KR101825568B1 - Failure Detection and Mitigation in Logic Circuits - Google Patents

Abstract

The present invention relates to a method for monitoring a logic circuit against a fault. In particular, the method relates to establishing parallel logic cores, and failures are detected by comparing redundant paths to equivalents at core locations by redundancy checkers. The mismatch will result in a predetermined failure safe operating mode. Additionally, important techniques are applied to periodically run individual parallel paths to ensure that the logical core is verified in a way that does not interfere with any processes that are monitored or controlled. This feature is important in some industries, such as the nuclear industry, and safety critical operations require a high level of reliability on logic circuit blocks that can be used infrequently.

Description

{Failure Detection and Mitigation in Logic Circuits}

This application is a continuation-in-part of U.S. Patent Application No. 12 / 026,703 filed on February 6, 2008. The entire contents are hereby incorporated by reference.

The present invention generally relates to a method for designing high integrity logic circuits. It is particularly concerned with safety-related control systems, including nuclear plant reactor protection systems, where integrity and reliability are paramount. The present invention particularly relates to performing these methods in a logic device such as a PAL, CPLD, FPGA, ASIC, or gate array, or a combination of multiple logic devices. Such logic devices are generally mounted on a printed circuit board.

Other inventions have attempted to improve the reliability of mission critical logic components in computerized systems. For example, U.S. Patent 7,290,169 describes a core level processor lock stepping system in which two microprocessors are operated in parallel and each provides an external output signal to be compared. The microprocessor is intended to operate in a tightly coordinated manner to operate in a lockstep, i. E., To match its output in a reliable manner. In actual practice, this method has a number of problems with safety critical systems. It is difficult to keep the microprocessor completely in the lockstep. There may be potential failures in the system that are not exposed until the system is actually used.

U.S. Patent No. 7,237,114 provides a chip lock step to provide similar operating accidents and problems but to inspect against "soft errors ". It has the same problems as described immediately before.

U.S. Patent No. 6,233,702 discloses a method of using software (e.g., using functional failures, redundancy) and software techniques (fast failures, e.g., software recovery with high data integrity hardware) ≪ RTI ID = 0.0 > and / or < / RTI > using fault tolerant data processing). The error checking avoids the use of redundancy, especially for comparing key data points between parallel processors, and instead only compares points operating at an I / O point or at a later rate than in main memory. This design is complex in its entirety and has problems with unprecedented errors to be discussed briefly. It is also a software-based system with problems to be briefly discussed.

U.S. Patent No. 7,134,104 describes a method for improving fault tolerance in an FPGA by generating at least three parallel copies of a logical function and then using a voting scheme to determine if any particular copy is defective Explain. While this method generally improves fault tolerance, it is not a satisfactory scheme for a safety critical environment where majority voting is not always convincing that it is a non-defective result.

U.S. Patent No. 5,144,230 describes a self-test circuit by a method called cycle stealing. When the output signal is not required to perform it as a normal function, the output signal from the 'circuit under test' is tested by selectively applying the test input signal. While this is one possible way to check the processor, testing does not provide any protection against failures affecting the dependent system. When parallel redundancy is used, bowter steam is used to determine if it is an unjoined result. These methods are not acceptable for a safe critical environment where a highly reliable system is desired.

US application 2007/0022348 describes a parallel lockstep core similar to the previously described U.S. Patent No. 7,290,169, except that the median value from the core is also compared to the output. However, this system has all the problems in maintaining two cores in the lockstep. For example, when there is an error, the cache must be loaded into system memory to ensure that the lockstep is kept forward. When there is a system or programming change, the cache must be maintained and continuously validated. The system is also software based.

There is a need in the art for providing a highly reliable system rather than a software based system. For example, in a safety critical system such as a nuclear power plant protection system, it is not desired to be dependent on executable software because of the tendency of potential errors. The software has inherent operational problems that are difficult to resolve. Even relatively simple systems require a significant amount of program code. In particular, software microprocessor systems target common mode faults where parallel redundant systems can fail simultaneously due to fault conditions.

Despite the redundancies that may be included in a software microprocessor system, defects can often fully impact redundancy functionality, such that it is not possible to accurately select non-defective results, and the system will experience common mode failures. Common mode faults can result from single faults or various faults. System-based microprocessors are known to be vulnerable to common mode failures where duplicate copies of software fail under the same defects. In particular, common mode faults prevent a software microprocessor system from being desired in a plant protection system.

For purposes of the present invention, the following definitions apply. The failure is the interruption of the ability to perform the required function. See also mission failure. Failure may not be noticed or detected until the next test, which is called unannounced failure. They can be acknowledged or detected in many ways at the moment of occurrence, called a known fault. A mission is a single object, task, or item or system purpose. Mission failures are impossible to complete the mission mentioned within the limits mentioned. A critical function is a function required in a logic circuit to perform a mission.

In the context of safety associated with a control system, a high integrity system will have the following two critical characteristics:

1) It will perform its mission when requested. When there is a predetermined set of input conditions, the mission should normally operate the field device. In order to have a high degree of confidence in performing the mission, there should be no undetected failures in the system when requested. Unknown failures can cause the system to malfunction at the moment the mission is requested. This means that all faults must be detected and noticed.

