DE102017207974A1 - Circuit arrangement for monitoring a time base in a timer - Google Patents

Abstract

The invention relates to a circuit arrangement for monitoring a state basis (14), which is incremented or decremented by pulses and these pulses comprise information about properties of a system, wherein the circuit arrangement comprises at least one memory in which the state base (14) with a system clock periodically buffer in which at least one comparator (21) is provided, which is set up to compare the current state base (14) with the state base (14) previously latched to a system clock, wherein the circuit arrangement is adapted to detect an error based on this comparison ,

Description

The invention relates to a circuit arrangement for monitoring a time base in a timer and a method for monitoring a time base in a timer.

State of the art

To support a processing unit, such as a CPU (Central Processing Unit), for time and position related processes are called timers, d. H. Timer units, known. Such timer units may be formed as individual components or as peripheral components of the processing unit and thereby provide more or less important functions for signal recording and generation in dependence on time of one or more clocks available.

According to the current state of the art, different architectures for the implementation of timer units are used in processing units, such as, for example, in microcontrollers.

In a known generic timer module, which is also referred to as GTM (Generic Timer Module), several time bases are included, which can contain both time and angle information. Usually these time bases are either counted by a clock or incremented by angle information pulses or decremented. These time bases are of central importance, since a great many events and thus also output signals are based on the comparison of data with these time bases. If a time base is faulty, then unexpectedly output signals can be generated that may violate a safety goal. The monitoring of the time bases is provided in the prior art only by software on the system CPU.

A time base is to be understood as a device which assigns a value to each point in time and determines a time span from the difference between these values of different points in time. For future time points, a value of the time base can be determined, which can also serve as a comparison value in order to trigger an event when this time has been reached.

It should be noted that a time base may be disturbed by transient or permanent errors. It is very important to recognize such errors in a timely manner. Testing via the CPU is often not sufficient because no permanent test can take place. Tests over a longer period of time are also possible, but these are usually only plausibility checks. Such checks should be performed periodically by the CPU in the fault tolerance time interval. It is therefore desirable to free the CPU from such burdens and to achieve a higher quality with the permanent test.

Disclosure of the invention

Against this background, a circuit arrangement according to claim 1 and a method according to claim 5 are presented. Embodiments emerge from the dependent claims and from the description.

The presented circuit arrangement serves to monitor a state basis, which is incremented or decremented by individual pulses. Typically, these pulses include information about, for example, time, angle, position, quantity, temperature, pressure or other properties of a system. The circuit arrangement is designed to buffer the state base periodically with a system clock. Typically, this is a memory or register, where each bit value of the state base at that time is stored in the register with a corresponding number of memory elements. Such caching may also be referred to as a pipeline stage. Either the state basis or the cached state basis can then be used to generate signals. The presented circuit arrangement has at least one comparator with which the current state base can be compared with the previously cached state basis. From this comparison, an error can be deduced, which in turn can be stored.

The circuit arrangement can be set up to make at least one comparison between the state basis and the stored state basis by subtracting these two values. A difference obtained by means of the subtraction can then be compared with at least one fixed value. In the event that the amount of the difference is greater than 1, an error can be signaled and stored. In the event that the difference is 1 or -1, an error may be signaled and / or stored, typically when the state base is operating backwards or forwards.

Furthermore, at least one comparison of the difference of the state basis and the buffered state basis with a variable comparison value can be made. In addition, it can be provided that the state basis can assume at most a maximum value, in order then to start again at 0, for example, and the variable comparison value is this maximum value or the negative value of this maximum value.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

list of figures

• 1 shows a block diagram of a time base unit.
• 2 shows a block diagram of a pipeline stage of the time base unit per cluster.
• 3 shows a block diagram of an embodiment of the circuitry for monitoring a time base.
• 4 shows a block diagram of an implementation possibility of a set flip-flop.
• 5 shows in a block diagram an embodiment of the circuit arrangement for monitoring a modulo counter.

