EP3161691A1 - Method for the automated manufacture of an electronic circuit suitable for detecting or masking faults by temporal redundancy, and associated computer programme and electronic circuit - Google Patents

Abstract

A method for the automated manufacture of an electronic circuit tolerant to faults by temporal redundancy of maximum order N, comprising a step implemented by computer, which involves replacing any memory cell of the circuit with a memory block (40) comprising a chain of memory cells in series, and a selection block which selects, in a temporal redundancy mode of order n1, n1 ∈ [1,N], as output data of the memory block, the majority content of n1 cells of the block, and can further deliver a fault signal if the content of the n1 cells differs. Said method is characterised in that the inserted memory blocks allow dynamic switching from a temporal redundancy mode of order n1 to any other mode of order n2. Said method for N=2, in association with a recording mechanism with backward recovery, makes it possible to mask an error with only double redundancy instead of triple redundancy.

Description

 Automated method of manufacturing an electronic circuit adapted to detect or mask faults by time redundancy, computer program and associated electronic circuit

The present invention relates to the field of electronic digital circuits adapted to detect or mask faults.

 There are different techniques, in electronic circuits, for detecting or masking transient errors (in English "soft errors") caused by transient singular effect electromagnetic or electromagnetic activities (SEU, "Single Event Upset" in English or SET , "Single Event Transient").

 A first technique is the triple modular redundancy or TMR (in English "Triple Modular Redundancy"), in which the hardware elements of an electronic circuit are tripled, the same input data are provided in parallel with each of the triplet components, and voting modules associated with these triplet components select as the result provided by the component triplet the common result provided in parallel by at least two of the components. This first technique, however, requires a large number of components, which is a significant drawback, particularly in terms of compactness of the electronic circuits.

 A second technique is time redundancy, typically triple time redundancy (TTR), in which the same input data is provided three times in succession to the same hardware component that delivers three results, and voting modules associated with the component select as a result. provided by the component the result provided at least twice by the component among the three results.

The present invention more particularly relates to this second technique, and in particular to a method of automated synthesis of an electronic circuit adapted to detect or hide faults by time redundancy, said method comprising a computer implemented step, according to which to implement a memory cell function of the electronic circuit is inserted in the electronic circuit a memory block comprising a delay chain comprising N series memory cells, N≥2, and a selection block (voter / detector) which, in a mode of operation corresponding to a time redundancy of order n1, involving n1 reruns, n1e [1, N], compares the current contents of the n1 memory cells storing n1 redundant input data successively supplied to the memory block, and if n1> 2, selects as output data of the memory cell function, the majority content of the n1 memory cells and optionally additionally delivers a fault signal if the contents of two memory cells differ;

 - If n1 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells containing the current redundant data and further delivers a fault signal if the contents of these two memory cells differ;

 - If n1 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined.

 n \ - \ n \

If n1> 2, the mask circuit E [- - faults and optionally detects E [-] faults, where £ is the function "integer part". If n2 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined.

 US 7,200,822 B1 is an example of circuits with triple time redundancy and more. The technique described therein, however, decreases the processing rate of the circuit.

 For this purpose, according to a first aspect, the invention proposes a method of automated synthesis of an electronic circuit adapted to detect or mask faults by time redundancy of the aforementioned type, characterized in that a control block of the above-mentioned type is furthermore inserted. circuit adapted to transmit control signals of the memory blocks, and in that the inserted memory block is adapted to switch, according to a toggle command signal received from the control block, between said operating mode corresponding to a temporal redundancy of order n1 and another mode of operation corresponding to a time redundancy of order n2 e [1, N] according to which the circuit performs n2 reruns, n2 ≠ n1, in which the selection block compares the current content of n2 determined cells among the N memory cells storing n2 redundant input data successively supplied to the memory block, and:

 if n2> 2, selects as output data of the memory cell function, the majority content of said n2 memory cells;

 if n2 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and delivers a fault signal if the contents of the two memory cells differ;

if n2 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined. The invention makes it possible to dynamically adapt the compromise between the corrections / fault detections and the output rate of the circuit.

 Such dynamic time redundancy makes it possible to change the number of reruns during execution. When this number is 1, the circuit operates without replay and without additional cost.

 The dynamic adaptation of the level of temporal redundancy implemented according to the invention makes it possible in particular to adapt the operation of the circuit manufactured according to the invention to the fluctuations of the radiation in the environment of the circuit.

 Such dynamic temporal redundancy makes it possible in particular to obtain circuits masking an error using means equivalent to a double temporal redundancy instead of triple. The principle is to take advantage of the K clock cycles following the occurrence of a fault during which, hypothetically, no new fault will occur. In a circuit according to the invention, following an error detection in a double redundancy mode, the circuit switches to non-redundant mode to make a third execution of the erroneous calculation, without the flow observed at the output of the circuit changing ( see "Combining Dual Dynamic Time Redundancy and Rewind Recording" below).

 In embodiments, the automated synthesis method of a temporally redundant fault tolerant electronic circuit according to the invention further comprises one or more of the following features:

 the inserted memory block furthermore comprises, when N> 2, an additional delay block disposed at the output of the delay chain and comprising at least

 N - l

E [- - memory cells; in operation mode corresponding to a time redundancy of order n, n> 2, every n cycles, the selection block selects as output data from the memory cell function, the majority content of the n memory cells of the memory channel. delay, and each ^me next cycle of said n cycles, 1≤i <n, selects as output data of the memory cell function, the majority content of a set of last cells of the delay chain and block the cells additional delay, said cells of the set storing redundant input data having been successively supplied to the memory block; this set comprises, for example ^me said cycle, (or) the last cells of the delay chain and / ^'cells additional delay block; -N = 3, n1 = 1, n1 = 2, or n1 = 3 and n2, n2 ≠ n1, takes a value equal to 1, 2 or 3 depending on the tilt command; this embodiment corresponds to a triple dynamic redundancy, which therefore includes the operating modes of order n = 1, n = 2 and n = 3 as well as all possible transitions between these three modes of operation;

-N = 2, n1 = 1 or n1 = 2 and n2, n2 ≠ n1, takes a value equal to 7 or 2 depending on the toggle command; this embodiment corresponds to a double dynamic redundancy, which therefore includes the operating modes of order n = 1 and n = 2 as well as all possible transitions between these two modes of operation;

the operating mode switching command according to a time redundancy of order 2 to the operating mode according to a time redundancy of order 1, and vice versa, is triggered following the reception by the control block of a signal of fault issued by one of the memory blocks;

the second cell of the delay chain stores, at each clock cycle of the circuit, the content stored in the previous clock cycle, in the first cell of the delay chain, the inserted memory block further comprises a chain for receiving, on receiving a control signal from the control block, storing the input signal value of the memory block also supplied in parallel with the first cell of the delay chain, and in the according to a redundancy of order 2, the recording control signal is output every two cycles so that when redundant data stored in the two memory cells of the delay chain are compared by the selection block, the last cell of the recording chain contains in memory the data which were stored two cycles previously in each of the two memory cells of the delay chain ;

following reception by the control block of a fault signal delivered by a memory block signaling that redundant data stored in the two memory cells of the delay chain differ, the control block supplies the memory block with a command backward response following which the memory block delivers as output data of the memory cell function, the current contents of the last cell of the recording string; this embodiment makes it possible to mask an error with only double redundancy instead of triple; an input block of the circuit receiving the current external data item to be oversampled twice is also inserted at the input of the electronic circuit,

the input block, in the mode of operation according to a second order temporal redundancy, storing the current external data item received and also supplying the circuit with said current external data received and, the input block, with the mode of reception. operation according to a first order time redundancy, providing the circuit with successive non-redundant external data previously stored by the input block to allow a third execution of these data by the circuit; and

according to which is further inserted at the output of the electronic circuit an output block of the circuit receiving the data output by the circuit, said output block, in the operating mode according to a time redundancy of order 2, storing the data delivered by the circuit and applying a given delay before delivering them, and the output block, in the mode of operation according to a temporal redundancy of order 1, delivering without delay the data delivered by the circuit, duplicating data delivered by the circuit and delivering the duplicate data,

the fault recovery by the circuit is thus masked vis-à-vis the upstream circuit and downstream of the circuit by said input and output blocks. The input and output blocks allow in non-redundant mode (n2 = 1) to make the step of backtracking and recalculation transparent vis-à-vis the external environment.