2) Unintended actuation of the control system due to logic circuit failure must be avoided. These actuations cause field devices to often perform expensive safety functions. In order to do this, all faults must be separated before they reach the field devices.

A common way to increase reliability and availability in logic circuits used in critical applications is to use triple or more redundancy (TMR). This is typically done in nuclear, space, and military applications. Having a TMR logic circuit with a majority convoy scheme allows fault tolerance. If many of the redundant logic circuits do not fail, the system will perform its function. Unfortunately, if the majority is in error compared to a decimal, the system will use the error in that function.

If a fault is allowed to accumulate in the TMR system, it can have a fatal effect. In particular, if it is applied to a safety critical application, the system can fail to take appropriate corrective action to eliminate the problem before it becomes serious, or to fail its function of shutting down the system.

Faults in the TMR logic circuit can be detected by comparing the outputs between the redundant logic circuits. However, it can not detect faults in logic circuits that do not result in unannounced faults, i. E. Output changes. Unpredicted faults in the system are not detected until a specific logical function is performed. That is, until a particular logical path is used.

Unpredicted faults are particularly problematic in nuclear safety systems that are normally in a "standby" position where no input or output changes state. The safety system may remain in this state for extended periods of time that allow unannounced failures to accumulate. Unposted failures can be undetected for weeks, months, or even years.

Uniquely adding a TMR to a system adds complexity that reduces overall reliability. Maintenance is increased by additional logic and additional programming. The addition of additional redundant modules (four or more) will improve protection against unannounced failures by establishing the booting logic and reducing the likelihood of affecting it, but a proportionate reduction in reliability Increases complexity from loss.

It is an object of the present invention to provide a method of monitoring a logic circuit for failures that do not have prior art problems, such as potential failure of the system.

The present invention relates to a method of devising high integrity logic circuits and monitoring them to verify correct operation. In particular, the method relates to establishing a parallel logic circuit core in which faults are detected by comparing redundant paths to equivalents at a core location by a redundancy checker. Any mismatch will result in a predetermined failure safe operating mode. Additionally, the method is deployed to periodically perform individual parallel paths to ensure that the logic circuit path is monitored, or to ensure that it is performed in such a way that it does not interfere with any controlled process, but exposes unannounced faults.

The features of the present invention are important in some industries, such as the nuclear industry, and such safety critical operations require a high level of reliability on logic circuit blocks.

Figure 1 shows a graphical illustration of the execution of a cascaded core using a redundancy checker.
Figures 2 and 3 illustrate another graphical illustration of the execution of two parallel cores using redundancy checkers.
Figure 4 shows important details of the built-in self-test of the present invention.

An important object of the present invention is to provide a highly reliable logic circuit with a guarantee that it can perform the intended mission when requested.

It is a further object of the present invention to provide a method of designing a fault-safe logic circuit that runs in a single logic device such as a PAL, CPLD, ASIC, gate array, or FPGA. Alternatively and equivalently, the logic circuitry is implemented in a combination of multiple logic devices on a single printed circuit board (PCB). Alternatively and equivalently, they are implemented in a combination of multiple printed circuit boards having one or more logic devices such as PAL, CPLD, FPGA, ASIC, or gate array.

The present invention can be combined with redundancy and / or fault tolerance at the application level by having multiple parallel systems capable of performing missions. If one of these systems fails and enters a fail-safe state, the other system (s) remains available to perform the mission. Another way to improve integrity is to have three or more parallel logic circuit cores in testing mode where two are used to provide fail safe operation and the third logic core is offline. The core is then periodically rotated so that at least two cores are always online and one is always tested. Alternatively, the testing schedule is established such that all cores are normally online and periodically one core is offline during testing.

Parallel logic cores are correctly replicated, or similarly replicated, to perform the same mission. In later cases, the cores are variously replicated cores or various cores in parallel.

The present invention is applicable to industrial process monitoring and control. The present invention relates to a safety critical control system, in particular including nuclear plant reactor protection systems, where reliability and integrity are paramount.

Logic circuits are susceptible to the following errors:

1. Single Event Effect (SEE) caused by cosmic ray or high energy proton, single event upset (SEU) causing transient pulse in logic, bit in memory cell and register Bitflip, and single event latchup (SEL).

2. Electrostatic discharge (ESD) and electrical overload (EOS).

3. Flash cell collapse / breakdown caused by device failure, device design failure, or excessive heating.

4. Aging associated with manufacturing failures and / or failures such as oxide failure, metal layer failure, electron transfer, wire erosion bonding, contamination effects from moisture, or chemicals used in the process.

In safety critical systems such as nuclear power plants, the above items are of increasing interest and importance.

The common point about all the above faults is that they generally occur non-uniformly in time and location, and generally affect only one or several transistors. These errors can cause serious problems.

The present invention describes a method for designing a logic circuit in which failures are automatically detected and mitigated in a way that other independent systems are not adversely affected.

The present invention provides a minimum addition of complexity and increases overall reliability to a minimum of maintenance.

The present invention can be combined with a fault tolerant scheme.

One embodiment of the present invention is a combination of the following three techniques:

1. The use of parallel redundant cores to ensure that all failures are immediately detected and separated by redundancy checkers.