Embodiments of the invention

The invention is schematically illustrated by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

1 shows in a block diagram a time base unit or TBU (Time Base Unit), which is used for example. In a Generic Timer Module or GTM (Generic Timer Module) and in total with the reference numeral 10 is designated. The illustration shows a number of TBU channels 12 , in each of which a time or angle basis and thus a state basis 14 and a controller 16 is provided. The time or angle base 14 is typically incremented or decremented by 1 on the arrival of (clock or angle) pulses (from top left) (component 17 ). Furthermore, a register BASE_MARK 20 and a register BASE_CAPTURE 22 provided that it is a modulo counter of the time or state basis. It is always checked (comparator 21 ), whether a given value of the time or angle BASE_MARK 20 is reached and then the time or angle base 14 on the value 0 reset.

• bei der TBU0: 0 oder +1, (TBU-Kanal 12a, weil dort nur Inkrementieren möglich ist)
• bei der TBU1, 2: 0, +1 oder -1, (TBU-Kanal 12b, weil dort ein Inkrementieren und Dekrementieren möglich ist)
• bei der TBU3: 0, +1 oder -1, (TBU-Kanal 12c, weil dort ein Inkrementieren und Dekrementieren möglich ist)
• weil bei den letzteren auch eine Rückwärtsrichtung möglich ist. (Winkel)

It should be noted that in a GTM, a pipeline stage for the time bases in the transition to the clusters, ie different sub-modules each with a uniformly delayed, in a pipeline stage with the system clock cached time or angle basis are supplied. This makes it possible to compare the old value with the new value using additional hardware. The new time base value can be at most around the value 1 if the system clock SYS_CLK is the highest frequency clock in the system. The deviation possibilities are:

• at TBU0: 0 or +1, (TBU channel 12a because only incrementing is possible there)
• at the TBU1, 2: 0, +1 or -1, (TBU channel 12b because it allows incrementing and decrementing)
• at the TBU3: 0, +1 or -1, (TBU channel 12c because it allows incrementing and decrementing)
• because in the latter also a reverse direction is possible. (Angle)

The externally guided value of the respective time / angle basis is temporarily stored in the sub-modules (clusters) in a further register stage (said pipeline stage).

In 1 becomes the upper TBU channel 12a a signal 23 With 27 Bit output, in the two middle TBU channels 12a , b (TBU1 and TBU2) each become a signal 25 With 24 Bits are output and in the lower TBU channel 12c (TBU3) becomes one 24 Bit signal output. These signals are the value of the corresponding state basis and are the input signals 102 the respective pipeline stage, which in 2 will be shown.

2 shows in a block diagram a pipeline register 100 , in which a value TBU_neu 102 is received, that is the current value of the corresponding state basis, and from which a value TBU_old 104 is output. The pipeline register is clocked 100 with the clock SYS_CLK 108 ,

By subtracting between a value TBU_neu 102 before the pipeline stage and TBU_alt 104 after the pipeline stage, only the values 0 , +1 and -1, if it is not a modulo counter as in the case of TBU3. The negative value is only allowed for those time-angle bases that can also count backwards. Since the time can not run backwards, TBU0 (upper block 12 in 1 ) only counting forward. This is indicated by the block with the +1. In the other blocks 12 a +/- 1 is allowed, which is expressed in the block labeled +/- 1.

Such difference formation or subtraction is possible, for example, by a simple adder if all bits are inverted by the subtrahend (One's complement) and additionally an incoming carry Carry_in = 1 is provided at the adder.

3 shows in a block diagram an embodiment of a circuit arrangement for monitoring a time-angle basis, in total with the reference numeral 130 is designated. The illustration shows an adder 132 in which TBU_new as input variables 134 and TBU_old 136 via one inverter each 138 for all bits of 136 , and a carryover 139 received. This forms a subtractor, denoted by reference numeral 140 is designated. Furthermore, the illustration shows a first comparator 142 with the function = 0 ?, a second comparator 144 with the function = 1? and a third comparator 146 with the function = (- 1) ?. In addition, a NOR element 150 and a flip flop 152 into which a set signal 154 and a clock signal SYS_CLK 156 come in and that an error signal (error) 158 spends, provided.

