DE102017207977A1 - Method for monitoring a timer module - Google Patents

Abstract

The invention relates to a method for monitoring a timer module (10) which comprises at least one clock divider, at least one state base incremented or decremented by pulses, and these pulses comprise information about properties of a system, and at least one data transfer device (80) comprising at least one Data transmission per unit time and makes a data transmission between first and second modules, wherein the timer module (10) is operated with at least one derived clock, which is derived from a system clock by means of the at least one clock divider, wherein for monitoring the timer module (10) a number of test steps is performed, wherein in a first test step, a test for timing of the timer module (10) is performed, in a second test step the at least one state basis and in a third test step, the at least one Datübe (80).

Description

The invention relates to a method for monitoring a timer module and a circuit arrangement for carrying out the method.

State of the art

To support a processing unit, such as a CPU (Central Processing Unit), for time and position related processes are called timers, d. H. Timer units or timer modules, known. Such timer modules can be designed as individual components or as peripheral components of the processing unit and thereby provide more or less important functions for signal acquisition and generation in dependence on time of one or more clocks available.

According to the current state of the art, different architectures for the implementation of timer modules are used in processing units, such as, for example, in microcontrollers.

In a known generic timer module, which is also referred to as GTM (Generic Timer Module), several time bases are included, which can contain both time and angle information. Usually these time bases are either counted by a clock or incremented by angle information pulses or decremented. These time bases are of central importance, since a great many events and thus also output signals are based on the comparison of data with these time bases. If a time base is faulty, then unexpectedly output signals can be generated that may violate a safety goal. The monitoring of the time bases is provided in the prior art only by software on the system CPU.

A time base is to be understood as a device which assigns a value to each point in time and determines a time span from the difference between these values of different points in time. For future time points, a value of the time base can be determined, which can also serve as a comparison value in order to trigger an event when this time has been reached.

It should be noted that a time base may be disturbed by transient or permanent errors. It is very important to recognize such errors in a timely manner. Testing via the CPU is often not sufficient because no permanent test can take place. Tests over a longer period of time are also possible, but these are usually only plausibility checks. Such checks should be performed periodically by the CPU in the fault tolerance time interval. It is therefore desirable to free the CPU from such burdens and to achieve a higher quality with the permanent test.

In the generic timer module, one or more routing units, also referred to herein as ARUs (Advanced Routing Units), are included. Such a routing unit is a module that transmits data provided by a data source to a data sink. Therefore, such a lead unit has a central importance for the distribution of the data.

So different modules are connected to the ARU, which can exchange data with each other. In the so-called round-robin mode, the data sinks are addressed one after the other via a counter and these request the corresponding data source via a stored address for sending the data. Such an ARU is also referred to herein as a data transfer device.

In the known GTM there are various signals and stored values which are of central importance and which in the event of an error can mask or hinder the detection of the error. Such errors are called Common Cause errors.

Disclosure of the invention

Against this background, a method according to claim 1 and a circuit arrangement according to claim 10 are presented. Embodiments emerge from the dependent claims and from the description.

Various measures for the detection of Common Cause errors are presented here. It has been recognized that these various measures have to be put together in such a way that a simple and complete examination of these errors can take place. The presented method thus shows a Possibility on how to use these different measures in conjunction with each other. By applying the method, thus, the effects of common cause errors can be prevented.

For example, in the monitoring or monitor unit of the GTM z. B. the activity of the different clocks are monitored. In addition, the activity in the state bases, i. H. the time and angle bases are checked, and it can also errors in these are recorded. Furthermore, the divider ratios can be checked in clock monitoring circuits and additional check bits for central functions and their monitoring can be used.

With the presented method, the various measures are now suitably linked together. In this case, certain tests or monitoring are carried out in a number of test steps. Thus, in a first step, one or more bars, i. H. the system clock and / or derived clocks, and / or one or more clock dividers are monitored. Thus, there is a check for timing of the timer module. In this case, first the clocks and then the clock divider can be monitored. Alternatively, the clock dividers and then the clocks can be monitored first. In a next test step, state bases, i. H. Time and / or angle bases, to be checked. Here it can be checked whether these status bases are even active and / or if there are errors.

In a next test step, at least one data transmission device (ARU) can be monitored. In this case, it can be checked whether there is an error in a counter, whether the data transmission device or its counter is even active, if there are errors in the addresses used and / or if there are errors in the transmitted data or the data registers.