According to a second aspect, the present invention proposes a computer program to be installed in an automated manufacturing tool of an electronic circuit adapted to detect or hide faults by time redundancy, said program comprising instructions for implementing the steps of FIG. a method according to the first aspect of the invention during execution of the program by processing means of the automated electronic circuit manufacturing tool.

According to a third aspect, the present invention proposes an electronic circuit adapted to detect or mask faults by time redundancy comprising a set of memory block (s), each memory block of said set comprising a delay chain comprising N memory cells in memory. series, N≥2, and a selection block which, in an operating mode corresponding to a time redundancy of order n1, n1 e [1, N], compares the current contents of n1 of said N memory cells storing n1 data d redundant inputs successively supplied to the memory block, and if n1> 2, selects as output data from the memory cell function, the majority content of the n1 memory cells and optionally additionally delivers a fault signal if the contents of two memory cells differ;

 - If n1 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and further delivers a fault signal if the contents of the two memory cells differ;

 - If n1 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined; said electronic circuit being characterized in that it comprises a control block of the circuit adapted to transmit control signals of said memory blocks, and in that each of said memory blocks is adapted to, according to a failover control signal received from the control block, switch between said operating mode corresponding to a time redundancy of order n1 and another operating mode corresponding to a time redundancy of order n2 e [1, N], n2 ≠ n1, in which the selection block compares the current contents of n2 determined cells, among said N memory cells, storing n2 redundant input data successively supplied to the memory block, and:

 if n2> 2, selects as output data of the memory cell function, the majority content of said n2 memory cells;

 if n2 = 2, delivers as output data of the memory cell function, the content of one of the two memory cells and delivers a fault signal if the contents of the two memory cells differ;

 - If n2 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined.

These features and advantages of the invention will appear on reading the description which follows, given solely by way of example, and with reference to the appended drawings, in which:

 FIG. 7 is a representation of a digital circuit before transformation according to the invention;

Figure 2 is a view of an automated synthesis tool of fault-tolerant electronic circuits in one embodiment of the invention; Figure 3 is a view of a digital circuit after transformation in an embodiment of the invention; Figure 4 is a view of a memory block of Figure 3 in one embodiment of the invention;

 FIG. 5 is a view of the memory block of FIG. 3 in one embodiment of the invention corresponding to a dual dynamic time redundancy;

 FIG. 6 is a view of the memory block of FIG. 3 in one embodiment of the invention corresponding to a triple dynamic time redundancy;

 Figure 7 shows an example of voter used in Figure 6;

 Figure 8 is a view of a memory block of Figure 3 having a recording / reverse mechanism in one embodiment of the invention;

 Fig. 9 is a view of a memory block of Fig. 3 in an embodiment of the invention combining dual dynamic time redundancy and back-up / recording mechanism features;

 FIG. 10 is a view of a digital circuit in one embodiment of the invention corresponding to a dual time redundancy with backtracking;

 Fig. 11 shows an input buffer in one embodiment of the dual dynamic redundancy with backtracking invention;

 Fig. 12 shows an output buffer in one embodiment of the dual dynamic redundancy with backtracking;

 Fig. 13 is a view of a finite state machine of a control block in an embodiment of the invention of double reverse dynamic redundancy;

 Figure 14 shows steps of a method in one embodiment of the invention;

 Figure 15 depicts steps of an integrated circuit design flow in one embodiment of the invention.

In the figures, identical references identify similar elements. FIG. 7 is a general representation of a digital circuit 10, comprising a combinational part 77 and a sequential part 72, driven by a clk clock signal.

 The combinatorial part 77, comprising combinatorial gates AND, OR, NOT, etc., performs a Boolean function without memory φ.

 The sequential part 72 comprises memory cells or Flip-Flops (FF) which each memorize a bit, or Flip-Flops (FF) intended to memorize the data delivered by the combinatorial part 77. A memory cell 73 is represented in FIG. It receives on an input wire D a signal IF and delivers on an output wire Q an output signal SO (note that here a flip-flop of type D is described, but the invention is of course applicable to any type of memory cell).

 The digital circuit 10 takes as input a primary input bit vector PI and outputs a primary output bit vector PO at each clock cycle.

 The input bit vector, respectively the output bit vector, of the combinatorial part 77 is denoted by Cl or CO respectively. The input bit vector, respectively the bit vector of output, of the sequential part 72.

 These vectors satisfy the following equalities:

 CO = (p (CI) C i = P i S S C C = = P ® S (1) where est is the vector concatenation operation.

We denote v the value of the bit vector v at ^my clock cycle in the circuit. We call v any component of the bit vector v.

The fault models considered are of the form "at most m transient singular effects (SET) every K clock cycles", denoted SET (m, K). This includes the direct SEUs of a memory cell and the SEUs resulting from a SET in the combinatorial part. According to the SET (1, K) fault model, there is no fault occurrence in the clock cycles following the last fault occurrence.

A SET in the combinatorial portion 77 of a circuit may lead to non-deterministic corruption of any connected memory cell (by a purely combinatorial path) at the location where the SET occurred. A SET in the combinatorial portion 77 to a cycle / ^' may cause output corruption (s) in POi and input (s) in Sh, which then causes the corruption of memory cells in the sequential portion 72. last corruption is visible in the clock cycle A SET can happen on any wire of the circuit (connections between logic gates, memory cells, inputs, outputs).

FIG. 2 represents a tool 1 for automated synthesis of fault-tolerant electronic circuits in one embodiment of the invention. This tool 1 comprises a microprocessor 2 and a memory 3. In the memory 3, a program of software instructions P is stored which, when it is executed by the microprocessor 2, is adapted to implement the steps indicated below. automatic transformation of the design of the circuit.

 Such a tool 1 is adapted for, from a description of a digital circuit of the type of logic gate network (in English "netlist") comprising AND, OR, NOT and memory cells or Flip-Flops, perform a stage of automatic transformation of the design of the circuit to obtain a transformed circuit, then to manufacture a circuit FGPA or an ASIC circuit from the transformed circuit in netlist form.

The lowercase vectors, for example pi, po, represent the signals in a digital circuit transformed by the digital circuit fabrication tool that correspond to the uppercase letter vectors, for example PI, PO. They satisfy the same equalities (1) indicated above.

Dynamic temporal redundancy

 According to a first aspect of the invention, the tool 1 implements an automatic transformation step 100 of the circuit design to obtain a fault-tolerant circuit by dynamic temporal redundancy.

 A circuit as obtained after transformation is adapted to switch, without any interruption of calculation, from an operating mode according to a time redundancy of order n to an operating mode according to a time redundancy of order m, with n ≠ m , following a mode switching control signal indicating the transition from the order n to the order m, which allows a dynamic compromise between the flow rate and the fault tolerance.

In this transformation step 100, the tool 1 replaces each input memory cell 13, output S0, and provided in the original circuit, with a memory block 14 of input S1 and output N0 and additionally a control block 15 which generates control signals, as represented by the modules 12 and 15 of FIG. The memory block 14 implements a dynamic temporal redundancy mechanism adapted to mask and / or detect faults caused by SETs in at least one of the operating modes of the memory block 14. The memory block 14 is adapted to switch during operational operation. of the circuit, from an operating mode according to an n-order time redundancy to a mode of operation according to a time redundancy of order m, with n and m integers and n ≠ m, following a mode switching command indicating the transition from order n to order m.

