JP6408482B2 - Programmable device and electronic system apparatus using the same - Google Patents

Description

  The present invention relates to a programmable device and an electronic system apparatus using the programmable device.

  As a background art in this technical field, there is US registered patent US8332722 (Patent Document 1) "Method and architecture for performing scrubbing of an FPGA's configuration memory".

US Pat. No. 8,332,722

  In a programmable device such as an FPGA (Field Programmable Gate Array), if a soft error due to radiation occurs in the configuration memory (hereinafter referred to as CRAM), the configuration information of the user logic may be temporarily destroyed, causing malfunction. There is. Therefore, a conventional programmable device is provided with a circuit that divides the data stored in the CRAM into fixed-length data frames and performs an error check while circulating each frame. The user can recover from the soft error state by improving the reliability of the device by performing recovery processing such as reconfiguration of the programmable device or device restart using the CRAM soft error detection signal of this circuit as a trigger. be able to.

  However, in the conventional error check method, the entire area of the CRAM is checked in the order of frames. Therefore, when the capacity of the programmable device is increased, the soft error detection time is delayed. For example, in a communication device that employs duplexing, it is required that the device switching time at the time of abnormality be within tens of milliseconds, so the programmable device mounted on the device detects and corrects an error within the above time. It is desirable to be able to do it. However, in a programmable device whose capacity is increasing, it may take 100 milliseconds or more to simply detect an error, and recovery within the switching time has become difficult. For this reason, it is necessary to shorten the detection and correction time of the environmental radiation soft error occurring in the CRAM, and to shorten the stop time and recovery time of the apparatus. In addition to error detection, it is required to correct soft errors in the CRAM in a short time.

  According to Patent Document 1, a circuit (scrubbing circuit) that detects and corrects a soft error that occurs in a CRAM is described. The scrubbing circuit is mounted on the FPGA as a part of the user logic circuit, and can read CRAM data in fixed-length data units called frames, and can detect errors by CRC and correct errors by ECC. In addition, the multi-bit error can be corrected by overwriting the normal data stored in the external ROM on the CRAM again.

  Also, the scrubbing circuit uses a soft processor inside the FPGA as a component, and can perform error checking of an arbitrary frame in the CRAM according to the instruction code stored in the instruction memory. However, Patent Document 1 does not consider the error detection time and correction time of the CRAM, and does not actively mention means and effects for shortening the error detection time and correction time.

  An object of the present invention is to provide a programmable device that shortens detection time and correction time when a soft error occurs, and an electronic system apparatus using the programmable device.

  In order to solve the above problems, for example, the configuration described in the claims is adopted. For example, in a programmable device having a configuration memory, as a diagnostic means for the configuration memory, a read / write unit that reads and writes data in the configuration memory, and an error check on the data in the configuration memory. And a sequencer unit that controls the read / write unit and the functional block unit to perform error checking on data in a predetermined area in the configuration memory in a predetermined order.

  ADVANTAGE OF THE INVENTION According to this invention, the reliability of a programmable device and an electronic system apparatus using the same improves by shortening the detection time and correction time at the time of soft error occurrence, and lengthening operation time.

1 is a configuration diagram of a programmable device according to Embodiment 1. FIG. The figure which shows the storage data structure of the area | region table 3. FIG. The figure which shows the example of a setting of a check area | region. The figure which shows the storage data structure of the execution order table. The figure which shows the structure of the functional block part. The figure which shows the structural example of the error signal output part 8. FIG. FIG. 6 is a configuration diagram of a programmable device according to a second embodiment. The figure which shows 4 A of execution order tables in Example 2. FIG. The block diagram which shows an example of the electronic system apparatus (communication apparatus) which mounts a programmable device (Example 3). The figure which shows the control flow at the time of the error generation of the communication apparatus 90. FIG. The figure which shows the example of a display of error information. The block diagram (Example 4) which shows an example (motor control system) of the electronic system apparatus carrying a programmable device. FIG. 10 is a configuration diagram of a programmable device according to a fifth embodiment.

  Embodiments of a programmable device and an electronic system apparatus using the same according to the present invention will be described with reference to the drawings.

