CN116893936A

CN116893936A - Processing system, related integrated circuit, apparatus and method

Info

Publication number: CN116893936A
Application number: CN202310337986.0A
Authority: CN
Inventors: R·科隆波; V·M·夏尔马; S·阿加瓦尔
Original assignee: STMICROELECTRONICS INTERNATIONAL NV; STMicroelectronics Application GmbH
Current assignee: STMICROELECTRONICS INTERNATIONAL NV; STMicroelectronics Application GmbH
Priority date: 2022-04-01
Filing date: 2023-03-31
Publication date: 2023-10-17

Abstract

The present disclosure relates to processing systems, related integrated circuits, devices, and methods. In one embodiment, the processing system includes a test circuit configured to set the address value, the upper address limit, and the lower address limit to a given sequence of reference bits, verify whether the upper limit comparison signal has a respective third logic level and/or whether the lower limit comparison signal has a respective third logic level, assert an error signal in response to determining that the upper limit comparison signal does not have a respective third logic level or that the lower limit comparison signal does not have a respective third logic level, and repeat a particular operation for each of the N bits.

Description

Processing system, related integrated circuit, apparatus and method

Cross Reference to Related Applications

The application claims the benefit of italian application No.102022000006455 filed on 1, 4, 2022, which is incorporated herein by reference.

Technical Field

Embodiments of the present disclosure relate to error management within a processing system (e.g., a microcontroller).

Background

Fig. 1 shows a typical electronic system, such as that of a vehicle, comprising a plurality of processing systems 10, such as embedded systems or integrated circuits, such as Field Programmable Gate Arrays (FPGAs), digital Signal Processors (DSPs) or microcontrollers (e.g. dedicated to the automotive market).

For example, three processing systems 101, 102 and 103 are shown in fig. 1 connected by a suitable communication system 20. For example, the communication system may include a vehicle control bus, such as a Controller Area Network (CAN) bus, and possibly a multimedia bus, such as a Media Oriented System Transfer (MOST) bus, connected to the vehicle control bus via a gateway. Typically, the processing system 10 is located in various locations of the vehicle and may include, for example, an engine control unit, a Transmission Control Unit (TCU), an Antilock Brake System (ABS), a Body Control Module (BCM), and/or a navigation and/or multimedia audio system. Thus, one or more of the processing systems 10 may also implement real-time control and regulation functions. These processing systems are typically identified as electronic control units.

In this regard, future generations of such processing systems 10 (e.g., microcontrollers suitable for use in automotive applications) are expected to exhibit increased complexity, primarily due to an increase in the number of requested functions (new protocols, new features, etc.) and stringent constraints on execution conditions (e.g., lower power consumption, increased computing power and speed, etc.). For example, more complex multi-core processing systems 10 have recently been proposed. For example, such a multi-core processing system may be used to execute (in parallel) several of the processing systems 10 shown in fig. 1, such as several ECUs of a vehicle.

FIG. 2 illustrates an example of a processing system 10, such as a multi-core processing system. Specifically, in the example considered, the processing system 10 includes one or more processing cores 102, such as a plurality of n processing cores 1021 … n, connected to a (on-chip) communication system 114. For example, in real time controlIn the context of a system, the processing core 1021 … 102n may be-an R52 core. In general, communication system 114 may include one or more bus systems based on, for example, an advanced extensible interface (AXI) bus architecture and/or a network on chip (NoC).

For example, as shown by way of example of processing cores 1021, each processing core 102 may include a microprocessor 1020 and a communication interface 1022, the communication interface 1022 configured to manage communications between the microprocessor 1020 and the communication system 114. In general, interface 1022 is a master interface configured to forward a given (read or write) request from microprocessor 1020 to communication system 114, and to forward an optional response from communication system 114 to microprocessor 1020. However, communication interface 1022 may also include a slave interface. For example, in this manner, the first microprocessor 1020 may send a request to the second microprocessor 1020 (via the communication interface 1022 of the first microprocessor, the communication system 114, and the communication interface 1022 of the second microprocessor). In general, each processing core 1021 … 102n may also include other local resources, such as one or more local memories 1026, typically identified as Tightly Coupled Memories (TCMs).

Typically, the processing core 102 is arranged to exchange data with one or more non-volatile memories 104 and/or one or more volatile memories 104 b. In general, memory 104 and/or 104b may be integrated with processing core 102 in a single integrated circuit, or memory 104 and/or 104b may be in the form of separate integrated circuits and connected to processing core 102, for example, via traces of a printed circuit board.

Specifically, in multi-core processing system 10, these memories are typically system memories, i.e., shared for processing cores 1021 … 102 n. For example, communication with memory 104 and/or 104b may be performed via one or more memory controllers 100 connected to communication system 114 for this purpose. However, as described above, each processing core 102 may include one or more additional local memories 1026.

For example, software executed by the microprocessor 1020 is typically stored in a non-volatile program memory 104 (e.g., flash memory or EEPROM), i.e., the memory 104 is configured to store firmware of the processing unit 102, wherein the firmware includes software instructions to be executed by the microprocessor 102. In general, the non-volatile memory 104 may also be used to store other data, such as configuration data, for example calibration data. In contrast, volatile memory 104b, such as Random Access Memory (RAM), may be used for storing temporary data.

Typically, the processing system 10 further comprises one or more (hardware) resources/peripherals 106, for example selected from the group of:

one or more communication interfaces, for example for exchanging data via the communication system 20, such as a universal asynchronous receiver/transmitter (UART), a serial peripheral interface bus (SPI), an inter-integrated circuit (I2C), a Controller Area Network (CAN) bus, and/or an ethernet interface, and/or a debug interface; and/or

-one or more analog-to-digital converters and/or digital-to-analog converters; and/or

One or more special purpose digital components, such as hardware timers and/or counters, or cryptographic coprocessors; and/or

One or more analog components, such as comparators, sensors, such as temperature sensors, etc.; and/or

One or more mixed signal components, such as PWM (pulse width modulation) drivers.

In general, the application specific digital components may also correspond to FPGAs integrated in the processing system 10. In this case, for example, the memory 104 may also include program data for such an FPGA.

Resources 106 are typically coupled to communication system 114 via respective communication interfaces 1062 (e.g., a peripheral bridge). For example, communication system 114 may actually include an Advanced Microcontroller Bus Architecture (AMBA) high performance bus (AHB) for this purpose, as well as an Advanced Peripheral Bus (APB) for connecting resources/peripherals 106 to the ambaadb bus. Generally, communication interface 1062 includes at least a slave interface. For example, in this manner, processing core 102 may send a request to resource 106, and the resource returns given data. In general, one or more of the communication interfaces 1062 may also include a corresponding primary interface. For example, such a master interface, typically identified as an integrated Direct Memory Access (DMA) controller, may be useful in situations where a resource must begin communication in order to exchange data with another circuit connected to the communication system 114, such as the resource 106 or the processing core 102, via a (read and/or write) request.

Typically, such a processing system 10 also includes one or more general-purpose DMA controllers 110. For example, as shown in FIG. 2, DMA controller 110 may be used to exchange data directly with a memory (e.g. memory 104 b) based on requests received from resource 106. For example, in this manner, the communication interface may read data directly from the memory 104b (via the DMA controller 110) and transfer such data without having to exchange other data with the processing unit 102. In general, the DMA controller 110 may communicate with one or more memories via the communication system 114 or via one or more dedicated communication channels.

In this regard, regardless of the complexity of the processing system 10 (e.g., with respect to the number of processing cores 102 and/or the number and type of resources 106), at least one of the circuits 100, 102, 106, and 110 may generate one or more error signals ERR1 … ERRm, which are provided to the fault collection and error management circuit 120. For example, such error signal ERR may be generated by at least one of:

a memory controller 100 supporting error detection and/or correction functions that generates an error signal ERR1 when data read from the memory 104 or 104b contains errors and/or when data cannot be written to the memory;

-a processing core 102 configured to generate an error signal ERR2 in response to a hardware and/or software fault; and

a communication interface 106 configured to generate an error signal ERR3, the error signal ERR3 corresponding to a hard error signal indicating a hardware failure and/or a soft error signal indicating a data transmission error.

In addition, one or more error signals ERR may be generated by monitoring the supply voltage of the processing system 10 (e.g., to detect an up and/or down voltage condition), the clock signal of the processing system 10 (e.g., to detect whether the clock frequency is out of range), and/or the temperature of the processing system 10 (e.g., to detect whether the current operating temperature is out of range).

For example, european patent application n.ep 3534261A1 or italian patent application n.1020200009683 disclose possible embodiments of the fault collection and error management circuit 120, which are incorporated herein by reference for this purpose.

Fig. 3 shows a possible implementation of the fault collection and error management circuit 120. In the example considered, the fault collection and error management circuit 120 includes a register 1200. Specifically, in the example considered, register 1200 includes one or more error bits EB for storing the value of error signal ERR. For example, considering the exemplary case of three error signals ERR1 … ERR3, register 1200 may include a corresponding number of error bits EB.

In the example considered, the fault collection and error management circuit 120 includes an internal reaction circuit 1202. Specifically, the internal reaction circuit 1202 may be configured to generate the interrupt signal IRQ and/or the reset request signal RST according to the content of the error bit EB of the register 1200. The error bit EB is purely optional and the external reactive circuit 1202 may also generate the interrupt signal IRQ and/or the reset request signal RST directly from the error signal ERR.

Similarly, the fault collection and error management circuit 120 may include an external reaction circuit 1204. In particular, the external reactive circuit 1204 may be configured to generate an error trigger signal ET provided to a terminal (pin/pad) of the processing system 10, e.g., to signal an error to the external circuit, and/or a signal SET for setting an output level of one or more safety critical terminals of the processing system 10. Likewise, the error bit EB is purely optional and the external reaction circuit 1204 may also generate the signal ET and/or the signal SET directly from the error signal ERR.

