KR20200016777A - Device including safety logic - Google Patents

Abstract

Disclosed is an apparatus including safety logic. According to an exemplary embodiment of the present disclosure, the apparatus comprises: a first function module outputting a master signal; a second function module outputting a comparison signal with respect to the master signal; a toggle signal generator including one or more comparators generating a comparison operation result based on the master signal and the comparison signal, a feedback path generating a first toggle signal based on the comparison operation result and outputting a feedback signal to the one or more comparators, and a first multi-input gate generating a second toggle signal based on the comparison operation result; and a toggle signal monitor outputting a fault search signal based on the first and second toggle signals.

Description

DEVICE INCLUDING SAFETY LOGIC}

The technical idea of the present disclosure relates to a device including safety logic, and more particularly, to a device including safety logic that determines whether a master signal and a comparison signal are identical during a run-time operation.

In devices such as automobiles, latent faults are faults that are not detected by a safety mechanism performed within a detection interval of the fault and are not recognized by the user. These faults are inherent as silent faults and then spread to multiple faults, which can have serious consequences. A representative example of a latent defect is a defect in a memory bit.

In order to prevent these potential faults from occurring, the fault detection interval must be within the Late Fault Tolerant Time Interval (L-FTTI). For example, detection of a defect in a memory bit should be made every memory access. In this case, however, the logic BIST or software test library (STL) method that stops operations such as access and performs fault check is difficult to satisfy L-FTTI, and hardware / software cost for detection (HW / SW cost)

The technical idea of the present disclosure relates to safety logic and a device including the same, and provides safety logic and a device including the same to detect whether a signal is faulted and a gate is broken.

In order to achieve the above object, an apparatus according to an aspect of the present invention, the first functional module for outputting a master signal; A second function module for outputting a comparison signal with respect to the master signal; At least one comparator generating a comparison operation result based on the master signal and the comparison signal, a feedback path generating a first toggle signal based on the comparison operation result and outputting a feedback signal to the at least one comparator, and the comparison A toggle signal generator including a first multiple input gate to generate a second toggle signal based on a result of the operation; And a toggle signal monitor configured to output a fault search signal based on the first and second toggle signals.

Meanwhile, according to another aspect of the inventive concept, a toggle signal generator configured to output a first toggle signal and a second toggle signal based on a master signal and a comparison signal including a plurality of bits, respectively, and the first and first 2. A device comprising a toggle signal monitor configured to output a fault search signal by monitoring a toggle signal, wherein the toggle signal generator is configured to compare a comparison operation result by comparing each bit of the master signal with each bit of the comparison signal. A plurality of comparators configured to generate; A feedback path configured to generate the first toggle signal by performing a first gate operation based on the comparison operation result, and output a feedback signal to each of the plurality of comparators based on the first toggle signal; And a first multiple input gate generating the second toggle signal by performing a second gate operation based on the comparison operation result.

On the other hand, according to another aspect of the technical idea of the present disclosure, a device comprising: a plurality of comparators configured to generate a comparison operation result by comparing each of the input master signal and the comparison signal in bit units; A feedback path configured to generate a first toggle signal based on a result of the comparison operation, and generate a feedback signal output to each of the comparators based on a clock signal and the first toggle signal; A first multiple input gate configured to generate a second toggle signal by performing a first gate operation on the comparison operation result; And a toggle signal monitor configured to output a fault search signal including information on whether the master signal and the comparison signal are identical by monitoring the first toggle signal and the second toggle signal based on the clock signal. Can be.

The apparatus according to the spirit of the present disclosure may detect not only information on whether the master signal and the comparison signal are the same during runtime operation, but also information on the failure of the gates constituting the safety logic. As such, the device can improve stability by detecting potential defects during runtime operation.

1 shows a block diagram of an apparatus according to an exemplary embodiment of the present disclosure.
2 illustrates a specific block diagram of safety logic in accordance with an exemplary embodiment of the present disclosure.
3 is a block diagram illustrating a detailed configuration of a toggle signal generator according to an exemplary embodiment of the present disclosure.
4 is a block diagram illustrating a detailed configuration of a toggle signal monitor according to an exemplary embodiment of the present disclosure.
5 is a flowchart illustrating a method of operating an apparatus according to an exemplary embodiment of the present disclosure.
6 is a flowchart illustrating a method of operating a toggle signal monitor according to an exemplary embodiment of the present disclosure.
7 is a timing diagram for various signals output according to an exemplary embodiment of the present disclosure.
8A and 8B illustrate tables representing values of fault search signals output under respective conditions according to exemplary embodiments of the present disclosure.
9 is a flowchart illustrating a method of operating an apparatus according to another exemplary embodiment of the present disclosure.
10 is a block diagram illustrating a specific configuration of a toggle signal generator according to another exemplary embodiment of the present disclosure.
11 is a timing diagram for various signals output according to an exemplary embodiment of the present disclosure.
12 illustrates a specific block diagram of safety logic in accordance with another example embodiment of the disclosure.
13 illustrates a block diagram of an apparatus according to another exemplary embodiment of the present disclosure.
14 is a flowchart illustrating a method of operating an apparatus according to an exemplary embodiment of the present disclosure.
15 is a block diagram illustrating a System On Chip (SoC) employing safety logic according to an exemplary embodiment of the present disclosure.
16 is a block diagram illustrating a memory system employing safety logic according to an example embodiment of the disclosure.
17 schematically illustrates a vehicle employing safety logic according to an example embodiment of the disclosure.

Hereinafter, with reference to the accompanying drawings will be described in detail an embodiment of the present invention.

1 shows a block diagram of an apparatus according to an exemplary embodiment of the present disclosure.

Referring to FIG. 1, the apparatus 1 may include a first functional module 10, a second functional module 20, and a safety logic 30. The device 1 can be designed to perform various functions and the operation can be controlled based on various electrical signals. For example, device 1 may be a robotic device such as a drone, an Advanced Drivers Assistance System (ADAS), an autonomous vehicle, a smart TV, a smartphone, a medical device, a mobile device. The present invention may be applied to an image display device, a measurement device, or an Internet of Things (IoT) device, and may be mounted on at least one of various kinds of electronic devices.