In an embodiment, the method is used for checking signals, data and addresses and time units connected to the signals, wherein there are a multiplicity of test options. In doing so, a sequence in the check is to be observed in such a way that with a growing number of checks there is a constantly improved secure test result with regard to absolute values of times, frequencies and data.

For example, the frequency of a first clock provided by the higher-level system to the timer module, the so-called system clock, can be checked using processing and output with the aid of an independent time base. From the checked first clock second clocks can be derived. Then, the divider ratios between the first and the second clocks can be checked so that a clock frequency of these second clocks can be determined.

The checked second clocks can be counted in at least one time base, so that the consistency of the time base is checked and thus a secure relationship is established at the absolute time.

Furthermore, a serial data distribution can take place by means of arbitration by a counter, whereby the continuity of the counter is checked, and the exchanged data and / or addresses can be provided with check bits of an error-detecting or error-correcting code, which are checked during the transmission or after the transmission ,

In addition, events may be counted in a value base associated with a time, angle, mass, temperature, pressure, distance, or other physical quantity. The continuity of the value base can then be checked.

Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

It is understood that the features mentioned above and those yet to be explained below can be used not only in the particular combination indicated, but also in other combinations or in isolation, without departing from the scope of the present invention.

list of figures

• 1 shows in a block diagram a generic timer module.
• 2 shows a block diagram of a clock management unit
• 3 shows a block diagram of a time base unit.

Embodiments of the invention

The invention is schematically illustrated by means of embodiments in the drawings and will be described in detail below with reference to the drawings.

1 shows in a block diagram a timer module, which is also referred to herein as GTM and collectively with the reference numeral 10 is provided. This timer module 10 includes a number of clusters, one of which is a cluster 0 12 , a cluster 114 and a cluster n 16 are shown. This timer module 10 is operated with a system clock clS0_clk 20. This system clock 20 goes into a clock management unit (CMU) 22, in which a number of clock dividers are provided, with which the system clock can be divided into a number of dependent clocks.

The illustration shows in clusters 0 12 furthermore a time base unit (TBU) 30 , a digital phase locked loop (DPLL) 32 , an imaging module (MAP: TIM0 input mapping module) 34 , a first dead time module (DTM: Dead Time Module) 36 , a second DTM 38 , a data source TIM 1 (time input module) 40 , an output module (TOM: Timer Output Module) 42 , an output module connected to the ARU (ATOM: ARU-connected Timer Output Module, ARU: Advanced Routing Unit) 44 , a sensor pattern evaluation (SPE: Sensor Pattern Evaluation) 46 , and in clusters 114 a first DTM 50 , a second DTM 52 , a PES 1 54 , a data source TIM 1 60 , a TOM 1 62 and an ATOM 1 62 , In cluster n 16 are a first DTM 70 , a second DTM 72 a data source TIM n 74 , an SPE n 74 , a TOM n 76 and an ATOM n 78 intended.

The illustration also shows a data transmission device ARU 80 , a transmission module (BRC: Broadcast Module) 82 , a cluster configuration module (CCM 0 : Cluster Configuration Module) 84 , an F2A unit (FIFO to ARU unit 86 ), a FIFO register (FIFO: first in first-out) 88 , an AFD Interface (AEI to FIFO Data Interface) 90 , a multichannel sequencer MCS 0 92 , an analog-to-digital converter ADC 0 94 , a monitoring unit (MON: Monitor Unit) 96 , an output monitoring unit (CMP: Output Compare Unit) 98 , a CCM 1100 , a parameter memory module (PSM 1 : Parameter Storage Module) 102 , an MCS 1 104 , an MCS n 110 , a CCM n 112 , a multiplexer AEIMux 0 114 , a multiplexer AEIMux 1 116 , a multiplexer AEIMux n 116 , an Interrupt Concentrator Module (ICM) 120 , an ADC 1122 , an ADC n 124 , an AEI bridge 126 and a watchdog 130 to activate a clock.

In the timer module 10 For example, clocks, time and angle bases, data transfer units or routing units (ARUs), processing units (MCS) and the AEI (generic AE interface) (AE: automotive electronics) are of central importance for almost all applications. There are already various possibilities in the timer module 10 to monitor each of these functions. Activity checkers, for example, monitor the activity of clocks and in each MCS channel (MCS: Multi Channel Sequencer) the activity of that channel can be monitored and displayed in an activity register. If the activity bit in the MCS program flow is not set until data has been processed, this activity simultaneously checks whether data is being provided to the MCS. Thus the data sources, eg TIM, and the distribution of the data, e.g. B. ARU, indirectly verified. It is therefore important to follow this order in the program flow.