 In one embodiment, the control block 15 determines the control signals of the memory block 14 in particular according to the order n of the time redundancy currently selected for the circuit. It is implemented for example using a finite state machine, for example itself protected by TMR.

Hereinafter n mode is defined as the mode of operation with time redundancy of order n (n natural number):

 the input flux PI of the circuit is oversampled n times and noted pi, the flow rate of the initial circuit is n times greater than the flow rate of the transformed circuit;

 n the memory block 14 is adapted to detect or hide up to ^ [-] faults

[E] represents the function "integer part") when n is greater than or equal to 2, as a function of comparisons between them, all the n clock cycles, of the n data successively stored by the memory block and corresponding to the n if redundant input signals (in the case of a fault mask, the output data selected by the memory block is the majority data among the n compared data). A memory block 14 includes a dynamic delay pipeline, an additional delay line and a voter / detector.

 The dynamic delay pipeline is adapted to, in an n-order time redundancy mode, storing n successive signals supplied at the input of the memory block. It is adapted to dynamically modify its delay function n as a function of control signals transmitted by the control block 15.

 The additional delay chain is suitable for, in a mode of n - \

temporal redundancy of order n, storing E \ signals having been successively supplied at the input of the memory block 14, so as to allow the realization by the Voter / detector 18 of n successive voting / detection decisions (in other modes, the additional delay line is adapted to save more signals that have been successively supplied).

 The memory block 14 comprises a voter / detector adapted to determine n decisions of the type masking or / and detection of faults, successive n-mode time redundancy mode, according to data stored in the pipeline and / or in the line additional delay.

 A memory block 14 is shown in one embodiment, in FIG. 4.

The dynamic delay pipeline 76 has N (N≥2) memory cells 13 arranged in cascade and N-2 multiplexers 20 (it should be noted that other implementations are possible: for example, one could not use multiplexers 20 and change the voter / detector to select cells to compare / vote.

The N successive memory cells are named respectively di, d ₂ , d _N -

A multiplexer 20 is disposed between each cell d, and each cell d _{i + 1} , \ e [1, N-2] (when N> 2). The cell di has for signal input the signal if. The cell d _N has for its input signal the output signal of d _N-1. The output of each cell d 1, ie [1, N-2], is delivered to the input 0 of the multiplexer 20 placed between each cell d, and each cell dj + i. The signal if is delivered to the input 7 of the multiplexer 20 disposed between each cell d, and each cell d _{i +} i. The output of the multiplexer 20 disposed between the cells d, and d _{i +} i cell d ,, ie [1, N-2], is delivered to the input of the cell d _{i +} i.

 In known manner, a control bus, named here modeS, indicates to each multiplexer 20, that of its inputs 0 and 7 to be output from the multiplexer 20 (if the signal of the control bus modeS is equal to 7: 1 input 7, receiving if is outputted from the multiplexer, if the signal of the control bus modeS is equal to 0: the input 0, receiving the output of the previous cell, is output from the multiplexer). This known operation of a multiplexer is also that of the other multiplexers described below and therefore will not be recalled systematically.

 The output of the cells d ,, i = 1 to N, is further provided to the voter / detector 18 on the dataA data bus.

The modeS control signals are a function of the selected time redundancy mode. not -\

The additional delay line 77 has k = E \ memory cells d 1, d _k in series. The input of d ^ is fed by the output of d _N. The input of of _{y + 1} is fed by the output of d, with j≥1. The contents of these cells are provided on the n - \

dataB bus. El of these cells are used by the voter / detector 18

 2

to make the n-1 last decisions relating to n redundant data at the input of the memory block 14.

The voter / detector 18 is adapted to determine the output signal so as a function of redundant data present on the dataA and dataB buses and to make mask decisions and / or error detection in the order n current time redundancy. In a masking decision, the voter / detector compares the entries supplied to him and selects as signal n the majority value among these entries.

 If n = 1 (operating mode = mode 7), there is no time redundancy. The flow rate of the transformed circuit is the same as the flow of the initial circuit. There is no detection or correction of mistakes.

In the embodiment described, the signal if is supplied at the input of the cell D _N - by control of the multiplexers 20 (in other embodiments, for example without multiplexer 20, it is provided to each cell). It is the content of the cell d _N- i which is delivered as signal n0 by the voter / detector 18 (thus the signal SO at the cycle / is the signal supplied at the input of the memory block 14 at the cycle i-1).

If n = 2 (operating mode = mode 2), the signal if is supplied at the input of the cell d _N .i to an even cycle 2 /; in the cycle 2Ί + 1, the signal if redundant is in turn provided at the input of the cell d _N -i while the output of the cell d _N -i is provided at the input of the cell d _N. The voter / detector 18 provides as a signal so the content of d _N each cycle. It compares, in cycle 2 / ^' , the data (derived from redundant input data) stored in the memory cells _N .i and d _N after they have been inputted from memory block 14 to cycle 2Ί-1. and 2 / ^' -2, and outputs a fail signal indicating 0 if the compared data is equal (no fault detected) and indicating 1 if the compared data is not equal (fault detected). At odd cycles, the value of the signal fail is ignored because the comparison is made with non-redundant data. The value of this signal fail is for example supplied to the control block 15 or to the output of the circuit. If n = 3 (operating mode = mode 3), the cells d _{N. 2} , d _N-1 and d _N are used as well as, similarly to the respective cells d, d ', d "and s of Figure 6 whose operation is described below.

In general, in time redundancy of order n≥3 (operating mode = mode n), the cells of the pipeline d _{N. n +} i, -i d _N and d _N are used, as well as cells of the line of further delay d ^, d _nl. If n is the order of the

^Εί Ύ ^]

redundancy mode currently selected for the operation of the circuit, the same input data are provided n times to the combinatorial part 11 of the circuit which recalculates the same result n times, which is then found gradually saved in the n memory cells dd ₂ , a _n n pipeline 16. These results represent the current redundant set of redundant results

When these n redundant results are stored in the n cells dd ₂ , d _n, the voter / detector 18 makes a first decision based on these n results which are inputted to it on the dataA bus. Then the redundant data at the output of the cell d _N are successively stored in the additional delay line 17,

 not -\

which will contain up to E \ in the following n-1 cycles during which the

 2

The decision maker / voter makes n-1 decisions on the redundant results of the current game stored in the memory cells of the pipeline 16 and the additional delay line 17 via the dataA and dataB data buses. So to ^me (i <n) the next cycle, the decision relates to the majority value from (or) redundant results

n - \ current set of redundant results in the d cells _{Nn .i + i} , d _N and the min (i, El)

First 2 cells of the additional delay line 17 also storing this redundant result (ie dd _η ). Thus (n-1) ^th next cycle, the decision relates to the mm (i, E [-]) single redundant result of the current set of redundant results in the cell and the _N

 not -\

redundant results of the current set of redundant results in the E cells of

 2

the additional delay line 17 considered. Then, in the pipeline 16, the n-1 redundant results of the following set of redundant results are contained in the _N cells. _n + i and d _N -i-

The fetchA control signals indicate at each clock cycle, according to the currently selected time redundancy order, that (s) of the outputs of the memory cells on dataA buses, dataB, that the voter / decision-maker 18 must consider in his current decision.

 As an illustration of an embodiment of the invention, a circuit is produced with alternative modes of operation 2 and 5, which thus detects a single SET (mode 2), or masks up to two SETs ( mode 5).

 The modeS, fetchA control signals are determined by the control block 15, in particular according to the selected time redundancy mode and the current cycle. Depending on the embodiments, a temporal mode change is made automatically or not, for example when crossing a radiation threshold in the environment of the circuit or following the occurrence of a fault.

During the mode changes, the modules interfaced to the circuit must adapt to the redundancy order changes, in particular the level of oversampling must follow the redundancy order.

 The cases N = 2 and N = 3 are detailed below.

