CN106445748A - Verification method for triplication redundancy - Google Patents

Abstract

The present invention relates to a triple-mode redundancy verification method, the method comprising: Step 1, determining whether the triple-mode redundancy implementation of the Field Programmable Gate Array FPGA is based on a function path, if not, then perform step 2, if , then execute step 3; step 2, process the FPGA, determine the three-mode redundancy range and the implementation mode of the three-mode redundancy that need to be verified in the FPGA, and perform step 3; step 3, perform the triple-mode redundancy implementation mode Classify and judge the implementation mode of triple-mode redundancy. If it is structural triple-mode redundancy, perform step 4. If it is sequential triple-mode redundancy, perform step 5. Step 4: verify structural triple-mode redundancy ; Step 5, verifying the timing triple-mode redundancy. The verification method for triple-mode redundancy provided by the invention improves the verification efficiency, makes the verification of the effectiveness of the triple-mode redundancy implementation mode more comprehensive and objective, and improves the accuracy and reliability of the verification method for triple-mode redundancy.

Description

A Three-mode Redundancy Verification Method

technical field

The invention relates to the field of system detection, in particular to a triple-mode redundancy verification method.

Background technique

As a simple and effective reliability reinforcement method in programmable logic, triple-mode redundancy measures are often used in systems such as aerospace, military, and nuclear industry facilities. With the improvement of integrated circuit manufacturing technology, the scale of programmable logic devices represented by field programmable gate array FPGA has shown exponential growth, and triple-mode redundancy measures have also been widely used in many fields.

In order to give full play to the advantages of triple-mode redundancy, the optimization implementation strategy of triple-mode redundancy based on functional paths has been explored in engineering applications such as aerospace, not only using the redundant method of circuit structure in the traditional sense, that is, structural triple-mode redundancy, It belongs to the space-dimensional reliability strategy, and introduces the redundant operation mode of sending and receiving the same data multiple times on the interface module, that is, the three-mode redundancy of the sequence, which belongs to the time-dimensional reliability strategy. As an optimized triple-mode redundancy implementation strategy, the implementation process of triple-mode redundancy based on functional paths can be summarized as follows: by sorting the FPGA logic functions according to their importance, the triple-mode redundancy measures are applied to the functional sequence from complex to simple. , and further selectively apply the structural triple-mode redundancy and sequential triple-mode redundancy implementations to the modules or circuits that each functional path runs through.

In terms of the effectiveness verification of FPGA triple-mode redundancy measures, the traditional method is to verify the implementation results of structural triple-mode redundancy. Under strong constraints such as hardware fault injection or simulation, physical interference or simulation is performed on the internal registers of the FPGA to be verified. Overturned, it did not consider the triple-mode redundancy method based on the functional path used in the industry, did not take into account the test and verification of the timing triple-mode redundancy, and did not include the verification of specific situations such as single-channel signals and multi-channel signals. Therefore, the existing The verification method has certain limitations and is not comprehensive enough.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method for verifying the effectiveness of the triple-mode redundancy implementation in view of the deficiencies of the prior art.

The technical scheme that the present invention solves the problems of the technologies described above is as follows:

A triple-mode redundancy verification method, comprising the steps of:

Step 1. Determine whether the triple-mode redundancy implementation of the field programmable gate array FPGA is based on the functional path, including clarifying the importance of each function, and the triple-mode redundancy of the modules or circuits that each functional path runs through. If it is not based on the functional path, then perform step 2, if it is based on the functional path, then determine the interfaces and functional sub-modules included in the triple-mode redundant implementation, and perform step 3;

Step 2, processing the FPGA, determining the three-mode redundancy range that needs to be verified in the FPGA, and determining the importance of the interfaces and functional sub-modules included in the three-mode redundancy range that needs to be verified and Three-mode redundant implementation, and perform step 3;

Step 3, classify the three-mode redundant implementation mode according to the structural three-mode redundant implementation mode and the sequential three-mode redundant implementation mode respectively, and judge the three-mode redundant implementation mode, if it is the structural three-mode redundant implementation mode If it is redundant, go to step 4, if it is time-series triple-mode redundancy, go to step 5;

Step 4, verifying the three-mode redundancy of the structure, including determining the position of the specific verification object of the interface and the functional sub-module in the source code file, the netlist file after layout and wiring, or the FPGA chip, and selecting specific verification The circuit or register of the object, and then verify the circuit or register;

Step 5, verifying the sequential triple redundancy, processing the sequential triple redundancy so that it is equivalently regarded as the structural triple redundancy, and then performing verification according to the structural triple redundancy.