In general, the behavior of the reactive circuits 1202 and/or 1204 may also be programmable, such as by setting one or more configuration bits in the register 1200. For example, in the example considered, register 1200 includes:

The respective interrupt enable bit IE for each error signal ERR1 … ERR3, i.e. when the respective interrupt enable bit IE of the asserted error signal ERR is also asserted, the interrupt signal IRQ is asserted;

the respective error trigger enable bit ETE for each error signal ERR1 … ERR3, i.e. when the respective error trigger enable bit ETE of the asserted error signal ERR is also asserted, the error trigger signal ET is asserted.

Similarly, register 1200 may include a respective reset enable bit for reset request signal REQ and/or a respective enable bit for security signal SET.

To simplify the exchange of data between the processing unit 102 and the register 1200, the register 1200 may be directly addressed by the processing core 102, which is schematically shown in fig. 2, wherein the fault collection and error management circuit 120 is connected to the communication system 114.

As shown in fig. 4, the error signal ERR is typically generated by a dedicated safety monitoring circuit SM. For example, such a safety monitor circuit may include combinational and/or sequential logic circuitry that monitors the operation of a given circuit. Typically, such a safety monitoring circuit SM may also comprise analog components, for example, in order to detect out-of-range conditions of the analog signal, such as an internal supply voltage or a signal indicative of the operating temperature of the processing system or of a specific circuit of the processing system. For example, fig. 4 shows a security monitor circuit SM100 configured to monitor one or more signals of a memory controller 100, a security monitor circuit SM102 configured to monitor one or more signals of a processing core 102, and a security monitor circuit SM106 configured to monitor one or more signals of a resource/peripheral 106. Typically, the security monitor circuit may also be integrated in the corresponding circuit.

Thus, typically, each security monitor circuit SM monitors one or more signals generated by and/or provided to the associated circuit and determines whether the signal's behaviour is normal or indicative of an error. For example, in many processing systems 10, one or more of such security monitoring circuits SM (or individual circuits directly monitored by the security monitoring circuit SM) may include a comparison circuit configured to compare address signals ADR to a given address range.

Such address comparison circuitry is typically used, for example, in a Memory Protection Unit (MPU) of the processing core 102, wherein the MPU is configured to manage the forwarding of read or write requests generated by the respective microprocessor 1020 to the communication system 114, e.g., the forwarding of read or write requests generated by the respective microprocessor 1020 to the communication interface 1022. For example, an MPU is used in a Protected Memory System Architecture (PMSA), such as the ARMAArch32 architecture with PMSA, where the MPU permits, e.g., via one or more access rights tables, direct specification of physical addresses/address ranges accessible and/or inaccessible to the microprocessor 1020 and/or software tasks performed by the microprocessor 1020, e.g., the MPU may be configured to:

When the request received by microprocessor 1020 includes a physical address allowed via the access rights table, forwarding the request to communication system 114; or alternatively, the process may be performed,

when the request received by the microprocessor 1020 includes a physical address not allowed via the access rights table, rejecting the request/prohibiting forwarding of the request.

Thus, when a security monitor circuit SM102 associated with an MPU of the processing core 102 detects a request for a blocking address (as signaled by the comparison circuitry of the MPU), the respective security monitor circuit SM102 should assert the respective error signal ERR1, signaling an error to the fault collection and error management circuit 120.

Such address comparison circuitry may also be used in security monitoring circuitry of memory controller 100 for determining behavior in the event of Error Correction Code (ECC) errors of memory 104 and/or 104 b. For example, such a memory may store ECC bits for implementing Single Error Correction and Double Error Detection (SECDED) schemes. For example, in this case, the memory range may be divided into different regions (via one or more comparison circuits), each region being assigned a specific and programmable error response. For example, in this way, a safety monitor circuit SM100 for monitoring a memory region containing safety critical data may be configured to already assert a corresponding error signal ERR1 in the case of a correctable unit error, while another safety monitor circuit SM100 for monitoring a memory region containing non-critical data may be configured to assert only a corresponding error signal ERR1 in the case of a non-correctable double bit error. Such a solution is disclosed, for example, in european patent application EP3534262A1, which is incorporated herein by reference.

The inventors have observed that ensuring proper functioning of such a comparison circuit may be particularly relevant. For example, a failure of the MPU's compare circuit would mean that the address protection is not working properly, which means that the undisturbed concept (one of the struts of the ISO 26262 specification) is violated. Fig. 1 shows a typical electronic system, such as that of a vehicle, comprising a plurality of processing systems 10, such as embedded systems or integrated circuits, such as Field Programmable Gate Arrays (FPGAs), digital Signal Processors (DSPs) or microcontrollers (e.g. dedicated to the automotive market).

Disclosure of Invention

Embodiments provide solutions for verifying the correct operation of such address comparison circuits.

As described above, various embodiments of the present disclosure relate to a processing system including an address comparison circuit configured to perform a comparison of an address value with an address upper bound and an address lower bound. To this end, the address comparison circuit comprises a first iterative digital comparator and a second iterative digital comparator.

Specifically, the first iterative digital comparator is configured to perform a comparison of the address value with an upper address limit. When the address value is less than the upper address limit, the first comparator sets the upper limit compare signal to a first logic level, e.g., high. When the address value is greater than the upper address limit, the first comparator sets the upper limit compare signal to a second logic level, e.g., low. Finally, when the address value corresponds to the upper address limit, the first comparator sets the upper limit comparison signal to a third logic level, wherein the third logic level corresponds to the first logic level or the second logic level based on the implementation of the first comparator.

For example, for this purpose, the first iterative digital comparator may comprise a cascade of a first set of bit comparators, wherein each bit comparator of the first set of bit comparators is configured to generate a respective comparison signal.

Specifically, the first bit comparator of the first set of bit comparators is configured to receive the first bit of the address value and the first bit of the upper address limit. When the first bit of the address value is set low and the first bit of the upper address limit is set high, the first bit comparator sets the corresponding comparison signal to the corresponding first logic level. When the first bit of the address value is set high and the first bit of the upper address limit is set low, the first bit comparator sets the corresponding comparison signal to the corresponding second logic level. Finally, when the first bit of the address value corresponds to the first bit of the address upper bound, the first bit comparator sets the corresponding comparison signal to the corresponding third logic level.

In contrast, the other bit comparators of the first set of bit comparators are configured to receive the respective bits of the address value, the respective bits of the upper address limit, and the comparison signal of the previous bit comparator of the first set of bit comparators. Specifically, when the respective bit of the address value is set low and the respective bit of the address upper limit is set high, the bit comparator sets the respective comparison signal to the respective first logic level. The bit comparator sets the respective comparison signal to the respective second logic level when the respective bit of the address value is set high and the respective bit of the upper address limit is set low. Finally, the bit comparator sets the corresponding comparison signal to the logical value of the comparison signal of the previous bit comparator when the corresponding bit of the address value corresponds to the corresponding bit of the address upper limit. In this case, therefore, the upper limit comparison signal may correspond to the comparison signal of the last bit comparator of the first group of bit comparators.

In various embodiments, the second iterative digital comparator is configured to perform a comparison of the address value with the address lower bound. Specifically, when the address value is greater than the address lower limit, the second comparator sets the lower limit comparison signal to a first logic level, e.g., high. When the address value is less than the address lower limit, the second comparator sets the lower limit comparison signal to a second logic level, e.g., low. Finally, when the address value corresponds to the address lower limit, the second comparator sets the lower limit comparison signal to a third logic level, wherein the third logic level corresponds to the first logic level or the second logic level based on implementation of the second comparator.

For example, for this purpose, the second iterative digital comparator may comprise a cascade of a second set of bit comparators, wherein each bit comparator of the second set of bit comparators is configured to generate a respective comparison signal.

Specifically, the first bit comparator of the second set of bit comparators is configured to receive the first bit of the address value and the first bit of the address lower bound. When the first bit of the address value is set high and the first bit of the address lower limit is set low, the first bit comparator sets the corresponding comparison signal to the corresponding first logic level. When the first bit of the address value is set low and the first bit of the address lower bound is set high, the first bit comparator sets the corresponding comparison signal to the corresponding second logic level. Finally, when the first bit of the address value corresponds to the first bit of the address lower bound, the first bit comparator sets the corresponding comparison signal to the corresponding third logic level.

In contrast, the other bit comparators of the second set of bit comparators are configured to receive the respective bits of the address value, the respective bits of the address lower bound, and the comparison signal of the previous bit comparator of the second set of bit comparators. Specifically, when the respective bit of the address value is set high and the respective bit of the address lower limit is set low, the bit comparator sets the respective comparison signal to the respective first logic level. The bit comparator sets the respective comparison signal to the respective second logic level when the respective bit of the address value is set low and the respective bit of the address lower bound is set high. Finally, the bit comparator sets the corresponding comparison signal to the logical value of the comparison signal of the previous bit comparator when the corresponding bit of the address value corresponds to the corresponding bit of the address lower limit. Therefore, in this case, the lower limit comparison signal may correspond to the comparison signal of the last bit comparator.

In various embodiments, the combinational logic circuit may thus be configured to assert the combinational comparison signal when the upper limit comparison signal has a respective first logic level and the lower limit comparison signal has a respective first logic level. In contrast, the combinational logic circuit may deassert the combinational comparison signal when the upper limit comparison signal has a corresponding second logic level or when the lower limit comparison signal has a corresponding second logic level.

As described above, various embodiments of the present disclosure relate to solutions for testing such address comparison circuits. Specifically, in various embodiments, the processing system includes a test circuit for this purpose.

Specifically, in various embodiments, the test circuit is configured to set the address value, the upper address limit, and the lower address limit to the same given reference bit sequence. For example, a given reference bit sequence may correspond to a first reference sequence with all bits set low or a second reference sequence with all bits set high. In various embodiments, the test circuit may also receive a first signal and select the first reference sequence or the second reference sequence based on the first signal.

Next, the test circuit verifies whether the upper limit comparison signal has a corresponding third logic level and/or whether the lower limit comparison signal has a corresponding third logic level. The test circuit may thus assert the error signal in response to determining that the upper bound comparison signal does not have a corresponding third logic level or that the lower bound comparison signal does not have a corresponding third logic level.