Dynamic dual time redundancy

 In one embodiment of the invention now considered, the value of N is chosen to be equal to 2, the circuit manufactured according to the invention thus having a dual dynamic redundancy mechanism according to the principle explained above according to which the operation of the circuit can switch between time redundancy modes of order n = 1 and n = 2.

 The transformation 100 therefore comprises the implementation of double oversampling means of the input stream PI which are activated when n = 2, the substitution of each memory cell provided in the original circuit by a memory block 140 and the addition of a control block 15.

In this circuit, with reference to FIG. 5, the memory block 140, replacing each memory cell provided in the original circuit, comprises a pipeline 16 comprising the cells d and d ', respectively corresponding to the cells of _N- i, d _N of Figure 4 and a voter / detector 18.

 The voter / detector 18 comprises a multiplexer 21 and a comparator 22.

The multiplexer 21 has two inputs 0 and 1. The output signal so of the memory block is the output signal of the multiplexer. It is equal to either input 1 or input 0 depending on the modeS control signals. The signal if is provided at the input of the cell d, the output of the cell d is provided at the input of the cell of, at the input of the comparator 22 and input 0 of the multiplexer 27. The output of the cell is supplied as input 7 of the multiplexer 27.

 The comparator 22 is adapted to compare the values supplied with each clock cycle on its two inputs, and to deliver a signal fail = 0 when the values are equal and a signal fail = 1 when the values differ.

Mode n = 1

In mode n = 1, p / ^' , = P \, V / ^' nonzero integer. At the cycle / ^' , the bit s /, is given at the input of the cell d. In this mode, the multiplexer 27 is controlled by the modeS = 0 signal transmitted by the control block 75, so that the multiplexer output 27, Le.sub.1, the signal so, is always equal to the input 0 of the multiplexer Le. at the exit of the cell d.

Mode n = 2

In mode n = 2, the input stream of the circuit is oversampled twice: p / ₂ = pi

The cells d and d thus contain redundant data at each even cycle (by convention, the first cycle is numbered 0). For example, if = u, if ₂ = u, then the pair (d, d ') will successively contain the values (0,0), (u, 0), (u, u) ... assuming that the initial values in (d, d ') were (0,0).

 The voter / detector 18 provides as signal each cycle the content of d.

In this mode, the multiplexer 27 is controlled by the modeS signal emitted by the control block 75, so that its output, Le., The signal so, is always equal to the input 7 of the multiplexer.

 The value of the signal fail returned by the comparator 22 is not significant to the odd cycles, since then d and d do not contain redundant data.

At an even cycle 2 / ^' , a signal value fail equal to 7 signals the detection of an error in the redundancy of the data then stored in d and d', Le., Supplied at the input of the memory block 740 in cycles 2 / and 2 / ^'-7.

 The double dynamic time redundancy according to the invention makes it possible, in mode n = 2, to detect errors in the fault model SET (1, K) for all K≥2, and in mode n = 1 to have the same bit rate than the initial circuit.

Triple Dynamic Time Redundancy

In another embodiment of the invention now considered, the value of N is chosen equal to 3, the circuit manufactured according to the invention thus having a triple dynamic time redundancy mechanism according to the general principle explained above, according to which the operation of the circuit can switch between time redundancy modes of order n = 1, n = 2 and n = 3.

 The transformation 100 therefore comprises the implementation of oversampling means (xn) which are activated when n = 2 or n = 3, the substitution of each memory cell provided in the original circuit by a memory block 141 and the addition of a control block 15.

In this circuit, with reference to Figure 6, the memory block 141, replacing each memory cell provided in the original circuit includes a pipeline 16 having the cells d, d 'and d ", respectively corresponding to the cells of _{N. 2,} d _N - d _N of FIG. 4, the additional delay line 13 and a voter / detector 18.

 A multiplexer 20, comprising two inputs 0 and 1, is arranged upstream of the input of the cell. The input of d is the output of the multiplexer 20. The multiplexer 20 receives on its input 1 the signal if and on its input 0 the output of the cell d. The modeS control signal indicates that of the inputs 0 or 1 at which the output of the multiplexer 20 is equal: modeS = 0 (n = 3), the length of the pipeline 16 is 3: the output of the multiplexer is set equal to the input 0; modeS = 1 (n = 1 or n = 2), the active length of the pipeline 16 is 2: the output of the multiplexer is set equal to the input 1.

The additional delay line 13 comprises a memory cell corresponding to the cell shown in FIG.

 The voter / detector 18 comprises two multiplexers 23, 23 'and a voter 24.

 Voter 24 receives 3 entries. These 3 inputs are the outputs of d 'and multiplexers 23, 23'. The voter 24 compares the three entries, selects among them the majority input value, this selected value constituting the output signal so delivered by the memory block 141. The voter 24 further compares the outputs of d 'and d "and delivers a signal fail = 0 if they are equal and a signal fail = 1 otherwise.

 An exemplary structure of such a voter 24 is shown in Figure 7, where the signal fail is the result of a comparison between a and b, and so is the result of the majority vote made on the entries a, b and c.

Mode n = 3

In mode n = 3 (redundancy of order 3), in normal operation (ie, without the behavior of all memory blocks is described by the following equations V / ^' non-zero integer, s /, = = of _{i + 2} = d " _{i + 3} = s, + 4 = so, + 3 (2)

 The oversampled input and output signals of the circuit satisfy the equations {1), namely:

coi = (p (cii) cii = pi _i ® SO _Î coi = po _i ® sii (3)

The input bit stream of the original PI is oversampled 3 times:

The control signal modeS is equal to 0.

 From equations (2), (3) and (4), it follows that the output bitstream of the combinatorial part co after the transformation 100 of the circuit is the output stream CO of the original circuit oversampled three times:

 COl-2 = COl-l = COl = COi

In this mode of operation, the three cells d, d ', d "have an equal content all (3 ^/' -2) cycles, as follows: d ₂ = d _3j _ '_ _{3j 2} = d" _3j _ _2.

 At each cycle, a vote of the voter / detector 18 selecting the majority value among the contents of the three cells d, d, masks a fault and only the result of this vote is provided via so to the combinatorial part of the circuit. .

In the first cycle following each specific cycle where the three cells d, d ', d "have an equal content, the cell s stores the redundant value stored in the specific cycle in d", then the next second cycle, the cell s stores the value redundant stored at the specific cycle in d ', ie: s _3j _ = d " _3j _ ₂ and s _3j = d' _3j _ ₂ , which keeps the level of redundancy required in the memory block.

The vote in the specific cycle 3 / ^' -2 is carried out on the contents of the cells d, d' and d "and the vote is made instead on the contents of the cells d, d" and s the following two cycles, selecting the majority value among these three contents. This functionality is implemented using the fetchA control signal emitted by the control block 15: fetchA = 1 at each cycle 3Ί-2 (ie output of the multiplexer 23 is set equal to the input 1 of the multiplexer 23) and fetchA = 0 cycles 3Ί-1 and 3 / (ie output of the multiplexer 23 is set equal to the input 0 of the multiplexer 23).

Suppose that in cycle 3 / ^' -2, d, d, and d' have a correct redundant value a, the vote takes place on (a, a, a) stored in {d, d ', d "); the vote in cycle 3Ί-1 will take place on (a, a, a) stored in (dd ", s), d then containing the next bit value on the initial stream, let's call it b, and in cycle 3i, the Voting takes place on (b, a, a) stored in (cf, d ", s), d and d, then each containing the value b. So if d "is corrupt at this cycle 3 /, the vote can return an erroneous value that will be propagated to the next block. But this erroneous value being preceded by two correct values, it will be corrected at the next cycle in the next block (an additional SET can not then occur according to the fault model considered).