The first function module 10 may perform at least one of various operations of the device 1. For example, the first function module 10 may output a master signal M_S to perform a predetermined operation or to perform a predetermined operation. As another example, the first function module 10 may output a sensing value (or a sensing signal) for temperature or power as the master signal M_S.

The second function module 20 may output a comparison signal C_S for comparison with the master signal M_S output from the first function module 10. In an exemplary embodiment, the second function module 20 may include the same configuration as the first function module 10. As a result, the second function module 20 may output the same comparison signal C_S as the master signal M_S under the assumption that there is no error. In other words, the first and second functional modules 10 and 20 may be designed to lockstep to detect a fault of the master signal M_S output from the first functional module 10.

In another exemplary embodiment, when the first function module 10 outputs a sensing value (or a sensing signal) for temperature, power, or the like as the master signal M_S, the second function module 20 may perform the sensing. A threshold for comparison with the value may be output as the comparison signal C_S. For example, when the first function module 10 is a temperature sensor, the first function module 10 outputs the sensing temperature as the master signal M_S, and the second function module 20 compares the threshold temperature value. It can output as a signal C_S.

The safety logic 30 may include a toggle signal generator 100 and a toggle signal monitor 200. In an example embodiment, the toggle signal generator 100 may receive the master signal M_S and the comparison signal C_S, and generate a first toggle signal TG_S1 and a second toggle signal TG_S2 based on the master signal M_S and the comparison signal C_S. Can be. In the present embodiment, the toggle signal may be a signal in which logic high and logic low are repeated at predetermined intervals.

The toggle signal generator 100 may output the first and second toggle signals TG_S1 and TG_S2 to the toggle signal monitor 200. In an example embodiment, the toggle signal generator 100 may include one or more comparators that generate a comparison operation result based on the master signal M_S and the comparison signal C_S, and a first toggle signal based on the comparison operation result. A feedback path for generating TG_S1 and outputting a feedback signal to one or more comparators, and a first multiple input gate for generating a second toggle signal TG_S2 based on a comparison operation result. For example, the master signal M_S (and the comparison signal C_S) may include a plurality of bits, and the toggle signal generator 100 may include as many comparators as the number of bits of the master signal M_S. As a result, the toggle signal generator 100 may perform a comparison operation for each bit of the master signal M_S and the comparison signal C_S.

The toggle signal generator 100 may transmit information on whether the master signal M_S and the comparison signal C_S are identical to the toggle signal monitor 200 through the first and second toggle signals TG_S1 and TG_S2. . For example, when the master signal M_S and the comparison signal C_S are the same, the first and second toggle signals TG_S1 and TG_S2 are the normal high-level toggle signals (eg, logic high and logic repeated at regular intervals). Low). When at least one bit is different between the master signal M_S and the comparison signal C_S, at least one of the first and second toggle signals TG_S1 and TG_S2 may have an abnormal shape. For example, when at least one bit is different between the master signal M_S and the comparison signal C_S, at least one of the first and second toggle signals TG_S1 and TG_S2 is not toggled for a predetermined time and is logic high. (Or logic low).

The toggle signal monitor 200 may output the fault search signal CON_S based on the first toggle signal TG_S1 and the second toggle signal TG_S2. In an exemplary embodiment, the toggle signal monitor 200 may include a first XOR gate and a first and second toggle signal that output a first error occurrence signal based on the first and second toggle signals TG_S1 and TG_S2. A second XOR gate that outputs a second error generation signal based on (TG_S1, TG_S2), a first output gate that outputs a first fault search signal based on the first and second error generation signals, and the first and It may include a second output gate for outputting a second fault search signal based on the second error occurrence signal.

The toggle signal monitor 200 may receive information on whether the master signal M_S and the comparison signal C_S are the same through the first and second toggle signals TG_S1 and TG_S2. As the toggle signal monitor 200 outputs the fault search signal CON_S based on the first and second toggle signals TG_S1 and TG_S2, the fault search signal CON_S is compared with the master signal M_S and the comparison signal C_S. ) May include information about whether they are identical.

In an exemplary embodiment, a predetermined error signal may be further input to the toggle signal monitor 200. For example, the first XOR gate included in the toggle signal monitor 200 outputs the first error generation signal based on the error signal, and the second XOR gate further outputs the second error generation signal based on the error signal. You can print As the toggle signal monitor 200 outputs the fault search signal CON_S based on the preset error signal and the first and second toggle signals TG_S1 and TG_S2, the fault search signal CON_S is the toggle signal generator 100. And the gate signals included in at least one of the toggle signal monitor 200 may be further included.

2 illustrates a specific block diagram of safety logic in accordance with an exemplary embodiment of the present disclosure.

2, the safety logic 30 may include a toggle signal generator 100, a toggle signal monitor 200, a clock generator 300, and an error injector 400. The toggle signal generator 100 may include a plurality of comparators 110-1 to 110 -N (N is a positive integer of 2 or more), a feedback path 120, and a first multiple input gate 130.

Each of the plurality of comparators 110-1 to 110 -N may receive a master signal M_S and a comparison signal C_S, and perform a comparison operation based thereon. For example, each of the master signal M_S and the comparison signal C_S includes a plurality of bits, and each of the comparators 110-1 to 110 -N includes a bit of the master signal M_S and the comparison signal C_S. Each of these may be input. In other words, the toggle signal generator 100 may determine whether the master signal M_S and the comparison signal C_S are the same on a bit basis through the comparators 110-1 to 110 -N.

The feedback path 120 generates a first toggle signal TG_S1 based on a comparison operation result of the comparators 110-1 to 110 -N, and feeds the feedback signal to each of the comparators 110-1 to 110 -N. You can output In addition, the feedback path 120 may receive the clock signal CLK from the clock generator 300.

