JP2015201814A - Field programmable gate array and electronic apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To quickly restore a system constituted by a logic circuit of an FPGA.SOLUTION: A field programmable gate array including a programmable logic circuit comprises: a configuration memory to which the logic circuit is set; and a countermeasure circuit for normalizing the configuration memory when the configuration memory includes a software error. A redundant configuration is assembled by an active system circuit and standby system circuit constituted by the field programmable gate array. The countermeasure circuit, at the time of detecting a software error generated in the configuration memory constituting the active system circuit, switches the active system circuit and standby system circuit; executes error correction for recovering from a secondary failure caused by the detected software error; and restores a value held in the logic circuit after the error correction.

Description

  The present invention relates to a technique for recovering a soft error that occurs in a programmable gate array (FPGA).

  It is known that soft errors due to neutrons, α rays, etc. occur in semiconductor devices. In recent years, with the miniaturization of semiconductor device processes, the effects of soft errors have become apparent. When applying such a component that may cause a soft error to the system, it may be within a range that allows a temporary stop or restart of the system due to the soft error. However, in a system that supports social infrastructure, even if a failure occurs for a short time, it may have a serious effect, so more strict measures are required.

  For example, in the case of a memory cell such as SRAM or DRAM, the failure of a semiconductor device due to a soft error is caused by injecting a neutron into a node that holds data in the memory cell and injecting charges, so that the stored data is inverted. Thereafter, this is caused by continuing to hold the inverted data.

  The most common method as a soft error countermeasure technique for a memory device is a method of storing an error correction code (ECC) together with data in the memory and correcting the error using the ECC when reading the data.

  In many FPGAs, an internal configuration memory is configured by SRAM memory cells, and a soft error failure similar to that of a memory device occurs. In order to correct an error in the configuration memory, an FPGA having an error correction function based on ECC has been proposed.

  There are two parts where a soft error occurs in the FPGA.

  One is an SRAM memory cell memory array, and the other is information on LUT (Look Up Table) that forms a logic circuit, IC (Interconnect) that is a programmable wiring, etc. Is a configuration memory in which is stored. In addition to the above-described circuits, functional elements such as flip-flops, IO buffers, clock buffers, and the like are mounted in the FPGA. However, since these are generally not configured with SRAM memory cells, the above-described LUTs, ICs, etc. Compared to soft errors, it has higher tolerance.

  For countermeasures against soft errors in the built-in memory portion of the FPGA, error detection and error correction using ECC similar to the above-described general memory device is used.

  Further, there is Patent Document 1 (Japanese Patent Application Laid-Open No. 2012-27927) as a prior art regarding countermeasures against soft errors in the configuration memory unit. Patent Document 1 discloses an error detection system in which an error detection circuit is provided on a programmable logic resource, programmable logic resource configuration data is loaded into a cyclic redundancy check (CRC) module, and a checksum is calculated there. It is disclosed.

  The FPGA is preloaded with many basic logic modules and wirings so that the designer can freely configure various logic circuits. Therefore, not all resources of the FPGA are used, and many resources often remain unused. Patent Document 2 (Japanese Patent Laid-Open No. 2007-293856) is a prior art of error detection of a configuration memory of a programmable device. In Patent Document 2, in response to reading configuration memory data from the configuration memory of a programmable device, determining whether an error has occurred in the configuration memory data, and determining that an error has occurred, Reading the sensitivity data corresponding to the configuration data, analyzing the sensitivity data to determine whether the error can be ignored, and if the error cannot be ignored, A method is disclosed that includes initiating a repair activity and, if the error can be ignored, ignoring the error by not initiating the repair activity.

JP 2012-27927 A JP 2007-293856 A

  As described above, a correction method using ECC has been used in the same way as a memory device as a countermeasure against a soft error in a conventional FPGA. However, the configuration memory built in the FPGA may not be able to normalize the function simply by correcting the soft error.

  That is, in the memory device, an error is detected and corrected when the connected memory control circuit reads the data, and the data is output to the logic circuit in the subsequent stage. The ECC correction function can correct an error of up to 1 bit in the range of data to be corrected, and the error of up to 1 bit is not propagated to the subsequent logic circuit.

  On the other hand, the information stored in the configuration memory includes information for forming a logic circuit in the FPGA. For example, the combinational logic unit realizes a truth value based on a combination of logic elements by using an LUT instead of logic elements such as AND and OR, and wiring and branch points for connecting between the LUT and the flip-flop (FF) IC has determined. Therefore, the logic circuit configured in the FPGA is formed with reference to a vast amount of configuration memory data, and even if the LUT configuration data and IC setting data are lost even temporarily, the logic circuit configuration There is a possibility of destroying itself.

  In addition, it is not realistic from the viewpoint of circuit scale and memory scale to add a correction circuit similar to the memory device to the configuration memory and add correction code bits to all data set in the configuration memory. Therefore, the correction function of the configuration memory generally corrects each small area by dividing the memory into areas of a predetermined size and providing error correction bits in each area.

  From the above, even when ECC correction is applied to the configuration memory, it is difficult to correct all read data in real time as in a memory device. Generally, from the occurrence of an error to detection and correction. During this time, a temporary error occurs in the subsequent logic circuit.

  When the logic circuit configured in the FPGA is a clock synchronous circuit, even if a soft error occurs within the period in which the error has occurred, if the correction of the soft error is completed within the clock period, the generated error is Does not propagate to subsequent logic circuit. However, if the period from the occurrence of the soft error to the correction exceeds the clock cycle, there is a possibility that erroneous data will be taken in and retained by the subsequent logic circuit due to the soft error. In this case, even if the location where the soft error has occurred is recovered by correction, the value captured by the subsequent logic circuit remains in error. For this reason, even if the correction of the soft error is completed, the soft error may not be recovered normally. As described above, in this specification, a phenomenon in which an error is propagated to a subsequent logic circuit between the occurrence of an error and the correction, even if the error is corrected at the location where the soft error occurs. This is called failure.

  As described above, as a countermeasure against the soft error in the configuration memory, correction using ECC alone is not sufficient, and secondary failure due to soft error is inevitable.