Mode n = 2

 In mode n = 2 (redundancy of order 2), in normal operation (i.e., without fault), the behavior of all the blocks is described by the following equalities:

V / ^' nonzero integer, sii = dm = d' _{i + 2} = d " _{i +} 3 = s _{i + 4} = so _{i + 2}

 To set the output of the multiplexer 20 equal to the input 7 of the multiplexer 20, the control signal modeS is therefore set to 7 by the control block 15 in this mode.

 The fetchA signal is set equal to 1.

 The cell did not participate in the decisions.

In mode n = 2, the input flow of the circuit is oversampled twice: p / ₂ = pi 21 = ^Pl > ^■

 The output bit stream of the combinational part co after the transformation 100 of the circuit is the output stream CO of the original circuit oversampled twice:

detection cases are based on the following equality: V / ^' non-zero integer,

 A new value on is supplied to d and d, then the next cycle is propagated to d while redundant data of value a is again provided on if d and d '.

 The error detection is carried out by the voter / detector 18 by comparing d 'and d' each (2i-1) th cycle, since in the absence of fault, their content should be equal according to the equation ( 5) If their content is not equal, a signal fail = 1 is sent.

 so is the result of voting (selecting the majority value) on d, d ', d "at each cycle.

A SET on if can corrupt both d and d 'and the vote will not hide this fault. But if a SEU takes place on one of the three cells d, d ', d "during an odd cycle, it will be masked by the vote. Mode n = 1

 In mode n = 1 (no redundancy), in normal operation (i.e. without fault), the behavior of each block of memory is described by the following equations:

V / ^' nonzero integer, sii = d _{i +} i = d _{i +} i = d _{i + 2} = s _{i +} 3 = so _{i +} i (6)

 To set the output of the multiplexer 20 equal to the input 7 of the multiplexer 20, the control signal modeS is therefore set to 7 by the control block 15 in this mode.

 The fetchA signal is set equal to 1.

In mode n = 1, the input stream of the circuit is not oversampled: p / ^' , = PI, ^■ . The output bit stream of the co-combinational part after the transformation 100 of the circuit is the output stream CO of the original circuit: co, = CO,. In this mode, the circuit does not have fault detection or fault masking properties.

 The corresponding control signals are fetchA = 1 and modeS = 1.

According to equation (6), in the absence of fault, d equals each clock cycle. Therefore, the vote by the voter / detector 18 returns the value of d (and d at each cycle.) Formally co, = c, ₊ i = o ", ₊ i = d" i + 2 = c / ^' , ₊ i If d and / or c / 'are corrupted then the vote on {d, d', d "} may return an erroneous value (without setting the signal fail to 1), which is why this mode does not mask or detect mistakes.

The triple dynamic time redundancy according to the invention makes it possible to mask the SETs of the SET model (1, K) for any K greater than 4 cycles.

Recording mechanism with backspace

 According to another aspect of the invention that can be implemented independently of the dynamic temporal redundancy described above, the tool 1 implements a step of automatic transformation 101 of the design of the circuit to obtain a circuit with a mechanism of recording of the state of the circuit, this recording being triggered by a control signal named save, and furthermore provided with a feedback mechanism of the state of the circuit in the state thus recorded, this backtrack being triggered later by a command signal named rollBack.

To do this, in a transformation step 101, the tool 1 replaces each input memory cell 13 if, so output and provided in the original circuit shown in FIG. 1, by an input memory block 30 if and output so as shown in Figure 8, and further adds a control block which generates control signals save and rollBack.

 The memory block 30 comprises a memory cell 13 receiving on its input D a signal if, delivering on its output Q a signal to the input 0 of a multiplexer mux. The memory block 30 further comprises a recording block 29 adapted to record the signal if it is input to it when a signal save equal to 1 is addressed to it. The signal, if so recorded by the record block, is supplied at input 1 of the multiplexer mux.

 The record block 29, in this case, comprises a memory cell 31, named copy. The memory cell 31 stores, when a signal save equal to 1 is provided on its input E (enable), the signal if supplied to it on its input D, in parallel with its supply on the input D of the cell 13 When save is equal to 0, the signal if is not stored in the memory cell copy 31.

 The Q output of the copy cell 31 is provided at input 1 of the mux multiplexer.

 The mux multiplexer delivers at its output the signal so. The signal so is equal to the input 0 of the multiplexer when rollBack is equal to 0 and is equal to the input 1 of the multiplexer 31 when rollBack is equal to 1.

 Thus, as long as rollBack is equal to 0, the so output is equal to the content of cell 13. When rollBack becomes equal to 1, it is the content of the copy cell, corresponding to the last setting of the save signal, which is outputted so.

The same signal save at 1 supplied to the cycle / to the set (or to a subset) of the memory blocks 30 of the circuit makes it possible to record in the cells copy 31 the current state of the cells 13 of the circuit to the cycle / ^' . This state remains stored as long as a new save signal at 1 is not supplied.

Combining Dual Dynamic Time Redundancy and Rewind Recording

 In one embodiment of the invention now considered, the aspects of dual dynamic time redundancy and backward recording are combined.

 The value of N is chosen equal to 2, the operation of the circuit can switch between the modes of temporal redundancy of order n = 1 and n = 2.

Such a circuit is adapted to mask errors using only a level 2 time redundancy instead of a level 3 time redundancy. To do this, in a transformation step 102, the tool 1 replaces each memory cell 13, of the input if and of the output so, provided in the original circuit represented in FIG. 1, by a memory block 40, of input si and output so as shown in Figure 9, and further adds a control block 15 which generates control signals save and rollBack. A view of the transformed circuit resulting from this transformation is shown in FIG.

 Such a transformation involves the implementation of double oversampling means of the primary inputs of the circuit which, in the embodiment under consideration, are always activated independently of the value of the active redundancy order, the addition of buffer memories of input to all the primary inputs PI of the initial circuit, and finally the addition of output buffers to all the primary outputs PO of the initial circuit.

<p (c / ^' ) is computed twice, the results are compared and if an error is detected, <p (c / ^' ) is computed a third time, thanks to the contents of the input buffers.

The input stream, oversampled twice, checks: pi _2l = pi _2i = PI _,.

 The memory block 40 thus comprises cells d and d arranged in series to save redundant data. It furthermore comprises an EQ comparator comparing the contents of the cells d and the emission of a signal fail indicating the result of the comparison.

 The memory block 40 further comprises a recording block 29 adapted to store the signal if it is input to it when the control signal save is set to 1. The output of the recording block is supplied to the input 1 the muxA multiplexer, while the output of the cell d is provided on the input 0 of the multiplexer muxA. The muxA multiplexer is controlled by the signal save as well.

 In the embodiment considered, the recording block 29 has the cells r and r 'arranged in series, the signal if supplied at the input D of the cell r, the output Q of the cell r is supplied at the input D of the cell r ', the output Q of the cell r' is the output of the recording block 29. The storage by the cells r and r 'of the signal supplied to them on their input D takes place only when the signal save command provided on their input £ is set to 1.

A muxB multiplexer receives at its input 1 the mu output of the multiplexer muxA and receives on its input 0 the output of the cell. The muxB multiplexer is controlled by the rollBack control signal. When rollBack = 0 (similar to the case modeS = 1 in the double dynamic redundancy), the so output of the muxB multiplexer is equal to its input 0 and when rollBack = 1, the so output of the muxB multiplexer is equal to its input 1.

 When the control signal rollback = 0 (similar to the case modeS = 1 in the dual dynamic redundancy), the operating mode is a time redundancy of order 2 and the output of the memory block so is equal to the contents of the cell of .

 When the control signal rollback = 1 (which is equivalent to the signal modeS = 0), the operating mode is without time redundancy (i.e., of order 1). The output of the memory block so is equal to the content of the cell d when save is equal to 0 and the output of the memory block so is equal to the output of the recording block, ie, in the embodiment considered to the content of the cell r 'when save is equal to 1.