In an exemplary embodiment, the feedback path 120 includes a second multiple input gate generating a first toggle signal TG_S1 based on a result of the comparison operation output from the comparators 110-1 to 110 -N. can do. For example, the second multiple input gate may be one of an AND gate and an OR gate.

In addition, the feedback path 120 may delay the first toggle signal TG_S1 based on the clock signal CLK and output the first toggle signal TG_S1 to the comparators 110-1 to 110 -N as a feedback signal. According to the feedback operation of the feedback path 120 with respect to the comparators 110-1 to 110 -N, the first toggle signal TG_S1 and the second toggle signal TG_S2 may be the master signal M_S and the comparison signal. When C_S) is the same, the logic high and the logic low may be output in a predetermined cycle.

The first multiple input gate 130 may generate a second toggle signal TG_S2 based on a comparison operation result of the comparators 110-1 to 110 -N. In an exemplary embodiment, the first multiple input gate 130 may be one of an AND gate and an OR gate. For example, the first multiple input gate 130 may be an AND gate, and the second multiple input gate provided in the feedback path 120 may be an OR gate. As another example, the first multiple input gate 130 may be an OR gate, and the second multiple input gate provided in the feedback path 120 may be an AND gate.

The toggle signal monitor 200 may receive the first and second toggle signals TG_S1 and TG_S2 generated from the toggle signal generator 100. In addition, the toggle signal monitor 200 may further receive a clock signal CLK from the clock generator 300 and an error signal ER from the error injector 400, respectively.

The toggle signal monitor 200 may perform a monitoring operation on the first and second toggle signals TG_S1 and TG_S2. In an exemplary embodiment, the toggle signal monitor 200 performs a fault search signal by performing a monitoring operation on the first and second toggle signals TG_S1 and TG_S2 based on the clock signal CLK and the error signal ER. You can output (CON_S).

By outputting based on the first and second toggle signals TG_S1 and TG_S2, the fault search signal CON_S may include information about whether the master signal M_S and the comparison signal C_S are the same. In addition, the output signal is further based on the clock signal CLK and the error signal ER, so that the fault search signal CON_S is information about a failure of the gates included in the toggle signal generator 100 and the toggle signal monitor 200. It may further include.

The clock generator 300 may include, for example, a phase locked loop (PLL). In the present exemplary embodiment, the clock generator 300 is included in the safety logic 30, but is not limited thereto. In another example, the clock generator is provided outside the safety logic 30, and the feedback path 120, the toggle signal monitor 200 and the error injector 400 may receive the clock signal from the outside.

The error injector 400 may output the error signal ER based on the clock signal CLK. In an exemplary embodiment, the error injector 400 may include a clock divider that divides the clock signal CLK. Accordingly, the error signal ER may be a divided clock signal.

The safety logic 30 may be implemented in various forms, and may be implemented in software form or hardware form according to an exemplary embodiment. For example, when the safety logic 30 is implemented in hardware, each of the components included in the safety logic 30 may include various circuits for performing the above-described operation. In addition, for example, when the safety logic 30 is implemented in software, the above-described operation may be performed by executing a program and / or instructions loaded in a memory (not shown) by a processor (not shown). However, the present invention is not limited thereto, and the safety logic 30 may be implemented in a form in which software and hardware are combined, such as firmware.

3 is a block diagram illustrating a detailed configuration of a toggle signal generator according to an exemplary embodiment of the present disclosure. For example, FIG. 3 may be a detailed block diagram of the toggle signal generator 100 of FIG. 2.

Referring to FIG. 3, each of the comparators 110-1 to 110 -N may include each of the XOR gates 112-1 to 112 -N. In addition, the feedback path 120 may include a second multiple input gate 122, a first delay circuit 124, and an inverter 126.

The second multiple input gate 122 may generate the first toggle signal TG_S1 based on the outputs of the XOR gates 112-1 to 112 -N. In addition, the first multiple input gate 130 may generate the second toggle signal TG_S2 based on the outputs of the XOR gates 112-1 to 112 -N. The first multiple input gate 130 may be an OR gate, and the second multiple input gate 122 may be an AND gate.

The first delay circuit 124 may delay the first toggle signal TG_S1 based on the clock signal CLK. For example, the first delay circuit 124 may include a flip flop that operates in response to the clock signal CLK. The inverter 126 may invert the output of the first delay circuit 124 and output it as the feedback signal to the XOR gates 112-1 to 112 -N.

The XOR gates 112-1 to 112 -N may receive each bit of the master signal M_S and each bit of the comparison signal C_S, respectively. In addition, the XOR gates 112-1 to 112 -N may receive feedback signals output from the inverter 126, respectively. In a specific embodiment, the first XOR gate 112-1 may receive the first master signal bit M_S1, the first comparison signal bit C_S1, and a feedback signal and perform an XOR operation based on the feedback signal.

4 is a block diagram illustrating a detailed configuration of a toggle signal monitor according to an exemplary embodiment of the present disclosure. For example, FIG. 4 may be a detailed block diagram of the toggle signal monitor 200 of FIG. 2.

Referring to FIG. 4, the toggle signal monitor 200 may include a first XOR gate 210, a second delay circuit 220, a second XOR gate 230, a third delay circuit 240, and a first output gate ( 250 and a second output gate 260. The first XOR gate 210 receives the error signal ER, the first toggle signal TG_S1, and the first error occurrence signal ER_B1 delayed by the second delay circuit 220, and based on this, performs an XOR operation. Can be done. The second delay circuit 220 may delay the first error generation signal ER_B1 based on the clock signal CLK. As a result, the first XOR gate 210 may output the first error generation signal ER_B1.

The second XOR gate 230 receives the error signal ER, the second toggle signal TG_S2, and the second error occurrence signal ER_B2 delayed by the third delay circuit 240, and performs an XOR operation based thereon. Can be done. The third delay circuit 240 may delay the second error generation signal ER_B2 based on the clock signal CLK. As a result, the second XOR gate 230 may output the second error generation signal ER_B2.

