,1. It is assumed that the STC 400 is used as an equality checker. In other words, if no error occurs, then ui = vi for i = 1, ..., n = 4.

Suppose, for example, that u1 = v1 = 0, u2 = v2 = 1, u3 = v3 = 1 and u4 = v4 = 0. Then the outputs of the XOR gates are 501 . 503 and 505 each equal to 1, 1 and 0, are the outputs of the XOR gates 502 . 504 and 506 all equals 0 and are all inputs to the OR gate 507 and the NAND gate 508 equals 0. This results in two-rail error signals or complementary error signals Errorl = 0 and Error2 = 1, which implies that there is no error.

By way of another example, suppose that u1 = v1 = 1, u3 = v2 = 1, u3 = v3 = 1, and u4 = v4 = 0. Then the issues are the OR gates 501 . 503 and 505 each equal to 0, 0 and 1, are the outputs of the XOR gates 502 . 504 and 506 all equals 1 and are all inputs to the OR gate 507 and the NAND gate 508 1. This results in two-rail error signals or complementary error signals Errorl = 1 and Error2 = 0, which also implies that there is no error.

To the fault detection capability of the LCSS 400 Now let us assume that u1 = v1 = u2 = v2 = 1, u3 = 1, u4 = v4 = 0, but v3 = 0. Then the issues are the XOR gates 501 . 503 and 505 each equal to 0, 0 and 1. The output of the XOR gate 502 is equal to 1, the output of the XOR gate 504 is equal to 0 and the output of the XOR gate 506 is equal to 1. The input values for the OR gate 507 and to the NAND gate 508 are 1,1,0,1, resulting in non-two-rail error signals (ie, non-complementary error signals) Error1 = 1 and Error2 = 1, indicating an error.

In accordance with one embodiment of the invention, the output of the STC 400 Two-Rail, where (Errorl, Error2) = (1,0) or (0,1) indicates no error and (Errorl, Error2) = (1,1) or (0,0) indicates an error.

The STC 400 can also receive inputs that are binary complements (ie, inverses) of each other. For example, if no error occurs, then the inputs to the STC 400 as indicated by the exemplary embodiment of 5 ui = vi for i = 1, ..., n, and the intermediate values are determined as z1 = u1 = 1 ⊕ v1z2 = 1 ⊕ v1, z2 = 1 ⊕ v1, z2 = 1 ⊕ v1,

For v1 = 0, all intermediate values z1, ..., zn = 4 are equal to 1, and for v1 = 1, all intermediate values z1, ..., zn = 4 are equal to 0. Thus, for v1 = 0, Errorl = 1 and Error2 = 0. For v1 = 1, Errorl = 0 and Error2 = 1. In other words, the error signals are two-rail or complementary (ie, either (1,0) or (0,1)) as long as no error occurs. It can also be seen that for any error on the inputs for which not all inputs are simultaneously faulty, the error signals Errorl and Error2 are two-rail (ie either (1,1) or (0,0)), and thus an error can be detected.

6 is a schematic diagram of a duplex system 600 in accordance with an embodiment of the invention. Elements of the duplex system 600 identical to the elements of the duplex system 100 and 300 are, have the same reference numerals. The duplex system 600 includes temporal data encoder (TDE) engine 602 and 604 as well as seed generators (key generators) 606 and 608 on. In the exemplary embodiment as illustrated, the TDE engines are 602 and 604 multiple input linear feedback shift registers (MISRs) 602 and 604 but the scope of the invention also extends to other time-domain engines known to those skilled in the art, such as feedback loop-type CRC polynomial generators as needed. The exemplary embodiment also includes a configurable MISR comparator (CMC). 610 , a control unit (CFG) 612 and an error checker 614 on. In one embodiment, the error checker 614 a dual-input fault checker or dual rail error checker (DREC) 614 ,

As will be discussed in more detail below, the MISRs 602 and 604 generate temporal signatures based on the accumulated histories of the signals (ie, output signatures) y1 and y2. In fact, the duplex system 600 designed (via the CMC 610 ) accumulated histories of the signals y1 and y2, as embodied in the temporal signatures generated by the MISRs, as well as (via the DSC 100 ) compare the (immediate) output signatures y1 and y2.

The MISRs 602 and 604 can be K-bit shift registers. In one embodiment of the invention, the MISRs 602 and 604 32-bit shift register. During operation, each seed generator initializes 606 and 608 its corresponding MISR with a predefined combination of ones and zeros. Each MISR uses for each clock cycle 602 and 604 a logic function that calculates an output value (ie, a temporal signature) based on predetermined feedback bit positions and combinational logic of the previous output value and input data (ie, correspondingly received output signatures y1 and y2). In this way, each MISR generates 602 and 604 a temporal signature (ie, an accumulated history of the corresponding signature outputs y1 and y2). The MISRs 602 and 604 introduce a form of feedback into the system 600 one, since the current value, in each MISR 602 and 604 is partly dependent on the current value of y1 and y2 and the earlier values of y1 and y2. Those in the MISRs 602 and 604 stored values also represent a pseudorandom input to the CMC 610 because each of the stored values also depends on the initial seed values stored in the K bit positions.

