TW202015066A - Detection apparatus and method of operating detection apparatus - Google Patents

Abstract

A detection apparatus and method of operating the detection apparatus are provided. The detection apparatus includes a first function module providing a master signal, a second function module providing a comparison signal, and safety logic. The safety logic includes a toggle signal generator having a comparator providing a comparison result in response to the master signal and the comparison signal, a feedback path generating a first toggle signal in response to the comparison result and providing a feedback signal to the comparator, and a first multiple input gate generating a second toggle signal in response to the comparison result. The safety logic also includes a toggle signal monitor providing a final fault search signal in response to the first toggle signal and the second toggle signal.

Description

Testing equipment and method of operating testing equipment

The concept of the present invention relates to a detection device including safety logic. More specifically, the inventive concept relates to various devices including safety logic configured to determine whether the main signal is correctly associated with the comparison signal during runtime. [Cross-reference to related applications] This application claims the rights of Korean Patent Application Nos. 10-2018-0092061 and 10-2019-0020050 filed on August 7, 2018 and February 20, 2019 at the Korea Intellectual Property Office, respectively. The overall theme of the Korean patent application is incorporated into this case for reference.

In the broad context of electrical, mechanical, and electromechanical equipment (such as automobiles), potential failures are specific types of failures—the safety mechanisms designed to implement such detections during the failure detection interval do not detect the occurrence of such potential failures. Potential failures also remain undetected by users of the equipment. Therefore, a latent failure can be understood as a silent failure that can evolve (or migrate) into multiple failures, which ultimately leads to serious performance failures in the equipment. A typical example of potential failure is memory bit failure.

Latent-fault tolerant time interval (L-FTTI) should be used to check the failure and potential failure to prevent the occurrence of potential failure. For example, you should check the memory bit failure for each memory access. Traditional fault checking methods that rely on built-in self-test (BIST) logic and/or software test library (STL) often suspend normal operations (eg, memory access operations) to check for faults . This temporary suspension of operation may exceed L-FTTI, and generally increases the hardware and/or software overhead associated with troubleshooting.

Embodiments of the inventive concept provide a detection device that includes safety logic that can potentially detect potential failures.

According to an aspect of the concept of the present invention, there is provided a detection device including: a first functional module configured to provide a main signal; a second functional module configured to provide a comparison signal; and safety logic. The safety logic includes: a two-state thixotropic signal generator and a two-state thixotropic signal monitor. The two-state thixotropic signal generator includes at least one comparator, a feedback path, and a first multiple input gate. A comparator is configured to provide a comparison result in response to the main signal and the comparison signal, and the feedback path is configured to generate a first two-state thixotropic signal in response to the comparison result and provide a feedback signal to all The at least one comparator, the first multiple input gate is configured to generate a second two-state thixotropic signal in response to the comparison result, and the two-state thixotropic signal monitor is configured to respond to the first A two-state thixotropic signal and the second two-state thixotropic signal provide a final fault search signal.

According to another aspect of the inventive concept, a detection device including safety logic is provided. The safety logic includes: a two-state thixotropic signal generator configured to provide a first two-state thixotropic signal and a second two-state thixotropic signal in response to the main signal and the comparison signal, wherein the main signal and the Each of the comparison signals includes multiple bits; and a two-state thixotropic signal monitor configured to provide in response to detecting the first two-state thixotropic signal and the second two-state thixotropic signal The final fault search signal, wherein the two-state thixotropic signal generator includes: a plurality of comparators configured to compare the main signal with the comparison signal bit by bit and generate a comparison result; the feedback path is Configured to perform a first gate operation in response to the comparison result, generate the first two-state thixotropic signal, and provide a feedback signal to the plurality of comparators in response to the first two-state thixotropic signal Each of; and the first multiple input gate, configured to perform a second gate operation in response to the comparison result and generate the second two-state thixotropic signal.

According to another aspect of the inventive concept, a detection device including safety logic is provided. The safety logic includes: a plurality of comparators that respectively receive at least one bit of the main signal and at least one bit of the comparison signal, and are configured to compare the main signal with the comparison signal bit by bit Generating a comparison result; the feedback path is configured to generate a first two-state thixotropic signal in response to the comparison result, and is further configured to generate a feedback signal in response to the clock signal and the first two-state thixotropic signal , Wherein the feedback signal is provided to each of the plurality of comparators; a first multiple input gate is configured to perform a first gate operation on the comparison result to generate a second two-state thixotropic Signal; a two-state thixotropic signal monitor configured to monitor the first two-state thixotropic signal and the second two-state thixotropic signal in response to the clock signal, and provide a final fault search signal, so The final fault search signal provides information indicating whether the main signal is correctly associated with the comparison signal; and an error injector configured to generate an error signal in response to the clock signal, wherein the two-state thixotropic The signal monitor further monitors the first two-state thixotropic signal and the second two-state thixotropic signal in response to the error signal and provides the final fault search signal, and the final fault search signal further provides an indication Information about whether at least one of the plurality of comparators, the feedback path, the first multiple input gate, and the two-state thixotropic signal monitor has a fault.