  Even if such a countermeasure against a secondary failure is taken, it takes time to recover the system, and it is difficult to recover the system in a short time. It may take several seconds to recover from the secondary failure. In a system in which the allowable stop time is set, a system failure of several seconds may not be allowed. For this reason, it is required to quickly recover the system from a failure caused by a soft error.

  Furthermore, when detecting and correcting soft errors with external memory and logic circuits, if these functionalities that detect and correct fail or a soft error occurs, the error is erroneously detected and the error is corrected erroneously. There is. When an error is corrected in error, the logic circuit determines that the error has been corrected correctly, but in reality, the error cannot be corrected, and error detection / correction is repeated. Similarly, when the configuration memory fails, error detection / correction is repeated. For this reason, when a functional unit that detects and corrects a soft error fails, it is required to determine the failure location.

  A typical example of the invention disclosed in the present application is as follows. Namely, a programmable gate array having a programmable logic circuit, comprising: a configuration memory in which the logic circuit is set; and a countermeasure circuit for normalizing a soft error in the configuration memory, the programmable gate array A redundant configuration is formed by a working system circuit and a standby system circuit, and the countermeasure circuit is triggered by detection of a soft error occurring in the configuration memory that constitutes the working system circuit. A value held in the logic circuit after correction of the error is performed by switching between the circuit of the standby circuit and the circuit of the standby system, executing an error correction for recovering from a secondary failure caused by the detected soft error To recover.

  According to a typical embodiment of the present invention, a system composed of FPGA logic circuits can be quickly restored. Problems, configurations, and effects other than those described above will become apparent from the description of the following embodiments.

It is a block diagram which shows the soft error countermeasure circuit of 1st Example. It is a block diagram which shows the connection of the reset control part and logic circuit part of 1st Example. It is a block diagram which shows the soft error countermeasure circuit of 2nd Example. It is a figure which shows the structure of the Paston transistor in the wiring connection intersection of 2nd Example. It is a timing chart which shows operation | movement of 2nd Example. It is a block diagram which shows the soft error countermeasure circuit of 3rd Example. It is a block diagram which shows the soft error countermeasure circuit of 4th Example. It is a block diagram of the system which switches an active system to a non-operation system by generation | occurrence | production of the soft error of 6th Example. It is a block diagram which shows the soft error countermeasure circuit of 7th Example. It is a sequence diagram which determines the soft error of a configuration memory in 7th Example. It is a sequence diagram which determines the failure of a structure data memory in 7th Example. It is a sequence diagram which determines the failure of a configuration memory in 7th Example. It is a sequence diagram which determines the soft error of the soft error countermeasure circuit in 7th Example. It is a sequence diagram which determines the failure of a configuration memory in 7th Example. It is a flowchart explaining the process of the soft error countermeasure circuit in 8th Example. It is a flowchart explaining the process of the soft error countermeasure circuit in 8th Example.

  An embodiment of a soft error countermeasure circuit according to the present invention will be described with reference to a configuration diagram and a flowchart.

<Example 1>
FIG. 1 is a block diagram showing a soft error countermeasure circuit 6 of the first embodiment.

  In general, an FPGA 1 employing an SRAM memory cell configuration includes a configuration memory 2 and a configuration memory control unit 3 that controls the configuration memory 2 and is connected to an external configuration data memory 4. The configuration data memory 4 stores circuit information for programming the configuration memory 2 to form various logic circuits, and is composed of a nonvolatile memory such as a flash memory.

  The circuit information stored in the configuration data memory 4 constitutes a logic circuit unit 5 in the configuration memory 2. The logic circuit unit includes all functions controlled by programming of the configuration memory 2, such as wiring, clock lines, and embedded hardware macros related to the logic circuit.

  The soft error countermeasure circuit 6 of the first embodiment is configured in the FPGA 1 and includes a configuration memory control unit 3 and a reset control unit 7 configured in the configuration memory 2, and includes external reset data. Connected to the memory 8. The reset data memory 8 stores an address for specifying the flip-flop 12 of the logic circuit unit 5 and reset data 16 for resetting the flip-flop 12. The reset control unit 7 outputs a read address and a control signal 15 to the reset data memory 8 and reads an address and reset data 16 for specifying the flip-flop 12 of the logic circuit unit 5.

  The configuration memory control unit 3 reads data from the configuration data memory 4, and writes the read data through the control lines (address line 9A, data line 9B) of the configuration memory 2. Further, the configuration memory control unit 3 outputs a flag 14 when a bit error occurring in the configuration memory 2 is detected, and each flag 14 when the bit error is correctable or impossible. And a correction function for outputting. The bit error in the configuration memory 2 is automatically corrected by the ECC function of the configuration memory 2. Further, the configuration memory control unit 3 determines whether the bit error occurrence location corresponds to an area used as the logic circuit unit 5 in the configuration memory 2 based on the data stored in the configuration data memory 4. Alternatively, it has a corresponding determination function for determining whether it is not applicable and outputting a flag 14 when it is applicable.

  In the first embodiment, the reset control unit 7 resets the logic circuit unit 5 using the correction flag output from the configuration memory control unit 3 as a trigger.

  The basic operation of the reset control unit 7 will be described below.

  FIG. 2 is a configuration diagram showing the connection between the reset control unit 7 and the logic circuit unit 5.

  The logic circuit unit 5 shown in FIG. 2 includes a plurality of basic circuit modules 10. Each basic circuit module 10 includes a combinational logic unit 11 that does not have a data holding function, a flip-flop 12 that is a data holding function, and a setting unit 13 that sets data in the flip-flop 12. The basic circuit module 10 and the wiring connections around it are programmed based on the information stored in the configuration data memory 4 to form various logic circuits.

  Upon receiving the error correction flag 14, the reset control unit 7 extracts the address of the portion where the bit error can be corrected or impossible from the received error correction flag 14, and re-set from the extracted address of the configuration memory 2. The address of the setting data memory 8 is specified. Then, the reset control unit 7 outputs a read address and a control signal 15 to the reset data memory 8 and reads an address and reset data 16 for specifying the flip-flop 12 of the logic circuit unit 5. Further, the reset control unit 7 outputs an address for specifying the flip-flop 12 and the control signal 17 to the setting unit 13, and writes the reset data 18 in the flip-flop 12.