2. Use of a built-in self-test engine to perform critical functions within the core for protection against unannounced failures. If a fault is detected before actual use, the fault is noticed.

3. The parallel redundant core interface for external communication is uniquely protected by:

a) A series or parallel interface is protected by a redundancy or cyclic redundancy check (CRC).

b) 'toggle test' on input. The toggle test is a method to ensure that the input circuit and its connections are functional. This test generally involves blocking the input from the sourcing device and applying a test input signal to the logic circuit. If the input mirrors the test input, the input circuit can be judged to be functional.

c) Independent readback of the output. This is an independent method of verifying the state of the output by including feedback on the input. An example may be by verifying that the relay is actually actuated when requested by using a spare contact on the relay to drive the input. A variety of different analog and digital outputs can be wired to the input in series or in parallel for verification in this way.

In a preferred embodiment of the present invention, a built-in self test (BIST) structure is placed on the programmable logic device and its function is performed in a manner that does not affect the logic circuit output. An important feature of the BIST is that it exposes any unrecognized faults in the parallel core. BIST has the following critical functions:

1. BIST engine tests parallel cores by pseudo random input stimuli.

2. The BIST engine tests parallel cores by applying a planned or programmed input stealing sequence.

3. It tests all state transitions and output combinations.

4. It verifies the ability of the parallel core to perform the mission.

5. It does any single item or combination of the above.

Additionally, in one embodiment, the BIST tests the parallel core by:

1. Monitor critical internal conditions from the core.

2. Monitor critical output from the core.

3. Testing two redundant cores for each other by comparison at the selected location.

4. 'Cumulate' the internal state with a checksum on each parallel core.

5. In each parallel core, the output response is 'cumulative'

6. It does any single item or combination of the above.

In one important embodiment, a test method by which a BIST verifies a parallel core involves:

1. Place one of the parallel cores in test mode to avoid affecting the state of any input or output,

2. Disable redundancy checkers for the tested cores,

3. Apply a predetermined set of inputs to at least one input or internal state for the previously tested core.

4. Verify the core's response to the input by monitoring the internal state change and core output for a checksum or for a predetermined pattern.

5. Restore core and disabled suppression redundancy checkers in normal operation.

Another embodiment test method by which the BIST verifies the parallel core relates to the following:

1. Place the logic circuit in a test mode where the state of any output is not affected,

2. Applying the same predetermined set of inputs to all parallel cores as described above,

3. Verify the response of all parallel cores by the redundancy checker.

In one preferred embodiment, there are multiple barriers to ensure that the logic circuit can not continue operation after a redundancy error has occurred. In a plant protection environment, fault-safe signals are sent to all affected parallel cores to stop all operations. All suitable functional cores will obey this signal and stop operating. One of the mismatched parallel cores that cause this condition may not be able to submit to this signal for the same reason as causing an error. To solve this:

1. Communication to other systems is configured in such a way that the parallel cores must match to succeed. This method does not allow faulty logic to deliver error data to unaffected / dependent systems. This is done by:

a) An AND or OR gate of communication data for intentionally generating an invalid CRC checksum.

b) AND gate ON (ON) Enable communication data output (enable). This prevents data from being transmitted.

A preferred embodiment of the present invention uses an FPGA to perform major control functions. In alternate embodiments, alternatives to FPGAs are used that include ASICs (application specific integrated circuits), CPLDs (compound programmable logic devices), gate arrays, and PALs (programmable array logic). These devices are commonly referred to as programmable logic devices, complex logic devices, or logic devices. All of these devices may be used through appropriate programming to operate without the use of executable software. Systems controlled by these devices may be described on a hardware basis.

Logic devices are programmed using logic tailored to the needs of a given application and can be programmed using AND gates, OR gates, XOR gates, flip flops (D, JK, SR), counters, timers, multiplexers, ≪ RTI ID = 0.0 > and / or < / RTI > When properly programmed, the logic device will behave in a highly predictable, deterministic manner.

In one important embodiment, the logic circuitry is described at a register transfer level that includes a hardware description language such as the verilog or VHDL, and schematic capture. The critical function of the entire logic circuit, or logic circuit, is duplicated by the redundant core. The input to the core is designed in such a way as to ensure that error free is transferred to the internal core register.

The logic circuit will receive an external input. The input to the logic circuit may include either a serial interface protected by redundancy, a discrete input, or a digitized analog value. Critical inputs are guaranteed by redundancy testing, XOR toggle testing, CRC and / or external loopback testing. Random input testing is performed in a way that does not affect input data. Typical input circuits include bus communication circuits (serial and parallel), digital channels (serial and parallel), and digitized analog circuits.

The output from the parallel core is designed in such a way as to ensure that the output functions. Confidence comes from redundancy testing, XOR toggle testing, CRC and / or external loopback testing. The outer loopback test is an independent verification of the output signal by routing the output signal back to the input. The output signal is then compared to the actual measured value. Typical output circuits include bus communication circuits (serial and parallel), digital channels (serial and parallel), digital channels (serial and parallel), communication circuits (serial and parallel), digital circuits (serial and parallel) .