  FIG. 1 is a configuration diagram of a programmable device according to the first embodiment. The programmable device 100 according to the present embodiment includes a configuration memory (CRAM) 9 for storing circuit configuration information of user logic, and a CRAM control unit 1 that detects and corrects a soft error generated in the CRAM. Here, the CRAM 9 divides the stored data into fixed-length data called frames, and the CRAM control unit 1 detects and corrects soft errors in units of the data frames. The CRAM control unit 1 is mounted on the programmable device 100 as part of the user logic.

  In the programmable device 100, the CRAM control unit 1 performs a soft error detection and correction operation of the CRAM 9. As a basic operation, a data frame is read from the CRAM 9 and the presence or absence of an error bit is checked. If there is an error bit, the data is corrected. If there is no error, the operation of reading the next designated data frame and checking the error is repeated.

  If the error cannot be corrected, an error signal 8a or error information 8b is output as a signal that can be connected to the user logic. The error signals 8a and 8b have a plurality of types of information, and may be connected to the user logic as necessary or output to the outside of the programmable device 10 as they are.

  The configuration of the CRAM control unit 1 is as follows. The CRAM read / write unit 2 reads and writes the data frame of the CRAM 9. The area table 3 stores area information of CRAM for checking errors. The execution order table 4 stores check sequence information such as the order of areas for checking errors in the CRAM 9, the type of data processing such as error detection and correction, and the number of repetitions. The functional block unit 7 has a plurality of types of functional blocks related to CRAM data processing such as error detection and correction. The selector unit 6 selects a functional block to be used. The error signal output unit 8 converts a plurality of error signals from the function block unit 7 into necessary types of error signals and outputs them. The sequencer unit 5 executes an error check operation of the CRAM 9 based on information in the area table 3 and the execution order table 4.

  Here, the CRAM read / write unit 2 includes an interface unit with the CRAM 9 and performs data frame read and write operations according to the physical address of the designated CRAM 9. The CRAM read / write unit 2 has an interface with the external ROM 50 connected to the programmable device 10 in addition to the CRAM 9 and can perform read and write operations of the external ROM 50. The external ROM 50 stores user logic circuit configuration information for configuring the CRAM 9 when the programmable device 10 is activated. According to the CRAM read / write unit 2, for example, data read from the external ROM 50 can be written into the CRAM 9.

  FIG. 2 is a diagram illustrating a storage data structure of the area table 3. As described above, the CRAM 9 is divided into fixed-length data frames, and a unique address is assigned to each frame. The row direction of this table indicates the address of the data frame, and a table in which a plurality of check areas A0 to An can be set in the column direction is prepared. Each frame address column stores 1-bit information indicating whether or not to check. For example, area number A2 indicates that data frame addresses F2 and F3 are to be checked.

  FIG. 3 is a diagram illustrating an example of setting a check area. According to the area table 3, a plurality of different check areas can be set like A0 to A4 in the figure. Further, since each check area is set as a group of data frames 10 as shown in the balloon, the shape of the area may not be a rectangular area such as A1 to A3. Like A0, an L-shaped area or a distant area can be set as one area. Moreover, you may designate so that several area | regions may overlap like A2 and A3. In this case, A2 and A3 include the same data frame.

  However, in general, the layout of the user logic is automatically optimally arranged so as to satisfy the operation timing of the user logic by a dedicated mapping tool prepared by the FPGA vendor. Therefore, when checking the entire surface of the CRAM without dividing the area, the area table is set so as to check only the data frame being used based on the layout of the user logic after optimal placement.

In addition, when user use bit information of CRAM is provided from the FPGA vendor, it is desirable to set the area table so as to check only the data frame including the used bit based on the information. In general, since the user logic is hierarchically designed as shown by A1 in FIG. 3, check areas are set in accordance with the layout of the modules A10 to A12. In that case, the layout is designated and mapped so that the user logic is laid out in A10 to A12.
By limiting the area to be checked by the area table 3 in this way, useless check time can be omitted and the soft error detection time in the CRAM 9 can be shortened.