It is also important to determine if a clock is AEI_SYS_CLK 131 is provided to the system if it has the correct frequency and whether it will derive clocks of the desired frequency for the clusters. For each cluster n, the frequency CLS [n] _CLK may be chosen according to the highest clock, half the frequency of the highest clock, or 0. In the cluster 0 the clock management unit and the time base unit are controlled, which are controlled by the corresponding clock CLS0_CLK. The clock management unit is capable of outputting an external clock having a predetermined divider ratio. A close examination of the external clock would therefore be very helpful.

This can be solved with the timer module itself. For this purpose, however, it must first be checked whether the required resources of the timer module work with reliable parameters, such as the specified clock frequency of the generated clocks. However, only the divider ratios can be checked in the indexer module itself and not the frequency of the source clock SYS_CLK. This can only be determined with the help of an independent time base.

It is called herein both the clock AEI_SYS_CLK and the clock SYS_CLK. These bars mean the same signal, namely the central GTM clock. From this clock, the clocks for the clusters emerge (CLS [0,1,2 ... n] _CLK). In parallel, there is the AEI_CLK, which leads into the AEI module. These two clocks could be of different frequency.

In any case, an external watchdog makes sense there, which monitors using its own independent time base (ECLK). This ensures that there is a clock whose frequency is within certain tolerances. The size of these tolerances depends directly on the accuracy of the independent time base. It is assumed here that this accuracy is sufficiently large to determine the frequency of the SYS_CLK with sufficient accuracy. For this purpose, at least one ECLK, an external, independent clock, is activated, and the parameters for the corresponding clock divisor of this clock are set. This monitoring of the clock is one way the system must support. If this is not the case, you have to search for another possibility in the system.

Table 1 below shows the necessary steps and suggestions for implementation. Table 1 Ser. No. aim Setting / Procedure / Hardware exam Result overall result 1 Check system clock frequency SYS_CLK set CLS0_CLK divider, set ECLKO divider, enable ECLKO check ECLKO using an independent time base SYS_CLK determined according to the accuracy of the independent time base Frequency SYS_CLK 2 Check global clock divisors (fractional) Check global clock divider in the GTM Global divider ratio Divider ratio of global clock divisors Frequency GCLK 3 Activity (FX) CLKi Status register MON Activity check CMU_ (FX) CLKi active (FX) CLKi active 4a Review CLKi, j differential checking of the clocks in the GTM Divider ratios i and j Divider ratios CMU_CLKi and CMU_CLKj Frequencies CMU_CLKi CMU_CLKj 4b Review FXCLKI, j Differential check of the clocks in the GTM Divider ratios i and j Divider ratios CMU_FXCLKi and CMU_FXCLKj Frequencies CMU_FXCLKi CMU_FXCLKj 5a Activity TBU_CHx TBU activity Change by a pulse TBU_CHx active TBU_CHx active 5b Continuity TBU_CHx TBU verification Change value range TBU CHx without error TBU_CHx right 6 Verification ARU arbitration ARU review Counter for arbitration complete arbitration all ARU targets activated 7 Check ARU addresses ARU addresses verification Parity bit with address no wrong source selected right source activated 8th Check ARU data ARU data validation Parity bit with data no data is corrupted Data is correct from source to sink 9 Check ARU data Aktivitätsreg. MON Verification activity register Activity MCS, ARU and data source consistent processing of correct data from the right source 10 Circulation time ARU Check using MCS and TBU values TBU value change between two accesses TBU difference between two ARU accesses absolute time between two ARU attacks

The SYS_CLK check is listed in the first line. All further steps should be processed in the appropriate order. Only in this case is a consistent review possible, which also ensures compliance with absolute values. In a subdivision into a, b the order is not decisive. Checks of serial numbers 5a and 5b must be set before a step that processes TBU data (eg, # 9).

After checking the clock frequency of the SYS_CLK ( 1 ) it is important to first check the global clock divider. Thus the clock CMU_GCLK is checked ( 2 ). The activity of the derived clocks should be checked in the monitor unit by means of activity registers ( 3 ). The check of the clock ratios should check two clock divisors at the same time (4a, 4b). Together with the previous steps, the clock frequencies are checked. The activity and continuity of the TBU channels ( 5a , 5b) is always to be performed before a step in which the TBU values are required. In step 6 the arbitration counter is checked for errors, step 7 ensures the use of the correct address and step 8th detects errors in the data.