  As shown in FIGS. 1 and 2, the first embodiment is the most basic soft error countermeasure circuit 6 according to the present invention, which is designated by an address and a control signal 17 in order to prevent a secondary failure caused by a soft error. The data is reset in the specified flip-flop 12. Generally, a logic circuit used in a communication apparatus includes a data path logic unit that handles main signal data, a control unit that controls the data path logic unit, and a setting register unit that holds setting information from a CPU or the like. And can be broadly divided. The soft error countermeasure circuit 6 of the first embodiment is particularly effective for the control unit and the setting system register unit. The reason is as follows. The data path logic unit is normalized as time passes because data flows even if an error occurs in part of the data, and bit errors that occur in a short time on the time axis If so, the system may be acceptable. However, if an error occurs in the control unit and the setting system register unit, there is a possibility that a malfunction may be expanded in the entire system due to a secondary failure, and active correction is necessary.

  In the first embodiment, the circuit for controlling the resetting of the flip-flop 12 in the logic circuit section 5 has been described. However, by using the soft error countermeasure circuit 6 according to this embodiment, the built-in memory mounted in the FPGA 1 In addition, the same reconfiguration can be performed for hardware macros that are configured in an embedded manner.

  In the first embodiment, the reset control unit 7 is configured in the configuration memory 2 as shown in FIG. By configuring the reset control unit 7 with the configuration memory 2, a circuit can be flexibly configured according to the reset method required by the system.

  The configuration memory control unit 3 can also detect a soft error for the reset control unit 7. When an error in the reset control unit 7 is detected, the control function itself cannot be guaranteed. Therefore, the FPGA 1 itself may be reconfigured when an error in the reset control unit 7 is detected. In order to reduce the soft error occurrence rate of the reset control unit 7, there are configurations such as minimizing the circuit scale as much as possible, and a configuration in which the reset control unit 7 is tripled and the control method is determined by majority. The reset control unit 7 may be configured outside the configuration memory 2. In this case, the reset control unit 7 may be mounted on an FPGA, a processor, or the like having a soft error tolerance. The configuration may be determined in accordance with the reliability required by the system after grasping the occurrence rate of the soft error occurring in the reset control unit 7.

  As described above, in the conventional detection / correction circuit, there is a problem that erroneous data is continuously held in a part of the logic circuit configured in the FPGA 1. However, according to the first embodiment, when the above-mentioned problem is eliminated and a soft error occurs in the configuration memory 2, the reset controller 7 writes the reset data to the flip-flop 12, so that the logic circuit Function can be normalized.

<Example 2>
In the second embodiment, an example of a circuit capable of simplifying resetting of the flip-flop of the logic circuit section will be described.

  FIG. 3 is a block diagram showing the soft error countermeasure circuit 6 of the second embodiment, FIG. 4 is a diagram showing the configuration of the pass transistor at the wiring connection intersection of the second embodiment, and FIG. It is a timing chart which shows operation | movement of an Example.

  The soft error countermeasure circuit shown in FIG. 3 includes a reset control unit 7 and four logic circuit unit groups 19 to 22. In FIG. 3, as an example, a function of giving a certain condition holding signal 23 to the logic circuit unit 22 which is a main function unit is considered. The logic circuit unit groups 19 to 22 hold the value of the condition signal 24 by the logic circuit unit 19 for generating the condition signal 24, the logic circuit unit 20 for generating the timing signal 25, and the timing signal 25, and hold the condition. The logic circuit unit 21 outputs the signal 23 and the logic circuit unit 22 receives the condition holding signal 23. In order to initialize the current operation once, the reset control unit 7 generates the reset signal 29 using the error correction flag 14 as a trigger and distributes the reset signal 29 to the logic circuit unit groups 19 to 22.

  Although the condition signal is a 4-bit bus signal, since all the bits have the same configuration, only the connection of bit 0 is shown in FIG. All the circuits are clock synchronization circuits that operate with a clock 26, and the clock 26 is several MHz or more.

  Here, when a soft error occurs at the wiring connection intersection 27 in FIG. 3, the wiring connection intersection 27 is constituted by the pass transistor 28 shown in FIG. 4 and is configured based on the circuit information stored in the configuration data memory 4. The wiring path is determined by the value programmed in the memory 2. For example, the pass transistor 28 before the occurrence of the soft error is in the On state, but when a soft error occurs in the configuration memory 2 and the bit of the setting information is inverted, the pass transistor 28 changes to Off, and the path Is refused. However, the FPGA 1 is provided with a configuration memory control unit 3 as shown in FIG. 1, and the configuration memory control unit 3 detects an error in the configuration memory 2 and corrects the detected error. . For this reason, the correction is completed after a lapse of time from the occurrence of the error, and the path is restored. In general, this error detection / correction is performed by circulating in the configuration memory 2, and therefore it takes a time of several milliseconds to several tens of milliseconds to complete the correction. As shown in FIG. 3, in the logic circuit groups 19 to 22 operating with a clock of several MHz, many clocks are toggled until the error is corrected (the On state and the Off state are switched). Secondary failures may occur.

  The detailed operation will be described with reference to the timing chart of FIG.

  The condition signal 24 determines the output value at timing T0, and the timing signal 25 for capturing the value is determined at timing T3. When a soft error occurs and bit 0 of the condition signal 24 is inverted from “1” to “0” at timing T1, the error is detected at timing T2, and is corrected to timing T4 after a predetermined time has elapsed from T2. Is completed. As described above, since a considerably long time is required for the clock cycle from the occurrence of the error to the completion of the correction, the condition holding signal 23 determined by the logic circuit unit 21 should be originally taken at the timing T3. An erroneous value “1010” different from the value “1011” is held. Therefore, after that, even if the condition signal 24 does not change, the logic circuit unit 22 operates with an incorrect value until the next timing signal 25 becomes “H”. Therefore, in the reset control unit 7 shown in FIG. 3, in order to initialize the current erroneous operation once, the reset signal 29 is triggered by the error correction flag 14 to be determined as a trigger after the error correction timing T4. It is generated and distributed to the logic circuit unit groups 19-22. The logic circuit unit groups 19 to 22 are initialized by the reset signal 29, whereby the entire FPGA 1 returns to the initial state.