  FIG. 4 is a diagram showing a storage data structure of the execution order table 4. The error check in the CRAM control unit 1 is executed according to the sequence information stored in the table 4. The execution order table 4 stores sequence information including an execution number, a check area number, a processing number, the number of repeats, and the next execution number. The execution number indicates the address of this table. If an address is specified, execution starts from that execution number. If not specified, execution starts from execution number 0. The check area number indicates an area number set in the area table 4. The process number indicates the function block number of the function block unit 7. The number of repeats indicates the number of repetitions in which execution numbers are continuously executed. The next execution number is set to the next execution number. Thus, the same execution number can be repeated, or the operation can be repeated by returning to the previous execution number.

  For example, in the execution order table shown in FIG. 4, first, the execution number 0 is executed, and the processing of the error processing number # 0 (error detection) is performed once for the data frame in the check area A1. When all the data frames in A1 are checked, the process proceeds to the next execution number 1. In execution number 1, the processing of process number # 1 (error detection and correction) is repeated four times for the data frame in area A0, and the process proceeds to the next execution number 2. In execution number 2, the process of process number # 0 (error detection) is repeated twice for the data frame in area A2, and then the process returns to execution number 0. Then, the above check operation is repeated.

  By using the execution order table 4, the number of repetitions is increased and the error check frequency is increased for the area of the circuit module having a high operation rate and high importance, so that error detection is focused on compared to other areas. be able to.

  The sequencer unit 5 performs an error check of the CRAM 9 based on the storage information of the area table 3 and the execution order table 4. The area table 3 is referred to based on the area number specified in the execution order table 4, and the address of the data frame to be read is notified to the CRAM read / write unit 2 (5a). At the same time, the function block to be used is selected according to the error processing number (5c). The data frame 2a read by the CRAM read / write unit 2 is input to the selected functional block unit 7 to perform error check processing.

  The function block unit 7 is a circuit block group having a soft error countermeasure processing function for CRAM data. The CRAM control unit 1 has a function block unit 7 incorporating a plurality of types of function blocks, and the user selects and uses it according to the purpose.

  FIG. 5 is a diagram illustrating a configuration of the functional block unit 7. The function block unit 7 incorporates a plurality of types of function blocks # 0 to #n. Here, an error detection function block by CRC (Cyclic Redundancy Code) is shown as # 0 (70), and a 1-bit error correction function block by ECC is shown as # 1 (71).

  The functional block # 0 (70) includes a CRC error check unit 11, a redundant bit storage unit 12, and a CRC redundant bit generation unit 13. The CRC error check unit 11 detects the presence or absence of an error bit in the data frame by comparing sequentially input CRAM read data frames with redundant bits stored in the redundant bit storage unit 12 in advance. The CRC redundant bit generation unit 13 automatically generates redundant bits for all data frames when the CRAM control unit 1 is activated, and stores the redundant bits in the redundant bit storage unit 12. Thereby, a soft error in the data frame can be detected. When a CRC error is detected, an error signal E1 indicating error detection is output, and error information such as an area number in which an error is detected, a frame address, and an error type are simultaneously output.

  The redundant bit information stored in the redundant bit storage unit 12 is generated by the CRC redundant bit generation unit 13 when the CRAM control unit 1 is activated, but may be added to the data frame of the CRAM 9. Further, an error detection algorithm and an error bit correction algorithm are not particularly limited. A plurality of types of function blocks may be mounted, but the function blocks to be mounted may be limited within an allowable circuit scale.

  The functional block # 1 (71) includes an error check correction unit 14, a redundant bit storage unit 15, and a redundant bit generation unit 16. The error check correction unit 14 detects the presence / absence of an error bit in the data frame by comparing sequentially input CRAM read data frames with ECC redundant bits stored in the redundant bit storage unit 15 in advance. When an error is detected, it is corrected and output as a CRAM write data frame. The redundant bit generation unit 16 automatically generates ECC redundant bits of all data frames when the CRAM control unit 1 is activated and stores the ECC redundant bits in the redundant bit storage unit 15. Thereby, a soft error in the data frame can be detected. When an ECC error is detected, an error signal E1 indicating error detection and an error signal E2 indicating error correction success are output. Further, if the error bit number is 1 bit or more and correction is not possible, an error signal E3 is output as a correction impossible notification. Further, error information such as the address and error type of the data frame determined to be error detected / corrected and uncorrectable is simultaneously output.