The first output gate 250 may output the first fault search signal CON_S1 based on the first and second error occurrence signals ER_B1 and ER_B2. In addition, the second output gate 260 may output the second fault search signal CON_S2 based on the first and second error occurrence signals ER_B1 and ER_B2.

In an exemplary embodiment, the first output gate 250 may be a NAND gate. In addition, the second output gate 260 may be a NOR gate. The toggle signal monitor 200 is a combination of the first and second fault search signals CON_S1 and CON_S2 included in the fault search signal CON_S, and is related to whether the master signal M_S and the comparison signal C_S are the same. Information can be passed outside. In addition, the toggle signal monitor 200 is a combination of the first and second fault search signals CON_S1 and CON_S2. The toggle signal monitor 200 is configured to determine whether or not the gates of the toggle signal generator 100 and the toggle signal monitor 200 have failed. Can be passed to the outside.

5 is a flowchart illustrating a method of operating an apparatus according to an exemplary embodiment of the present disclosure.

Referring to FIG. 5, the device 1 may determine whether to input the master signal M_S and the comparison signal C_S (S10). For example, the master signal M_S may be output from the first function module 10 and the comparison signal C_S may be output from the second function module 20, respectively. In an exemplary embodiment, the second function module 20 may be configured in the same manner as the first function module 10 to test whether the first function module 10 operates normally. Thus, when there is no failure, the master signal M_S and the comparison signal C_S may be the same signal.

The apparatus 1 may generate the toggle signals TG_S1 and TG_S2 based on the master signal M_S and the comparison signal C_S (S20). The device 1 comprises a safety logic 30 with a toggle signal generator 100, the toggle signal generator 100 toggles the first and second toggles based on the master signal M_S and the comparison signal C_S. Signals TG_S1 and TG_S2 may be generated. In an exemplary embodiment, the toggle signal generator 100 includes a plurality of comparators 110-1 to 110 -N comparing the master signal M_S and the comparison signal C_S bit by bit, and the comparators 110. It may include a feedback path 120 for generating a feedback signal based on the output of -1 ~ 110 -N and outputs it to the comparators (110-1 ~ 110-N). The toggle signal generator 100 based on the feedback operation of the feedback path 120 and the master signal M_S and the comparison signal C_S, the first and second toggles in which logic high and logic low are repeated at predetermined periods. Signals TG_S1 and TG_S2 may be generated.

The device 1 may monitor the generated first and second toggle signals TG_S1 and TG_S2 (S30). The safety logic 30 included in the device 1 may include a toggle signal monitor 200 for monitoring the first and second toggle signals TG_S1 and TG_S2. The toggle signal monitor 200 may output the fault search signal CON_S based on the received first and second toggle signals TG_S1 and TG_S2 (S40). The safety logic 30 uses the fault search signal CON_S output as the first and second toggle signals TG_S1 and TG_S2 are monitored, and information about whether the master signal M_S and the comparison signal C_S are the same. Can be generated.

6 is a flowchart illustrating a method of operating a toggle signal monitor according to an exemplary embodiment of the present disclosure.

Referring to FIG. 6, the toggle signal monitor 200 may determine whether an error signal ER is input (S100). For example, the error signal ER is a signal for checking whether a gate of each of the toggle signal generator 100 and the toggle signal monitor 200 has failed, and the logic high and logic low are repeated at predetermined intervals. It may be a signal of. In an exemplary embodiment, the error signal ER is output through the error injector 400 provided in the apparatus 1, and the error injector 400 receives the error signal ER based on the clock signal CLK. You can print For example, the error injector 400 may include a divider for dividing the clock signal CLK.

When the error signal ER is input, the toggle signal monitor 200 may output the fault search signal CON_S based on the first toggle signal TG_S1, the second toggle signal TG_S2, and the error signal ER. It may be (S110). For example, the toggle signal monitor 200 may include a first fault search signal CON_S1 that performs a NAND operation on the first and second error generation signals ER_B1 and ER_B2, and a first and second error generation signal ( The second fault search signal CON_S2 having performed the NOR operation on the ER_B1 and ER_B2 may be output as the fault search signal CON_S. For example, the logic state of the error signal ER, whether the master signal M_S and the comparison signal C_S are the same, and whether the gates provided in the toggle signal generator 100 and the toggle signal monitor 200 fail, respectively. Accordingly, the logic combination of each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may vary.

Thus, in accordance with the technical spirit of the present disclosure, the device 1 including the safety logic 30 may not only provide information on whether the master signal M_S and the comparison signal C_S are the same during the runtime operation, but also the signal generator 100. ) And information on whether the gates provided in the toggle signal monitor 200 fail, respectively, may be output as the fault search signal CON_S. Accordingly, the device 1 can improve the stability by detecting latent faults during runtime operation.

7 is a timing diagram for various signals output according to an exemplary embodiment of the present disclosure. 7 shows an example in which the error signal ER is a signal obtained by dividing the clock signal CLK by four. However, those skilled in the art will fully understand that this is only one embodiment, and the shape of the error signal ER may be variously modified.

Referring to FIG. 7, the first toggle signal TG_S1 may be abnormally output at the first time point t1. For example, the abnormal output of the first toggle signal TG_S1 may be a result of at least one bit difference between the master signal M_S and the comparison signal C_S. In detail, the first toggle signal TG_S1 may be output at a logic low level from the first time point t1 to the second time point t2. As the first toggle signal TG_S1 is output at a logic low level, the first error generation signal ER_B1 may be output at a logic low level from the first time point t1 to the second time point t2. In addition, the first fault search signal CON_S1 may be logic high and the second fault search signal CON_S2 may be output logic logic from the first time point t1 to the second time point t2, respectively.