The beneficial effects of the present invention are: by judging whether the three-mode redundant implementation mode of FPGA is based on the mode of functional path, described FPGA is processed, classified, and the verification efficiency has been increased, and the triple-mode redundant implementation mode The judgment takes into account the judgment of the structural triple redundancy and the timing triple redundancy, and the verification of the effectiveness of the triple redundancy implementation is more comprehensive and objective, which improves the accuracy and reliability of the triple redundancy verification method.

On the basis of the above technical solutions, the present invention can also be improved as follows.

Further, in step 2, the following steps are included:

Step 2.1, analyze the core function of described FPGA from task profile angle, determine the interface that described core function comprises and function sub-module, described interface and function sub-module all comprise importance classification respectively;

Step 2.2, determine the interface and functional sub-modules that have been implemented in the FPGA and included in the triple-mode redundancy measure;

Step 2.3, comparing the interfaces and functional sub-modules included in the core function with the interfaces and functional sub-modules included in the three-mode redundancy measures that have been implemented, and taking the intersection to obtain the triple-mode redundancy range that needs to be verified;

Step 2.4, determine the importance of the interfaces and functional sub-modules included in the three-mode redundancy range that needs to be verified, and the implementation mode of the three-mode redundancy, and perform step 3.

The beneficial effect of adopting the above-mentioned further scheme is: by processing the FPGA, determining the importance of the interfaces and functional sub-modules included in the three-mode redundancy range that needs to be verified, and the implementation mode of the three-mode redundancy, it can be better implemented Non-functional path-based triple-mode redundancy implementation is verified.

Further, in step 3, classify the three-mode redundant implementation according to the structural three-mode redundant implementation and the sequential three-mode redundant implementation, and classify the three-mode redundant according to the preset order Sorting in an implementation manner, for example, the preset order may be a triple redundancy order determined according to the importance of functions.

The beneficial effect of adopting the above further scheme is that the verification efficiency is improved by classifying the three-mode redundant implementation manners according to the structural triple-mode redundant implementation manner and the sequential triple-mode redundant implementation manner.

Further, step 4 includes the following steps:

Step 4.1, determine the position of the specific verification object of the interface and the functional sub-module in the source code file, the netlist file after layout and wiring, or the FPGA chip, and select the circuit or register where the specific verification object is located, wherein the specific Verification objects include input and output signals or voters;

Step 4.2, judging the signal type of the input and output signals, if it is a multi-channel signal, then perform step 4.3, if it is a single-channel signal, then perform step 4.4;

Step 4.3, verifying the multiple signals until all selected circuits or registers are verified;

Step 4.4, verifying the single signal until all selected circuits or registers are verified.

Further, the single-channel signal is a signal transmitting 1-bit information, and the multi-channel signal is an ordered set of multiple single-channel signals transmitting 1-bit information.

Further, step 4.3 includes the following steps:

Step 4.3.1, when the values of the three modes of the multi-channel signal are different from each other, select 3 different values within the effective value range of each mode, and randomly assign the 3 different values to the three modes to obtain the output signal, and vote on the output signal, if the output signal after the vote is a preset value, the implementation of the triple-mode redundancy is valid, otherwise it is invalid;

Step 4.3.2, exclude the situation that the values of the three modes of the multi-channel signal are different, and constrain the values of the signals of each mode, for example, when the values of the three modes of the multi-channel signal are different, the values are respectively { x, y, z}, after constraining each modulus signal according to the value, remove the value z, and the value can be {x, y, y};

In step 4.3.3, the equivalence of each module is regarded as a single-channel signal, and verification is performed according to the verification method of a single-channel signal.

Further, step 4.4 includes the following steps:

Step 4.4.1, the single-channel signal includes a three-mode signal, and the fault simulation is performed on each mode signal by randomly selecting a logic value of 0 or 1;

Step 4.4.2, obtaining all possible 8 states of the single signal;

In step 4.4.3, all possible 8 states of the single-channel signal are voted on by a voting device, and the effectiveness of the three-mode redundant implementation is verified respectively;

In step 4.4.4, comprehensively analyze the effectiveness of all obtained three-mode redundancy implementation modes, and complete the verification.