In various embodiments, the test circuit repeats various operations for each of the N bits.

Specifically, in various embodiments, the test circuit sets the respective bits of the address value high and sets the respective bits of the upper and lower address limits low. Next, the test circuit verifies whether the upper limit comparison signal has a corresponding second logic level and/or whether the lower limit comparison signal has a corresponding first logic level. The test circuit may thus assert the error signal in response to determining that the upper bound comparison signal has a corresponding first logic level or that the lower bound comparison signal has a corresponding second logic level.

Further, in various embodiments, the test circuit sets the respective bits of the address value low and sets the respective bits of the upper and lower address limits high. Next, the test circuit verifies whether the upper limit comparison signal has a corresponding first logic level and/or the lower limit comparison signal has a corresponding second logic level. The test circuit may thus assert the error signal in response to determining that the upper bound comparison signal has a corresponding second logic level or that the lower bound comparison signal has a corresponding first logic level.

Finally, the test circuit sets the respective bits of the address value, the upper address limit and the lower address limit to a given logic level, whereby the address value, the upper address limit and the lower address limit again have the same value. For example, a given logic level may correspond to a logic level of a respective bit of the reference sequence. For example, when the reference bit sequence corresponds to the first reference sequence, the given logic level may be low. In contrast, when the reference bit sequence corresponds to the second reference sequence, the given logic level may be high.

In various embodiments, the test circuit may be configured to determine the test result by monitoring the combined comparison signal. For example, in this case, the test circuit may receive the second signal and, in response to determining that the second signal has the first logic level, mask the lower bound comparison signal by setting the lower bound comparison signal to the corresponding first logic level. Thus, in this case, the test circuit can verify whether the upper bound comparison signal has the corresponding first logic level by verifying whether the combined comparison signal is asserted. Similarly, the test circuit may verify whether the upper bound comparison signal has a corresponding second logic level by verifying whether the combined comparison signal is deasserted. Similarly, in response to determining that the second signal has the second logic level, the test circuit may mask the upper bound comparison signal by setting the upper bound comparison signal to the corresponding first logic level. Thus, the test circuit can verify whether the lower bound comparison signal has the corresponding first logic level by verifying whether the combined comparison signal is asserted. Similarly, the test circuit may verify whether the lower bound comparison signal has a corresponding second logic level by verifying whether the combined comparison signal is deasserted.

Thus, in various embodiments, the processing circuit may include sequential logic circuitry configured to perform the test of the first iterative digital comparator by setting the second signal to the first logic level and verifying whether the error signal is asserted. Similarly, the sequential logic circuit may perform a test of the second iterative digital comparator by setting the second signal to a second logic level and verifying whether the error signal is asserted. For example, in various embodiments, the sequential logic circuit sets the first signal to a first logic level and performs a first test of the first iterative digital comparator. The sequential logic circuit then sets the first signal to a second logic level and performs a second test of the first iterative digital comparator. Similarly, the sequential logic circuit may set the first signal to a first logic level and perform a first test of the second iterative digital comparator, and set the first signal to a second logic level and perform a second test of the second iterative digital comparator.

Drawings

Embodiments of the present disclosure will now be described with reference to the accompanying drawings, which are provided by way of non-limiting example only, and in which:

FIG. 1 illustrates an example of an electronic system including multiple processing systems;

FIG. 2 illustrates an example of a processing system;

FIG. 3 illustrates an example of the fault collection and error management circuit of FIG. 2;

FIG. 4 illustrates an example of connections between multiple safety monitoring circuits and fault collection and error management circuits;

fig. 5 shows an example of an address comparing circuit including an upper limit comparator and a lower limit comparator;

FIG. 6 illustrates an embodiment of a modified address comparison circuit with associated test circuitry;

FIG. 7 illustrates one embodiment in which a test circuit may test multiple address comparison circuits;

FIG. 8 illustrates an embodiment of the operation of an iterative upper limit comparator;

FIG. 9 illustrates an embodiment of the operation of the iterative lower limit comparator;

FIG. 10 illustrates an embodiment of a structure of an iterative upper limit comparator;

FIG. 11 illustrates an embodiment of a structure of an iterative lower limit comparator;

FIG. 12 illustrates an embodiment of the operation of the test circuit of FIG. 6;

13-17 illustrate embodiments of details of the operations of FIG. 12; and

FIG. 18 illustrates an embodiment of a processing system including address comparison circuitry and corresponding test circuitry.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments. Embodiments may be practiced without one or more of these specific details, or with other methods, components, materials, etc. In other instances, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring aspects of the embodiments.

Reference throughout this specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of the phrases "in one embodiment" or "in an embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

The headings provided herein are for convenience only and do not interpret the scope or meaning of the embodiments.

In the following fig. 5 to 18, parts, elements or components which have been described with reference to fig. 1 to 4 are denoted by the same reference numerals as previously used in the figures; in order not to overburden the detailed description of the present disclosure, a description of these previously described elements will not be repeated below.

As described above, various embodiments of the present disclosure provide solutions for verifying proper operation of one or more address compare circuits of a processing system. As mentioned above, typically such an address comparison circuit forms part of an error detection and management circuit implemented for example with a plurality of security monitoring circuits SM and a fault collection and error management circuit 120. Thus, a general description of these circuits may be referred to the previous description of fig. 1 to 4.

Fig. 5 shows an embodiment of an address comparison circuit 40 configured to receive an address signal ADR. For example, the address signal ADR may correspond to an address of the communication system 114, an address of the memory 104 or 104b, or any other address signal, such as an internal address signal of the processing core 102, for example, for the interface TCM1026 or for providing a read or write request to a memory protection unit of the processing core. For example, in contemplated embodiments, address comparator circuit 40 may form part of a set of address comparison circuits 40, such as circuit 40 ₁ ，40 ₂ And 40 ₃ 。

In the considered embodiment, each address comparison circuit 40 is configured to perform a comparison of the value of the address signal ADR with a respective (e.g. programmable) upper address limit HADR and a respective (e.g. programmable) lower address limit LADR, in order to:

in response to determining that the value of address signal ADR is between upper address limit HADR and lower address limit LADR, asserting a respective range hit signal RH, such as signals RH1, RH2 and RH3 for circuits 401, 402 and 403; and

-deasserting the respective range hit signal RH in response to determining that the value of the address signal ADR is greater than the address upper limit HADR or less than the address lower limit LADR.

In general, signal RH may be asserted by setting signal RH high (e.g., to indicate a positive address hit) or low (e.g., to indicate a negative address hit).

For example, in the embodiment considered, each address comparison circuit 40 comprises a first digital comparator 400 configured to perform a comparison of the value of the address signal ADR with a respective upper address limit HADR, and:

-asserting a respective signal HH in response to determining that the value of the address signal ADR is less than the upper address limit HADR; and

-in response to determining that the value of the address signal ADR is greater than the address upper limit HADR, deasserting the corresponding signal HH.

In general, based on the application and as will be described in more detail below, digital comparator 400 may be configured to assert or de-assert signal HH when address signal ADR corresponds to an upper address limit HADR.

Similarly, each address comparison circuit 40 includes a second digital comparator 402 configured to compare the value of the address signal ADR with a respective lower address limit LADR, and: -asserting a respective signal LH in response to determining that the value of the address signal ADR is greater than the address lower limit LADR; and

-deasserting the corresponding signal LH in response to determining that the value of the address signal ADR is smaller than the address lower limit LADR.

Based on the application, the digital comparator 402 may be configured to assert or de-assert the signal LH when the address signal ADR corresponds to the address lower limit LADR.

Thus, in the contemplated embodiment, each address comparison circuit 40 includes a combinational logic circuit 404, e.g., a logic gate, configured to assert a corresponding signal RH when signals HH and LH are asserted. For example, assuming signals HH, LH, AND RH are asserted by setting the respective signals high, then combinational logic circuit 404 may be implemented with a logic AND gate.

In this regard, standard ISO 26262 specifies that any error detection logic should be protected from faults. The level of protection depends on how the safety critical function is the final error captured by the error detection logic: in the most stringent scenario, the error detection logic should have at least 90% fault coverage of all possible errors, corresponding to ASIL-D class of ISO 26262 specifications.

The inventors have observed that the verification/override of the address verification circuitry can be implemented with different policies, such as:

running LBIST (logic built-in self test), which is a way to activate the internal nodes of the security monitoring circuit and verify the result and/or to provide the same output by copying the address comparison circuit and checking both circuits; and/or

Running some specific software intended to activate a logic function, for example by setting different address comparison ranges and providing requests comprising different addresses.

However, the inventors have observed that these solutions have advantages and disadvantages, such as: the LBIST solution requires effort at the back-end development stage, which may consume resources and project time, as LBIST coverage may only be obtained after a few time-consuming trials. Furthermore, in order to achieve the target coverage, LBIST test points must be inserted, which also means an increase in area. In addition, the test time to achieve target coverage may be high.

Duplicating logic increases the device area and requires one or more security monitors to check the output of the duplicated security monitors.

SW testing may not be practical because the number of tests may be so high that their time to complete also exceeds the final test time budget limit (which is typically defined by the customer). Furthermore, the complexity of software may represent a problem in terms of development, validation and related costs. In addition, multiple instances of such comparison circuits may need to be tested sequentially, further increasing test time.

Fig. 6 shows an embodiment of a modified address comparison circuit 40 a.

Specifically, in the contemplated embodiment, the address comparison circuit 40a includes a multiplexer 420, the multiplexer 420 being configured to provide the address signal IA by selecting either the address signal ADR or the test address signal TADR in accordance with the signal TM, wherein the test address signal TADR is provided by the test circuit 42, i.e., the test circuit 42 is configured to selectively provide the address signal IA to the address comparison circuit 40 a.