The first toggle signal TG_S1 and the second toggle signal TG_S2 may be normally output from the second time point t2 to the third time point t3. As the first toggle signal TG_S1 and the second toggle signal TG_S2 are normally output, the first error generation signal ER_B1 and the second error occurrence signal from the second time point t2 to the third time point t3. ER_B2) may be output at logic high. In addition, the first fault search signal CON_S1 may be output at a logic low and the second fault search signal CON_S2 may be output at a logic high.

At a third time point t3, the second toggle signal TG_S2 may be abnormally output. For example, the abnormal output of the second toggle signal TG_S2 may be a result of one or more bits being different between the master signal M_S and the comparison signal C_S. In detail, the second toggle signal TG_S2 may be output at a logic high level from the third time point t3 to the fourth time point t4. As the second toggle signal TG_S2 is output at a logic high state, the second error generation signal ER_B2 may be output as a logic low from the third time point t3 to the fourth time point t4. In addition, the first fault search signal CON_S1 may be logic high and the second fault search signal CON_S2 may be output logic logic from the third time point t3 to the fourth time point t4, respectively.

8A and 8B illustrate tables representing values of fault search signals output under respective conditions according to exemplary embodiments of the present disclosure. In detail, FIG. 8A illustrates a first value representing a value of each of the first and second fault search signals CON_S1 and CON_S2 according to the value of the error signal ER and whether the master signal M_S is equal to the comparison signal C_S. The table TB1 is shown. In addition, FIG. 8B illustrates the first and second fault search signals according to the value of the error signal ER and the case regarding the failure status and the failure type of each gate included in the toggle signal generator 100 and the toggle signal monitor 200. (CON_S1, CON_S2) A second table TB2 showing each value is shown.

Referring to FIG. 8A, when the value of the error signal ER is 0 (or logic low) and the master signal M_S and the comparison signal C_S are the same, the first and second fault search signals CON_S1 and CON_S2 may be used. Each can have a value of zero. When the value of the error signal ER is 0 and one or more bits between the master signal M_S and the comparison signal C_S are different, each of the first and second fault search signals CON_S1 and CON_S2 is 1 (or, logic high). ) Can have a value.

When the value of the error signal ER is 1 and the master signal M_S and the comparison signal C_S are the same, each of the first and second fault search signals CON_S1 and CON_S2 may have a value of 1. When the value of the error signal ER is 1 and one or more bits between the master signal M_S and the comparison signal C_S are different, each of the first and second fault search signals CON_S1 and CON_S2 may have a value of zero. .

Referring to FIG. 8B, the first case may be a failure in which the output of the gate is fixed to a zero value, and the second case may be a failure in which the output of the gate is fixed to a one value. For example, when the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N has failed in the first case, the first fault search signal CON_S1 may have a value of 1, The second fault search signal CON_S2 may have a value of zero. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N has failed in the first case, each of the first and second fault search signals CON_S1 and CON_S2 It can have a value of zero.

For example, when the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N has failed in the second case, the first fault search signal CON_S1 may have a value of 1, The second fault search signal CON_S2 may have a value of zero. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N has failed in the second case, each of the first and second fault search signals CON_S1 and CON_S2 It can have a value of zero.

For convenience of explanation, only the values of the fault search signals CON_S1 and CON_S2 for each case according to the failure of the XOR gates 112-1 to 112 -N have been described, but other gates included in the second table TB2 are described. The same table interpretation can be applied to each of these failures. For example, when the value of the error signal ER is 0 and the first XOR gate 210 has failed in the first case, the first fault search signal CON_S1 has a value of 1 and the second fault search signal CON_S2. May have a value of zero. In addition, when the value of the error signal ER is 1 and the first XOR gate 210 fails in the first case, each of the first and second fault search signals CON_S1 and CON_S2 may have a value of zero.

As described above, the fault search signals CON_S1 and CON_S2 may have respective situations according to the error signal ER in which 0 and 1 values are repeated (or logic low and logic high are repeated) at predetermined periods. Presence values can be provided as tables TB1 and TB2. As a result, the fault search signals CON_S1 and CON_S2 may include information on whether the master signal M_S and the comparison signal C_S are the same. In addition, the fault search signals CON_S1 and CON_S2 may further include information regarding failure of gates provided in the toggle signal generator 100 and the toggle signal monitor 200, respectively.

9 is a flowchart illustrating a method of operating an apparatus according to another exemplary embodiment of the present disclosure.

Referring to FIG. 9, the device 1 may input a sensing signal and a threshold signal to the safety logic 30 (S200). In an exemplary embodiment, the device 1 may input the sensing signal as the master signal M_S and the threshold signal as the comparison signal C_S, respectively, to the safety logic 30. The sensing signal may be output from a sensor provided in the device 1.

For example, the first function module 10 may include a temperature sensor and output a sensing signal for temperature to the safety logic 30 as the master signal M_S. In addition, the second function module 20 may output the threshold signal for the preset threshold temperature to the safety logic 30 as the comparison signal C_S.

As another example, the first functional module 10 may output the sensing signal for the power consumption of the device 1 as the master signal M_S to the safety logic 30. In addition, the second function module 20 may output the threshold signal for the predetermined threshold power consumption to the safety logic 30 as the comparison signal C_S.

Next, the device 1 may generate the toggle signals TG_S1 and TG_S2 based on the sensing signal and the threshold signal (or based on the master signal M_S and the comparison signal C_S) (S210). The safety logic 30 included in the apparatus 1 may include a toggle signal generator 100 that outputs a toggle signal TG_S1 or TG_S2 that is variable based on whether the sensing signal and the threshold signal are the same.

Next, the device 1 may monitor the generated first and second toggle signals TG_S1 and TG_S2 (S220). The safety logic 30 included in the device 1 may include a toggle signal monitor 200 for monitoring the first and second toggle signals TG_S1 and TG_S2. The toggle signal monitor 200 may output the fault search signal CON_S as the same determination signal based on the received first and second toggle signals TG_S1 and TG_S2 (S230). The safety logic 30 may generate information about whether the sensing signal and the threshold signal are the same through the fault search signal CON_S output as the sensing signal and the threshold signal are monitored.