According to another aspect of the inventive concept, a method of operating a detection device including safety logic is provided. The method includes: judging whether the main signal is correctly associated with the comparison signal, and generating a first two-state thixotropic signal and a second two-state haptic signal in response to the judging whether the main signal is correctly associated with the comparison signal A variable signal; and a final fault search signal is generated in response to the first two-state thixotropic signal and the second two-state thixotropic signal, wherein the final fault search signal provides an indication of whether the main signal is compared with the comparison The signal is correctly associated with information, and further provides information indicating whether at least one of the logic gates used in the process of determining whether the main signal is correctly associated with the comparison signal is faulty.

In the following, certain embodiments of the inventive concept will be explained with some additional details with reference to the drawings.

Figure 1 (Figure 1) is a block diagram of a device 1 according to an embodiment of the inventive concept.

Referring to FIG. 1, the device 1 generally includes a first functional module 10, a second functional module 20 and a safety logic 30. The device 1 may be designed to perform one or more functions. The operation of the device 1 can be controlled according to various electrical signals. For example, the device 1 can be applied to robotic devices (eg, drones and advanced driver assistance systems (ADAS)), autonomous vehicles, smart TVs, smart phones, medical devices, mobile devices, and image display devices , Measuring devices and Internet of Things (IoT) devices. In addition, the apparatus 1 may be installed on at least one of various types of electronic devices.

The first functional module 10 is configured to perform at least one function associated with the operation of the device 1. As an example, the first functional module 10 can execute (or execute) a predetermined function in order to generate (or define) the main signal M_S. This main signal M_S can then be used to control one or more operations of the device 1. As another example, the first functional module 10 may generate a sensing value (or sensing signal) associated with a condition (eg, power condition) or temperature associated with the device 1. This sensing signal can be provided as the main signal M_S. (From now on, the sensing signal can be understood to be related to "conditions" (such as temperature or power)).

In contrast to the first functional module 10 that provides (eg, outputs) the main (or main) signal, the second functional module 20 provides a comparison signal C_S to be compared with the main signal M_S. Therefore, the second functional module 20 can be understood as providing a secondary (or comparison) signal opposite to the primary signal provided by the first functional module 10. In some embodiments, the second functional module 20 may be a functional mirror of the first functional module. That is, the second functional module may have the same composition configuration as the first functional module 10. In this way, assuming that there is no fault associated with the operation of the first functional module 10 or the second functional module 20, the comparison signal C_S should be correctly related to the main signal M_S. In some embodiments, the phrase "correctly related to" means that the main signal M_S is "equal to" the comparison signal C_S. However, in other embodiments, the phrase "correctly related to" means that the main signal M_S fails within the established range, limit, or tolerance relationship with respect to the comparison signal C_S. In other words, the first functional module 10 and the second functional module 20 can be designed in a mirrored (or lock-step) manner in order to detect a potential failure in the main signal M_S provided by the first functional module 10.

In other embodiments where the first functional module 10 provides the sensing signal associated with the condition as the main signal M_S, the second functional module 20 may provide the critical sensing value to be compared with the sensing value as the comparison signal C_S . For example, when the first functional module 10 is a temperature sensor, the first functional module 10 can provide the temperature sensing signal as the main signal M_S, and the second functional module 20 can provide the critical temperature value as the comparison signal C_S.

As shown in FIG. 1, the safety logic 30 may include a two-state thixotropic signal generator 100 and a two-state thixotropic signal monitor 200. In an exemplary embodiment, the two-state thixotropic signal generator 100 can receive the main signal M_S and the comparison signal C_S and generate the first two-state thixotropic signal TG_S1 and the second two-state touch in response to the main signal M_S and the comparison signal C_S Variable signal TG_S2. In some embodiments, each two-state thixotropic signal may be a signal that repeats a logic high level and a logic low level in a predetermined cycle.