In the embodiment considered, the address comparison circuit 40a comprises two further multiplexers 422 and 424. Specifically, multiplexer 422 is configured to provide an upper address limit or threshold TAH by selecting, for example, an upper address limit HADR or an upper address limit THADR (corresponding to a test upper address limit) provided by register interface 406 in accordance with signal TM. Similarly, multiplexer 424 is configured to provide a lower address limit or threshold TAL by selecting, for example, a lower address limit LADR or a second lower address limit TLADR (corresponding to a test lower address limit) provided by register interface 406, in accordance with signal TM. Thus, addresses THADR and TLADR may be provided by test circuitry 42. As will be described in more detail below, in various embodiments, the test circuit 42 may also provide a common limitation signal TRADR, where thadr=tladr=tradr.

In general, the lower address limit LADR and/or the upper address limit HADR may also be fixed or programmable in any other suitable manner, and the use of the register interface 406 involves only typical applications. For example, the register interface 406 may include registers for storing respective upper address limits HADR and respective lower address limits LADR, where the registers are programmable, e.g., by sending commands to the communication system 114 and/or the communication system within the processing core 102 (e.g., for configuring a memory protection unit).

In the embodiment under consideration, comparator 400 is thus configured to assert signal HH when address signal IA is less than upper address limit TAL, and comparator 402 is configured to assert signal LH when address signal IA is greater than lower address limit TAL. Typically, the address signal ADR (and accordingly also the signal TADR, IA, HADR, THADR, TAH, LADR, TLADR, TAL) therefore has a given number N of bits, such as 16, 32 or 62 bits.

In the embodiment under consideration, test circuit 42 may thus drive multiplexers 420, 422 and 424 via signal TM to provide address signal TADR and upper and lower limits THADR and TLADR, respectively, to digital comparators 400 and 402 during a test mode (e.g., signal TM set high).

In various embodiments, address comparison circuit 40a also includes two additional combinational logic circuits 426 and 428. Specifically, the combinational logic circuit 426, schematically illustrated via a multiplexer, is configured to selectively assert/mask the signal HH provided to the combinational logic circuit 404, for example, by setting the signal HH high. Similarly, the combinational logic circuit 428, schematically illustrated via a multiplexer, is configured to selectively assert/mask the signal LH provided to the combinational logic circuit 404, for example, by setting the signal LH high. Thus, in this manner, test circuit 42 may also generate select signals for combinational logic circuits 426 and 428 to selectively assert signals HH and/or LH regardless of the comparison results of comparators 400 and/or 402.

As described above, the comparison circuit 40a may form part of, for example, the processing core 102, the memory controller 100, the resource 106 or one or more security monitoring circuits SM. For example, also shown in fig. 6 is a safety monitoring circuit SM40, which safety monitoring circuit SM40 is configured to receive the signal RH and to selectively assert an error signal ERR as a function of the signal RH, wherein the error signal ERR is provided to the fault collection and error management circuit 120.

Thus, in the contemplated embodiment, test circuit 42 may activate the test mode via signal TM (for switching multiplexers 420, 422, and 424) and provide various combinations of signals TADR, THADR, and TLADR to comparison circuit 40a in order to test comparison circuit 40a and provide adequate test coverage.

As shown in FIG. 7, in various embodiments, test circuit 42 may also test multiple comparison circuits 40a, such as comparison circuit 40a, in parallel ₁ ，40a ₂ And 40a ₃ . In this case, the test circuit 42 supplies the same signals TADR, THADR, and TLADR to the comparison circuit 40a in addition to the test mode (through signal TM) in which the comparison circuit 40a is activated. To monitor the range hit signal RH generated by the comparison circuit 40a, e.g. signal RH ₁ ，RH ₂ And RH (relative humidity) ₃ Test circuit 42 has associated (or includes) two logic gates:

a first logic gate 440, e.g. an AND gate, configured to assert the first signal RHa when the all range hit signal RH is asserted; and

a second logic gate 442, e.g. an OR gate, configured to assert the second signal RHb when the at least one range hit signal RH is asserted.

Thus, in the event that the range hit signal RH should be asserted (based on signals TADR, THADR, and TLADR), test circuit 42 may verify whether signal RHA is asserted. In practice, signal RHa is deasserted when at least one of the comparison circuits 40a does not assert the corresponding signal RH. Thus, in this case, in response to determining that signal RHa is deasserted, test circuit 42 may signal an error.

Similarly, in the event that the range hit signal RH should be deasserted (based on signals TADR, THADR, and TLADR), test circuit 42 may verify whether signal RHB is deasserted. In practice, signal RHb is asserted when at least one of the comparison circuits 40a asserts the corresponding signal RH. Thus, in this case, the test circuit may signal an error in response to determining that signal RHb is asserted.

In general, the particular test sequence used to test comparators 400 and 402 depends on the particular implementation of these comparators.

In this respect, the inventors have observed that the number of tests to be performed can be significantly reduced when using a specific structure for the comparator.

Fig. 8 illustrates an embodiment of the operation of the comparator 400.

Specifically, the operation of comparator 400 begins at start step 4000, for example, at each clock cycle or in response to a given request. In the next step 4002, the comparator 400 sets the index x to the index of the Most Significant Bit (MSB), for example x=n.

In a next step 4006, the comparator 400 verifies whether the bit value of the selected bit of the address signal IA [ x ] corresponds to the bit value of the selected bit of the address upper threshold TAH [ x ], i.e., IA [ x ] =tah [ x ]. In the case where the value of bit IA [ x ] does not correspond to the value of bit TAH [ x ] (the output "N" of verification step 4006), comparator 400 proceeds to step 4008, where comparator 400 verifies whether the value of bit IA [ x ] is greater than the value of bit TAH [ x ], i.e., IA [ x ] > TAH [ x ], e.g., whether bit IA [ x ] is set high and bit TAH [ x ] is set low.

In the case where the value of bit IA [ x ] is greater than the value of bit TAH [ x ] (the output "Y" of verification step 4008), comparator 400 deasserts signal HH in step 4012, and the operation stops in stop step 4016. In contrast, if the value of bit IA [ x ] is smaller than the value of bit TAH [ x ] (the output "N" of verification step 4008), then comparator 400 asserts signal HH at step 4014 and operation stops at stop step 4016.

In contrast, if the value of bit IA [ x ] corresponds to the value of bit TAH [ x ] (the output "Y" of verification step 4006), comparator 400 cannot determine whether address IA is greater than threshold TAH based on the selected bit and must check the next lower bit. Thus, in this case, the comparator 400 selects the next lower bit, i.e., x=x-1, at step 4010 and returns to step 4006 to verify the next lower bit. For this reason, such comparator architectures are generally identified as iterative comparator circuits.

Also shown in fig. 8 is a verification step 4004. Specifically, this step verifies whether all bits have been verified, for example because the index is set to 0. Thus, in the event that not all bits have been verified (verifying the output "N" of step 4004), the loop of steps 4006 and 4010 may be repeated. In contrast, in the case where all bits have been verified (verifying the output "Y" of step 4004), this means that bit IA [ x ] is neither greater than nor less than the corresponding bit TAH [ x ], i.e., address IA corresponds to the threshold TAH. Thus, in the event that this occurs, the comparator 400 may perform to:

Step 4012 in case the threshold TAH is not comprised in the address range; or-step 4014 in case the threshold TAH is comprised in the address range.

Similarly, fig. 9 illustrates an embodiment of the operation of the comparator 402.

Specifically, the operation of comparator 402 begins at start step 4100, e.g., at each clock cycle or in response to a given request. At next step 4102, comparator 402 sets index x to the index of the Most Significant Bit (MSB), e.g., x=n.

At next step 4106, comparator 402 verifies whether the bit value of the selected bit of address signal IA [ x ] corresponds to the bit value of the selected bit of address logic threshold TAL [ x ], i.e., IA [ x ] =tal [ x ]. In the case where the value of bit IA [ x ] does not correspond to the value of bit TAL [ x ] (the output "N" of verification step 4106), the comparator 402 proceeds to step 4108, where the comparator 402 verifies whether the value of bit IA [ x ] is greater than the value of bit TAL [ x ], i.e., IA [ x ] > TAL [ x ], e.g., whether bit IA [ x ] is set high and bit TAL [ x ] is set low.

In the case where the value of bit IA [ x ] is greater than the value of bit TAL [ x ] (the output "Y" of verification step 4108), comparator 402 asserts signal LH at step 4114 and the operation stops at stop step 4116. In contrast, if the value of bit IA [ x ] is smaller than the value of bit TAL [ x ] (the output "N" of verification step 4108), comparator 402 deasserts signal LH in step 4112 and the operation stops in stop step 4116.

Also in this case, when the value of bit IA [ x ] corresponds to the value of bit LAH [ x ] (the output "Y" of verification step 4106), the comparator 402 cannot determine whether the address IA is greater than the threshold LAH based on the selected bit and must check the next lower bit. Thus, in this case, the comparator 402 selects the next lower bit, i.e., x=x-1, at step 4110 and returns to step 4106 to verify the next lower bit.

Similarly, fig. 9 shows an additional verification step 4104 for verifying whether all bits have been verified, for example because the index is set to 0. Thus, in the event that not all bits have been verified (verifying the output "N" of step 4104), the loop of steps 4106 and 4110 is repeated. In contrast, in the case where all bits have been verified (the output "Y" of verification step 4104), this means that none of bits IA [ x ] is greater than or less than the corresponding bit TAL [ x ], i.e., address IA corresponds to the threshold TAL. Thus, in the event that this occurs, the comparator 402 may proceed to:

-step 4112 if the threshold TAL is not comprised in the address range; or-step 4114 in case the threshold TAL is comprised in the address range.

Fig. 10 shows a possible hardware implementation of the operation of the comparator 400.

Specifically, in the embodiment under consideration, iterative digital comparator 400 uses N-bit comparator 4000 ₀ …4000 _n Wherein n= (N-1), with each bit comparator 4000 having 0.ltoreq.i.ltoreq.n _i Generating a phase according to the address signal IAPosition IA [ i ]]Corresponding bit TAH [ i ] of address upper limit address signal TAH]Comparison result HH [ i-1 ] with previous bit comparator 4000i-1]Corresponding comparison result HH [ i ]]。

In this respect, the signal HH is determined from the comparison result HH n of the last bit comparator and preferably corresponds to the comparison result HH n of the last bit comparator, i.e., hh=hh n. Further, the value HH < -1 > received by the first bit comparator 40000 may be set to "0" whereby signal HH is asserted when signal IA is less than signal TAH, or "1" whereby signal HH is also asserted when signal IA corresponds to signal TAH.