  In the first embodiment, data is reset for a specific flip-flop 12 in the logic circuit unit 5 by an address. However, in order to individually give instructions to the flip-flop 12, as shown in FIG. It is necessary to store the target address and reset data 16 in the reset data memory 8. In addition, the logic circuit unit 5 requires a setting unit 13 for decoding the address. It also takes time to complete the resetting.

  On the other hand, in the second embodiment, it is only necessary to return the flip-flop of the logic circuit unit 21 to the initial state, so that an auxiliary circuit of the logic circuit unit 21 is unnecessary, and the resetting can be completed in a short time. It is.

  As for the range of initialization, since the soft error may occur anywhere in the configuration memory 2 like the wiring connection intersection 27 described with reference to FIG. 3, it is difficult to specify the spillover range of the secondary fault. . For this reason, only some of the logic circuit units may be initialized or the logic circuit units of the entire FPGA may be reset according to the system specifications. For example, when a plurality of reset lines are provided and each logic circuit unit is connected to one reset line, a reset signal is transmitted only to some reset lines, and only some logic circuit units are initialized. Good.

  As described above, according to the second embodiment, address control is not required, and therefore data can be reset with a small circuit scale. Moreover, since it is sufficient to send a reset, the data can be reset by the simple plan control. In particular, when resetting the entire data, only one reset line is required, and the circuit can be simplified.

<Example 3>
In the third embodiment, in order to reduce the frequency of resetting, it is determined that the location where an error has occurred is an area used as a logic circuit section in the configuration memory 2 and error correction has been completed. Only when will the example of the circuit for resetting the value of the flip-flop (data holding function) 12 of the logic circuit unit 5 be described.

  FIG. 6 is a block diagram showing the soft error countermeasure circuit 6 of the third embodiment.

  Unlike the first embodiment (FIG. 1), the third embodiment (FIG. 6) treats the configuration memory 2 differently in the used area 30 and the unused area 31 used in the logic circuit unit group 34. To do.

  In the third embodiment, information indicating whether the area in the configuration memory 2 is used is stored in the configuration data memory 4 in, for example, a bitmap format. This bitmap may be set at the same time when circuit information is read from the configuration data memory 4 and set in the configuration memory 2. By referring to this bitmap, it is possible to identify the used area 30 used in the logic circuit and the unused area 31 not used in the logic circuit.

  The configuration memory control unit 3 refers to the bitmap stored in the configuration data memory 4 to determine whether the soft error corresponds to the use area 30. The configuration memory control unit 3 has a corresponding determination function that asserts the corresponding flag 14 only when the soft error occurrence location corresponds to the use area 30. The hit determination function is the same as that described in the first embodiment (FIG. 1). Therefore, only when the corresponding flag 14 is detected and error correction is completed, it is determined that there is a possibility that a secondary failure has occurred in the logic circuit group 34 in the FPGA 1, and the first embodiment is shown. The resetting method and the initialization method shown in the second embodiment are performed.

  In general, the FPGA 1 has resources several times to several tens of times larger than the scale of a logic circuit section to be programmed in order to increase the degree of programming freedom, and a vast configuration memory 2 area is secured. However, the ratio of the used area actually used is often smaller than the unused area. Therefore, by using the corresponding flag 14 as in the third embodiment, the reset range can be reduced and the system stop time can be shortened.

<Example 4>
In the fourth embodiment, in order to further reduce the frequency of resetting, an example of a circuit that specifies a logic circuit unit that needs to be reset and resets only the specified logic circuit unit (area) will be described.

  FIG. 7 is a block diagram showing the soft error countermeasure circuit 6 of the fourth embodiment.

  Unlike the third embodiment (FIG. 6), the fourth embodiment (FIG. 7) is divided into specific logic circuit sections 35 that need to be reset.

  The configuration memory control unit 3 according to the fourth embodiment detects an error for each area of the configuration memory 2. For this reason, the correspondence relationship between the area provided in the configuration memory 2 and the address of the configuration memory 2 is maintained. This correspondence may be set when the FPGA 1 is shipped from the factory or when it is initially set. Then, by referring to this correspondence relationship, it is possible to specify the area where the error is detected.

  In the fourth embodiment, the reset data memory 8 is divided into areas of the configuration memory 2, and for each area, an address for specifying the flip-flop 12 of the logic circuit unit 5 and the flip-flop 12. The reset data 16 for resetting is stored.

  The reset control unit 7 stores an address table 33. The address table 33 holds the correspondence between the area provided in the configuration memory 2 and the address of the configuration memory 2. By referring to the address table 33, an area corresponding to the address of the configuration memory 2 can be specified.

  In the fourth embodiment, as shown in FIG. 7, the data path logic unit is not reset by detecting a specific logic circuit unit 35 that needs to be reset, divided into areas, and the control unit and the setting register. It is possible to specify a finer resetting target, such as resetting only the part, and shorten the resetting time.

  It should be noted that the third embodiment and the fourth embodiment may be used in combination to detect a specific logic circuit unit 35 that needs to be reset only in the use region.

  Further, in the fourth embodiment, the corresponding determination of the specific logic circuit unit 35 that needs to be reset may be controlled by the reset control unit 7 regardless of the function of the configuration memory control unit 3.

  For example, the configuration memory control unit 3 outputs the corresponding flag 14 and the address 32 where the error has occurred. The reset control unit 7 refers to the address table 33 to determine a region corresponding to the error address 32 output from the configuration memory control unit 3, and sets the address / reset data 16 of the corresponding region as reset data. It is possible to read out from the memory 8 and reset only a specific logic circuit unit 35 that needs to be reset inside the FPGA 1.

  The configuration memory control unit 3 needs to store a large amount of circuit information in the configuration data memory 4 in order to determine the corresponding area for the entire configuration memory 2. However, as in the fourth embodiment, when the address of a specific logic circuit unit 35 that needs to be reset in advance is determined at the time of design, the circuit scale and required memory are registered by registering the address in the address table 33. The scale can be kept small.

  In addition, since the address that needs to be reset in advance is determined at the time of design, it is sufficient to reset the data within the predetermined address range, so the range for resetting is reduced and the system downtime is shortened. can do.