In one embodiment of the invention, the values set forth in each MISR 602 and 604 are stored so that they can be read and analyzed by the system hardware and / or software collectively referred to as a TDE logic unit (eg, a MISR logic unit) (not shown). During operation, a preconfigured code (also referred to as a test pattern) may be part of the main and checker parts 102 and 104 be executed. The resulting temporal signatures can then be read from each of the MISRs, and in dependence on the values of the temporal signatures compared to the expected signature values (based on the initial seed values and the operation of the main and checker Parts relative to the test pattern), the system can determine if the error is from the main part 102 or from the checker part 104 comes. If, for example, the checker part 104 just generates an error, then the system can 600 Components of the microcontroller or components that are controlled by an ECU (eg, via output signals) instruct to operate at sub-optimal (ie, reduced) operational levels.

Referring again to 6 receives the CMC 610 the temporal signatures of the MISRs 602 and 604 and generates an / error signal based on a comparison of the temporal signatures (eg, for a single rail output, it produces a 1 if there is no detected error, and 0 if an detected one) Error is present). In one embodiment of the invention, the CMC 610 equivalent to the STC 400 as he is in 4 is illustrated. It should be noted that this edition of the DSC 110 and the CMC 610 Either single-rail, dual-rail or larger than dual-rail or another encoding can be. One skilled in the art has the knowledge, the DREC 614 to either receive single-rail or dual-rail error signals, to determine if an error is present, and if so, to determine whether the error is from Errors, malfunctions or failures in the DSC 110 , errors, failures or failures in the CMC 610 or errors, faults or failures in the redundant components of the system 600 came.

For example, the DREC receives 614 the / error signal from the CMC 610 and the error signal from the DSC 110 (which form complementary values in the corresponding two lines). For example, assuming that the error signals are single-rail, then the system generates 600 then when the DREC 614 a 1 from the CMC 610 and a 0 from the DSC 110 receives just error-free functional outputs from the functional inputs, and in one embodiment, the DREC generates 614 then one 0 , In one embodiment, the output of the DREC 614 continue with the original edition of the DSC 110 combined to form another error signaling with complementary values in the respective lines, and the ISM 116 generates an internal error message and / or an external error message, which has a value of 1 whenever the inputs to the ISM 116 are not complementary (ie, not 1.0 or 0.1), but otherwise generates an internal error message and / or an external error message having a value of 0 in the healthy state.

In one embodiment of the invention, the CFG 612 Control circuits and / or software that includes one or more functions of the CMC 610 controls or controls. The CFG 612 For example, it can be designed to be the CMC 610 activated or deactivated based on user commands or internal system signals (not shown). Although the embodiment of the invention according to 6 describes specific responses for given high and low values of the various error signals, the scope of the invention also extends to other embodiments that recognize data errors based on other combinations of values of the error signals.

Although the present invention has been described with reference to particular embodiments, it will be apparent to those skilled in the art that various changes may be made and equivalents may be substituted without departing from the scope of the present invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the present invention without departing from the scope thereof. Therefore, the present invention should not be limited to the particular apparent embodiment, but the present invention will include all embodiments falling within the scope of the appended claims.

Claims (8)

Redundant system with: a body configured to receive an input signal and generate a binary output signal; a first clock delay configured to receive the input signal and generate a delayed input signal; a first signature generator coupled to the body and configured to receive the binary output and generate a first output signature; a second clock delay coupled to the first signature generator and configured to receive the first output signature and generate a delayed first output signature; a checker portion coupled to the first clock delay and configured to receive the delayed input signal and generate a delayed binary output signal; a second signature generator coupled to the checker portion and configured to receive the delayed binary output signal and generate a delayed second output signature; and a comparator coupled to the second clock delay and the second signature generator, the comparator configured to receive the delayed first output signature and the delayed second output signature to generate an error signal, wherein a state of the error signal is based on a comparison of the delayed first Output signature based on the delayed second output signature. Redundant system after Claim 1 wherein the second clock delay delays the input signal by n clock cycles and the first clock delay delays the first output signature by those n clock cycles. Redundant system after Claim 1 wherein the main part comprises first circuits and the checker part has second circuits that are redundant to the first circuits. Redundant system after Claim 1 wherein the binary output signal M comprises binary components, and wherein the first signature generator is a first compactor, the first compactor being configured to compact the M binary components to produce the first output signature comprising K binary components, where K < Damn. Redundant system after Claim 1 wherein the binary output signal M comprises binary components, and wherein the first signature generator is a first compactor, the first compactor being configured to compact a subset J of the M binary components to produce the first output signature comprising K + (M - M). J) comprises binary components, wherein the K binary components are generated from the compacted subset J of the M binary components, and where K <J ≦ M. A method for a signature-based redundancy comparison, comprising the following steps: Receiving an input signal through a body and generating a binary output signal through the body; Generating a delayed input signal based on the input signal; Generating a first output signature based on the binary output signal; Generating a delayed first output signature based on the first output signature; Generating a delayed binary output signal based on the delayed input signal; Generating a delayed second output signature by a checker portion based on the delayed binary output signal; Comparing the delayed first output signature with the delayed second output signature by a comparator; and Generating an error signal, wherein a state of the error signal is based on the comparison. Method according to Claim 6 wherein the input signal and the first output signature are both delayed by n clock cycles. A system for a signature-based redundancy comparison, comprising: means for receiving an input signal through a body and means for generating a binary output signal through the body; means for generating a delayed input signal based on the input signal; means for generating a first output signature based on the binary output signal; means for generating a delayed first output signature based on the first output signature; means for generating a delayed binary output signal based on the delayed input signal; means for generating a delayed second output signature by a checker portion based on the delayed binary output signal; means for comparing the delayed first output signature with the delayed second output signature; and means for generating an error signal, wherein a state of the error signal is based on the comparison.

Images