Specifically, in the contemplated embodiment, each bit comparator 4000 is configured to:

-determining the logical values of the bits IA [ i ] and TAH [ i ], and

-asserting the signal HH [ i ] in response to determining that the bit TAH [ i ] is set high and the bit IA [ i ] is set low;

-deasserting said signal HH [ i ] in response to determining that said bit TAH [ i ] is set low and that said bit IA [ i ] is set high; and

In response to determining that bit TAH [ i ] is set to the value of bit IA [ i ], signal HH [ i ] is set to the value of signal HH [ i-1] provided by previous bit comparator 4000 i-1.

For example, assuming that signal IA is set to "100" and signal TAH is set to "101", the bit comparator will provide the following output signals:

HH [0] will be set to "1" because bit TAH [0] is set high and bit IA [0] is set low;

HH [1] will be set to "1" because TAH [1] =ia [1] and HH [0] is set high; and is also provided with

-HH [2] =hh will be set to "1" because TAH [2] =ia [2] and HH [1] is set to high.

Similarly, as shown in FIG. 11, iterative digital comparator 402 may employ an N-bit comparator 4020 ₀ …4020 _n Wherein n= (N-1), wherein each bit comparator 4020i having 0.ltoreq.i.ltoreq.n generates a corresponding bit IA [ i ] according to the address signal IA]Ground and floorCorresponding bit TAL [ i ] of address lower limit address signal TAH]And previous bit comparator 4020 _i-1 Is the comparison result LH [ i-1]]Corresponding comparison result LH [ i ]]。

In this respect, the signal LH is determined as a function of and preferably corresponds to the comparison result of the last bit comparator, i.e. lh=lh [ n ] ]. Further, by the first bit comparator 4020 ₀ Received value LH 1]May be set to "0" whereby signal LH is asserted when signal IA is greater than signal TAL, or "1" whereby signal LH is also asserted when signal IA corresponds to signal TAL.

Specifically, in the contemplated embodiment, each bit comparator 4020 is configured to:

-determining the logical values of the bits IA [ i ] and TAL [ i ], and

-deasserting said signal LH [ i ] in response to determining that said bit TAL [ i ] is set high and that said bit IA [ i ] is set low;

-asserting the signal LH [ i ] in response to determining that the bit TAL [ i ] is set low and the bit IA [ i ] is set high; and

-in response to determining bit TAL [ i ]]Is set to bit IA [ i ]]Is to signal LH [ i ]]Is set to be made by the previous bit comparator 4020 _i-1 The provided signal LH [ i-1 ]]Is a value of (2).

For example, assuming that signal ADR is set to "100" and signal TAL is set to "011", the bit comparator will provide the following output signals:

LH [0] will be set to "0" because bit TAL [0] is set high and bit IA [0] is set low;

LH [1] will be set to "0" because bit TAL [1] is set high and bit IA [1] is set low;

LH [2] will be set to "1" because bit TAL [2] is set low and bit IA [2] is set high.

Thus, for the examples of ia= "100", tah= "101" and tal= "011", comparator 400 may provide signal hh= "1" and comparator 402 may provide signal lh= "1", whereby signal RH may also be set high, indicating that address IA is between addresses TAH and TAL.

For example, the above-described behavior of the bit comparator may be represented in the form of a logic table. For example, based on the implementation of comparator 402, the value LH < -1 > used by the first bit comparator 40200]May be set high or low, and may also be hardwired. Therefore, when comparator 402 is configured to determine whether signal IA is greater than signal TAL (LH [1 ]]When= "0"), the signal IA [0 ] is received]And TAL [0 ]]Comparator 4020 of (1) ₀ Has the following logic table:

IA[0]	TAL[0]	LH[0]
			0	0	0
0	1	0
			1	0	1
1	1	0

in contrast, when the comparator 402 is configured to determine whether the signal IA corresponds to or is greater than the signal TAL (LH < -1 >]When= "1"), signal IA [0 ] is received]And TAL [0 ]]Is a comparison of (2)4020 device ₀ Has the following logic table:

IA[0]	TAL[0]	LH[0]
			0	0	1
0	1	0
			1	0	1
1	1	1

relatively, a corresponding signal IA [ i ] is received]And TAL [ i ]]Bit comparator 4020 of (1) ₁ 4020 to 4020 _n Has the following logic table:

/>

without lack of generality, it will be primarily assumed hereinafter that comparator 402 sets signal LH [ n ] high when IA≡TAL. In this case, when the signal LH [ n ] is set high, the signal LH is thus asserted, for example, set high. Similarly, assume that comparator 400 sets signal HH [ n ] high when IA+.TAH. In this case, when signal HH [ n ] is set high, signal HH is thus asserted, e.g., set high. Thus, when TAL+.IA+.TAH, signal RH is asserted, e.g., set high, indicating a positive hit.

As described above, test circuit 42 should therefore provide a sequence of different modes to comparison circuit 40a via signals TADR, TAH and TAL in order to test comparators 400 and 402. To this end, the test circuit 42 may be implemented in hardware sequential logic circuitry, thereby implementing a finite state machine.

Fig. 12 shows an embodiment of the operation of the test circuit 42 for testing the address comparison circuit 40 a.

Specifically, in the contemplated embodiment, after start step 4200, test circuit 42 is configured to test comparators 400 and 402, respectively. For this purpose, the test circuit may be configured to perform two phases, which may also be reversed:

during a first test phase 4202, the combinational logic circuit 426 is driven to assert the signal HH, whereby the test result of the comparator 400 is rewritten and the signal RH corresponds to the signal LH generated by the comparator 402, i.e. rh=lh; and is also provided with

During the second test phase 4204, the combinational logic circuit 428 is driven to assert the signal LH, whereby the test result of the comparator 402 is rewritten and the signal RH corresponds to the signal HH generated by the comparator 400, i.e. rh=hh.

Thus, in various embodiments, test circuit 42 may begin step 4200 in response to asserting test mode signal TM, and once the test procedure is completed at stop step 4212, test circuit 42 may again deassert test mode signal TM.

Masking of signals HH (during one phase) and LH (during the other phase) allows the final signal RH to be checked at the output of the combinational logic circuit 404. Further, in this way, the signals THADR and TLADR may be combined, i.e. the test circuit 42 may provide a single address limit signal TRADR to the comparison circuit 40a, whereby the address upper and lower limits TAH and TAL correspond to the address limit signal TRADR when the test mode is activated, i.e. tah=tal=tradr, thereby reducing wiring between the test circuit 42 and the respective comparison circuit 40 a.

However, to achieve faster testing, signals HH AND LH may also be provided (directly, OR through additional AND AND OR gates similar to FIG. 7) to test circuit 42. Thus, in this case, comparators 400 and 402 may also be tested in parallel, and combinational logic circuits 426 and 428 may also be omitted, i.e., stages 4202 and 4204 may be performed in parallel.

As shown in fig. 12, in various embodiments, the test phase 4202 includes two sub-phases or processes 4300 and 4400, which sub-phases or processes 4300 and 4400 may also be reversed. Similarly, test phase 4204 includes two sub-phases or processes 4500 and 4600, which sub-phases or processes 4500 and 4600 may also be reversed.

Fig. 13 illustrates an embodiment of a process 4300. Specifically, once process 4300 begins, test circuit 42 sets all bits of test address signal TADR (and thus signal IA) and address lower limit TAL (e.g., via common signal TRADR) to "0" at step 4302.

Thus, when comparator 402 receives ia=tal, for example, when bit comparator 4020 _i Receiving IA [ i ]]= "0" and TAL [ i ]]When= "0", the test 4302 verifies the comparison result. Thus, based on the implementation of comparator 402, test circuit 42 may be configured to determine at step 4304 whether signals LH and/or RH correspond to expected results, namely:

when comparator 402 is configured to determine whether address signal IA corresponds to or is greater than address lower limit TAL, whether signal LH (or preferably signal RH in the case of masking of signal HH) is deasserted; or alternatively

When the comparator 402 is configured to determine whether the address signal IA corresponds to or is greater than the address lower limit TAL, whether the signal LH (or preferably, the signal RH in the case of masking of the signal HH) is asserted.

Thus, in the event that signals LH and/or RH do not correspond to the expected result of verification step 4304 (output "N"), test circuit 42 may proceed to error step 4320 to signal a test failure. In contrast, in the event that the signals LH and/or RH correspond to the expected result of verification step 4304 (output "Y"), test circuit 42 proceeds to step 4306.

Specifically, in various embodiments, the test circuit sets a given bit IA [ i ] high and sets a corresponding bit TAL [ i ] low, where 0.ltoreq.i.ltoreq.n, at step 4306. For example, as shown in fig. 13, the test circuit 42 may select an initial value of the index i, such as the Most Significant Bit (MSB) or the Least Significant Bit (LSB), at step 4303.

In this way, therefore, the signal LH should be set high. Thus, test circuit 42 may verify whether signals LH and/or RH are asserted (i.e., the comparator issues a hit signal) at step 4308. Thus, in the event that signal LH (or RH) is deasserted (verifying output "N" of step 4308), the test circuit proceeds to error step 4320. In contrast, in the case where the signal LH and/or RH is asserted (the output "Y" of the verification step 4308), the test circuit proceeds to step 4310.

Specifically, in various embodiments, the test circuit sets bit IA [ i ] low and sets bit TAL [ i ] high at step 4310. In this way, therefore, the signal LH should be set low. Thus, test circuit 42 may verify whether signals LH and/or RH are deasserted (i.e., the comparator signals a failure) at step 4312. Thus, in the case where signals LH and/or RH are asserted (verifying the output "N" of step 4312), the test circuit proceeds to an error step 4320. In contrast, in the case where the signal LH and/or RH is deasserted (the output "Y" of the verification step 4312), the test circuit proceeds to step 4314.