Further, in step 5, the following steps are included:

Step 5.1, sequentially treating the three communication equivalents of the sequential triple-mode redundancy as a redundant structure in the structural triple-mode redundancy;

Step 5.2, verifying the sequence triple redundancy according to the verification method of the structural triple redundancy.

The beneficial effect of adopting the above further scheme is: by considering the three-time communication equivalence of time-series triple-mode redundancy as the redundant structure in structural triple-mode redundancy, the equivalence of time-sequence triple-mode redundancy can be regarded as structural triple-mode redundancy It is processed to make the verification of the triple redundancy more objective and comprehensive.

Further, if the three-mode redundancy implementation includes structural three-mode redundancy and sequential three-mode redundancy, the sequential three-mode redundancy is verified first, and then the structural three-mode redundancy is verified.

Advantages of additional aspects of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Description of drawings

FIG. 1 is a schematic flow diagram of a triple-mode redundancy verification method provided by an embodiment of the present invention;

FIG. 2 is a schematic flow diagram of a triple-mode redundancy verification method provided by another embodiment of the present invention;

FIG. 3 is a schematic flowchart of a processing method of a non-functional path-based triple-mode redundancy implementation provided by another embodiment of the present invention.

detailed description

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

As shown in Figure 1, it is a schematic flow chart of a triple-mode redundancy verification method provided by an embodiment of the present invention, the method comprising:

S101, determine whether the triple-mode redundancy implementation mode of the field programmable gate array FPGA is based on the functional path, including specifying the importance of each function, and the triple-mode redundancy mode of the modules or circuits that each functional path runs through, if not If the method is based on the functional path, execute S102, and if it is based on the functional path, execute S103.

S102, process the FPGA, determine the three-mode redundancy range and implementation mode of the three-mode redundancy that need to be verified in the FPGA, and execute S103.

S103, classify the three-mode redundant implementation mode according to the structural three-mode redundant implementation mode and the sequential three-mode redundant implementation mode respectively, and judge the three-mode redundant implementation mode, if it is the structural three-mode redundant implementation mode, execute S104, if it is time-sequential triple-mode redundancy, execute S105.

S104, verifying the structural triple-mode redundancy.

S105, verifying the timing triple-mode redundancy.

A kind of three-mode redundancy verification method provided by the above-mentioned embodiment, by judging whether the three-mode redundancy implementation mode of FPGA is based on the mode of functional path, FPGA is processed and classified, the verification efficiency is increased, and three The judgment of the implementation mode of the module redundancy takes into account the judgment of the structure triple redundancy and the timing triple redundancy, and the verification of the effectiveness of the triple redundancy implementation is more comprehensive and objective, and the accuracy of the triple redundancy verification method is improved. sex and reliability.

In another embodiment, as shown in Figure 2, assume that a certain product is developed based on Xilinx company 2V3000 model FPGA, the main function of this FPGA is numerical calculation, the secondary function is data forwarding, and the auxiliary function is light switch control. Primary function, secondary function and auxiliary function are defined as function A, function B and function C, respectively. For the above functions, a three-mode redundant implementation based on the functional path is adopted, and the specific measures are as follows: respectively perform "sequential three-mode redundant More than" and "structural triple-mode redundancy"; perform "sequential triple-mode redundancy" on the single-channel signal interface B-1 involved in function B; function C does not implement triple-mode redundancy.

The present embodiment comprises the following steps to the verification method of the three-mode redundancy of 2V3000 type FPGA:

S201. Determine the triple-mode redundancy implementation manner of the verified object. In this example, the FPGA adopts a triple-mode redundant implementation based on functional paths.

S202. Classify the implementation manners of triple-mode redundancy. In this embodiment, the three-mode redundant implementations are classified according to the structural three-mode redundant implementations and the sequential three-mode redundant implementations, and the classified three-mode redundant implementations are classified according to the degree of importance. The sorting, the logical functions that need to be triple-mode redundant are A and B. Therefore, the interfaces and modules involved in each function are sorted into A-1, A-2, and B-1 according to their importance. Among them, the implementation of timing three-mode Redundant interfaces are A-1 and B-1, and modules implementing structural triple-mode redundancy are A-2. For interfaces A-1 and B-1 implementing sequential triple-mode redundancy, execute S203-S205. For implementing For a module with triple-mode redundancy, go to S206.