  Further, as described above, since the CRAM control unit 1 is mounted on a programmable device as part of the user logic, the neutron soft error rate of the CRAM control unit itself increases as the circuit scale increases. Therefore, the functional blocks in the present embodiment have a module configuration, and only necessary functional blocks can be selected and mounted. By separating unnecessary blocks and not mounting them on a programmable device, the circuit scale of the CRAM control unit itself can be reduced and soft error failures can be reduced.

FIG. 6 is a diagram illustrating a configuration example of the error signal output unit 8. In the error signal output unit 8, a plurality of error signals from the function block unit 7 are converted into error signals of an externally required format (type, number, signal shape (level, pulse), timing) and output. In FIG. 6, error signals E1 to E3 and error information from the function block units (# 0 to #n) are combined with logical sums 80 to 83, and error signals E1 ′, E2 ′, E3 ′ and error information are collected. Output.
As described above, in the programmable device 100 according to this embodiment, the CRAM control unit 1 can freely set the error check order, the check contents (error processing number), and the number of repetitions for a plurality of arbitrary areas of the CRAM 9. As a result, the error check processing efficiency can be improved and the error detection time can be shortened by focusing on the specified area in the CRAM 9 for error checking.

  For example, the number of frames to be checked is limited by setting the area table 3 so as to check only the data frame including the bit based on the user use bit information of the CRAM provided by the FPGA vendor. Error detection time can be shortened. In addition, in the electronic system apparatus equipped with the programmable device of this embodiment, the soft error detection / correction in the programmable device is completed in a shorter time than before, so that the recovery process can be executed quickly, and the entire apparatus can be Recovery time can be shortened.

  Further, in the programmable device 100 according to the present embodiment, based on the setting information of the region table 4, it is possible to notify the region information where an error has been detected, or to notify the error signal for each region. Since the CRAM area information and the configuration information of the user logic stored in the area correspond to each other, if the CRAM area where the error has occurred can be identified, the user logic portion in which the error has occurred can be identified, and is necessary according to the user logic. Minimal optimal recovery processing can be performed.

  In this embodiment, the CRAM control unit 1 is mounted on the CRAM 9 as a part of programmable user logic, and the execution order table 4 and the area table 3 are stored in a block RAM inside the programmable device. The CRAM control unit 1 may be mounted as a dedicated hardware circuit inside the programmable device in addition to being mounted on the CRAM. Further, the CRAM control circuit 1 may be mounted on an external device. Although the error detection block 70 uses CRC, the error detection method is not limited to CRC.

  Although not shown, the types of functional blocks include a circuit block that can detect and correct a multi-bit soft error. The correction means may use a correction code technique such as ECC, or may use a correction method in which configuration data stored in the external memory is called in units of frames and overwritten in the CRAM. Furthermore, a forced correction method that always overwrites all frames regardless of whether or not an error is detected may be used. Other functional blocks include a hardware error detection block that detects uncorrectable (hardware failure) by performing error check once or multiple times after correction or immediately after correction.

  From the above, according to the present embodiment, the error detection time of the configuration memory can be shortened by performing error check only on the important data area in the configuration memory in the programmable device used in the electronic system product. it can. Furthermore, in the product equipped with the programmable device of this embodiment, it is possible to detect an error in the configuration memory at high speed, to shorten the recovery time of the apparatus, and to achieve high reliability and improvement in availability. As a result, it is possible to provide a programmable device in which the soft error detection time is shortened and the reliability is improved, and an electronic system apparatus using the programmable device.

  FIG. 7 is a configuration diagram of a programmable device according to the second embodiment. The programmable device 101 of the present embodiment is configured such that the error check order of the CRAM 9 can be controlled by the interrupt signal from the outside of the device in the CRAM control unit 1 of the first embodiment.