Specifically, at step 4314, test circuit 42 again sets bit IA [ i ] low and sets bit TAL [ i ] low.

Thus, at step 4316, test circuit 42 may select another bit, e.g., the next lower bit, of the N bits to be tested. Further, at step 4318, test circuit 42 may verify whether all N bits have been tested. Specifically, in the event that another one of the N bits must be tested (the output "N" of verification step 4318), test circuit 42 returns to step 4306 for testing of the next selected bit. Thus, in the contemplated embodiment, the test circuit 42 is configured to repeat steps 4306-4314 for all N bits.

In contrast, if the test circuit has tested all N bits (the output "Y" of the verification step 4316), the test circuit 42 proceeds to the stop step 4322. In general, the test circuit may also proceed from error step 4320 to stop step 4322.

Thus, the test 4300 may begin verifying operation of the comparator circuit 4020 from the initial values IA and TAL that set all bits to "0".

In contrast, test 4400 may begin verifying the operation of comparator 403 from initial values IA and TAL, which set all bits to "1".

Fig. 14 illustrates an embodiment of a process 4400. Specifically, once process 4400 begins, test circuit 42 sets all bits of test address signal TADR (and thus signal IA) and address lower limit TAL (e.g., via common signal TRADR) to "1" at step 4402.

Thus, when comparator 402 receives ia=tal, for example, when bit comparator 4020 _i Receiving IA [ i ]]= "1" and TAL [ i ]]When = "1", the test 4402 verifies the comparison result. Thus, based on the implementation of comparator 402, test circuit 42 may be configured to determine at step 4404 whether signals LH and/or RH correspond to the expected result, namely:

when comparator 402 is configured to determine whether address signal IA is greater than address lower limit TAL, whether signal LH (or preferably signal RH in the case of masking of signal HH) is deasserted; or alternatively

Thus, in the event that signals LH and/or RH do not correspond to the expected result of verification step 4404 (output "N"), test circuit 42 may proceed to error step 4420 to send an error signal to, for example, fault collection and error management circuit 120.

In contrast, in the event that signals LH and/or RH correspond to the expected result of verification step 4404 (output "Y"), test circuit 42 proceeds to step 4406.

Specifically, in various embodiments, the test circuit sets a given bit IA [ i ] high and sets bit TAL [ i ] low, where 0.ltoreq.i.ltoreq.n, at step 4406. For example, as shown in fig. 14, the test circuit 42 may select an initial value of the index i, such as the Most Significant Bit (MSB) or the Least Significant Bit (LSB), at step 4403.

In this way, therefore, the signal LH should be set high. Thus, test circuit 42 may verify whether signals LH and/or RH are valid at step 4408. Thus, in the event that signals LH and/or RH are deasserted (verifying output "N" of step 4408), the test circuit proceeds to error step 4420. In contrast, in the case where the signal LH and/or RH is asserted (the output "Y" of the verification step 4408), the test circuit proceeds to step 4410.

Specifically, in various embodiments, the test circuit sets bit IA [ i ] low and sets bit TAL [ i ] high at step 4410. In this way, therefore, the signal LH should be set low. Thus, test circuit 42 may verify whether signals LH and/or RH are deasserted at step 4412. Thus, in the event that signals LH and/or RH are asserted (verifying the output "N" of step 4412), the test circuit proceeds to an error step 4420. In contrast, in the case where the signals LH and/or RH are deasserted (the output "Y" of the verification step 4412), the test circuit proceeds to step 4414.

Specifically, at step 4414, test circuit 42 again sets bit IA [ i ] high and sets bit TAL [ i ] high.

Thus, at step 4416, test circuit 42 may select another bit of the N bits, such as the next lower bit. Further, at step 4418, test circuit 42 may verify whether all N bits have been tested. Specifically, in the event that another one of the N bits must be tested (verifying the output "N" of step 4418), test circuit 42 returns to step 4406 for testing the next selected bit. Thus, in the contemplated embodiment, the test circuit 42 is configured to repeat steps 4406-4414 for all N bits.

In contrast, in the case where the test circuit has tested all N bits (the output "N" of the verification step 4416), the test circuit 42 proceeds to the stop step 4422. Typically, the test circuit may also proceed from the error step 4420 to the stop step 4422.

In various embodiments, test circuit 42 may also implement corresponding operations to test comparator 400.

For example, as shown in fig. 15, process 4500 may substantially correspond to process 4300 shown in fig. 11, i.e., test circuit 42 may set all bits of test address signal TADR (and thus signal IA) and upper address limit TAH (e.g., via common signal TRADR) to "0" at step 4502. Thus, when comparator 400 receives ia=tal, for example, when bit comparator 4000 ₁ Receiving IA [ i ]]= "0" and TAH [ i ]]When = "0", the test verifies the comparison result. Thus, based on the implementation of comparator 400, the test circuit may verify at step 4504 whether signals HH and/or RH correspond to expected results, namely:

when comparator 400 is configured to determine whether address signal IA is less than upper address limit TAH, whether signal HH (or preferably signal RH in the case of masking of signal LH) is deasserted; or alternatively

When comparator 400 is configured to determine whether address signal IA corresponds to or is less than upper address limit TAH, whether signal HH (or preferably signal RH in the case of masking of signal LH) is asserted.

Thus, in the event that signals HH and/or RH do not correspond to the expected result, test circuit 42 may issue an error signal at error step 4520. In contrast, in the event that signals HH and/or RH correspond to the expected results, test circuit 42 may sequentially select a set position i having 0.ltoreq.i.ltoreq.n, e.g., via steps 4503, 4516, and 4518 (corresponding to steps 4303, 4316, and 4318), and:

-setting bit IA [ i ] high and bit TAH [ i ] low at step 4506;

verifying whether the signal HH and/or RH is deasserted in step 4508, and possibly signaling an error in step 4520 when the signal HH and/or RH is asserted;

-at step 4510, bit IA [ i ] is set low and bit TAH [ i ] is set high;

verifying whether the signal HH and/or RH is asserted at step 4512, and possibly signaling an error at step 4520 when the signal HH and/or RH is deasserted; and-bit IA [ i ] is set low and bit TAH [ i ] is set low at step 4514.

In contrast, as shown in fig. 16, process 4600 may substantially correspond to process 4400 shown in fig. 12, i.e., test circuit 42 may set all bits of test address signal TADR (and thus signal IA) and upper address limit TAH (e.g., via common signal TRADR) to "1" at step 4602. Thus, when comparator 400 receives ia=tal, for example, when bit comparator 40001 receives IA [ i ] = "1" and TAH [ i ] = "1", the test verifies the comparison result. Thus, based on the implementation of comparator 400, the test circuit may verify whether signals HH and/or RH correspond to expected results, namely:

Thus, in the event that signals HH and/or RH do not correspond to the expected result, test circuit 42 issues an error signal at error step 4620. In contrast, in the event that signals HH and/or RH correspond to the expected results, test circuit 42 may sequentially select a set position i having 0.ltoreq.i.ltoreq.n, e.g., via steps 4603, 4616, and 4618 (corresponding to steps 4403, 4416, and 4418), and:

-at step 4606, bit IA [ i ] is set high and bit TAH [ i ] is set low;

verifying if signals HH and/or RH are deasserted at step 4680, and possibly signaling an error at error step 4620 when signal HH (or RH) is asserted; -at step 4612, bit IA [ i ] is set low and bit TAH [ i ] is set high;

verifying whether the signal HH and/or RH is asserted and possibly signaling an error at an error step 4620 when the signal HH and/or RH is deasserted; and-bit IA [ i ] is set high and bit TAH [ i ] is set high at step 4614.

Thus, in various embodiments, processes 4300 and 4500 and similar processes 4400 and 4600 may generate the same signals TADR and thadr=tladr, but may verify different results for signals LH and HH. Thus, also in the case of performing parallel testing, in particular, since the test circuit 42 also receives the signals HH and LH from the comparison circuit 40a, the test circuit 42 may be configured to generate the common signal tradr=thadr=tladr.

Thus, as shown in fig. 12, once tests 4202 and 4204 are performed, test circuit 42 may verify at step 4206 whether one of the tests has issued an error signal (see steps 4320, 4420, 4520 and 4620). In the event that one of the tests has issued an error signal (the output "Y" of verification step 4206), the test circuit may assert an error signal, which may be provided to, for example, the processing core 102 and/or the fault collection and error management circuit 120. In contrast, in the event that none of the tests signal an error (verify the output "N" of step 4206), the test circuit may signal that the test of the comparator has been completed without an error, for example, by deasserting an error signal. Finally, the test terminates at a stop step 4212.

In general, based on the application, test circuit 42 may also be configured to perform only one of tests 4300 and 4400 to test comparator 402, and similarly perform one of tests 4500 and 4600 to test comparator 400.

Thus, in various embodiments, test circuit 42 may be a configurable test circuit configured to perform one of tests 4300, 4400, 4500, and/or 4600 in accordance with one or more signals indicating which test should be performed, e.g., a first signal 0_1 indicating whether to start with a bit sequence having all bits set to "0" or "1" and a second signal h_l indicating whether to test comparator 400 or 402. For example, the combination of signals 0_1 and h_l may indicate whether or not to perform:

Test 4300, e.g., when 0_1= "0" and h_l= "0";

test 4400, for example when 0_1= "1" and h_l= "0";

test 4500, for example when 0_1= "0" and h_l= "1"; and-test 4600, for example when 0_1= "1" and h_l= "1".

Fig. 17 illustrates an embodiment of the operation of configurable test circuit 42.

In the following it will be assumed that the configurable test circuit supports all four tests. In this regard, as previously described, process 4300 begins to form initial bit sequences IA and TAL (via signals TLADR or TRADR) with all bits set to "0", and process 4400 begins to form initial bit sequences IA and TAL with all bits set to "1". However, in both cases, the test circuit 42 expects the same result. In contrast, processes 4500 and 4600 use the same initial bit sequences IA and TAH (via signals THADR or TRADR), but different results are desired.