The toggle signal generator 100 can provide the first toggle signal TG_S1 and the second toggle signal TG_S2 to the toggle signal monitor 200. In an exemplary embodiment, the two-state thixotropic signal generator 100 may include at least one comparator configured to generate a "comparison result" in response to the comparison of the main signal M_S and the comparison signal C_S. The two-state thixotropic signal generator 100 may also include a feedback path configured to generate a first two-state thixotropic signal TG_S1 in response to the comparison result, and provide a feedback signal to the at least one comparator. The two-state thixotropic signal generator 100 may also include a first multiple-input gate. The first multiple-input gate is configured to generate a second two-state thixotropic signal TG_S2 in response to the comparison result. For example, the main signal M_S and the comparison signal C_S may include a plurality of bits (for example, a first plurality of bits and a second plurality of bits, respectively, wherein the first plurality of bits and the second The multiple bits may be the same or different), and the bi-state thixotropic signal generator 100 may include a plurality of comparators with a desired number so that the corresponding (or similar) bits of the main signal M_S and the comparison signal C_S Compare. That is, the two-state thixotropic signal generator 100 may perform an operation in which the main signal M_S is compared with the comparison signal C_S "bit by bit" to determine whether the main signal M_S is correctly related to the comparison signal C_S.

In this way, the two-state thixotropic signal generator 100 can use the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 to send information indicating whether the main signal M_S is correctly related to the comparison signal C_S to the two-state Thixotropic signal monitor 200. For example, when the main signal M_S and the comparison signal C_S are correctly correlated, each of the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 may be a "normal" two-state thixotropic signal ( That is, a high/low toggle signal with a predetermined cycle). However, when at least one bit of the main signal M_S is different from the similar bit of the comparison signal C_S, at least one of the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 may be an "abnormal" double Thixotropic signal (ie, a signal that is different from the normal bimodal thixotropic signal). For example, when at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, at least one of the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 may not be according to a predetermined The cycle performs a two-state thixotropy, but remains fixed at a high or low logic level for two or more cycles.

The two-state thixotropic signal monitor 200 may be configured to generate and provide a final fault search signal CON_S in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2. In an exemplary embodiment, the two-state thixotropic signal monitor 200 may include: a first mutex or gate configured to provide the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 An error occurrence signal; the second mutex or gate is configured to provide a second error occurrence signal in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2; the first output gate is configured to The first fault search signal is provided in response to the first error occurrence signal and the second error occurrence signal; and the second output gate is configured to provide the second fault search signal in response to the first error occurrence signal and the second error occurrence signal .

Therefore, the two-state thixotropic signal monitor 200 can receive information indicating whether the main signal M_S is correctly related to the comparison signal C_S from the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2. Since the two-state thixotropic signal monitor 200 provides the final fault search signal CON_S in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2, the final fault search signal CON_S may include information about whether the main signal M_S is Compare the information related to the signal C_S correctly.

In an exemplary embodiment, a predetermined error signal (not shown in FIG. 1) may be further applied to the two-state thixotropic signal monitor 200. For example, the first mutex or gate included in the two-state thixotropic signal monitor 200 may provide a first error occurrence signal in response to the error signal, and the second included in the two-state thixotropic signal monitor 200 The mutual exclusion or gate can provide a second error occurrence signal in response to the error signal. When the two-state thixotropic signal monitor 200 provides the final fault search signal CON_S in response to the predetermined error signal and the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2, the final fault search signal CON_S can be further It is predicted whether the gate included in at least one of the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200 has a fault.

FIG. 2 is a block diagram further illustrating the security logic 30 shown in FIG. 1 according to an embodiment of the inventive concept in one example.

Referring to FIG. 2, the safety logic 30 again includes a two-state thixotropic signal generator 100 and a two-state thixotropic signal monitor 200, but further includes a clock generator 300 and an error injector 400. The two-state thixotropic signal generator 100 may include a plurality of comparators 110-1 to 110-N, where "N" is a positive integer greater than one. The two-state thixotropic signal generator 100 may also include a feedback (FB) path 120 and a first multiple input (MI) gate 130.

Each of the comparators 110-1 to 110-N receives the main signal M_S and the comparison signal C_S, and performs a comparison operation between the main signal M_S and the comparison signal C_S. For example, each of the main signal M_S and the comparison signal C_S may include multiple bits, and each of the bits of the main signal M_S and the similar bits of the comparison signal C_S may be applied to the comparator 110 -1 to 110-N each. In this way, the two-state thixotropic signal generator 100 can use the comparators 110-1 to 110-N to determine bit by bit whether the main signal M_S is correctly related to the comparison signal C_S (ie, equal to the comparison signal C_S).