As already stated, is according to 3 allows subtraction with the adder when all bits are inverted by the subtrahend (one's complement) plus an incoming carry 139 Carry_in = 1 is provided at the adder. In this way, the one's complement becomes the two's complement of the subtrahend. The addition of the minuend and the two's complement of the subtrahend equals the subtraction of these two operands. The result of this subtraction is compared with the fixed values 0, 1 and -1.

The outputs of these three comparators 142 . 144 . 146 be in the NOR gate 150 connected. If one of the three comparisons yields a 1, then the output of the NOR gate supplies 150 a 0. Only if none of these three comparators 142 . 144 . 146 has a 1 at the output, provides the NOR gate 150 a 1 at the output and this 1 sets the flip flop 152 with the active edge of the system clock SYS_CLK 156 and thereby signals an error.

This set flip flop 152 is in an execution in 4 shown. It should be noted that this can only be actively reset by the user or the system. The illustration shows a flip-flop 200 according to the flip-flop 152 out 3 with an OR gate 202 , Signals are "set" 204 , "Reset" 206 and an output signal 208 , There is thus a feedback of the flip-flop output and an OR operation of this signal before the flip-flop input with the input signal.

A transient error that falsifies in the time base a memory element that is not the least significant bit (LSB) leads to a sudden difference between the values TBU_neu and TBU_alt, which is greater than 1 in magnitude. Likewise, a permanent error in the time base, in which, for example, a memory element permanently remains at a fixed value (stuck-at fault), leads to a deviation> 1, if in the counting operation a carry up to this bit value of the defective memory element or even higher should be counted out. In both cases, none of the comparators delivers 142 . 144 . 146 out 3 a 1 and thus the flip flop 152 set to indicate an error. An error in the LSB usually has no effect on the security objective and therefore does not need to be detected.

If only counting up or only down counting is allowed for a time base, the corresponding comparator = (- 1)? (or = 1?) to block. Such a blocking can be done by an AND operation with a control signal, which must be set to 0. This control signal can come from a configuration register which is to be set accordingly or derived from an already present direction signal. In the latter case, common cause errors may have to be considered. In this case, if the direction signal is erroneous, no error is detected because the test uses the same wrong signal.

It should be noted that in the GTM another time base TBU_CH3, which is primarily referred to as the angle base, is provided (TBU channel 12c ). You should have the box 12 distinguish each other !!! This operates as a modulo counter and is used for an angle value that distinguishes between 0 and 360 degrees of angle values. In doing so, y impulses are evenly distributed to the 360 degrees. An impulse then corresponds to an angle of 360 / y degrees. This angle is incremented in forward mode until it reaches the programmable modulo value x = y-1. The counter then has the value 0 again after the next pulse. In reverse mode, it is counted accordingly to 0 and the next value is then again x. Add the circuit after 3 with two comparators that compare to x and -x, you can also check this modulo counter accordingly. The previous comparators continue to check the range where no TBU value (the current value or the previous value stored in the pipeline stage) is 0. If a value is 0, then either the previous or the following value may be x. Therefore, the difference can be x or (-x).

5 shows a circuit arrangement for testing the modulo counter with the two additional comparators, the whole with the reference numeral 300 is designated. The illustration shows an adder 302 in which TBU_new as input variables 304 and TBU_old 306 via an inverter 308 and a carryover 309 received. This forms a subtractor, denoted by reference numeral 310 is designated. Furthermore, the illustration shows a first comparator 312 with the function = 0 ?, a second comparator 314 with the function = 1 ?, a third comparator 316 with the function = (- 1) ?, a fourth comparator 318 with the function = x? and a fifth comparator 320 with the function = (- x) ?. In addition, a NOR element 330 and a flip flop 332 into which a set signal 334 and a clock signal SYS_CLK 336 come in and that an error signal (error) 338 outputs.

It should be noted that the comparators 318 . 320 now not against a fixed value, but against a variable value compare. This comparison value must be configured in a register. It is useful not to use the same register as in the TBU, but a separate register to avoid so-called common cause errors that occur when, for example, the register BASE_MARK 20 in 1 has an error and this incorrect value is used both for counting up to the modulo value and for its testing.