  An interrupt signal interface (IF) 17 for inputting an external interrupt signal is connected to the sequencer unit 5 in the CRAM control unit 1A. A plurality of interrupt signals 0 to n can be input to the interrupt signal IF17. When an interrupt signal is input, the interrupt number is notified to the sequencer unit 5 in accordance with the input port number of the interface (17a). In accordance with the interrupt number, the sequencer unit 5 interrupts and executes the designated CRAM error check process during the CRAM error check being executed.

  FIG. 8 is a diagram showing the execution order table 4A in the present embodiment. Normally, the CRAM error detection / correction operations for the areas A0 to A2 are repeatedly executed in the order of execution numbers 0 → 1 → 3 → 0 according to the contents of the table. For example, when an interrupt signal is input to port 2 of the interrupt IF 17 here, the interrupt signal IF 17 notifies the sequencer unit 5 of the interrupt number (= 2). The sequencer unit that has received the interrupt number preferentially executes the process of the execution number 2 in the execution order table 4A according to the interrupt number (= 2). In the example of FIG. 8, error detection and correction operations are performed on the entire area A5 of the CRAM 9. In addition, the normal error check operation (execution number 0) is set to the next execution number in the execution number 2 table, so that the normal error check operation is automatically restored after the operation by the interrupt signal is completed. be able to.

  As described above, in the programmable device 101 according to the present embodiment, by adding the interrupt signal IF17 to the CRAM control unit 1A, not only the normal error check in the CRAM 9 but also the specified error check by the interrupt signal from the outside is performed. It can be forcibly executed. For example, even when a partial area error check is normally executed, the error check of the entire CRAM area can be forcibly interrupted. Also, each circuit module of the user logic, other devices connected to the programmable device 101, and an abnormal signal from the device side on which the programmable device is mounted are received by the CRAM control unit 1A, and the programmable device related to the abnormality is received. Only the CRAM area can be detected and corrected, error detection efficiency can be improved, and error detection time can be shortened.

  From the above, in the programmable device of this embodiment, the soft error detection time in the CRAM can be shortened by checking the error only in the area designated by the user using the interrupt signal. In addition, the apparatus equipped with the programmable device of this embodiment can detect CRAM errors at high speed, reduce the recovery time of the apparatus, and achieve high reliability and improved availability. As a result, it is possible to provide a programmable device with a reduced soft error detection time and improved reliability, and an electronic system apparatus using the programmable device.

  FIG. 9 is a configuration diagram illustrating an example of an electronic system device on which a programmable device is mounted. In this embodiment, a communication device is taken as an example of an electronic system device, and a case where an FPGA (Field Programmable Gate Array) is used as a programmable device is shown.

  The communication device 90 has a standby system duplex configuration called cold standby, and is composed of an active system 91 and a standby system 92. When the unit of the active system 91 is in the operating state (ACT), the standby system 92 is on standby (SBY) with the power off. Here, when an abnormality occurs in the active system 91 for some reason, the operation (ACT) is switched to the standby system 92 and the operation of the apparatus is continued.

  Each system is composed of a plurality of types of units. The communication control units 91c and 92c mainly input communication packet data, and select an output destination according to destination data added to the packet data. The diagnosis units 91b and 92b diagnose whether the communication control units 91c and 92c are operating normally. The monitoring units 91a and 92a control unit operations such as operation start and reset of the communication control units 91c and 92c and diagnosis units 91b and 92b, initialization of installed processors and programmable devices, and the like. In this example, FPGAs 93 and 94 mounted with the CRAM control unit 1 of the first embodiment are mounted on all units.

  FIG. 10 is a diagram illustrating a control flow when an error occurs in the communication device 90. Here, an example in which an error is detected on the active system 91 side when the active system 91 is in operation and the standby system 92 is in a standby state is shown.

  After operating the communication device (S0), the diagnostic unit 91b monitors the CRAM error detection signal from the FPGA of each unit (S1). When a CRAM error is detected (S2), the active system 91 and the standby system 92 are immediately switched (S3). In this example, the standby system 92 is switched to the operating state, and the active system 91 is switched to the standby state. The apparatus continues to operate in the standby system 92. On the other hand, the monitoring unit 91a of the active system 91 in which the error is detected performs a temporary stop process of a unit (for example, the communication control unit 91c) related to the FPGA in which the error has occurred (S4). At this time, the diagnosis unit 91b outputs error information to a log file. In the log file, an error occurrence time, error mode information such as detection, correction success, and correction impossible, and address information of a data frame in which an error has occurred are recorded (S5).