I / O from logic circuits generally includes the following important features:

1. Serial or parallel interface protected by redundancy.

2. A serial or parallel interface from redundant cores is ANDed or ORed by the redundancy checker in the CRC to ensure that all communications to other systems are stopped when a failure occurs due to a CRC failure in the communication.

3. Input from discrete inputs.

4. Discrete outputs that can drive relays, solid state relays, field components, or other system inputs.

5. Significant output is tested by the following means.

a) Guaranteed by redundancy,

b) XOR toggle test,

c) CRC, and

d) External loopback test.

The output test is performed in a manner that does not cause undesired field actuation.

In one preferred embodiment, the BIST is executed by:

1. Designed to perform critical functions such as traversing all states in a finite state machine or a specific set of complex states.

2. The critical function of the logic circuit is judged and tested for satisfactory operation. This can include all the functions of the circuit.

3. In the logic circuit, inject the test input signal in such a way that a stuck-at fault can not exist.

4. Designed in such a way that it does not affect the output. This can be done by:

a) freezing the output during the test, or

b) Perform the test in a period of time when the output is not updated.

5. Verify the operation of the logic circuit by:

a) Having a BIST engine verifies functionality by monitoring the internal state (i. e., the key value or register in the core, called the critical state, and the core output). The form of data compression can be used to simplify core output or internal state conditions based on BIST input stimulation.

b) Having multiple BIST engines enables synchronization routines between redundant cores. In this case, the BIST engine does not need to verify the output. This will be done by a redundancy checker that can compare two cores at a key point, or compare the outputs of two cores for a match.

6. Upon completion of the BIST, the logic circuit is restored to its proper state. That is, the arbitrary parallel core being tested is restored to normal operation.

In one preferred embodiment, the redundancy check logic is used to determine whether the logic circuit is faulty and to place the logic circuit in a fault-safe state. The redundancy checker monitors key redundancy checkpoints in the logic circuitry (i. E., The signal from a given circuit in each of the redundant logic cores is wired to the redundancy checker logic). The redundancy checker then finds the discrepancy between the two cores by comparing the two signals from each of the redundant cores for an exact match. If the values are not matched, a redundancy failure (i.e., an error) is detected. Additionally, the redundancy checker is implemented by comparing the threshold signal (threshold data) preferably including both the critical internal state and the output.

In the preferred embodiment, there is no mismatch between parallel redundant cores because the system is hardware based. They will receive the same input at exactly the same time, and the core will work at full concurrency.

By monitoring the internal state and output from each redundant core, the redundancy checker will immediately detect a state change in the critical function, such as an unintended actuation signal generated by the core due to a failure. Without redundancy checks to mitigate this fault and force the logic circuit into a fault-safe state, the fault can propagate to the dependent system and cause unintended power plant transients.

In a preferred embodiment, the critical functions of the logic circuit monitored by the redundancy checker include logic determination, limit checking, state machine, detection logic, and control logic.

In another important embodiment of the present invention, the parallel cores are not correctly replicated. That is, parallel cores complete the same mission or function, but due to the variety in design. The cores are referred to as various cores in parallel. Diversity can be established by how the program is physically located within the FPGA, for example, by changing the way the interconnected resources are used, or by minor programming differences between the given programmers . The diversity can be very wide if other logic devices are used in execution (for example, using a microprocessor to perform part of a logic or other FPGA vendor).

Diversity is a very important operational safety feature to ensure that programming errors do not affect the overall safety of the operation. Two, three, or more cores may be individually programmed by two or more programmers. To improve diversity, other programmers have even a fairly simple programming mission and are tasked with taking different approaches. The method for ensuring diversity or other performance may be achieved by using various optimization techniques such as using a hierarchical optimization, or otherwise using a flattening, or various state encodings Quot; one hot "versus" gray code ").

In the case of using various cores in parallel, the redundancy checker compares the value from the selected point in the core, the value from the output point, or both.

In one embodiment of the invention, diversity can be extended to include the use of a microprocessor with software executable in parallel with an FPGA-based system free from the use of executable software. For example, one parallel core may be executed in a logic device and another parallel core may be executed in a software based processor device. The redundancy checker can then be used to look at the output at both cores to monitor the mismatch.

In the case of software-based parallel cores, the built-in self-test is characterized by the use of a combination of watch dog, runtime assertion and self-testing to ensure accurate operation and detection of untested failures. . ≪ / RTI > In one preferred embodiment, the software-based BIST executes a threshold function, injects a test input signal, stops the output during the test, performs a test in a period of time during which the output is updated, verifies the operation of the processor, And may be designed to test the processor by using a previously described technique, such as verifying functionality by monitoring a key value or register. Upon completion of the BIST, the processor is restored to its proper state.

Figure 1 shows a graphical illustration of the execution of two parallel cores using a redundancy checker. The first core A 101 and the second core B 102 are parallel and redundant representations of logic circuits. The redundancy checker circuit 103 already described is used to verify the integrity operation of the core. The BISTs 104 and 105 are shown as each part of the core structure, but can alternatively and equally be shown separately. The overall logic circuitry is within a single FPGA 106 or other logic device. Alternatively, the logic circuitry may be located on multiple logical devices. The same input is received by core A and core B and its output is monitored by the redundancy checker for an exact match. The fault signal from the redundancy checker, as well as the output from the two cores, is the output from the FPGA. An output failure safety gate is used but is not shown in FIG. This feature is illustrated in Fig.