The recording block 29 makes it possible to memorize the value of if during 4 clock cycles and to allow the circuit to reposition itself on this memorized value in the event of error detection. As indicated above, an input buffer 50 is further inserted after each primary input P1 of the original circuit for storing the last two bits of the input stream (each input corresponds to a component of the vector pi). This input buffer 50, shown in FIG. 11 in one embodiment, is implemented by a pipeline of two memory cells b and b ', pi denotes the primary input of the original circuit. The control signal rB is set to 1 by the control block during the recovery phase, after an error detection performed by the comparator EQ during an odd cycle. The contents of cells b and b 'are used only during the recovery phase to re-run the last two cycles. These bits are supplied to the combinatorial part 11 of the circuit in place of the bits of the input stream. The cells b and b 'are also used to store the inputs that are provided during these two cycles. During the recovery phase, the vector ci thus comprises the vector p / ^' which comes from the input buffers and the vector so from the repositioned memory blocks. If the error is detected at the cycle / ^' , then the backspace is performed at cycle i + 1 and the vector ρ / ^' ,. _ ₁ ® n, -i is supplied to the combinatorial portion, exactly the input vector already provided two cycles previously.

From pi _2j _ = pi _2i = PI, it follows that b and b 'represent two oversampled bits identical (respectively distinct) to each odd cycle (respectively even): i> ₂ / -i = b' _2i _ ^ . Since a fault is detected in the odd cycle, the recovery phase that starts a cycle later, will then read two entries different (ie, not the same oversampled input) in b and b ', which is relevant with the mode without redundancy, ie, accelerated, implemented during the recovery phase. The behavior of the input buffers is shown in Tables 7 and 2.

The recovery phase (mode without temporal redundancy) disturbs the flow of the vectors co of the circuit relative to the normal operating mode (mode of redundancy of order 2). To mask this effect at the primary outputs, an output buffer is inserted before each primary output po (each output po corresponds to a component of the vector po). Such an output buffer 60 is shown in one embodiment in FIG. 72. The signal co comes from the combinatorial part 77. The buffer memory 60 is adapted to be tolerant to a SET occurring in the buffer memory 60 or its outputs. . For this purpose, the primary outputs are tripled: poA, poB and poC are the primary outputs of the transformed circuit corresponding to the primary output po of the initial circuit.

 Output buffers ensure that at least two of the tripled outputs are correct on every even cycle. The surrounding circuit can read these outputs in the even cycle and vote on these outputs read to hide any SET. In different embodiments, other output blocks (eg, ignoring faults in the outputs) or other interface specifications could be used.

 The behavior of the output buffers during the recovery phase is also shown in Table 2.

Tables 7 and 2 below illustrate a case fault detection cycle ^/. In Tables 7 and 2, a vector v corrupted by any number of corrupted bits is noted † v.

In the shaded tables 7a and 2b are indicated the values of the signals that would have been obtained in the absence of fault detection. clk pb b V d 7 'rr' fail save rollBack

1-3, 3-4, or _5, 7, 7, 7 or 7; 1 0

1-2 β-1-β-2-dihydro-4-dihydro-4-dihydro-diol

1-1- (1H) -3- I pI; PII PII-1 PI-2 _B t SII-2 FSII FSII-l-2-l FSII SII-3 1 0 0 i + i + 1 PI PII; 1 - 3, 3, 5, 7, 7 1 1 i + 2 + 2 Pii Pii Pii PIT + 1 + i _® SII-1 Sii Sii-2 tsii FSII-2-l? 0 1 i + 3 + 3 Pii Pii Pii + 1 + 2 + 3 IIP e ^~ SII + l + i sii sii sii-2-FSII 2-l? 1 0 i + 4 + 4 pii pii pii + 3 + 2 + 4e ^~ pii IIC IIC + 3 + 3 + i IIC IIC-2 FSII-l? 0 1 i + 5 + 5 pii pii pii + 4 + 3 + 5e ^~ Pii Sii + 3 Sij + 4 + 3 IIC IIC FSII-i-l? I + e + i + i + i + i + i + i + 4 i + i + i + i + i + i -7 ^~ Is + 5 Is + 6 Sli + 5 Is + 5 Is-2? 1 + 8 + 8 + 1 + 1 + 1 + 1 + 1 + 1 + 1 + 5 +

Table 1

Table 1 a

The acronyms † and correspond to two exclusive cases of faults (which can not happen at the same time).

 i ignore 0 0 0 0 0

Table 2

Table 2b

The acronyms † and correspond to two cases of faults (which can not happen at the same time). (<-) indicates a data substitution performed by the muxAs, muxBs, muxCs, muxDs multiplexers of an output buffer 60.

The control signals save, rollBack, rB and subst are generated by the control block 15 to implement the functionality of the transformed circuit during the normal operating mode and the recovery phase. The input of the control block 15 is the fault detection signal fail (disjoint fail signals come from the different memory blocks 14 and the output buffer memories 60) Fig. 13 shows the finite state machine (FSM) of the control block 15 in one embodiment of the invention. The notation ab indicates here that the change of state is realized if the condition is a = b is true, for example if a signal fail is detected equal to

0 in the case fail 1 0. The sign = indicates the action of assigning a value to a signal, for example if a signal fail is detected equal to 1, we assign the value 1 to the signals rB, save, rollBack and subst during the next cycle. In this figure, all the control signals transmitted by the control block 15 and not mentioned during a change of state are set to 0. The states norm1 and norm2 correspond to the normal operating mode, which gives rise to the setting at 1 alternating of the signal save. When a fault is detected (reception of a signal fail equal to 1), the FSM enters the recovery phase for 4 cycles corresponding to the successive states "error", "recovl", "recov2", "recov3".

 The control block 15 itself is not protected against the SETs by time redundancy. In one embodiment, it is protected by TMR. The values taken by the control signals in the different states are shown in Tables 1 and 2.

Normal operating mode

 As long as no fault is detected in the odd cycles, the operating mode of the circuit is the normal operating mode (2nd order redundancy mode).

 During this mode, the value of the rollBack control signal is always set to 0 by the control block 15.

The save signal is set to 1 at every even cycle: save _2j ^ = 0 and save _2j = 1.

Since save is the signal (enable signal) for triggering storage of the cells r and r ', a delay of four cycles is set between if and r in the normal operating mode.

 The internal behavior of each memory block 40 in normal operating mode is then described by the following equations (7):

roll = 0

save _2i _ _l = 0, save _2j = 1.

As seen above, the comparison of d and d is relevant only in odd cycles, the cells d and d then having, failing fault, redundant data. The transformed circuit satisfies the same equations (1) as the original circuit:

coi = (p (cii) c = pi _i Θ self coi = po _i Θ su (8)

Equations (7) and (8) and equality pi _2i = pi _2i = P1 derive two properties of the normal operating mode.

Property 1: first of all, the output bit stream co of the combinatorial part 11 after the transformation of the circuit is a double oversampling of the bit stream CO of the original circuit. Formally: Neck neck = i = COi for all / ^'natural number.

In addition, for each odd cycle, the outputs of cells d and d are equal: du-ι for all / ^'natural number.

 The error detection corresponds to a determination of a violation of this property 2 by the comparator EQ.

If, during an odd cycle, the contents of the cells d and differ, an error is thus detected and the signal fail is set to 1 (fail _2j -i = 1). The circuit must then backtrack to the correct state stored in r 'and recalculate the previous step. The backtracking is performed by propagating the contents of the cell r 'to so.

It follows from equations (17) that r'u-i = , which means that at the time of fault detection (and at the following clock cycle), the contents of the recovery memory cell / - 'are equal to the value of the input signal 3 cycles before. Recovery phase

 When a fault is detected, the circuit backtracks during the cycle following the fault detection, then performs three consecutive cycles during which the second order time redundancy in the memory blocks is replaced by a mode without time redundancy and by application by the control block 15 of the sequence of the save, rollBack, subst and rB control signals shown in FIG. 13 between the "error" state until it returns to the "norm2" state.