  Further, as shown in FIG. 11, the content of the acquired error information may be displayed on the user interface screen 19 on the monitor screen 18 (S5). Thereafter, the FPGA of the communication control unit 91c performs CRAM error correction processing (S6), and the monitoring unit 91a performs FPGA reset processing (S7). The monitoring unit 91a performs recovery processing by discarding and retransmitting packets before and after error detection by the device firmware (S8), and preparing for the next system switching as a standby state. For devices that require system switchback after recovery, system switching is performed again here.

  When the communication device is configured using the programmable device according to the present embodiment, it is possible to shorten the configuration memory error detection time (S1 to S2) that spends much of the conventional recovery processing time, and to shorten the device recovery processing time. Is possible.

  For example, in the case of the communication apparatus 90 having the standby system 92 shown in FIG. 9, when an abnormality occurs in the active system 91 for some reason, it is necessary to switch the system in a time that does not affect the user who uses the apparatus. In this case, if switching to the standby system 92 is performed in a short time, it is possible to prevent the user who uses the apparatus from being affected. Also, the standby system 92 that is normally stopped may fail immediately after switching. In response to a failure caused by environmental radiation, that is, a so-called soft error failure, it is possible to prepare for the failure of the standby system 92 by restoring the active system 91 within the system switching time as in this embodiment. This is effective in a device such as a communication device that requires reliability and availability.

  In addition, for the purpose of reducing power consumption, the standby system clock may be stopped in a state where it can be operated immediately, such as by stopping the standby system. In this case, the standby system programmable device executes from standby. It is conceivable that the data inversion of the configuration memory in the programmable device is detected immediately after the mode is shifted, and in this case, the recovery can be performed within the time allowed as the system switching time.

  Further, in the programmable device 93 or 94 according to the present embodiment, it is possible to notify the area information in which an error is detected based on the setting information of the area table 4 or to notify the error signal for each area. Since the CRAM area information and the configuration information of the user logic stored in the area correspond to each other, it is possible to identify the user logic portion in which the error has occurred based on the CRAM area information in which the error has occurred. It is possible to perform a limited optimal recovery process. In this embodiment, for example, only the CRAM correction is performed for an error in an area 1, but if an error occurs in another area 2 including a control unit such as a user logic state machine, the FPGA is reconfigured. The recovery process varies depending on the error occurrence area.

  From the above, according to the present embodiment, it is possible to shorten the soft error detection time in the CRAM by performing error check only on the area specified by the user of the programmable device mounted on the electronic system apparatus. In addition, the apparatus equipped with the programmable device of this embodiment can detect CRAM errors at high speed, reduce the recovery time of the apparatus, and achieve high reliability and improved availability. As a result, it is possible to provide a programmable device with a reduced soft error detection time and improved reliability, and an electronic system apparatus using the programmable device.

  In Example 4, a motor control system used in a rolling device, an elevator, a water supply control pump, or the like will be described as an example of an electronic system device equipped with a programmable device.

  FIG. 12 is a diagram illustrating a configuration example of the motor control system 200. The system 200 includes a motor control device 20, a motor 26, a monitoring camera 25 that monitors the system environment, and a monitor 24 for an operator to check the operating state. The motor control device 20 includes an FPGA 21 on which the CRAM control unit 1 according to the first embodiment is mounted and an input / output IF 23 that interfaces with an external device group. In the system 200, a control value 26a indicating the rotation amount of the motor is output from the control device 20, and the current rotation amount 26b is simultaneously monitored by a sensor (not shown) mounted in the motor 26. By performing feedback to the side, a motor control operation such as maintaining a desired rotation amount is performed. Here, since the FPGA 21 is used to control the rotation amount of the motor 26, when the user logic 22 is destroyed due to a soft error generated in the CRAM, the control value changes abruptly, such as an abnormal high-speed rotation state or a stop state. An unexpected system failure may have occurred.