Figure 2 shows the implementation of a cascaded core using another embodiment of the redundancy checker. The cascaded redundant cores 215 and 225 are used to implement the logic circuit. Additional details of the redundant cores are shown including input registers 210 and 220, output registers 211 and 221 and built-in self-test (BIST) features 214 and 224. The redundancy checker 205 is used for reliability and error checking and for activating the fail safe mode 203. Some of the redundant cores are the critical functions 212, 222 where the critical state 213, 223 variable or information resides. This information is used for error checking by the redundancy checker 205 as shown.

Input 201 flows to parallel input registers 210 and 220. The inputs are used by the logic circuit according to the system design and the output registers 211, 221 are updated. The core output then flows from the output resistor through the output failure safety gate 204 that is then coupled and becomes the output 202 for the system. This is the gate ON communication data output enable. This prevents data from being transmitted when there is a redundancy check that has been detected as a failure. Output failure safety 203 is activated by redundancy checker 205 when an error is detected to warn the system. Failure safety can be a relay contact closure, an alarm or some kind of communication. The entire logic circuit 200 stays on a single logic device, such as a PAL, CPLD, FPGA, ASIC, or gate array. Alternatively, the logic circuitry may be located on multiple logical devices.

Figure 2 is another embodiment of a redundancy checker similar to Figure 1. In Fig. 2, the redundancy checker additionally uses the critical state (i. E., Value) in each redundant core for comparison. This additional information is useful for rapidly exposing an undisclosed failure.

In this case, the BIST monitors the redundant cores in the self-test.

Similarly, Figure 3 shows another embodiment of the redundancy checker. The cascaded redundant cores 315 and 325 are used to execute the logic circuit using input registers 310 and 320, output registers 311 and 321 and built-in self test (BIST) features 314 and 324 . The redundancy checker 305 is used for reliability and error checking and for activating the failure safe mode 303. Some of the redundant cores are threshold functions (312, 322) where the threshold state (313, 323) variable or information resides. This information is used for error checking by the redundancy checker 305 as shown.

Similarly, as before, the input 301 flows to the parallel input registers 310, 320. The inputs are used by the logic circuit according to the system design and the output registers 311 and 321 are updated. The core output then flows from the output register through the output failure safety gate 304 that is then coupled and becomes the output 302 for the system. The output failure safety 303 is activated by the redundancy checker 305 when an error is detected to warn the system. The entire logic circuit 300 stays on a single logic device. Alternatively, the logic circuitry may be located on multiple logical devices.

In this case, the BIST additionally uses a threshold state and an output register in the self-test.

FIG. 4 shows important details of a typical built-in self test (BIST) 314. In this case, Figure 4 is additional detail from Figure 3. The output register values from the redundant core 315 and the critical state 313 are input to an output verification routine 401 that passes through the BIST finite state machine (FSM) The BIST is controlled by the FSM. When activated by an operator, timer, or event, the BIST will generate input styli as either a random sequence or as a sequence 403 programmed into the input register 310. BIST monitors redundant cores, redundant core outputs, and critical status to verify correct operation. This verification includes comparing against a stored reference, comparing to another redundant core, or generating a checksum of the monitored output and verifying it against a reference checksum.

It is a preferred embodiment of the present invention for executing the BIST during normal operation of the logic circuit. That is, the logic circuit activates the BIST while performing the mission. This is done without affecting other systems or outputs by methods including:

1. Stop output during test.

2. Perform the test during the time that the output is updated.

3. Place one of the parallel cores in a specialized test mode, isolate it so that it does not affect the state of any input or output, and suppress the redundancy checker associated with the core being tested.

A typical mission for a logic circuit is to provide a process function between the input and the output according to the design. The design may be either readiness, or safety related functions such as in a plant protection system. The design may be further included if it is process control.

The logic circuit mission may also include interfacing with the control circuitry. They include external logic, decision, detection, and control circuitry. These circuits are common in power plant determinations involving process control and safety. They can be binary (on / off) types of circuits, or they can be control related circuits including sensors, switches, process controllers, and actuators. They may be part of an interface to a relay-based system and other computerized systems.

In another embodiment of the present invention, the redundancy checker is not located on the logic device in which the parallel core is located. The redundancy checkers are individually located on another logical unit. It is then connected by a communication path to the output of the core to provide redundancy checking. The redundancy checker then operates as described in Figures 1-3 by failure signal or the like.

In a preferred embodiment, the present invention is based on a hardware platform rather than a software based microprocessor system. It differs significantly from a software-based microprocessor control system architecture by running logic in logic devices by eliminating problems with software-based microprocessor systems, such as executable software and software common mode failures. It provides highly reliable systems suitable for safety critical control systems, including nuclear reactor protection systems at nuclear power plants.

While various embodiments of the present invention have been described, the present invention can be modified and modified in various ways by those skilled in the art. The invention, therefore, is not intended to be limited to the illustrations and illustrations shown herein but embraces all such embodiments, modifications, and variations that fall within the scope of the claims.