The feedback path 120 may generate the first two-state thixotropic signal TG_S1 in response to the comparison result provided by each of the comparators 110-1 to 110-N, and output the feedback signal to the comparators 110-1 to 110- Each of N. In the example shown in FIG. 2, the feedback path 120 also receives the clock signal CLK from the clock generator 300.

In one embodiment, the feedback path 120 may include a second multiple input gate configured to generate the first two-state touch in response to the comparison result provided by the comparators 110-1 to 110-N Variable signal TG_S1. Here, the second multiple input gate may be an AND gate or an OR gate.

With this configuration, the feedback path 120 can delay the first two-state thixotropic signal TG_S1 in response to the clock signal CLK, and provide the delayed signal as the feedback signal to the comparators 110-1 to 110-N. After the feedback operation is performed on the comparators 110-1 to 110-N through the feedback path 120, and when the main signal M_S and the comparison signal C_S are correctly correlated, the first two-state thixotropic signal TG_S1 and the second two-state will be provided Each of the thixotropic signals TG_S2 serves as a normal two-state thixotropic signal.

The first multiple input gate 130 can be used to generate the second two-state thixotropic signal TG_S2 in response to the comparison results of the comparators 110-1 to 110-N. In one embodiment, the first multiple input gate 130 may be an AND gate or an OR gate. In another embodiment, the first multiple input gate 130 may be an AND gate, and the second multiple input gate included in the feedback path 120 may be an OR gate. In yet another embodiment, the first multiple input gate 130 may be an OR gate, and the second multiple input gate included in the feedback path 120 may be an AND gate.

As shown in FIG. 2, the two-state thixotropic signal monitor 200 receives the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 generated by the two-state thixotropic signal generator 100. The two-state thixotropic signal monitor 200 also receives the clock signal CLK from the clock generator 300 and the error signal ER from the error injector 400.

Using these inputs, the two-state thixotropic signal monitor 200 can perform monitoring operations on the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2. In one embodiment, the two-state thixotropic signal monitor 200 can monitor the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 in response to the clock signal CLK and the error signal ER to provide the final Fault search signal CON_S.

The final fault search signal CON_S may be provided in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2, and the final fault search signal CON_S includes information indicating whether the main signal M_S is correctly related to the comparison signal C_S. Here, the final fault search signal CON_S may be further provided in response to the clock signal CLK and the error signal ER so as to further include indicating whether the gate included in the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200 exists Failure information.

The clock generator 300 may include, for example, a phase-locked loop (PLL). Although this embodiment illustrates the case where the safety logic 30 includes the clock generator 300, the inventive concept is not limited to this. In another example, a clock generator may be provided outside the safety logic 30, and the feedback path 120, the two-state thixotropic signal monitor 200, and the error injector 400 may receive the clock signal from outside.

The error injector 400 can be used to generate and provide an error signal ER in response to the clock signal CLK. In one embodiment, the error injector 400 may include a clock divider, which is configured to divide the clock signal CLK. Therefore, the error signal ER may be a divided clock signal.

As those skilled in the art should understand, the safety logic 30 can be implemented in various ways. That is, the safety logic 30 can be implemented in software and/or hardware. In certain embodiments, the safety logic 30 may be implemented as hardware, where each of the components included in the safety logic 30 may include various circuits configured to perform the operations described above. However, in other embodiments, the security logic 30 may be implemented as software, programs, and/or commands that are loaded in memory (not shown) and executed by a processor (not shown) to perform the above operations. Still other embodiments may use a combination of hardware and software to implement the security logic 30.

FIG. 3 is a block diagram further illustrating the two-state thixotropic signal generator 100 shown in FIGS. 1 and/or 2 according to an embodiment of the inventive concept in one example.

Referring to FIG. 3, the comparators 110-1 to 110-N may include mutually exclusive or gates 112-1 to 112-N, respectively. In addition, the feedback path 120 may include a second multiple input gate 122, a first delay (D) circuit 124, and an inverter 126.

The second multiple input gate 122 can generate the first two-state thixotropic signal TG_S1 in response to the output of the mutex or gates 112-1 to 112-N. In addition, the first multiple input gate 130 may generate the second two-state thixotropic signal TG_S2 in response to the output of the mutex or gates 112-1 to 112-N. The first multiple input gate 130 may include an OR gate, and the second multiple input gate 122 may include an AND gate.