  In this embodiment, the CRAM control unit 1 detects and corrects soft errors that occur in the CRAM of the FPGA 21. In particular, since only the CRAM area in which the configuration information of the user logic 22 related to motor control is stored is checked, error checking and correction within the CRAM within the feedback control cycle of the motor 26 is possible, and a system such as a motor stop is performed. Obstacles can be avoided.

  Further, when the CRAM control unit 1 having the interrupt signal IF 17 shown in the second embodiment is used, the error check of the FPGA 21 using the inertia operation time of the motor 26 and the non-operation time information is possible, so that the efficiency is further improved. The abnormality occurrence rate of the motor 26 can be suppressed.

  According to the present embodiment, it is possible to shorten the detection time of the soft error in the programmable device, to recover from the device abnormality caused by the FPGA soft error in a short time, and to improve the reliability of the electronic system device Can do.

  FIG. 13 is a configuration diagram of a programmable device according to the fifth embodiment. Since the CRAM control units 1 and 1A in the embodiment are implemented as FPGA user logic, the CRAM control unit itself may be destroyed by a soft error. Therefore, in this embodiment, the CRAM control unit 1B in the programmable device 102 is configured to include the internal diagnosis unit 27 for checking the operation of the CRAM control unit itself.

The internal diagnosis unit 27 includes an error data insertion unit 28 and a comparison unit 29. The error data insertion unit 28 intentionally inserts error data into any data frame 2a read from the CRAM 9 and writes it back to the CRAM 9 again (28a). Thereafter, the comparison unit 29 compares the error information (occurrence address and data) 8b output from the error detection block # 0 or the error correction block # 1 with the intentionally written error information 28a. If the comparison results do not match, the CRAM control unit 1B outputs an error signal 27a to the FPGA or the outside as being in some abnormal state.
The internal diagnostic unit 27 operates in accordance with the control signal 5c of the sequencer unit 5 in accordance with the setting data of the area table 3 and the execution order table 4 like the other functional blocks.

  Although not shown, the internal diagnostic unit 27 can discriminate abnormal parts by performing read / write check of each data frame of the CRAM 9 a plurality of times. For example, a read / write check of ALL “0” or ALL “1” is performed on the frames in the entire area, and if an error is detected in the same data frame a plurality of times, an error is detected on the CRAM 9 side. If an error detection signal is not output even when an error is inserted, or if an error is detected in a data frame with a different address, it can be determined that the CRAM control unit 1B is abnormal. In addition, when overwriting correction using configuration data stored in the external ROM 50 is used and an abnormality is detected by the read / write check, it can be determined that the external ROM 50 is abnormal.

  Also, in this diagnostic method, abnormal values are written to the CRAM data, so when performing a diagnosis in a time zone in which the user logic is normally operating, the above check is performed using a data frame not used by the user logic. Do. If the diagnosis can be performed in a time zone in which the user logic is not yet operated, such as immediately after starting the FPGA, a check for all data frames in the CRAM 9 is performed.

  In addition to the above diagnosis, the CRAM control unit 1B sets a CRAM area in which circuit information of the CRAM control unit 1B itself is stored in the area table 4, and periodically checks the CRAM data in the area to perform CRAM control. It is good also as a structure which diagnoses the part 1B. Alternatively, the main part of the CRAM control unit 1B may be duplicated and the output values may be compared to notify the FPGA side of the abnormality of the CRAM control unit itself.

  If the error data insertion unit 28 of the internal diagnosis unit 27 is used, erroneous error data can be intentionally inserted into the CRAM. Therefore, a pseudo soft error failure may be generated in the FPGA and used for verification of the system behavior when the soft error occurs.

  According to the present embodiment, by reducing the soft error rate of the CRAM control unit itself and realizing highly reliable CRAM error detection / correction, it is possible to recover the device abnormality of the system device in a short time, and the electronic system The reliability of the apparatus can be improved.