In the embodiment under consideration, after the start step 5000, the circuit 42 sets all bits of the signals TADR and TRADR to the logic level of the signal 0_1 in step 5002 (implementing steps 4302, 4402, 4502 and 4602), for example, to "0" when the signal 0_1 is set to low and to "1" when the signal 0_1 is set to high. Generally, in various embodiments, the test circuit may also use any other reference sequence in step 5002, wherein the reference sequence may also depend on the selection signal, e.g. signal 0_1. Thus, in this case, test circuit 42 tests the bits of signals TADR and TRADR as a reference sequence.

For example, the configurable test circuit 42 may be configured to begin step 5000 in response to a request signal REQT. In addition, when the signal H_L is used, the test circuit 42 also masks one of the signals HH or LH according to the signal H_L. For example, in various embodiments, the signal may also be used to drive combinational logic circuits 426 and 428. For example, during a test mode (e.g., signal TM is set high), combinational logic circuit 426 may assert signal HH when signal h_l is set low, thereby testing low level comparator 402, and combinational logic circuit 428 may assert signal LH when signal h_l is set high, thereby testing high level comparator 400.

Next, circuit 42 verifies in step 5004 (implementing steps 4304, 4404, 4504, and 4604) whether signal RH has a given desired logic level. As previously described, the desired logic level may be high (signal IA may or may not correspond to the limit TAL/TAH) or low (signal IA may or may not correspond to the limit TAL/TAH). Thus, in case the logic value of the signal RH is different from the intended logic level (the output "N" of the verification step 5004), the circuit 42 proceeds to an error step 5020, for example for asserting the result signal RES.

In contrast, in the case where the logical value of the signal RH corresponds to the desired logical value level (verifying the output "Y" of step 5004), the circuit 42 selects a given bit i, for example, in step 5003, and sets bit TADR [ i ] high and sets bit TRADR [ i ] low, in step 5006 (implementing steps 4306, 4406, 4506 and 4606). Specifically, when the signal h_l is set low (test of the lower limit comparator 402), the signal RH should be asserted. In contrast, when the signal h_l is set high (test of the upper level comparator 400), the signal RH should be deasserted. Thus, circuit 42 may verify at step 5008 (implementing steps 4308, 4408, 4508, and 4608) whether signal RH corresponds to an inverted version of signal h_l. Specifically, in the case where the logical value of the signal RH corresponds to the logical value of the signal h_l (the output "N" of the verification step 5008), the circuit 42 proceeds to the error step 5020.

In contrast, in the case where the logical value of the signal RH is different from the logical value of the signal h_l (the output "Y" of the verification step 5008), the circuit 42 sets the bit TADR [ i ] to low and sets the bit TRADR [ i ] to high in step 5010 (the implementation steps 4310, 4410, 4510 and 4610). Specifically, when the signal h_l is set low (test of the lower limit comparator 402), the signal RH should be deasserted. In contrast, when the signal h_l is set high (test of the upper level comparator 400), the signal RH should be asserted.

Thus, circuit 42 may verify at step 5012 (implementing steps 4312, 4412, 4512, and 4612) whether signal RH corresponds to signal h_l. Specifically, in the case where the logical value of the signal RH is different from the logical value of the signal h_l (the output "N" of the verification step 5012), the circuit 42 proceeds to the error step 5020. In contrast, in the case where the logical value of the signal RH corresponds to the logical value of the signal h_l (the output "Y" of the verification step 5012), the circuit 42 sets the bit TADR [ i ] and the bit TRADR [ i ] to the logical level of the signal 0_1 in step 5014 (the implementation steps 4314 and 4414).

Thus, configurable test circuit 42 may select another bit at step 5016 (implementing steps 4316, 4416, 4516 and 4616) and verify at step 4018 (implementing steps 4318, 4418, 4518 and 4618) whether another of the N bits must be tested. Specifically, in the case where another one of the N bits has to be tested (the output "N" of the verification step 5018), the test circuit 42 returns to step 5006. In contrast, in the case where the test circuit has tested all N bits (the output "Y" of the verification step 5018), the test circuit 42 proceeds to a stop step 5022 in which the circuit 42 asserts the DONE signal DONE. In general, the test circuit may also proceed from the error step 5020 to the stop step 5022.

In general, any other bit value may also be used at step 5016, so long as test circuit 42 sets bit TADR [ i ] to the same logic level as bit TRADR [ i ]. Thus, in the embodiment under consideration, the test circuit sets signals IA, TAL and TAH to the same value in step 5002, then temporarily modifies the signals in steps 5006 and 5008 to verify whether signal RH is set to once higher (once) and once lower, and then again sets signals IA, TAL and TAH to the same value. Thus, the verification step 5004 may be provided at the beginning (after step 5002), at the end (before step 5022) and/or even within the loop (e.g., after step 5016 or before step 5006). However, using the above bit sequence has the following advantages: various tests may be requested based on the signal 0_1 having only a single bit.

Fig. 18 illustrates an embodiment of a processing system 10a including test circuitry 42.

Specifically, as previously described, the configurable test circuit 42a may be configured to initiate a given test indicated via one or more signals, such as signals 0_1 and/or h_l, in response to a request signal REQT. In various embodiments, once a given test has been initiated, configurable test circuit 42 generates a common address limit signal TRADR and a test address signal TADR, which are provided to comparators 400 and 402 (e.g., by using test mode signal TM, previously described). In addition, when mask signal H_L is used, test circuit 42 provides signal H_L to combinational logic circuits 426 and 428. For example, for the exemplary logic levels of signal H_L described above, combinational logic circuit 426 may receive signal H_L and combinational logic circuit 428 may receive an inverted version of signal H_L, as schematically illustrated via inverter 430. Finally, once the test is completed, configurable test circuit 42 may provide a DONE signal DONE and a result signal RES indicating the test result.

Thus, in various embodiments, the processing system includes circuitry, such as processing core 102a, configured to assert a request signal REQT in order to request a given test, such as by also providing signals 0_1 and/or H_L.

However, as also shown in fig. 18, in various embodiments, the test circuit 42 may have another sequence logic circuit 42a associated therewith. For example, the circuit 42a may be configured to receive another request signal REQT'. In response to this request signal REQT', circuit 42a provides a given combination of signals 0_1 and H_L to configurable test circuit 42 and asserts request signal REQ in order to perform a respective test. Upon detecting that test circuit 42 asserts signal DONE, circuit 42a may therefore change signals o_1 and h_l and request a different test. For example, in this manner, circuitry 42 may request execution of:

tests 4300 and 4500, or tests 4400 and 4600; or (b)

Tests 4300, 4400, 4500 and 4600.

Once all requested tests are performed, circuit 42a may thus assert another signal "complete" indicating that the test is complete, and provide an aggregate result of the tests via signal "RES", e.g., signal "RES" may be asserted (e.g., signal "RES" is always deasserted) when all tests are complete without error, and signal "RES" is deasserted (e.g., signal "RES" is asserted at least once) when at least one test is complete with error.

Thus, in this case, the processing core 102a may be configured to assert a request signal REQ' in order to request execution of a given test sequence.

Accordingly, embodiments disclosed herein relate to a new solution to test the compare circuit 40a configured to determine whether an address ADR belongs to a certain memory region. The described solution is implemented in hardware with minimal execution time, minimal area overhead, and no software intervention. This solution is deterministic in that it can be implemented in a front-end design and easily migrated to any different address area comparator. Whenever the same region comparator logic is implemented for multiple regions, the solution employed allows them to be tested in parallel, reducing the test time during application launch. This reduces the complexity and cost associated with logic protection performed with conventional methods such as LBIST, replication, or software testing.

Of course, without prejudice to the principle of the disclosure, the details of construction and the embodiments may vary widely with respect to what is described and illustrated herein purely by way of example, without thereby departing from the scope of the present disclosure as defined by the annexed claims.

Claims

1. A processing system, comprising:

an address comparison circuit configured to perform a comparison of an address value with an address upper limit and an address lower limit, wherein the address value, the address upper limit and the address lower limit have a given number N of bits, and wherein the address comparison circuit comprises:

a first iterative digital comparator configured to:

comparing the address value with the upper address limit,

when the address value is less than the upper address limit, the upper limit comparison signal is set to a first logic level,

when the address value is greater than the upper address limit, setting the upper limit comparison signal to a second logic level, and

setting the upper limit comparison signal to a third logic level when the address value corresponds to the upper address limit, wherein the third logic level corresponds to the first logic level or the second logic level;

a second iterative digital comparator configured to:

comparing the address value with the address lower limit,

when the address value is greater than the address lower limit, the lower limit comparison signal is set to a first logic level,

setting the lower limit comparison signal to a second logic level when the address value is less than the lower address limit,

Setting the lower limit comparison signal to a third logic level when the address value corresponds to the lower address limit, wherein the third logic level corresponds to the first logic level or the second logic level;

combinational logic circuitry configured to:

when the upper limit comparison signal has a corresponding first logic level and the lower limit comparison signal has a corresponding first logic level, the combined comparison signal is asserted, and

deasserting the combined comparison signal when the upper limit comparison signal has a corresponding second logic level or the lower limit comparison signal has a corresponding second logic level; and

test circuitry configured to:

setting the address value, the upper address limit and the lower address limit to a given reference bit sequence,

verifying whether the upper limit comparison signal has a corresponding third logic level and/or whether the lower limit comparison signal has a corresponding third logic level,

in response to determining that the upper bound comparison signal does not have a corresponding third logic level or the lower bound comparison signal does not have a corresponding third logic level, asserting an error signal,

repeating the following for each of the N bits:

Setting respective bits of the address value high, and setting respective bits of the address upper limit and the address lower limit low,

verifying whether the upper comparison signal has a corresponding second logic level and/or whether the lower comparison signal has a corresponding first logic level,

the error signal is asserted in response to determining that the upper bound comparison signal has a corresponding first logic level or the lower bound comparison signal has a corresponding second logic level,

setting the respective bits of the address value low, and setting the respective bits of the upper address limit and the lower address limit high,

verifying whether the upper comparison signal has a corresponding first logic level and/or the lower comparison signal has a corresponding second logic level,

asserting the error signal in response to determining that the upper bound comparison signal has a corresponding second logic level or the lower bound comparison signal has a corresponding first logic level, and

the respective bits of the address value, the upper address limit and the lower address limit are set to a given logic level.