Table 1 contains the values of the bit vectors in the transformed circuit cycle by cycle when a fault is detected at the cycle / ^' . The behavior of the circuit in normal mode (ie, in the absence of fault) is indicated in Table 1a.

In normal mode, the vector ci at the cycle / ^' is such that cU = pi ₍ ® soi = pi _i ® sii-2) The principle of backtracking is that the memory blocks 40 re-inject the last state saved in the cells r '(vector si) while the input buffers reinject the corresponding primary inputs (vector pi) stored therein.

At the cycle (i + 1) following the error detection of the cycle / ^' , the recovery phase begins and the correct state stored in the cell r' is propagated through the signal so. As a result, se ₊ ι = = sii-3 instead of SA expected in the normal operating mode. Therefore, the second component of c // + i is sus. The primary input vector is also replaced by the vector stored in the input buffer: thus at the cycle i + 1, p / ^' , ₊₁ is replaced by pi _l It is recalled that, during the recovery phase, the circuit operates with the flow of the original circuit, which is twice as fast as in the normal mode. In particular, during the cycles i + 2, i + 3 and i + 4, the contents of the memory cell d are propagated directly through the outputs so of each memory block 40, by short-circuiting the memory cells of. This is implemented by setting the rollBack control signal to 1, keeping the save signal at 0 which controls the muxA and muxB multiplexers appropriately. This is of no consequence since the SET fault pattern (1, K) ensures that no additional fault occurs during K cycles after a SET.

At cycle i + 2, the second component of c + 2 is SUA (s -2, which is identical to sii-i, has been skipped). Similarly, the primary input vector is replaced by p / _{i + 1} since, in the input buffers, b'i + 2 = pi, and p / _{i + 1} = p / ^' ,. It follows that C // + 1 = pi ® if i-3 and ci i + 2 = pi, ₊₁ ® if, -1.

All corrupted signals disappeared from the circuit within 6 cycles after error detection. The complete circuit returns to a correct state after at most 8 cycles after detection. In other embodiments of a circuit transformed by combining dual dynamic redundancy and backtracking aspects are combined, a single cell r 'is used in place of the cells r and r'. The save command signal is set to 1 every two cycles. Error detection and retrieval functionality remain with reduced fault tolerance. A SET on the wire if, for example caused by a SET in the combinatorial logic, can in this case simultaneously corrupt r 'and d if save = 1. The error is detected in the next cycle and the recovery takes place using the corrupted information of the cell r '. The cell r actually plays an isolation role which prevents a re-write of the recovery bit until this information has been verified by the comparator EQ.

 In embodiments, the architectures of the output buffers are simplified, the main function being maintained: implement a delay on the signal co in normal operating mode with a mechanism for propagating co to po during the recovery phase.

 A circuit converted according to this embodiment of the invention realizes the propagation of the signal through the combinational part of the circuit twice before the comparison, with a backtracking and replaying when an error is detected. According to a SET fault model (1, K), no error occurring in the cycles after the last fault occurrence, the level 2 redundancy mechanism is then removed and the circuit is accelerated twice. It returns to its correct state (Le., The state of the circuit if no error had occurred) after 8 cycles after detection or 10 cycles after the occurrence of the SET.

 A circuit converted according to this embodiment can also operate in accelerated mode (n = 7) when the fault tolerance is not necessary.

 FIG. 14 represents steps of a method of automated manufacturing of a fault tolerant electronic circuit by time redundancy, which is implemented in one embodiment of the invention.

 These steps, for example implemented by an automated synthesis tool of electronic circuits, are:

 step 80 of receiving an original circuit design at the logic level;

 step 90 of choosing the required transformation and the type of dynamic redundancy (redundancy level, modes of operation and fault tolerance properties);

 step 700 of transforming the memory blocks of the original circuit into memory blocks for implementing the dynamic redundancy chosen, comprising:

 i / step 101: generation of the memory block;

 ii / step 102: replacing each memory cell of the original circuit by the memory block generated in the circuit design;

 Ni / step 103: generation of the control block (and for the double dynamic redundancy with backtracking, input and output buffers);

iv / step 104: insertion of the control block (and in the case of double dynamic redundancy with backtracking, input buffers and output) in the design of the circuit and interconnections between the control block and the transformed memory blocks of the circuit (and in the case of the double reverse dynamic redundancy with the input and output buffers).

 FIG. 15 describes different stages of the design flow of integrated circuits corresponding to different levels of abstraction in one embodiment of the invention:

 step 201: synthesis at the system level, based on circuit specifications, including allocation or distribution between software and hardware, one of whose results is a high-level and behavioral description of the circuit;

 step 202: synthesis of the high-level circuit on the basis of this description (transformation, planning, selection of modules), one of whose results is an architectural description, at the level of "Transfer of registers" or RTL: this modeling amounts to describing the implementation in the form of sequential elements (registers, flip-flops) and logical combinations between the different inputs / outputs of the sequential elements and the primary inputs / outputs of the circuit:

 step 203: logical synthesis of the circuit as a function of this description RTL, which transforms the description RTL of the circuit into a description at the logic level, in terms of logical gates (netlist gate): this step 203 comprising the following successive substeps:

 functions from RTL to Boolean;

 optimizations independent of the technology;

 transformation 100 of the circuit for dynamic redundancy according to the invention;

 technology mapping ("mapping technology");

 technology-dependent optimizations;

step 204: physical mask synthesis of the circuit based on the logical description. For VLSI circuits, this synthesis includes the description of the circuit at the level of the transistors (placement, routing, clock distribution) and delivers a description of the circuit at the level of the mask. For FPGA circuits, this synthesis includes translation, topography (placement, routing) and delivers a programming file. Transform 100 brings the fault tolerance properties to the circuit. In the embodiment described, it is implemented after the independent optimizations of the technology (the properties will thus be preserved by the subsequent steps) and before the separation of the flow in VLSI technology or FPGA technology, which makes it possible to apply it. jointly with both technologies.

Claims

1 .- Automated manufacturing method of an electronic circuit adapted to detect or mask faults by time redundancy,

said method comprising a computer-implemented step, according to which to implement a memory cell function of the electronic circuit, is inserted in the electronic circuit a memory block (14) comprising a delay chain (76) having N memory cells in series, N≥2, and a selection block (18) which, in an operating mode corresponding to a time redundancy of order n1, n1 e [1, N], compares the current contents of n1 of said N memory cells storing n1 redundant input data successively supplied to the memory block, and

 if n1> 2, selects as output data from the memory cell function, the majority content of the n1 memory cells and optionally additionally delivers a fault signal if the contents of two memory cells differ;

 - If n1 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and further delivers a fault signal if the contents of the two memory cells differ;

 - If n1 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined;

said method being characterized by inserting further a control block of the circuit adapted to transmit control signals of the memory blocks, and in that the inserted memory block is adapted to, as a function of a control signal of switching received from the control block, switching between said operating mode corresponding to a time redundancy of order n1 and another operating mode corresponding to a time redundancy of order n2 e [1, N], n2 ≠ n1, in which the selection block compares the current contents of n2 determined cells, among said N memory cells, storing n2 redundant input data successively supplied to the memory block, and:

 if n2> 2, selects as output data of the memory cell function, the majority content of said n2 memory cells;

 if n2 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and delivers a fault signal if the contents of the two memory cells differ;

if n2 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined.

2. - A method of automated manufacture of a circuit according to claim 1, wherein the inserted memory block further comprises, when N> 2, an additional delay block

 Λ / - 1

 (17) disposed at the output of the delay chain and comprising at least E [] memory cells,

in operation mode corresponding to a time redundancy of order n, n> 2, every n cycles, the selection block selects as output data from the memory cell function, the majority content of the n memory cells of the memory channel. delay, and each ^me next cycle of said n cycles, 1≤i <n, selects as output data of the memory cell function, the majority content of a set of last cells of the delay chain and block the cells additional delay, said cells of the set storing redundant input data having been successively supplied to the memory block.