1, 1A, 1B: CRAM part,
2: CRAM read / write unit,
3: Area table,
4: Execution order table,
5: Sequencer section,
6: selector part,
7: Function block part,
8: Error signal output unit,
9: Configuration memory (CRAM),
10: data frame,
11: CRC error check part,
12, 15: Redundant bit storage unit,
13: CRC redundant bit generator,
14: Error check correction section
16: Redundant bit generator
17: Interrupt signal IF,
20: motor control device,
27: Internal diagnosis unit
28: Error data insertion part,
29: Comparison part,
50: External ROM,
90: a communication device,
100, 101, 102: Programmable device (FPGA),
200: Motor control system.

Claims (9)

In an electronic system apparatus equipped with a programmable device having a configuration memory,
The programmable device is a diagnostic means for the configuration memory.
A read / write unit for reading and writing data of the configuration memory;
A functional block unit that performs an error check on the data in the configuration memory;
An area table for storing area information in the configuration memory corresponding to the circuit configuration of the user logic, which performs error checking in the configuration memory;
An execution order table for storing order information of areas for executing error checking of the configuration memory;
Based on the area information stored in the area table and the order information stored in the execution order table, an error check is performed on a predetermined area in a predetermined order for the read / write unit and the functional block unit. A sequencer section that controls to perform,
When an error is detected by the error check, an error signal output unit that inputs an error signal including area information in which an error is detected from the functional block unit, and outputs the error signal to the electronic system device;
Equipped with a,
The order information stored in the execution order table describes the number of repeated checks based on the operating rate and importance of the user logic,
An electronic system device characterized in that the frequency of error checks is increased in the configuration memory area corresponding to the user logic having a high operating rate and high importance . The electronic system device according to claim 1,
The diagnostic means of the configuration memory has an interrupt signal input section having at least one input port, and executes an error check interrupt operation designated based on an interrupt signal input from the input port. An electronic system device characterized by the above. The electronic system device according to claim 1 or 2,
The diagnostic means of the configuration memory includes an internal diagnostic unit for confirming the normal operation of the diagnostic means itself,
The internal diagnosis unit includes an error data insertion unit that inserts error data into the configuration memory, and a comparison unit that compares the inserted error information with the detected error information. . An electronic system device according to any one of claims 1 to 3,
The functional block unit performs error detection and correction processing of the configuration memory, and is composed of a plurality of functional blocks according to the processing content, and each functional block can be added or deleted as necessary. An electronic system device characterized by having a modular configuration. An electronic system device according to any one of claims 1 to 4,
The electronic system apparatus is composed of a plurality of units, and the programmable device is mounted on each unit. In a programmable device having a configuration memory,
As diagnostic means for the configuration memory,
A read / write unit for reading and writing data of the configuration memory;
A functional block unit that performs an error check on the data in the configuration memory;
An area table for storing area information in the configuration memory corresponding to the circuit configuration of the user logic, which performs error checking in the configuration memory;
An execution order table for storing order information of areas for executing error checking of the configuration memory;
Based on the area information stored in the area table and the order information stored in the execution order table, an error check is performed on a predetermined area in a predetermined order for the read / write unit and the functional block unit. A sequencer section that controls to perform,
An error signal output unit that inputs an error signal including region information in which an error from the functional block unit is detected,
Equipped with a,
The order information stored in the execution order table describes the number of repeated checks based on the operating rate and importance of the user logic,
A programmable device characterized in that the frequency of error checking is increased for the area of the configuration memory corresponding to the user logic having a high operating rate and high importance . The programmable device according to claim 6,
The diagnostic means of the configuration memory has an interrupt signal input section having at least one input port, and executes an error check interrupt operation designated based on an interrupt signal input from the input port. A programmable device characterized by A programmable device according to claim 6 or 7,
The diagnostic means of the configuration memory includes an internal diagnostic unit for confirming the normal operation of the diagnostic means itself,
The internal diagnostic unit includes an error data insertion unit that inserts error data into the configuration memory, and a comparison unit that compares the inserted error information with detected error information. A programmable device according to any one of claims 6 to 8,
The functional block unit performs error detection and correction processing of the configuration memory, and is composed of a plurality of functional blocks according to the processing content, and each functional block can be added or deleted as necessary. A programmable device characterized by a possible module configuration.

Images