If one operates the angle base only in the forward direction, one can block the comparison with negative values, as explained above. Accordingly, in an exclusive direction in reverse operation, all comparisons with values greater than 0 are to be blocked. Again, the blocking can be made variable and performed in response to a direction signal. In this case, a separate direction value from a configuration register is to be preferred to the test device. Otherwise, a common cause error may occur, as shown above.

The presented circuitry detects all transient and permanent errors in the time base and in the pipeline stage of the corresponding cluster, which occur above the LSB (least significant bit). In this way, high safety requirements for the system can be ensured, if necessary in connection with further measures.

In principle, not only times or angles of a system can be detected, such. Counted traveled distance portions, amounts such as a counted number of elements, masses such as summed weight units, temperatures such as counted temperature increments, pressures such as counted pressure increments or other properties of a system. Instead of a time or angle basis, one can then speak of a state basis of the system. By a state basis herein are thus understood property bases for properties or states, as they are listed above purely by way of example.

According to a further embodiment, it is provided to store the register bit 0 in the TBU_CH0_CTRL (LOW_RES) duplicated in the test unit and to check it against the value of the signal LOW_RES. This bit determines whether in the TBU0 (upper block 12 in 1 ) the upper or lower 24 Bits of 27 output bits of the state basis are used for further processing. An error of this bit could have devastating consequences for the behavior of the system and the security goal. Due to the duplicated storage with the comparison an error could be detected very fast. In the event of a deviation, an error is to be signaled if the test unit is activated or enabled. Furthermore, the bits 0 in the TBU_CH1_CTRL, TBU_CH2_CTRL and TBU_CH3_CTRL registers must also be duplicated in order to check whether a reverse mode is possible. If this bit = 0, the comparison is masked to -1 or + x.

The DIR1 / DIR2 direction signal for TBU1 / TBU2 indicates the direction for TBU_CH1,2,3. If this value is generated incorrectly, then this is external, for example in the DPLL to examine. There one can check, for example, whether the currently calculated error EDT_T, S is plausible in comparison to the error MEDT_T, S averaged over a longer period of time.

Claims (10)

Circuitry for monitoring a state basis (14) which is incremented or decremented by pulses and which comprises information about characteristics of a system, the circuitry (130) comprising at least one memory in which the state base (14) is to be periodically latched at a system clock wherein at least one comparator (21, 142, 144, 146, 312, 314, 316, 318) is provided which is adapted to compare the current state base (14) with the state base (14) previously latched one system clock, wherein the circuit arrangement (130) is set up to detect an error on the basis of this comparison. Circuit arrangement according to Claim 1 which is adapted to make at least a comparison between the current state base (14) and the previously stored state base (14) by subtracting these two values. Circuit arrangement according to Claim 2 which is adapted to compare a difference obtained by means of the subtraction with at least one fixed value. Circuit arrangement according to Claim 2 or 3 comprising an adder (132, 302) for performing the subtraction. A method for monitoring a state basis (14) which is incremented or decremented by pulses, and which pulses comprise information about properties of a system, in particular a circuit arrangement (130) according to any one of Claims 1 to 4 wherein the state base (14) is latched with a system clock, wherein the current state base (14) is compared with the previously cached state base (14) and based on this comparison, an error is detected. Method according to Claim 5 in which a difference obtained by means of a subtraction is compared with at least one fixed value. Method according to Claim 6 in which, if the difference is greater than 1, an error is signaled and stored. Method according to Claim 6 in which, in the event that the difference is 1, an error is signaled exactly when the state base (14) only counts backwards and in the case that the difference is -1, an error signals when the state base is only operated forward , Circuit arrangement according to Claim 5 in which at least a comparison of a difference between the state basis (14) and the cached state basis (14) is made with a variable comparison value. Method according to Claim 9 in which the state basis (14) can assume at most one maximum value and the variable comparison value is this maximum value or the negative value of this maximum value.

Images