<Example 5>
In the fifth embodiment, in order to facilitate the determination of the reset target area, the area used for the logic circuit unit 5 is fixed in advance at a design stage in a predetermined mounting area in the configuration memory 2, and the fixed area is fixed. An example of a circuit that performs resetting when an error is detected and corrected in the area will be described.

  A fifth embodiment will be described with reference to FIG.

  In the third embodiment, the configuration memory control unit 3 detects a soft error with respect to the logic circuit unit group 34 freely arranged in the configuration memory, and the location where the soft error is detected is the use area 30. It is determined whether or not there is a use area 30, and the reset control unit 7 resets.

  In the fifth embodiment, for example, the use area 30 of FIG. 6 is fixed in advance to a specific physical area in the configuration memory 2 in an area for mounting the logic circuit unit 5 at the design stage. Consideration is made at the stage of mounting design of the FPGA 1 so that the logic circuit unit 5 is arranged in FIG. As a result, the monitoring of the soft error can be limited to only within the FPGA1 specific area (usage area 30). When an error is detected in the monitoring target area and the error is corrected, the value of the flip-flop 12 is detected. Can be reset.

  As described above, according to the fifth embodiment, the configuration memory control unit 3 may not be provided with a corresponding determination function for determining the use area. Even when the configuration memory control unit 3 is equipped with a corresponding determination function, it is not necessary to store information for determination in the configuration data memory 4, and the storage capacity of the external memory can be reduced. Cost and board mounting area can be reduced.

<Example 6>
In the sixth embodiment, a system that switches an active system to a non-operating system when a soft error occurs will be described.

  FIG. 8 is a block diagram of a system in which the soft error countermeasure circuit 6 of the third embodiment (FIG. 6) is mounted and the active system is switched to the non-operating system when a soft error occurs.

  In the sixth embodiment, a communication apparatus will be described as an example, but the present invention can also be applied to other systems. In addition, an example in which the communication apparatus includes the soft error countermeasure circuit 6 of the third embodiment will be described, but the soft error countermeasure circuit 6 of any of the first to fifth embodiments described above may be mounted.

  Communication is performed between the communication device A 40 and the communication device B 41 using the operation main signal 42 and the non-operation main signal 43. The communication device A40 and the communication device B41 are respectively equipped with an active device 44 and a non-active device 45. The operational system device 44 and the non-operation system device 45 are constituted by circuits in the FPGA 1 and are equipped with the soft error countermeasure circuit 6 of the third embodiment. When a soft error occurring in the configuration memory 2 is detected, error detection The signal 46 is output. The active device 44 and the non-active device 45 may be configured by a circuit in one FPGA 1 or may be configured by a circuit in a plurality of FPGAs 1.

  The selector control unit 47 monitors the error detection signal 46 output from the operation system device 44 and the non-operation system device 45, and when detecting the error detection signal 46 from the operation system device 44, the selector control signal 48 is changed to the selector 49. The selector 49 is switched from the active main signal 42 to the non-operating main signal 43.

  By switching to the non-operational main signal 43, the soft error can be corrected and the system failure can be recovered sooner than the data resetting is completed.

  The active device 44 in which the soft error has occurred switches from the active device 44 to the non-active device 45, corrects the soft error, resets the data, and continues to operate the system as a non-active device. It becomes possible.

  According to general FPGA performance, data resetting from detection and correction of a soft error requires several tens of milliseconds to several seconds, and the time required to detect a soft error is several microseconds to several milliseconds. By switching to the non-operational device 45 when a soft error is detected, the system failure time can be reduced.

  The soft error countermeasure circuit 6 notifies the alarm display / notification unit 51 of alarm / failure information 50 indicating that a soft error has been detected at the timing when the operation system device 44 is switched to the non-operation system device 45. The alarm display / notification unit 51 notifies the maintenance person of the detection of the soft error, thereby knowing that the switching from the active device 44 to the non-operating device 45 has occurred when the soft error occurs. it can. Further, as described in the eighth embodiment, error information can be included in the alarm / failure information 50 and notified to the alarm display / notification unit 51.

  The configuration of the sixth embodiment described above is applied to a system in which the allowable stop time from the occurrence of a failure to recovery is specified. In a system in which the allowable stop time is not specified, the non-operation system device 45, the selector 49, and the selector control unit 47 may not be installed.

  As described above, according to the sixth embodiment, the detection of the soft error occurring in the configuration memory 2 constituting the active circuit is triggered by the active circuit (active system device 44) and the standby system. Switch the circuit (non-operation system device 45), execute error correction to recover from the secondary failure caused by the detected soft error, and recover the value held in the logic circuit after the error correction As a result, the system can be quickly recovered in a prescribed time.

<Example 7>
In the seventh embodiment, an example will be described in which a function for identifying a functional unit in which a failure or a soft error has occurred in a functional unit that detects and corrects a soft error is added to the soft error countermeasure circuit.

  FIG. 9 is a block diagram showing the soft error countermeasure circuit 6 of the seventh embodiment.

  In the soft error countermeasure circuit 6 of the seventh embodiment, an information holding unit 65 is connected to the soft error countermeasure circuit 6 of the third embodiment. Configuration completion information 60, soft error address information 61, and uncorrectable information 63 are transmitted from the configuration memory control unit 3 to the information holding unit 65. Further, the soft error address holding information 62 and the uncorrectable holding information 64 are transmitted from the information holding unit 65 to the configuration memory control unit 3.

  Next, a method for identifying a functional unit in which a failure has occurred will be described.

  FIG. 10 is a sequence diagram for determining a soft error in the configuration memory 2 in the seventh embodiment.

  The configuration memory control unit 3 determines a soft error in the configuration memory 2 by detecting the error again at the same address while scanning the configuration memory once after correcting the error.

  The configuration memory control unit 3 notifies the information holding unit 65 of the soft error address information 61 after error detection / correction (S100) (S101).

  The information holding unit 65 holds the soft error address information 61 notified from the configuration memory control unit 3 for N milliseconds (S102), and configures the soft error address holding information 62 while holding the soft error address information 61. It repeatedly returns to the memory control unit 3 (S103). The soft error address holding information 62 may be transmitted periodically.

  The time for holding the soft error address information 61 (N milliseconds) may be set to the time for scanning the configuration memory 2 once.