With step 9 it is easy to deduce the activity of the MCS and from it (if used) those of the ARU and the data source. In step 10 Finally, the absolute cycle time of the ARU can be measured if the TBU continuity and the value of the TBU data are secured.

2 shows in a block diagram a clock management unit or CMU (Clock Management Unit), as this example, in a generic timer module or GTM (Generic Timer Module) is used and in total with the reference numeral 210 is designated. The illustration shows a first block EGU (external clock generation unit) 212 , a second block CFGU (configurable clock generation unit) 214 and a third block FXU (fixed clock generation unit) 216 ,

In the EGU 212 are three clock divisors 220 intended. In the CFGU 214 is a global clock divider 230 provided, at the entrance 232 a signal CLS0_CLK, the system clock, is applied and at its output 234 a signal GCLK_EN is output, which in turn to another clock divider 236 coming from a controller 238 be controlled and at their outputs 237 Output signals is given. The global clock divider 230 output clock is thus processed further. In the FXU 216 are further divisors 240 with outputs 241 intended. The block also processes EGU 212 the system clock CLS0_CLK and thus indirectly generates clock signals that are externally output and, as described above, make the activity or even the frequency of the CLS0_CLK clock verifiable by an external monitoring unit. In the block CFGU 214 the divider ratios are the clock divisors 236 programmable and thus the clocks output there are variably adjustable in their frequency. The in block FXU 216 output clocks, however, are fixed in frequency to each other, because the divider 240 are not variable.

In the GTM is the global clock divider 230 in the CMU 210 is designed as a fractional divider and serves to divide the system clock CLS0_CLK into a wide programmable divider range. The central clock GCLK_EN generated thereby is used as base clock for all further internal clocks. It should be noted that this clock has no constant period, but generated by the realization with little circuitry effort periods that are now and then a system clock period longer than the minimum period. This is not a mistake, but serves in particular to be able to easily realize the non-integral divisor ratio on average. It must also be considered that an error in the global divider has an immediate effect on all clock signals. This error may act as a so-called common cause error in redundantly executing processing units that may mask its own discovery when the redundant processing units are operating with an equally wrong clock signal. A comparison of the outputs of these redundant processing units can not contribute to the discovery of this error. It has been shown that such errors are particularly critical in security-relevant applications and there bring with them the risk of breaching the security goal.

It has been recognized that it is important to closely monitor the period within the given limits to immediately detect any deviation. External monitoring has no access to the central clock GCLK_EN and can only be done indirectly via further clocks, which are only obtained from this clock by further division. As a result, no exact assignment of the error to the respective divider is possible and the clock period can be very long by the application of several dividers in succession. In extreme cases, this would require a counter with enormously very large bit width. This effort can be greatly reduced by checking the global clock divider according to the invention.

The divider ratio of the global clock divider 230 is now permanently checked by an additional hardware, in this case, the proposed circuitry. This also makes it possible to immediately detect the effects of transient errors, so-called soft errors, in the parameter registers. Such registers are, for example, the counter NUM and denominator DEN of the fractional divider. Only one additional compare register with a predetermined minimum number of system clock periods and a corresponding counter with the corresponding bit width are needed. Because the global clock divider 230 outputting only an intermediate signal, which is further divided in the generation of the clocks, the bit width can be significantly lower than in the case where the whole clock divider is tested.

In the global clock divider 230 the system clock CLS0_CLK is divided to generate the global clock enable signal GCLK_EN so that the period T can be determined as follows: $${\text{T}}_{\text{GCLK\_EN}}=\left(\text{NUM}/\text{THE}\right)*{\text{T}}_{\text{CLS0\_CLK}}$$

The parameters NUM (numerator) and DEN (denominator) are each in 24 Bit wide registers stored. In this case, it is expedient to generate an activation or enable signal for the global clock, because delays occur due to delays in the divider.

3 shows in a block diagram a time base unit or TBU (Time Base Unit), which is used for example. In a generic timer module or GTM (Generic Timer Module) and in total with the reference numeral 310 is designated. The illustration shows a number of TBU channels 312 in each of which a time or angle basis 314 and a controller 316 is provided. The time or angle base 314 is typically incremented or decremented by 1 on the arrival of (clock or angle) pulses (from top left) (component 17 ). Furthermore, a register BASE_MARK 320 and a register BASE_CAPTURE 322 provided that it is a modulo counter of the time or state basis. It is always checked (comparator 321 ), whether a given value of the time or angle BASE_MARK 320 is reached and then the time or angle base 314 on the value 0 reset.