10 is a block diagram illustrating a specific configuration of a toggle signal generator according to another exemplary embodiment of the present disclosure. The configuration of the toggle signal generator 100a of FIG. 10 is similar to that of the toggle signal generator 100 described with reference to FIG. 3. However, according to the present exemplary embodiment, the first multiple input gate 130a may be an AND gate, and the second multiple input gate 122a may be an OR gate. Thus, the first multiple input gate 130a may generate the second toggle signal TG_S2a by performing an AND operation on the outputs of the XOR gates 112a-1 to 112a -N.

The second multiple input gate 122a may generate the first toggle signal TG_S1a by performing an OR operation on the outputs of the XOR gates 112a-1 to 112a -N. In addition, the first delay circuit 124a delays the first toggle signal TG_S1a based on the clock signal CLKa, and the inverter 126a inverts the output of the first delay circuit 124a. May be output to the XOR gates 112a-1 to 112a -N.

11 is a timing diagram for various signals output according to an exemplary embodiment of the present disclosure. FIG. 11 may illustrate an example of each signal according to an exemplary embodiment in which the toggle signal generator 100a of FIG. 10 is employed.

The timing diagram of FIG. 11 is similar to the timing diagram described with reference to FIG. 7. For example, the timing diagram of FIG. 11 may represent each signal according to the case where the same master signal and the comparison signal are input as in the embodiment of FIG. 7. However, according to the timing diagram of FIG. 11, the second toggle signal TG_S2a is output at a logic low state from the first time point t1a to the second time point t2a, and the third time point t3a to the third time point are output. The first toggle signal TG_S1a may be output at a logic high level until the fourth time point t4a.

12 illustrates a specific block diagram of safety logic in accordance with another exemplary embodiment of the present disclosure. The configuration of the safety logic 30b of FIG. 12 is similar to that of the safety logic 30 described with reference to FIG. 2. However, the safety logic 30 of FIG. 2 includes an error injector 400, and according to the present embodiment, the safety logic 30b is externally provided from the error injector 400. An error signal ERb may be received. For example, the safety logic 30b may receive the error signal ERb through an externally provided error signal source. In an exemplary embodiment, the error signal ERb may be in the form of a signal in which logic high and logic low are repeated at a longer period than the clock signal CLKb.

13 illustrates a block diagram of an apparatus according to another exemplary embodiment of the present disclosure. The configuration of the device 1c of FIG. 13 is similar to that of the device 1 described with reference to FIG. 1. However, according to the present embodiment, the device 1c may further include an interrupt generator 40c. The interrupt generator 40c may generate an interrupt signal ITc based on the fault search signal CON_S.

For example, the interrupt generator 40c may obtain information on whether the master signal M_Sc and the comparison signal C_Sc are the same based on the fault search signal CON_Sc. In addition, the interrupt generator 40c may acquire information on whether each of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c has failed based on the fault search signal CON_Sc.

In an exemplary embodiment, the interrupt generator 40c includes the first table TB1 of FIG. 8A, and the master signal M_Sc and the comparison signal based on the fault search signal CON_Sc and the first table TB1. Information about whether the C_Sc is the same may be obtained. For example, in response to determining that one or more bits between the master signal M_Sc and the comparison signal C_Sc are different, the interrupt generator 40c may output the interrupt signal ITc. As another example, when the first function module 10c outputs the master signal M_Sc as a sensing signal and the second function module 20c outputs the comparison signal C_Sc as a threshold signal, the interrupt generator 40c may master. In response to determining that the signal M_Sc and the comparison signal C_Sc are the same, the interrupt signal ITc may be output.

In addition, in an exemplary embodiment, the interrupt generator 40c includes the second table TB2 of FIG. 8B, and the toggle signal generator 100c is based on the fault search signal CON_Sc and the second table TB2. And information about a failure of each of the gates included in the toggle signal monitor 200c. For example, in response to determining a failure of at least one of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c, the interrupt generator 40c may output the interrupt signal ITc.

For example, the interrupt generator 40c may output the interrupt signal ITc to a predetermined controller (not shown) included in the device 1c. Alternatively, the interrupt generator 40c may output the interrupt signal ITc to a host controller or the like external to the device 1c.

14 is a flowchart illustrating a method of operating an apparatus according to an exemplary embodiment of the present disclosure. FIG. 14 may represent a method of operating the device 1c shown in FIG. 13, for example.

Referring to FIG. 14, the apparatus 1c may input the master signal M_Sc and the comparison signal C_Sc into the safety logic 30c (S300). The safety logic 30c may include a toggle signal generator 100c and a toggle signal monitor 200c. The toggle signal generator 100c outputs the first and second toggle signals TG_S1c and TG_S2c based on the master signal M_Sc and the comparison signal C_Sc, and the toggle signal monitor 200c based on the fault search signal. (CON_Sc) may be output (S310).

The interrupt generator 40c may determine whether a fault occurs based on the fault search signal CON_Sc (S320). For example, the interrupt generator 40c may determine that a fault has occurred when it is determined that at least one bit between the master signal M_Sc and the comparison signal C_Sc is different based on the fault search signal CON_Sc. Alternatively, when the interrupt generator 40c determines the failure of at least one of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c based on the fault search signal CON_Sc, it is determined that a fault has occurred. can do.

If a fault occurs, the interrupt generator 40c may output the interrupt signal ITc (S330). For example, device 1c may include a controller that controls the components in device 1c, and interrupt generator 40c may output an interrupt signal ITc to the controller. The interrupt generator 40c may also output the interrupt signal ITc to the outside of the device 1c.

FIG. 15 is a block diagram illustrating a System On Chip (SoC) employing safety logic according to an exemplary embodiment of the present disclosure.