  When no error is detected during the error detection monitoring period (N milliseconds), the configuration memory control unit 3 instructs the information holding unit 65 to discard the held soft error address information 61. Note that the information holding unit 65 may autonomously discard the soft error address information 61 (for example, due to a timer up of N milliseconds).

  The configuration memory control unit 3 performs error detection monitoring for N milliseconds (S104), and when no error is detected at the address that matches the soft error address holding information 62 for N milliseconds (S105), the error can be corrected normally. Therefore, it is determined that the configuration memory 2 is a soft error. Therefore, the configuration memory control unit 3 includes information determined to be a soft error in the configuration memory 2 in the alarm / failure information 50 and notifies the alarm display / notification unit 51 (S106).

  The alarm display / notification unit 51 notifies the maintenance person of a software error in the configuration memory 2 (S107).

  FIG. 11 is a sequence diagram for determining a failure of the configuration data memory 4 in the seventh embodiment.

  The configuration memory control unit 3 determines a soft error in the configuration memory 2 by detecting the error again at the same address while scanning the configuration memory 2 once after correcting the error.

  The configuration memory control unit 3 notifies the information holding unit 65 of the soft error address information 61 after error detection / correction (S110) (S111).

  The information holding unit 65 holds the soft error address information 61 notified from the configuration memory control unit 3 for N milliseconds (S112), and configures the soft error address holding information 62 while holding the soft error address information 61. It repeatedly returns to the memory control unit 3 (S113). The soft error address holding information 62 may be transmitted periodically.

  The time for holding the soft error address information 61 (N milliseconds) may be set to the time for scanning the configuration memory 2 once. The time for holding the soft error address information 61 is extended until the next error detection monitoring period (N milliseconds) ends when an error is detected in the first error detection monitoring period (N milliseconds). .

  The configuration memory control unit 3 performs error detection monitoring for N milliseconds (S114) and detects an error (S115). When the address where the error is detected matches the soft error address holding information 62 (S116), since the error has not been corrected, the configuration memory control unit 3 stores the corrected data in the configuration data memory 4 or the configuration data memory 4 It is determined that the memory 2 is faulty.

  The soft error countermeasure circuit 6 reconfigures the FPGA 1 in order to identify the failure location (S117). After completion of the reconfiguration, the configuration memory control unit 3 transmits the configuration completion information 60 to the information holding unit 65 (S118).

  Upon receiving the configuration completion information 60, the information holding unit 65 repeatedly returns the soft error address holding information 62 to the configuration memory control unit 3 for N milliseconds (S119). The soft error address holding information 62 may be transmitted periodically.

  The configuration memory control unit 3 performs error detection monitoring for N milliseconds (S120), and when no error is detected at an address that matches the soft error address holding information 62 (S121), the configuration data memory 4 fails and correction data is stored. Judge that it is wrong. Therefore, the configuration memory control unit 3 includes the failure information of the configuration data memory 4 in the alarm / failure information 50 and notifies the alarm display / notification unit 51 (S122).

  Further, when no error is detected during the error detection monitoring period (N milliseconds), the configuration memory control unit 3 instructs the information holding unit 65 to discard the held soft error address information 61. Note that the information holding unit 65 may autonomously discard the soft error address information 61 (for example, due to a timer up of N milliseconds).

  The alarm display / notification unit 51 notifies the maintenance person of the failure information of the configuration data memory 4 (S123).

  FIG. 12 is a sequence diagram for determining a failure of the configuration memory 2 in the seventh embodiment.

  The procedure until the reconfiguration is completed is the same as that in FIG. 11 (S110 to S118). After the reconfiguration is completed, the configuration memory control unit 3 performs error detection monitoring for N milliseconds (S130) and detects an error (S131). If the address where the error is detected matches the soft error holding information 62 (S132), the circuit information read from the configuration data memory 4 is correct, so that it can be determined that the configuration memory 2 has failed. For this reason, the configuration memory control unit 3 includes failure information of the configuration memory 2 in the alarm / failure information 50 and notifies the alarm display / notification unit 51 (S133).

  The alarm display / notification unit 51 notifies the maintenance person of the failure of the configuration memory 2 (S134).

  FIG. 13 is a sequence diagram for determining a soft error in the soft error countermeasure circuit 6 in the seventh embodiment.

  After detecting that the error cannot be corrected, the FPGA 1 is reconfigured. After the reconfiguration is completed, the determination is made by monitoring again the presence / absence of error correction impossible while scanning the configuration memory once. As described above, for example, when the configuration memory 2 has an ECC correction function, errors up to 1 bit can be corrected in the detection target area, but errors of 2 bits or more cannot be corrected. It can be determined that there is.

  After detecting that the error cannot be corrected (S140), the configuration memory control unit 3 notifies the information holding unit 65 of the uncorrectable information 63 (S141). The information holding unit 65 holds the uncorrectable information 63 notified from the configuration memory control unit 3 (S142).

  The soft error countermeasure circuit 6 reconfigures the FPGA 1 in order to identify the failure location (S143). After completion of the reconfiguration, the configuration memory control unit 3 transmits the configuration completion information 60 to the information holding unit 65 (S144).

  Upon receiving the configuration completion information 60, the information holding unit 65 repeatedly returns the uncorrectable holding information 64 to the configuration memory control unit 3 for N milliseconds (S145). The uncorrectable holding information 64 may be transmitted periodically.

  If the configuration memory control unit 3 does not detect that error correction is not possible within N milliseconds (S146), the configuration memory control unit 3 determines that the circuit cannot operate normally due to the soft error generated in the soft error countermeasure circuit 6, and cannot be corrected. To do. Therefore, the configuration memory control unit 3 includes the soft error of the soft error countermeasure circuit 6 in the alarm / failure information 50 and notifies the alarm display / notification unit 51 (S147).

  The alarm display / notification unit 51 notifies the maintenance person of the soft error in the soft error countermeasure circuit 6 (S148).

  FIG. 14 is a sequence diagram for determining a failure of the configuration memory 2 in the seventh embodiment.