101: Core A
102: Core B
103: Redundancy Checker
104, 105: BIST
200: logic circuit
201, 301: Input
202, 302: Output
203, 303: Fail safe
204, 304: output failure safety gate
205, 305: redundancy checker
210, 220, 310, 320: input register
211, 221, 311, 321: output register
212, 222, 312, 322: critical function
213, 223, 313, 323: Critical state
214, 224, 314, 324: BIST
215, 225, 315, 325: redundant cores
401: Output verification
402: BIST FSM
403: Input styli generator random or programmed sequence

Claims (31)

As a logic circuit with high integrity:
a. A plurality of parallel cores used to perform the critical function of the logic circuit,
b. The parallel cores may be redundant or diverse,
c. As a redundancy checker,
I. Verifying whether a plurality of values from the first parallel core match a plurality of values from the second parallel core, and
Ii. Said redundancy checker being used to activate said logic circuit to a fault-safe state in accordance with a predetermined criterion,
d. The logic circuit interfacing with a plurality of inputs and a plurality of outputs,
e. Said logic circuit performing a mission related to said input and said output, said mission being a safety critical mission,
f. Said logic circuit and said input and said output comprising:
I. Redundancy,
Ii. Cyclic redundancy check, and
Iii. A toggle test on the input, and
Iv. The logic circuit being protected by at least one item selected from the group consisting of readback on the output, and communication between the input and the output,
g. A built-in self test that is used to expose an unrecognized fault in the parallel core,
h. The built-in self test in which the logic circuit is periodically or continuously performed while performing the mission,
i. Said threshold function of said logic circuit being executed in at least one logic device,
j. Said at least one logic device being implemented free from the use of executable software. The method according to claim 1,
a. Wherein the redundancy checker is located on an individual logic device from the parallel core and is in contact with the parallel core by a communication path to the output of the parallel core,
or,
b. Wherein the redundancy checker is located on the same logic device in which at least one of the parallel cores is present. As a logic circuit with high integrity:
a. Wherein the parallel core is used to perform a critical function of the logic circuit and includes redundant or various different parallel cores, the parallel core interfaces input and output circuits,
b. A redundancy checker for providing error detection in the parallel core,
I. The mismatch between the parallel cores, and
Ii. The redundancy checker including a state change in a critical function of the logic circuit,
c. And said redundancy checker activating said logic circuit in a fault-safe state for any said error detection,
d. At least one built-in self test structure that exposes a fault in a critical function of the logic circuit,
e. The threshold function of the logic circuit being executed in at least one logic device, and
f. Said logic device being freely executed in use of executable software. The method of claim 3,
Wherein the threshold function of the logic circuit comprises:
a. A single logical device,
b. A plurality of logic devices on a single printed circuit board, and
c. And a plurality of printed circuit boards each having at least one logic device on each of said printed circuit boards. delete The method of claim 3,
a. The input circuit comprising:
I. Serial bus communication circuit,
Ii. Parallel bus communication circuit,
Iii. Serial digital channels, and
Iv. And at least one item from the group consisting of parallel digital channels,
b. The threshold function comprises:
I. Logical decision,
Ii. Limit check, and
Iii. Comprising at least one item from the group consisting of state machines,
c. The output circuit comprising:
I. Serial bus communication circuit,
Ii. Parallel bus communication circuit,
Iii. Serial digital channels, and
Iv. And at least one item from the group consisting of parallel digital channels. The method of claim 3,
a. The input circuit comprising:
I. Serial communication circuit,
Ii. Parallel communication circuit,
Iii. Serial digital circuit,
Iv. Parallel digital circuit, and
V. At least one item from the group consisting of digitized analog circuits,
b. The output circuit comprising:
I. Serial communication circuit,
Ii. Parallel communication circuit,
Iii. Serial digital circuit,
Iv. Parallel digital circuit, and
V. At least one item from the group consisting of digitized analog circuits,
c. The threshold function comprises:
I. Decision logic,
Ii. Detection logic, and
Iii. And at least one function from the group consisting of control logic. The method of claim 3,
Wherein the redundancy checker receives threshold data associated with each of the parallel cores, the threshold data comprising:
a. The critical internal state from the parallel core, and
b. And a critical output signal from said parallel core. The method of claim 3,
Wherein said built-in self-test structure executes said parallel core associated for the purpose of exposing an undefined fault. The method of claim 3,
The built-in self-test structure comprises:
a. Placing a single selected parallel core in a test mode that does not affect the mission of the logic circuit or cause unintended actuation of the output circuit,
b. Wherein the redundancy checker is functionally inhibited for the selected parallel core,
c. Applying a predetermined set of inputs to at least one input or an internal state of the selected parallel core,
d. Verifying the response of the selected parallel core to the set of predetermined inputs via an internal state change and a selected parallel core output,
e. Restoring the selected parallel core with normal operation and restoring the redundancy checker. ≪ Desc / Clms Page number 20 > The method of claim 3,
The built-in self-test structure comprises:
a. Placing the logic circuit in a test mode that does not guarantee any unwanted actuation of the output circuit,
b. Applies the same predetermined set of inputs to all of said parallel cores, and
c. And to verify the response of all said parallel cores to said set of identical predetermined inputs by use of said redundancy checker. The method of claim 3,