Referring to FIG. 15, the system on chip 1000 may include a plurality of IPs 1010, 1020, and 1030, a safety logic 1040, and a system bus 1050. The system on chip 1000 may be designed to perform various functions in a semiconductor system. For example, the system on chip 1000 may be an application processor.

The system on chip 1000 may include various types of IPs. For example, the IPs 1010, 1020, and 1030 may include a processing unit, a plurality of cores included in the processing unit, a multi-format codec (MFC), a video module (eg, a camera interface) camera interface, Joint Photographic Experts Group (JPEG) processor, video processor, or mixer), 3D graphics core, audio system, driver, display driver (display driver), volatile memory, non-volatile memory, memory controller, input and output interface blocks, or cache memory. can do.

As a technology for connecting the IPs 1010, 1020, 1030 and the safety logic 1040, a connection based on the system bus 1050 may be used. For example, as a standard bus standard, the Advanced Microcontroller Bus Architecture (AMBA) protocol of ARM (Advanced RISC Machine) may be applied. The bus types of the AMBA protocol may include Advanced High-Performance Bus (AHB), Advanced Peripheral Bus (APB), Advanced eXtensible Interface (AXI), AXI4, and AXI Coherency Extensions (ACE). Among the aforementioned bus types, AXI is an interface protocol between IPs, and may provide multiple outstanding address functions and data interleaving functions. In addition, other types of protocols may be applied to the system bus, such as uNetwork from SONICs Inc., CoreConnect from IBM, and Open Core Protocol from OCP-IP.

In an example embodiment, the safety logic 1040 may detect whether a signal output from at least one of the IPs 1010, 1020, and 1030 is faulty. For example, IP2 1020 may include the same configuration as IP1 1010 to determine whether the IP1 1010 is faulted. Accordingly, IP1 1010 may output the master signal to safety logic 1040, and IP2 1020 may output the comparison signal to safety logic 1040. The safety logic 1040 may be implemented based on the embodiments described with reference to FIGS. 1 through 14. As a result, the system on chip 1000 may detect whether the signals output from the IPs are faulted during the runtime operation, and may also detect whether the gates provided in the safety logic 1040 fail.

16 is a block diagram illustrating a memory system employing safety logic according to an example embodiment of the disclosure.

Referring to FIG. 16, the memory system 1100 may include a memory controller 1200 and a memory device 1300. For example, the memory controller 1200 controls the memory device 1300 to read data stored in the memory device 1300 or to write data to the memory device 1300 in response to a command from a host (not shown). can do. In detail, the memory controller 1200 may control the program, read, and erase operations of the memory device 1300 by providing an address, a command, and a control signal to the memory device 1300.

The memory controller 1200 may include a first ECC encoder 1210, a second ECC encoder 1220, and a first safety logic 1230. For example, the first and second ECC encoders 1210 and 1220 may output the encoded write data WD_C1 and WD_C2 by performing ECC encoding based on the input write data WD. For example, the second ECC encoder 1220 may include the same configuration as the first ECC encoder 1210 to determine whether the signal output from the first ECC encoder 1210 is faulty.

The first safety logic 1230 may be implemented based on the embodiments described with reference to FIGS. 1 to 14. According to an exemplary embodiment, the first ECC encoder 1210 may output the first encoded write data WD_C1 to the first safety logic 1230 as a master signal. In addition, the second ECC encoder 1220 may output the second encoded write data WD_C2 to the first safety logic 1230 as a comparison signal. The first safety logic 1230 may output the first fault search signal CON_Sd_1 based on the encoded write data WD_C1 and WD_C2.

The memory controller 1200 may further include a first ECC decoder 1240, a second ECC decoder 1250, and a second safety logic 1260. For example, the first and second ECC decoders 1240 and 1250 perform ECC decoding based on the read data RD_C read from the memory device 1300, thereby respectively decoding the decoded read data RD_1 and RD_2. You can print For example, the second ECC decoder 1250 may include the same configuration as the first ECC decoder 1240 to determine whether the signal output from the first ECC decoder 1240 is faulty.

The second safety logic 1260 may be implemented based on the embodiments described with reference to FIGS. 1 to 14. In an exemplary embodiment, the first ECC decoder 1240 may output the first decoded read data RD_1 to the second safety logic 1260 as a master signal. In addition, the second ECC decoder 1250 may output the second decoded read data RD_2 to the second safety logic 1260 as a comparison signal. The second safety logic 1260 may output the second fault search signal CON_SD_2 based on the decoded read data RD_1 and RD_2.

17 is a schematic illustration of a vehicle employing safety logic in accordance with an exemplary embodiment of the present disclosure.

Referring to FIG. 17, the vehicle 1400 may include a processing assembly 1402, one or more sensors 1420, a communication interface 1430, a driving control element 1440, an autonomous driving system 1450, and a user interface 1460. It may include. Sensor 1420 may include one or more camera devices, an active scanning device (eg, one or more LiDAR sensors), one or more ultrasonic sensors, one or more geospatial positioning devices. And the like. The sensor 1420 may generate a sensing signal by monitoring at least a part of an external environment surrounding the vehicle 1400.

The communication interface 1430 may include a wireless transceiver and / or a global positioning system (GPS). The driving control element 1440 is a vehicle steering device configured to control the direction of the vehicle 1400, a throttle device configured to control acceleration and / or deceleration by controlling a motor or engine of the vehicle 1400, a vehicle ( It may include a brake device, an external lighting device, etc. configured to control the braking of the 1400.

The autonomous driving system 1450 may include a computing device configured to implement autonomous control of the driving control element 1440. For example, the autonomous driving system 1450 may include a memory that stores a plurality of program instructions and one or more processors that execute the program instructions. The autonomous driving system 1450 may be configured to control the driving control element 1440 based on the sensing signal output from the sensor 1420. The user interface 1460 may include a display indicating the instrument panel of the vehicle 1400.