  The procedure until the reconfiguration is completed is the same as that in FIG. 13 (S140 to S144). When error correction impossible is detected within N milliseconds after completion of reconfiguration (S150), it is determined that the soft error countermeasure circuit 6 functions normally but cannot be corrected due to a failure of the configuration memory 2. be able to. For this reason, the configuration memory control unit 3 includes failure information of the configuration memory 2 in the alarm / failure information 50 and notifies the alarm display / notification unit 51 (S151).

  The alarm display / notification unit 51 notifies the maintenance person of the failure of the configuration memory 2 (S152).

  As described above, the FPGA 1 needs to be reconfigured in order to determine the failed part. When reconfiguration is performed, the soft error address information 61 and the uncorrectable information 63 used for determination are initialized and deleted. In the seventh embodiment, the soft error address information 61 and the uncorrectable information 63 are saved in the information holding unit 65 in order to prevent this information from being erased.

  The information holding unit 65 can be configured by an FPGA 1 or a processor. When the information holding unit 65 is realized by the FPGA 1, the soft error countermeasure circuit 6 is required, and therefore the circuit shown in FIG. 9 is mounted. If a soft error occurs simultaneously in both the soft error countermeasure circuits 6 of the reconfigured FPGA 1 and the information holding unit 65, the method of the seventh embodiment cannot be realized. However, there is no practical problem because the probability of simultaneous occurrence of soft errors in both soft error countermeasure circuits 6 is very small.

  As described above, according to the seventh embodiment, when a functional unit that detects and corrects a soft error fails or a soft error occurs, the error detection and correction may be repeated. By analyzing the error state in detail, it is possible to identify the malfunctioning functional unit and improve the maintainability of the system.

  In addition, since the failure part is analyzed by comparing the address where the error is detected with the address where the error is detected after the error is corrected, the soft error in the configuration memory 2, the configuration data memory 4 or the configuration The failure of the memory 2 can be accurately determined.

  If it is determined that the detected error cannot be corrected, the soft error of the soft error countermeasure circuit 6 or the configuration memory is determined by determining whether the error can be corrected again after executing reconfiguration of the logic circuit. Two failures can be determined.

  Further, since the information holding unit 65 for storing the information of the address where the error is detected before the reconfiguration of the logic circuit and the information on whether correction is possible is provided, the information stored in the information holding unit 65 by the reconfiguration is erased. The failure can be recovered by using the detected soft error address information 61 and the uncorrectable information 63.

<Example 8>
15A and 15B are flowcharts for explaining the processing of the soft error countermeasure circuit in the eighth embodiment.

  The flowcharts shown in FIGS. 15A and 15B include processing for identifying a functional unit that detects and corrects a soft error described in the seventh embodiment and a functional unit in which the soft error has occurred. Also included is a process for determining whether to switch between the active system and the non-active system described in the sixth embodiment.

  When detecting an error in the configuration memory 2, the configuration memory control unit 3 determines whether the detected error can be corrected (Step 1). As a result, when correction is possible (YES in Step 1), the operation system and non-operation system are switched using the method of the sixth embodiment (Step 10), correction processing is executed after switching (Step 2), and the error detection flag and Both the error correction flag and the error correction flag are asserted and output (Step 3). Thereafter, it is monitored whether an error is detected again in N milliseconds with the error address corrected in Step 3 (Step 11). If no error is detected at the same address in N milliseconds (NO in Step 11), it can be determined that the error has been correctly corrected. For this reason, the reset control unit 7 executes reset for the specific logic circuit unit 5. For the resetting of the logic circuit unit, any of the methods of the first to fifth embodiments described above may be adopted (Step 5). Thereafter, it is determined that the configuration memory 2 is a soft error (Step 12), the system is restored, and the restoration is notified (Step 21).

  On the other hand, if an error is detected at the same address for N milliseconds in Step 11 (YES in Step 11), the entire FPGA 1 is reconfigured in order to identify the faulty part (Step 13). Then, after completion of reconfiguration, it is monitored whether an error is detected at the same address in N milliseconds (Step 14).

  If no error is detected at the same address for N milliseconds in Step 14 (NO in Step 14), it is determined that the configuration data memory 4 is faulty (Step 15), and the fault of the configuration data memory 4 is notified (Step 22). . On the other hand, if an error is detected at the same address for N milliseconds in Step 14 (YES in Step 14), it is determined that the configuration memory 2 has failed (Step 16), and the failure of the configuration memory 2 is notified (Step 23).

  On the other hand, when correction is impossible (NO in Step 1), the operation system and the non-operation system are switched using the method of the sixth embodiment (Step 17). Thereafter, the configuration memory control unit 3 asserts and outputs only the error detection flag (Step 4). That is, the error correction flag is deasserted and not output. After that, the reset control unit 7 reads the circuit information from the configuration data memory 4, reconfigures the entire FPGA 1 (Step 6), and then detects uncorrectable in N milliseconds at the address where the error is detected. Is monitored (Step 18).

  If no uncorrectable error is detected at the same address for N milliseconds (NO in Step 18), it is determined that a soft error has occurred in the soft error countermeasure circuit 6 (Step 19), and after all the logic circuit units are restarted, the FPGA 1 is restarted. Initialization is performed (Step 7), the system is restored, and the restoration is notified (Step 24).

  On the other hand, when it is detected that correction is impossible in N milliseconds (YES in Step 18), it is determined that the configuration memory 2 is faulty (Step 20), and the fault of the configuration memory 2 is notified (Step 25).

  The flowcharts shown in FIGS. 15A and 15B include all of the determination sequences described with reference to FIGS. 10 to 14, but may include only a determination sequence for detecting only a part of failure. In particular, the determination processes of Steps 1-3, 5, and 10-16 and the determination processes of Steps 1, 4, 6-5, and 17-20 can be easily separated, and only one of them can be implemented.

  As described above, in the eighth embodiment, the failed functional unit can be easily identified by analyzing the corrected error state in detail.

  The present invention is not limited to the above-described embodiments, and includes various modifications and equivalent configurations within the scope of the appended claims. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and the present invention is not necessarily limited to those having all the configurations described. A part of the configuration of one embodiment may be replaced with the configuration of another embodiment. Moreover, you may add the structure of another Example to the structure of a certain Example. In addition, for a part of the configuration of each embodiment, another configuration may be added, deleted, or replaced.