S203, verifying the structural triple-mode redundancy. Select the circuit or register, and determine the location information of the specific verification object according to the selected circuit or register, including the entity name, signal name, signal bit width and other information of the port input and output signals in the RTL source code file, or the voter after layout and wiring The name number, bit width and other information in the netlist file, or the location area information of each module circuit in the FPGA chip (only used for the verification method of physical fault injection).

S204, verifying the multiple signals. According to the location information of the specific verification object determined in S202, mark each redundant structure of the A-2 module as A-2_R0, A-2_R1, A-2_R2, and set the verification priority of the A-2 module as high. Because the signals of each mode of the A-2 module are multi-channel signals, first of all, the special case of the different values of the three modes is verified, and three different values are selected within the effective value range of each mode, respectively {0 , 1, X}, where X is any value that is not 0 or 1 within the value range, and the value range is determined according to the actual situation of the multi-channel signal. For example, when the multi-channel signal is two channels, the value of X The range is binary value 00~11. And randomly assign 3 different values to the three modes to obtain the output signal, and vote on the output signal, if the output signal after the vote is the preset value, then the triple mode redundant implementation is valid, if it is other values , the implementation of triple-mode redundancy is invalid.

S205, verifying the single signal. After verifying the special case, exclude the special case, constrain the value of each mode signal of the multi-channel signal to "type 0" and "type 1", and make the above value types equivalent to the signal logic value of the single-channel signal "Logic 0" and "Logic 1", the A-2 module is processed as a single signal: Let "Logic 1" indicate normal, "Logic 0" indicates failure, and then randomly select each model signal according to the logic value 0 or 1 Simulate faults in the same way, perform ergodic verification on all possible 2*2*2=8 states of the three-mode signal, and obtain the validity conclusion of the three-mode redundant implementation mode under the eight states through voting by the voter, and then combine the special case In this case, the effectiveness of the implementation of triple-mode redundancy is comprehensively judged, and a conclusion is drawn. For specific results, refer to the table below.

S206, verifying the timing triple-mode redundancy. According to the order of communication time, the three communications of A-1 interface are marked as A-1_Tr0, A-1_Tr1, A-1_Tr2, and the verification priority of A-1 interface is set to high; then B- The three communications of interface 1 are marked as B-1_Tr0, B-1_Tr1, and B-1_Tr2, and the verification priority of interface B-1 is set to low. The above-mentioned communication marks whose suffixes are "_Tr0 (first mode), _Tr1 (second mode), _Tr2 (third mode)" can be equivalent to the redundant structure mark "_R0( first model), _R1 (second model), _R2 (third model)", and then verify according to the steps of S203-S205.

S207, the verification is completed. When necessary, according to external conditions such as verification cost and progress, verification can be performed only for interfaces or modules with a selected verification priority to improve verification work efficiency.

In another embodiment, as shown in Figure 3, assuming that the triple-mode redundancy implementation of the FPGA produced by a certain company is not based on the functional path, the following processing needs to be performed on it before verification, and the processing steps include:

S301, analyze the core functions of the FPGA from the perspective of the task profile, and determine the interfaces and functional sub-modules included in the core functions;

S302, determining the interfaces and functional sub-modules included in the triple-mode redundancy measures implemented in the FPGA;

S303, comparing the interfaces and function sub-modules included in the core function with the interfaces and function sub-modules included in the implemented triple-mode redundancy measures, taking the intersection part, and obtaining the triple-mode redundancy range that needs to be verified;

S304. Determine the importance of interfaces and functional sub-modules included in the three-mode redundancy range that needs to be verified, and the implementation manner of the three-mode redundancy.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (10)