3. - A method of automated manufacture of a circuit according to claim 1 or 2, wherein N = 3, n1 = 1, n1 = 2, or n1 = 3 and n2, n2 ≠ n1, takes a value equal to 1, 2 or 3 depending on the tilt command.

4. - A method of automated manufacture of an electronic circuit according to claim 1 or 2, wherein N = 2, n1 = 1 or 2 and n2 = 1 or 2, n2 ≠ n1.

5. - A method of automated manufacture of an electronic circuit according to claim 4, wherein the operating mode switchover control according to a time redundancy of order 2 to the operating mode according to a time redundancy of order 1, and reciprocally, is triggered following the reception by the control block of a fault signal issued by one of the memory blocks (40).

6. A method of automated manufacturing of an electronic circuit according to claim 4 or 5,

wherein the second cell (32) of the delay chain (29) stores, at each clock cycle of the circuit, the content stored in the previous clock cycle, in the first cell (31) of the delay chain,

according to which the inserted memory block (40) further comprises a recording string (30) adapted for receiving a control signal of the control block, storing the input signal value of the memory block also provided in parallel to the first cell of the delay chain, wherein in the operation mode according to a redundancy of order 2, the recording control signal is output every two cycles so that when redundant data stored in the two memory cells of the delay chain are compared by the selection block, the last cell of the recording chain contains in memory the data which were stored two cycles previously in each of the two memory cells of the delay chain.

7. - A method of automated manufacture of an electronic circuit according to claim 6, wherein following receipt by the control unit of a fault signal issued by a memory block (40) indicating that redundant data stored in the two memory cells of the delay chain differ, the control block supplies the memory block with a backspace command following which the memory block delivers as output data of the memory cell function, the current contents of the last cell of the memory cell. the recording chain, said method thus making it possible to mask an error with only a double redundancy instead of a triple redundancy.

8. - A method for automated manufacture of an electronic circuit according to one of claims 4 to 7, wherein is further inserted at the input of the electronic circuit an input block (50) of the circuit receiving the current external data. to process oversampled twice,

the input block, in the mode of operation according to a second order temporal redundancy, storing the current external data item received and also supplying the circuit with said current external data received and, the input block, with the mode of reception. operation according to a first order time redundancy, providing the circuit with successive non-redundant external data previously stored by the input block to allow a third execution of these data by the circuit; and

according to which an output block (60) of the circuit receiving the data delivered by the circuit, said output block, is also inserted at the output of the electronic circuit in the mode of operation according to a time redundancy of order 2, storing the data delivered by the circuit and applying a given delay before delivering them, and the output block, in the mode of operation according to a first order time redundancy, delivering without delay the data delivered by the circuit, duplicating data delivered by the circuit and delivering duplicate data,

the fault recovery by the circuit is thus masked vis-à-vis the upstream circuit and downstream of the circuit by said input and output blocks.

9. - Computer program to be installed in an automated manufacturing tool of an electronic circuit adapted to detect or hide faults by time redundancy, said program comprising instructions for implementing the steps of a method according to one of claims 1 to 8 during execution of the program by processing means of the automated electronic circuit manufacturing tool.

An electronic circuit adapted to detect or mask faults by time redundancy, comprising a set of memory block (s), each memory block (14) of said set comprising a delay chain (76) having N memory cells in memory. series, N≥2, and a selection block (78) which, in an operating mode corresponding to a time redundancy of order n1, n1 e [1, N], compares the current contents of n1 of said N memory cells storing n1 redundant input data successively supplied to the memory block, and

 if n1> 2, selects as output data from the memory cell function, the majority content of the n1 memory cells and optionally additionally delivers a fault signal if the contents of two memory cells differ;

 - If n1 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and further delivers a fault signal if the contents of the two memory cells differ;

 - If n1 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined; said electronic circuit being characterized in that it comprises a control block of the circuit adapted to transmit control signals of said memory blocks, and in that each of said memory blocks is adapted to, according to a failover control signal received from the control block, switch between said operating mode corresponding to a time redundancy of order n1 and another operating mode corresponding to a time redundancy of order n2 e [1, N], n2 ≠ n1, in which the selection block compares the current contents of n2 determined cells, among said N memory cells, storing n2 redundant input data successively supplied to the memory block, and:

if n2> 2, selects as output data of the memory cell function, the majority content of said n2 memory cells; if n2 = 2, delivers as output data of the memory cell function, the contents of one of the two memory cells and delivers a fault signal if the contents of the two memory cells differ;

 if n2 = 1, delivers as output data of the memory cell function, the contents of the memory cell determined.

An electronic circuit according to claim 10, wherein the memory block further comprises, when N> 2, an additional delay block {17) disposed at the output of the

 Λ / - 1

delay chain and having at least E [] memory cells,

 2

in operation mode corresponding to a time redundancy of order n, n> 2, every n cycles, the selection block selects as output data from the memory cell function, the majority content of the n memory cells of the memory channel. delay, and each ^me next cycle of said n cycles, 1≤i <n, selects as output data of the memory cell function, the majority content of a set of last cells of the delay chain and block the cells additional delay, said cells of the set storing redundant input data having been successively supplied to the memory block. 12. An electronic circuit according to claim 10 or 11, wherein N = 3, n1 = 1, 2, or 3 and n2, n2 ≠ n1, takes a value equal to 1, 2 or 3 according to the control of failover.

13. - Electronic circuit according to claim 10 or 1 1, wherein N = 2, n1 = 1 or 2 and n2 = 1 or 2, n2 ≠ n1.

14. - Electronic circuit according to claim 13, adapted to trigger, following the reception by the control unit of a fault signal issued by one of the memory blocks (40), the operating mode switching control according to a redundancy. second-order time to the mode of operation according to a time redundancy of order 1, and vice versa.

15. Electronic circuit according to claim 13 or 14, wherein the second cell (32) of the delay chain (29) stores, at each clock cycle of the circuit, the content stored in the previous clock cycle, in the first cell (31) of the delay chain,

each of said memory blocks (40) further comprises a recording string (30) adapted for receiving a control signal of the control block, storing the input signal value of the memory block also provided in parallel with the first cell of the delay chain,

in operation mode with redundancy of order 2, the recording control signal is output every two cycles so that when redundant data stored in the two memory cells of the delay chain are compared by the block of selection, the last cell of the recording chain contains in memory the data which were stored two cycles previously in each of the two memory cells of the delay chain. 16. An electronic circuit according to claim 15, wherein following reception by a control block of a fault signal delivered by a memory block (40) indicating that redundant data stored in the two memory cells of the memory channel. delay delay, the control block supplies the memory block with a backward command following which the memory block delivers as output data of the memory cell function, the current contents of the last cell of the recording string, said electronic circuit thus making it possible to mask an error with only a double redundancy instead of a triple redundancy.

17. An electronic circuit according to one of claims 13 to 16, comprising an input block of the circuit receiving the current external data to be oversampled twice,

the input block (50), in the mode of operation according to a second-order temporal redundancy, storing the current external data item received and also simultaneously supplying the circuit with said current external data item received and, the input block, with the mode of operation according to a first order temporal redundancy, supplying the circuit with successive non-redundant external data previously stored by the input block to allow a third execution of these data by the circuit; and

said electronic circuit comprising at the output of the electronic circuit an output block (60) of the circuit receiving the data delivered by the circuit, said output block, in the operating mode according to a second order temporal redundancy, storing the data delivered by the circuit and applying a given delay before delivering them, and the output block, in the mode of operation according to a time redundancy of order 1, delivering without delay the data delivered by the circuit, duplicating data delivered by the circuit and delivering duplicate data,

the fault recovery by the circuit is thus masked vis-à-vis the upstream circuit and downstream of the circuit by said input and output blocks.