a. Wherein the logic circuit is implemented using at least three parallel cores,
b. At least two parallel cores are interfaced to a plurality of inputs and a plurality of outputs in an operating mode,
c. The logic circuit operating the output based on the input in accordance with a predetermined criterion, and
d. The single selected parallel core is periodically removed from the operating mode and located in a test mode, wherein the test mode comprises:
I. Separating the selected parallel core from the one that affects the state of the input or the output,
Ii. At least one input or a set of predetermined inputs into the internal state of the selected parallel core,
Iii. Verifying the correct response of said selected parallel core to said set of predetermined inputs via internal state changes and selected parallel core outputs, and
Iv. And restoring the selected parallel core with normal operation. ≪ Desc / Clms Page number 21 > The method of claim 3,
All the parallel cores and all the redundancy checkers are executed in the logic circuit. The method of claim 3,
Wherein the at least one logic device comprises a PAL, CPLD, FPGA, ASIC, or gate array. The method of claim 3,
Wherein the redundancy checker is located on an individual logic device from the parallel core and the redundancy checker is located on the same logic device in which at least one of the parallel cores is present. As a logic circuit with high integrity:
a. A plurality of parallel cores used to perform the critical function of the logic circuit,
b. Said logic device comprising at least one of said parallel cores running in a logic device and free from use of executable software,
c. At least one of said parallel cores executing using software executable in a processor,
d. As a redundancy checker:
I. Verifying whether a plurality of values from the first parallel core matches a plurality of values from the second parallel core, and
Ii. Said redundancy checker being used to activate said logic circuit in a fail safe state according to a predetermined criterion,
e. The logic circuit interfacing with a plurality of inputs and a plurality of outputs,
f. Said logic circuit performing a mission associated with said input and said output,
g. Said logic circuit and said input and said output comprising:
I. Redundancy,
Ii. Cyclic redundancy check,
Iii. A toggle test on the input, and
Iv. The logic circuit being protected by at least one item selected from the group consisting of readback on the output, and communication between the input and the output,
h. A built-in self test that is used to expose unprecedented failures in the parallel core, and
i. Wherein the built-in self test is performed periodically or continuously while the logic circuit performs the mission. CLAIMS What is claimed is: 1. A method for mitigating the effect of a fault by detecting a fault in a logic circuit, comprising:
a. And providing a plurality of parallel cores that are redundant or various used to perform the critical function of the logic circuit,
b. Providing a redundancy checker that provides error detection in the parallel core,
I. The mismatch between the parallel cores, and
Ii. Providing a redundancy checker comprising a state change in a critical function of the logic circuit,
c. Said redundancy checker being used to activate said logic circuit in a fault-safe state for said fault detection,
d. Providing at least one built-in self test structure, which is used to expose a fault in the critical function of the logic circuit,
e. Providing the at least one logical device, wherein the threshold function of the logic circuit is executed in at least one logical device, and
f. Said logic device being freely executed in executable software,
Whereby the logic circuit is monitored for the fault detection and the fault detection by the built-in self test, and
Whereby the effect of the fault is mitigated by the fault-safe condition. ≪ RTI ID = 0.0 > 11. < / RTI > 18. The method of claim 17,
Wherein the threshold function of the logic circuit comprises:
a. Single logical unit,
b. A plurality of logic devices on a single printed circuit board, and
c. Wherein the method is executed on a selection from a group consisting of a plurality of printed circuit boards each having at least one logic device on each of the printed circuit boards. 18. The method of claim 17,
Wherein the parallel core is interfaced with an input circuit and an output circuit. 20. The method of claim 19,
a. As the input circuit,
I. Serial bus communication circuit,
Ii. Parallel bus communication circuit,
Iii. Serial digital channels, and
Iv. And at least one item from the group consisting of parallel digital channels,
b. As the threshold function,
I. Logical decision,
Ii. Limit check, and
Iii. Comprising at least one item from the group consisting of state machines,
c. The output circuit comprising:
I. Serial bus communication circuit,
Ii. Parallel bus communication circuit,
Iii. Serial digital channels, and
Iv. And at least one item from the group consisting of parallel digital channels. ≪ Desc / Clms Page number 19 > 20. The method of claim 19,
a. The input circuit comprising:
I. Serial communication circuit,
Ii. Parallel communication circuit,
Iii. Serial digital input circuit,
Iv. A parallel digital input circuit, and
V. And at least one item from the group consisting of digitized analog input circuits,
b. The output circuit comprising:
I. Serial communication circuit,
Ii. Parallel communication circuit,
Iii. Serial digital input circuit,
Iv. A parallel digital input circuit, and
V. At least one item from the group consisting of a digitized analog input circuit,
c. The threshold function comprises:
I. Decision logic,
Ii. Detection logic, and
Iii. Control logic, and at least one function from the group consisting of control logic. 18. The method of claim 17,
Wherein the redundancy checker receives threshold data associated with each of the parallel cores, the threshold data comprising:
a. The critical internal state from the parallel core, and
b. And a threshold output signal from said parallel core. A method for mitigating a fault effect by detecting a fault in a logic circuit. 18. The method of claim 17,
Wherein the built-in self-test structure executes the associated parallel core for the purpose of exposing an undefined fault. ≪ RTI ID = 0.0 > 8. < / RTI > 18. The method of claim 17,