2. The processing system of claim 1, wherein the given reference bit sequence corresponds to:

A first reference sequence that sets all bits low; or (b)

And a second reference sequence in which all bits are set high.

3. The processing system of claim 2, wherein the test circuit is configured to:

receiving a first signal; and

the following are selected as the reference bit sequences:

the first reference sequence when the first signal has a first logic level, and

the second reference sequence when the first signal has a second logic level.

4. A processing system according to claim 3,

wherein when the reference bit sequence corresponds to the first reference sequence, the given logic level corresponds to low, and

wherein the given logic level corresponds to a high when the reference bit sequence corresponds to the second reference sequence.

5. The processing system of claim 4, wherein the test circuit is configured to:

receiving a second signal in response to determining that the second signal has a first logic level, an

The lower bound comparison signal is masked by setting the lower bound comparison signal to a corresponding first logic level,

wherein verifying whether the upper bound comparison signal has a corresponding first logic level comprises verifying whether the combined comparison signal is asserted, and

Wherein verifying whether the upper bound comparison signal has a corresponding second logic level comprises verifying whether the combined comparison signal is deasserted.

6. The processing system of claim 5,

wherein the test circuit is configured to mask the upper bound comparison signal by setting the upper bound comparison signal to a corresponding first logic level in response to determining that the second signal has a second logic level,

wherein verifying whether the lower bound comparison signal has a corresponding first logic level comprises verifying whether the combined comparison signal is asserted, and

wherein verifying whether the lower bound comparison signal has a corresponding second logic level comprises verifying whether the combined comparison signal is deasserted.

7. The processing system of claim 6, further comprising sequential logic circuitry configured to:

performing a test of the first iterative digital comparator by setting the second signal to a first logic level and verifying whether the error signal is asserted; and

testing of the second iterative digital comparator is performed by setting the second signal to the second logic level and verifying whether the error signal is asserted.

8. The processing system of claim 7, wherein the sequential logic circuit is configured to:

setting the first signal to the first logic level and performing a first test on the first iterative digital comparator;

setting the first signal to a second logic level and performing a second test on the first iterative digital comparator;

setting the first signal to a first logic level and performing a first test on the second iterative digital comparator; and

the first signal is set to the second logic level and a second test is performed on the second iterative digital comparator.

9. The processing system according to claim 2,

10. The processing system of claim 1,

wherein the first iterative digital comparator comprises a cascade of a first set of bit comparators, wherein each bit comparator of the first set of bit comparators is configured to generate a respective comparison signal,

Wherein a first bit comparator of the first set of bit comparators is configured to:

a first bit of the address value and a first bit of the address upper bound are received,

when the first bit of the address value is set low and the first bit of the upper address limit is set high, the respective comparison signal is set to a respective first logic level,

when the first bit of the address value is set high and the first bit of the upper address limit is set low, the corresponding comparison signal is set to a corresponding second logic level, an

Setting the respective comparison signal to a respective third logic level when the first bit of the address value corresponds to the first bit of the address upper limit, an

Wherein the other bit comparators of the first set of bit comparators are configured to:

receiving the corresponding bit of the address value, the corresponding bit of the address upper bound, and the comparison signal of the previous bit comparator of the first set of bit comparators,

when the respective bit of the address value is set low and the respective bit of the upper address limit is set high, the respective comparison signal is set to the respective first logic level,

when the respective bit of the address value is set high and the respective bit of the upper address limit is set low, the respective comparison signal is set to the respective second logic level,

Setting the respective comparison signal to a logical value of the comparison signal of the previous bit comparator when the respective bit of the address value corresponds to the respective bit of the address upper limit, and

wherein the upper bound comparison signal corresponds to a comparison signal of a last bit comparator of the first set of bit comparators.

11. The processing system of claim 1,

wherein the second iterative digital comparator comprises a cascade of a second set of bit comparators, wherein each bit comparator of the second set of bit comparators is configured to generate a respective comparison signal, wherein a first bit comparator of the second set of bit comparators is configured to:

a first bit of the address value and a first bit of the address lower bound are received,

when the first bit of the address value is set high and the first bit of the address lower bound is set low, the respective comparison signal is set to the respective first logic level,

when the first bit of the address value is set low and the first bit of the address lower limit is set high, the corresponding comparison signal is set to a corresponding second logic level, and

when the first bit of the address value corresponds to the first bit of the address lower bound, the respective comparison signal is set to a respective third logic level,

Wherein the other bit comparators of the second set of bit comparators are configured to:

receiving the corresponding bit of the address value, the corresponding bit of the address lower bound and the comparison signal of the previous bit comparator of the second set of bit comparators,

when the respective bit of the address value is set high and the respective bit of the address lower bound is set low, the respective comparison signal is set to the respective first logic level,

setting the respective comparison signal to a respective second logic level when the respective bit of the address value is set low and the respective bit of the address lower bound is set high, and

setting the respective comparison signal to a logical value of the comparison signal of the previous bit comparator when the respective bit of the address value corresponds to the respective bit of the address lower limit, and

wherein the lower bound comparison signal corresponds to the comparison signal of a last bit comparator of the second set of bit comparators.

12. An integrated circuit, comprising: the processing system of claim 1.

13. A vehicle, comprising:

a plurality of processing systems, each processing system being a processing system according to claim 1, wherein the processing systems are connected via another communication system.

14. A method for operating the processing system of claim 1, the method comprising:

setting an address value, an address upper limit and an address lower limit to a given reference bit sequence;

verifying whether the upper limit comparison signal has a corresponding third logic level and/or the lower limit comparison signal has a corresponding third logic level;

asserting an error signal in response to determining that the upper bound comparison signal does not have a corresponding third logic level or the lower bound comparison signal does not have a corresponding third logic level; and

the following is repeated for each of the N bits:

setting respective bits of the address value high, and setting respective bits of the address upper limit and the address lower limit low;

verifying whether the upper limit comparison signal has a corresponding second logic level and/or whether the lower limit comparison signal has a corresponding first logic level;

asserting the error signal in response to determining that the upper bound comparison signal has a respective first logic level or the lower bound comparison signal has a respective second logic level;

setting respective bits of the address value low, and setting respective bits of the address upper limit and the address lower limit high;

Verifying whether the upper limit comparison signal has a corresponding first logic level and/or the lower limit comparison signal has a corresponding second logic level;

asserting the error signal in response to determining that the upper bound comparison signal has a respective second logic level or the lower bound comparison signal has a respective first logic level; and

the respective bits of the address value, the upper address limit, and the lower address limit are set to a given logic level.

15. A method for operating a processing system, the method comprising:

repeating the following for each of the N bits:

setting respective bits of the address value high and respective bits of the address upper bound and the address lower bound low;

16. A processing system, comprising:

A first iterative digital comparator comprising:

a first cascade of a first set of first bit comparators, wherein each first bit comparator of the first set of first bit comparators is configured to generate a respective comparison signal,

setting the respective comparison signal to the respective first logic level when the first bit of the address value is set low and the first bit of the address upper limit is set high, setting the respective comparison signal to the respective second logic level when the first bit of the address value is set high and the first bit of the address upper limit is set low, and

when the first bit of the address value corresponds to the first bit of the address upper limit, setting the corresponding comparison signal to the corresponding third logic level, and

setting the respective comparison signal to the respective first logic level when the respective bit of the address value is set low and the respective bit of the address upper limit is set high, setting the respective comparison signal to the respective second logic level when the respective bit of the address value is set high and the respective bit of the address upper limit is set low, setting the respective comparison signal to the logic value of the comparison signal of the previous bit comparator when the respective bit of the address value corresponds to the respective bit of the address upper limit, and

Wherein an upper bound comparison signal corresponds to the comparison signal of a last bit comparator of the first set of bit comparators.

17. The processing system of claim 16, wherein the address comparison circuit further comprises a second iterative digital comparator, and wherein the second iterative digital comparator comprises:

a second cascade of a second set of second bit comparators, wherein each second bit comparator of the second set of second bit comparators is configured to generate a respective comparison signal,

wherein a second bit comparator of the second set of second bit comparators is configured to:

when the first bit of the address value is set high and the first bit of the address lower bound is set low, the corresponding comparison signal is set to the corresponding first logic level,

when the first bit of the address value is set low and the first bit of the address lower limit is set high, the corresponding comparison signal is set to the corresponding second logic level, and

when the first bit of the address value corresponds to the first bit of the address lower bound, the respective comparison signal is set to the respective third logic level,

setting the respective comparison signal to the respective second logic level when the respective bit of the address value is set low and the respective bit of the address lower limit is set high, and

setting a respective comparison signal to a logical value of the comparison signal of the previous bit comparator when a respective bit of the address value corresponds to a respective bit of the address lower limit, and

wherein a lower bound comparison signal corresponds to the comparison signal of a last bit comparator of the second set of bit comparators.

18. The processing system of claim 17, further comprising a test circuit configured to:

verifying whether the upper limit comparison signal has a corresponding third logic level and/or whether the lower limit comparison signal has a corresponding third logic level;

Asserting an error signal in response to determining that the upper bound comparison signal does not have a corresponding third logic level or the lower bound comparison signal does not have a corresponding third logic level;

repeating the following for each of the N bits:

19. The processing system of claim 18, wherein the given reference bit sequence corresponds to:

a first reference sequence that sets all bits low; or (b)

And a second reference sequence in which all bits are set high.

20. The processing system of claim 19, wherein the test circuit is configured to:

receiving a first signal; and

the following are selected as the reference bit sequences:

the first reference sequence when the first signal has a first logic level, and

the second reference sequence when the first signal has a second logic level.