1. A triple-mode redundancy verification method, characterized in that, may further comprise the steps: Step 1, determine whether the triple-mode redundant implementation mode of field programmable gate array FPGA is the mode based on functional path, if not, then perform step 2, if so, then perform step 3; Step 2, processing the FPGA, determining the three-mode redundancy range and the implementation mode of the three-mode redundancy that need to be verified in the FPGA, and performing step 3; Step 3, classify the implementation mode of triple redundancy, and judge the implementation mode of triple redundancy, if it is structural triple redundancy, then perform step 4, if it is sequential triple redundancy, then Execute step 5; Step 4, verifying the three-mode redundancy of the structure; Step 5, verifying the timing triple redundancy. 2. a kind of three-mode redundancy verification method according to claim 1, is characterized in that, in step 2, comprises the following steps: Step 2.1, analyzing the core functions of the FPGA from a task profile angle, determining the interfaces and functional submodules that the core functions include; Step 2.2, determine the interface and functional sub-modules that have been implemented in the FPGA and included in the triple-mode redundancy measure; Step 2.3, comparing the interfaces and functional sub-modules included in the core function with the interfaces and functional sub-modules included in the three-mode redundancy measures that have been implemented, and taking the intersection to obtain the triple-mode redundancy range that needs to be verified; Step 2.4, determine the importance of the interfaces and functional sub-modules included in the three-mode redundancy range that needs to be verified, and the implementation mode of the three-mode redundancy, and perform step 3. 3. a kind of three-mode redundancy verification method according to claim 1, is characterized in that, in step 3, described three-mode redundancy implementation mode is implemented according to structural triple-mode redundancy implementation mode and sequence triple-mode redundancy The manners are classified, and the classified three-mode redundant implementation manners are sorted according to a preset order. 4. A kind of triple-mode redundancy verification method according to any one of claims 1 to 3, characterized in that, in step 1, if the triple-mode redundancy implementation is based on a functional path, then determine The interface and functional sub-modules included in the triple-mode redundancy implementation. 5. a kind of three-mode redundancy verification method according to claim 4, is characterized in that, step 4 comprises the following steps: Step 4.1, determining the specific verification object of the interface and the functional sub-module; Step 4.2, judging the signal type of the specific verification object, if it is a multi-channel signal, then perform step 4.3, if it is a single-channel signal, then perform step 4.4; Step 4.3, verifying the multi-channel signal; Step 4.4, verifying the single signal. 6. a kind of three-mode redundancy verification method according to claim 5, is characterized in that, described single-channel signal is the signal that transmits 1-bit information, and described multi-channel signal is a plurality of single-channel signals that transmit 1-bit information An ordered collection of signals. 7. A kind of three-mode redundancy verification method according to claim 5, is characterized in that, step 4.3 comprises the following steps: Step 4.3.1, when the values of the three modes of the multi-channel signal are different from each other, select 3 different values within the effective value range of each mode, and randomly assign the 3 different values to the three modes to obtain the output signal, and vote on the output signal, if the output signal after the vote is a preset value, the implementation of the triple-mode redundancy is valid, otherwise it is invalid; Step 4.3.2, exclude the situation that the values of the three modes of the multi-channel signal are different, and constrain the values of the signals of each mode; In step 4.3.3, the equivalence of each module is regarded as a single-channel signal, and verification is performed according to the verification method of a single-channel signal. 8. a kind of three-mode redundancy verification method according to claim 5, is characterized in that, step 4.4 comprises the following steps: Step 4.4.1, the single-channel signal includes a three-mode signal, and the fault simulation is performed on each mode signal by randomly selecting a logic value of 0 or 1; Step 4.4.2, obtaining all possible 8 states of the single signal; Step 4.4.3, respectively verifying the effectiveness of the implementation of the triple-mode redundancy according to the obtained 8 states; In step 4.4.4, comprehensively analyze the effectiveness of all obtained three-mode redundancy implementation modes, and complete the verification. 9. according to a kind of three-mode redundancy verification method described in any one of claims 1 to 3, it is characterized in that, in step 5, comprise the following steps: Step 5.1, sequentially treating the three communication equivalents of the sequential triple-mode redundancy as a redundant structure in the structural triple-mode redundancy; Step 5.2, verifying the sequence triple redundancy according to the verification method of the structural triple redundancy. 10. A kind of three-mode redundancy verification method according to claim 1, characterized in that, if the three-mode redundancy implementation includes structural three-mode redundancy and sequence three-mode redundancy, first check the sequence The triple-mode redundancy is verified, and then the triple-mode redundancy of the structure is verified.