  In addition, each of the above-described configurations, functions, processing units, processing means, etc. may be realized in hardware by designing a part or all of them, for example, with an integrated circuit, and the processor realizes each function. It may be realized by software by interpreting and executing the program to be executed.

  Information such as programs, tables, and files that realize each function can be stored in a storage device such as a memory, a hard disk, or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, the control lines and the information lines are those that are considered necessary for the explanation, and not all the control lines and the information lines that are necessary for the mounting are shown. In practice, it can be considered that almost all the components are connected to each other.

  The following are typical examples of aspects of the present invention other than those described in the claims.

(1) A programmable gate array having a programmable logic circuit,
A configuration memory in which the logic circuit is set, and
A countermeasure circuit for normalizing a soft error in the configuration memory,
The countermeasure circuit is
Execute error correction to recover from a secondary failure caused by a soft error that occurs in the configuration memory,
A programmable gate array for recovering a value held in the logic circuit after the error correction.

  (2) The programmable gate array according to (1), wherein the countermeasure circuit recovers a value held in the logic circuit by resetting a value to be held in the logic circuit.

  (3) The countermeasure circuit recovers the value held in the logic circuit by returning the value held in the logic circuit to an initial state after the error correction. Programmable gate array.

(4) The countermeasure circuit is
Determine whether the location where the soft error has occurred is an area used as a logic circuit in the configuration memory,
When the location where the soft error occurs is an area used as a logic circuit in the configuration memory, the value held in the logic circuit is reset (1) to (3) The programmable gate array according to any one of the above.

(5) The countermeasure circuit is
Determine whether the location where the soft error has occurred is a predetermined area,
The programmable gate array according to any one of (1) to (3), wherein when the location where the soft error occurs is a predetermined area, the value held in the logic circuit is reset .

(6) The logic circuit uses a predetermined mounting area,
The countermeasure circuit is
Determine whether the location where the soft error occurred is the mounting area,
The programmable gate array according to any one of (1) to (3), wherein a value held in the logic circuit is reset when the place where the soft error has occurred is the mounting area .

(7) The countermeasure circuit is
Determine whether the soft error can be corrected,
When the soft error can be corrected, the value held in the logic circuit is reset by the method according to any one of (1) to (5),
The programmable gate array according to any one of (1) to (5), wherein when the soft error cannot be corrected, all the logic circuits are initialized.

1 FPGA
2 Configuration Memory 3 Configuration Memory Control Unit 4 Configuration Data Memory 5 Logic Circuit Group 6 Soft Error Countermeasure Circuit 7 Reset Control Unit 8 Reset Data Memory 9A Address Line 9B Data Line 10 Basic Circuit Module 11 Combinational Logic Unit 12 Flip-flop 13 Setting section 14 Error detection / correction / corresponding flag 15 Read address and control signal 16 Address and reset data 17 Address and control signal 18 Reset data 19 to 22 Logic circuit section 23 Condition holding signal 24 Condition signal 25 Timing signal 26 Clock 27 Wire connection intersection 28 Pass transistor 29 Reset 30 Used area 31 Unused area 32 Error address 33 Address table 34 Logic circuit section 35 Specific logic circuit section 40 that needs to be reset Communication apparatus A
41 Communication device B
42 Operational main signal 43 Non-operational main signal 44 Operational system 45 Non-operational apparatus 46 Error detection signal 47 Selector control unit 48 Selector control signal 49 Selector 50 Alarm / failure information 51 Alarm display / notification unit 60 Configuration completion information 61 Soft error address information 62 Soft error address holding information 63 Uncorrectable information 64 Uncorrectable holding information

Claims (8)

A programmable gate array having a programmable logic circuit comprising:
A configuration memory in which the logic circuit is set;
A countermeasure circuit for normalizing a soft error in the configuration memory,
A redundant configuration is constructed by a working circuit and a standby circuit configured by the programmable gate array,
The countermeasure circuit is
Triggered by detection of a soft error that occurs in the configuration memory that constitutes the working circuit, the working circuit and the standby circuit are switched,
Performing error correction to recover from a secondary failure caused by the detected soft error;
A programmable gate array, wherein a value held in the logic circuit is recovered after the error is corrected. The programmable gate array of claim 1,
The programmable circuit array characterized in that the countermeasure circuit analyzes a failed part by comparing an address where the error is detected with an address where an error is further detected after the error is corrected. The programmable gate array of claim 1,
The countermeasure circuit is
Determine whether the detected error can be corrected,
When it is determined that correction of the detected error is impossible, reconfiguration of the logic circuit is performed, and then the failure part is analyzed by determining whether the error can be corrected again. array. A programmable gate array according to claim 2 or 3,
The countermeasure circuit is
It is connected to a storage unit that stores information on an address where an error is detected before reconfiguration of the logic circuit and information on whether correction is possible,
A programmable gate array, wherein information stored in the storage unit is acquired after completion of the reconfiguration. An electronic device having a programmable gate array including programmable logic circuitry,
With the two circuits configured by the programmable gate array, a redundant configuration by the active system and the standby system is assembled,

The programmable gate array has a configuration memory in which a logic circuit is set, and a countermeasure circuit that normalizes a soft error in the configuration memory,
The countermeasure circuit is
Triggered by the detection of a soft error that occurs in the configuration memory that constitutes the working circuit, the working circuit and the standby circuit are switched,
Performing error correction to recover from a secondary failure caused by the detected soft error;
An electronic device for recovering a value held in the logic circuit after correcting the error. The electronic device according to claim 5,
The electronic device according to claim 1, wherein the countermeasure circuit analyzes a failed part by comparing an address where the error is detected with an address where the error is further detected after the error is corrected. The electronic device according to claim 5,
The countermeasure circuit is
Determine whether the detected error can be corrected,
If it is determined that the detected error cannot be corrected, the electronic device is characterized by reconfiguring the logic circuit and then analyzing again the failure site by determining whether the error can be corrected again. . The electronic device according to claim 6 or 7,
The countermeasure circuit is
It is connected to a storage unit that stores information on an address where an error is detected before reconfiguration of the logic circuit and information on whether correction is possible,
An electronic device that acquires information stored in the storage unit after the reconfiguration is completed.

Images