The built-in self-test structure comprises:
a. Placing a single selected parallel core in a test mode that does not affect the mission of the logic circuit or cause unintended actuation of the output circuit,
b. Wherein the redundancy checker is disabled for the selected parallel core,
c. Applying at least one input or a predetermined set of inputs to the internal state of the selected parallel core,
d. Verifying the response of the selected parallel core to the set of predetermined inputs via an internal state change and a selected parallel core output, and
e. And restoring the selected parallel core in a normal operation and restoring the redundancy checker. A method for mitigating a failure effect by detecting a failure in a logic circuit. 25. The method of claim 24,
The built-in self-test structure comprises:
a. The test mode locating the logic circuit in a test mode which does not guarantee any unwanted actuation of the output circuit,
b. Applies the same predetermined set of inputs to all of said parallel cores, and
c. Wherein said redundancy checker is designed to perform an item of verifying the response of all said parallel cores to said set of identical predetermined inputs by use of said redundancy checker. 18. The method of claim 17,
Wherein the logic circuit is implemented using at least three parallel cores,
a. At least two parallel cores are interfaced to a plurality of inputs and a plurality of outputs in an operating mode,
b. Said logic circuit operating said output based on said input in accordance with a predetermined criterion, and
c. The single selected parallel core is periodically removed from the operating mode and placed in a test mode, the test mode comprising:
I. Separating the selected parallel cores from affecting the state of any of the inputs or outputs,
Ii. At least one input or a set of predetermined inputs into the internal state of the selected parallel core,
Iii. Verifying correct response of said selected parallel core to said set of predetermined inputs via internal state change and selected parallel core output, and
Iv. And restoring the selected parallel core in normal operation. ≪ Desc / Clms Page number 20 > 18. The method of claim 17,
Wherein all said parallel cores and all said redundancy checkers are executed in said logic circuit. 18. The method of claim 17,
Wherein the at least one logic device comprises a PAL, CPLD, FPGA, ASIC, or gate array. 18. The method of claim 17,
Wherein the redundancy checker is located on an individual logic device from the parallel core or the redundancy checker is located on the same logic device in which at least one of the parallel cores is present. Lt; / RTI > CLAIMS What is claimed is: 1. A method for mitigating the effect of a fault by detecting a fault in a logic circuit, comprising:
a. And providing a plurality of parallel cores to be used to perform the critical function of the logic circuit,
b. At least one of said parallel cores running in a logic device, said logic device being free to use executable software,
c. At least one of said parallel cores executing using software executable on a processor,
d. Providing a redundancy checker,
I. Verifying whether a plurality of values from the first parallel core match a plurality of values from the second parallel core, and
Ii. And the redundancy checker used to activate the logic circuit in a fail safe state according to a predetermined criterion,
e. Providing the plurality of inputs and the plurality of outputs, wherein the logic circuit is interfaced with a plurality of inputs and a plurality of outputs,
f. Said logic circuit performing a mission associated with said input and said output,
g. Said logic circuit and said input and said output comprising:
I. Redundancy,
Ii. Cyclic redundancy check,
Iii. A toggle test on the input, and
Iv. The logic circuit being protected by at least one item selected from the group consisting of readback on the output, and communication between the input and the output,
h. Providing a built-in self test that is used to expose unprecedented faults in any of said parallel cores, and
i. The built-in self-test being performed periodically or continuously while the logic circuit is performing the mission,
Whereby the logic circuit is monitored for the fault detection by the redundancy checker and the built-in self-test, and
Whereby the effect of the fault is mitigated by the fault-safe condition. ≪ RTI ID = 0.0 > 11. < / RTI > CLAIMS What is claimed is: 1. A method for mitigating the effect of a fault by detecting a fault in a logic circuit, comprising:
a. Providing a plurality of parallel cores that are used to perform the critical function of the logic circuit,
b. Overlapping or a plurality of said parallel cores,
c. As a redundancy checker:
I. Verifying whether a plurality of values from the first parallel core match a plurality of values from the second parallel core, and
Ii. Providing the redundancy checker used to activate the logic circuit in a fail safe state according to a predetermined criterion,
d. Providing the plurality of inputs and the plurality of outputs, wherein the logic circuit is interfaced with a plurality of inputs and a plurality of outputs,
e. Said logic circuit performing a mission associated with said input and said output,
f. Said logic circuit and said input and said output comprising:
I. Redundancy,
Ii. Cyclic redundancy check,
Iii. A toggle test on the input, and
Iv. The logic circuit being protected by at least one item selected from the group consisting of readback on the output, and communication between the input and the output,
g. Providing a built-in self test that is used to expose unprecedented faults in any of said parallel cores,
h. The built-in self test in which the logic circuit is periodically or continuously performed while performing the mission,
i. The threshold function of the logic circuit being executed in at least one logic device, and
j. The at least one logical device being freely executed in use of executable software,
Whereby the logic circuit is monitored for the fault detection by the fault detection and the built-in self test, and
Whereby the effect of the fault is mitigated by the fault-safe condition. ≪ RTI ID = 0.0 > 11. < / RTI >

Images