• bei der TBU0: 0 oder +1, (TBU-Kanal 312a, weil dort nur Inkrementieren möglich ist)
• bei der TBU1, 2: 0, +1 oder -1, (TBU-Kanal 312b, weil dort ein Inkrementieren und Dekrementieren möglich ist)
• bei der TBU3: 0, +1 oder -1, (TBU-Kanal 312c, weil dort ein Inkrementieren und Dekrementieren möglich ist)
• weil bei den letzteren auch eine Rückwärtsrichtung möglich ist.

It should be noted that in a GTM, a pipeline stage for the time bases in the transition to the clusters, ie different sub-modules each with a uniformly delayed, in a pipeline stage with the system clock cached time or angle basis are supplied. This makes it possible to compare the old value with the new value using additional hardware. The new time base value can be at most around the value 1 if the system clock SYS_CLK is the highest frequency clock in the system. The deviation possibilities are:

• at TBU0: 0 or +1, (TBU channel 312a because only incrementing is possible there)
• at the TBU1, 2: 0, +1 or -1, (TBU channel 312b because it allows incrementing and decrementing)
• at the TBU3: 0, +1 or -1, (TBU channel 312c because it allows incrementing and decrementing)
• because in the latter also a reverse direction is possible.

The externally guided value of the respective time / angle base is temporarily stored in the submodules (clusters) in a further register stage.

In 3 becomes the upper TBU channel 312a a signal 323 With 27 Bit output, in the two middle TBU channels 312a , b (TBU1 and TBU2) each become a signal 325 With 24 Bits are output and in the lower TBU channel 312c (TBU3) becomes one 24 Bit signal output.

Claims (10)

A method of monitoring a timer module (10) comprising at least one clock divider (220, 236, 240), at least one state base incremented or decremented by pulses, and including information about system characteristics, and at least one data transfer device (80), the at least one data transmission per unit time allows and carries out a data transmission between first and second modules, wherein the timer module (10) is operated with at least one derived clock derived from a system clock by means of the at least one clock divider (220, 236, 240) in which a number of checking steps are carried out for monitoring the timer module (10), wherein in a first checking step a check is made with respect to a clocking of the timer module Timer module (10) is performed, in a second test step the at least one state basis and in a third test step, the at least one data transmission means (80) are checked. Method according to Claim 1 in which the frequency of the system clock is checked by means of processing and output with the aid of an independent time base. Method according to Claim 1 or 2 in which division ratios between the system clock and the at least one derived clock are checked in such a way that a clock frequency of these derived clocks can thus be determined. Method according to one of Claims 1 to 3 in which, for monitoring the at least one state basis in at least one memory, the state basis is temporarily stored with a system clock, wherein the current state basis is compared with the state base previously buffered by a system clock with at least one comparator (321), an error being detected on the basis of this comparison becomes. Method according to one of Claims 1 to 4 in which, for monitoring the at least one state basis in a memory, the state of the state basis is periodically buffered, and with at least one comparator (321) the state of the state basis before the buffer stored in the memory with the state of the state basis after the buffering is compared and an error is detected based on the comparison. Method according to one of Claims 1 to 5 in which, in order to check an address in a data transmission which takes place with the at least one data transmission device (80), the address is provided with at least one additional code bit enabling error detection, wherein in the case of a request for data transmission the address together with these code bits is transmitted and the address is checked taking into account the at least one code bit. Method according to one of Claims 1 to 6 in which for monitoring at least one counter for the at least one data transmission device (80), wherein the at least one counter successively addresses modules for data transmission, wherein at least one counter is periodically stored in at least one memory with a system clock, wherein at least one comparator ( 321) the current counter reading is compared with the one meter clock previously stored counter reading and based on this comparison an error is detected. Method according to one of Claims 1 to 7 in which, for monitoring at least one counter for the at least one data transmission device (80), wherein the at least one counter successively addresses modules for data transmission, the state basis is to be buffered periodically in at least one memory with a system clock, wherein with at least one comparator of Count before caching, which is stored in the memory to compare with the count after caching and based on this comparison, an error is detected. Method according to one of Claims 1 to 8th in which data is monitored, which are transmitted in a data transmission with the at least one data transmission device (80), wherein the data is provided with at least one additional code bit, which allows error detection, wherein in the case of a request for data transmission, the data together with these Code bits are transmitted and the data are checked taking into account the at least one code bit. Circuit arrangement for monitoring a timer module (10), which is used to carry out a method according to one of the Claims 1 to 9 is set up.

Images