In an example embodiment, the processing assembly 1402 may include safety logic 1410. The safety logic 1410 may be implemented based on the embodiments described with reference to FIGS. 1 through 14. Although not shown, the vehicle 1400 may determine whether a signal output from each of the sensor 1420, the communication interface 1430, the driving control element 1440, the autonomous driving system 1450, and the user interface 1460 is faulty. To this end, it may further include the same configuration as each of these. As such, the vehicle 1400 may include at least one of a sensor 1420, a communication interface 1430, a driving control element 1440, an autonomous driving system 1450, and a user interface 1460 during runtime operation (eg, while driving). It is possible to detect whether a signal outputted from one faults. In addition, it may be detected whether the gates provided in the safety logic 1410 fail. As a result, the safety of the vehicle 1400 may be further improved.

As described above, exemplary embodiments have been disclosed in the drawings and the specification. Although embodiments have been described using specific terms in this specification, they are used only for the purpose of illustrating the technical spirit of the present disclosure and are not used to limit the scope of the disclosure as defined in the meaning or the claims. . Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present disclosure will be defined by the technical spirit of the appended claims.

Claims (20)

A first function module for outputting a master signal;
A second function module for outputting a comparison signal with respect to the master signal;
At least one comparator for generating a comparison operation result based on the master signal and the comparison signal, a feedback path for generating a first toggle signal based on the comparison operation result and outputting a feedback signal to the at least one comparator, and the comparison A toggle signal generator including a first multiple input gate to generate a second toggle signal based on a result of the operation; And
And a toggle signal monitor outputting a fault search signal based on the first and second toggle signals. According to claim 1,
The feedback path is,
The feedback signal by inverting a second multiple input gate generating the first toggle signal, a first delay circuit delaying an output of the second multiple input gate, and an output of the first delay circuit based on a result of the comparison operation. The device further comprises an inverter for outputting. The method of claim 2,
The first multiple input gate is an AND gate,
And the second multiple input gate is an OR gate. The method of claim 2,
The first multiple input gate is an OR gate,
And the second multiple input gate is an AND gate. According to claim 1,
The toggle signal monitor,
A first XOR gate configured to output a first error occurrence signal based on the first toggle signal;
A second XOR gate outputting a second error generation signal based on the second toggle signal;
A first output gate configured to output a first fault search signal based on the first and second error occurrence signals; And
And a second output gate outputting a second fault search signal based on the first and second error occurrence signals. The method of claim 5,
The toggle signal monitor,
A second delay circuit delaying the first error generation signal and outputting the delayed first error generation signal to the first XOR gate; And
And a third delay circuit for delaying the second error generation signal and outputting the delayed second error generation signal to the second XOR gate. The method of claim 6,
Further comprising a clock generator for generating a clock signal,
And the second and third delay circuits respectively delay the first error generation signal and the second error generation signal based on the clock signal. The method of claim 7, wherein
An error injector for outputting an error signal based on the clock signal,
The first XOR gate further outputs the first error generation signal based on the error signal,
And the second XOR gate outputs the second error generation signal further based on the error signal. The method of claim 8,
And the error injector comprises a clock divider for dividing the clock signal. The method of claim 5,
The first output gate is a NAND gate,
And the second output gate is a NOR gate. According to claim 1,
A controller controlling the first functional module and the second functional module; And
And an interrupt generator for generating an interrupt signal to the controller based on the fault search signal. According to claim 1,
The first functional module senses the temperature of the device, outputs a sensing value for the temperature as the master signal,
And the second functional module outputs a threshold value for comparison with the sensing value as the comparison signal. A toggle signal generator configured to output a first toggle signal and a second toggle signal based on a master signal and a comparison signal each including a plurality of bits and configured to output the fault search signal by monitoring the first and second toggle signals A device comprising a toggle signal monitor,
The toggle signal generator,
A plurality of comparators configured to generate a comparison operation result by comparing whether each bit of the master signal is identical to each bit of the comparison signal;
A feedback path configured to generate the first toggle signal by performing a first gate operation based on the comparison operation result, and output a feedback signal to each of the plurality of comparators based on the first toggle signal; And
And a first multiple input gate configured to generate the second toggle signal by performing a second gate operation based on the comparison operation result. The method of claim 13,
Further comprising a clock generator for outputting a clock signal,
And the feedback path further outputs the feedback signal based on the clock signal. The method of claim 14,
The feedback path is,
A first delay circuit configured to delay the first toggle signal based on the clock signal; And
And an inverter configured to output the feedback signal by inverting the output of the first delay circuit. The method of claim 14,
The toggle signal monitor,
A first XOR gate configured to output a first error generation signal based on the first toggle signal;
A second delay circuit configured to delay the first error generation signal based on the clock signal, and output the delayed first error generation signal to the first XOR gate;
A second XOR gate configured to output a second error generation signal based on the second toggle signal;
A third delay circuit configured to delay the second error generation signal based on the clock signal, and output the delayed second error generation signal to the second XOR gate; And
And a plurality of output gates configured to output the fault search signal based on the first and second error occurrence signals. The method of claim 16,
The plurality of output gates,
A NAND gate configured to output a first fault search signal based on the first and second error occurrence signals; And
And a NOR gate outputting a second fault search signal based on the first and second error occurrence signals. The method of claim 14,
An error injector for generating an error signal based on the clock signal,
And the toggle signal monitor is configured to monitor the first and second toggle signals further based on the error signal. The method of claim 13,
The toggle signal generator,
And output the first toggle signal and the second toggle signal based on the master signal and the comparison signal during run-time of the device. A plurality of comparators configured to generate a comparison operation result by comparing each of the input master signal and the comparison signal in bit units;
A feedback path configured to generate a first toggle signal based on a result of the comparison operation, and generate a feedback signal output to each of the comparators based on a clock signal and the first toggle signal;
A first multiple input gate configured to generate a second toggle signal by performing a first gate operation on the comparison operation result; And
And a toggle signal monitor configured to output a fault search signal including information on whether the master signal and the comparison signal are identical by monitoring the first toggle signal and the second toggle signal based on the clock signal. .

Images