The first delay circuit 124 may delay the first toggle signal TG_S1 in response to the clock signal CLK. For example, the first delay circuit 124 may include a flip-flop configured to operate in response to the clock signal CLK. The inverter 126 may invert the output of the first delay circuit 124 and provide the inverted output as a feedback signal to the mutex OR gates 112-1 to 112-N.

Each of the mutually exclusive OR gates 112-1 to 112-N can receive each bit of the main signal M_S and each bit of the comparison signal C_S. In addition, each of the mutually exclusive or gates 112-1 to 112 -N can receive the feedback signal output by the inverter 126. In a specific embodiment, the first mutex or gate 112-1 may receive the first main signal bit M_S1, the first comparison signal bit C_S1 and the feedback signal and respond to the first main signal bit M_S1, the first comparison signal Bit C_S1 and the feedback signal are mutually exclusive or.

FIG. 4 is a block diagram further illustrating the two-state thixotropic signal monitor 200 shown in FIGS. 1 and/or 2 according to an embodiment of the inventive concept in one example.

4, the two-state thixotropic signal monitor 200 may include a first mutex OR gate 210, a second delay circuit 220, a second mutex OR gate 230, a third delay circuit 240, a first output gate 250 and a second Output gate 260. The first mutex or gate 210 can receive the error signal ER, the first toggle signal TG_S1 and the first error occurrence signal ER_B1 delayed by the second delay circuit 220, and respond to the error signal ER and the first toggle signal The variable signal TG_S1 and the delayed first error occurrence signal ER_B1 are mutually exclusive or. The second delay circuit 220 may delay the first error occurrence signal ER_B1 in response to the clock signal CLK. Therefore, the first mutex or gate 210 can provide the first error occurrence signal ER_B1.

The second mutex or gate 230 can receive the error signal ER, the second toggle signal TG_S2 and the second error occurrence signal ER_B2 delayed by the third delay circuit 240, and respond to the error signal ER and the second toggle signal The variable signal TG_S2 and the delayed second error occurrence signal ER_B2 perform a mutually exclusive OR operation. The third delay circuit 240 may delay the second error occurrence signal ER_B2 in response to the clock signal CLK. Therefore, the second mutex OR gate 230 can provide the second error occurrence signal ER_B2.

The first output gate 250 may provide the first fault search signal CON_S1 in response to the first error occurrence signal ER_B1 and the second error occurrence signal ER_B2. In addition, the second output gate 260 can provide a second fault search signal CON_S2 in response to the first error occurrence signal ER_B1 and the second error occurrence signal ER_B2. The first fault search signal CON_S1 and the second fault search signal CON_S2 may together or separately constitute the final fault search signal CON_S.

In one embodiment, the first output gate 250 may include an inverter gate. In addition, the second output gate 260 may include an inverted OR gate. The two-state thixotropic signal monitor 200 can use the combination of the first fault search signal CON_S1 and the second fault search signal CON_S2 included in the final fault search signal CON_S to transmit information about whether the main signal M_S is correctly related to the comparison signal C_S One or more components external to the two-state thixotropic signal monitor 200. In addition, the two-state thixotropic signal monitor 200 can further use the combination of the first fault search signal CON_S1 and the second fault search signal CON_S2 to indicate the inclusion of the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200. The information about whether the brake of the gate is faulty is sent to the external component.

FIG. 5 is a flowchart summarizing in one example a method of operating the device 1 shown in FIG. 1 according to an exemplary embodiment of the inventive concept. The flowchart shown in FIG. 5 will be explained in the context of the embodiment previously explained with reference to FIGS. 1, 2 and 3.

Referring to FIGS. 1, 2 and 5, the device 1 determines whether the main signal M_S and the comparison signal C_S are applied to the two-state thixotropic signal generator 100 (S10). Here, the main signal M_S may be provided by the first functional module 10, and the comparison signal C_S may be provided by the second functional module 20.

Therefore, the device 1 can generate the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 in response to the main signal M_S and the comparison signal C_S (S20). For example, assume that the safety logic 30 shown in FIG. 2, the two-state thixotropic signal generator 100 can use the multiple comparators 110-1 to 110-N and the feedback path 120 in response to the main signal M_S and the comparison signal C_S. The first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 are generated.

The device 1 can monitor the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 (S30). Here, the safety logic 30 included in the device 1 may include a two-state thixotropic signal monitor 200, configured as described above with reference to FIG. 3 to configure the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 A two-state thixotropic signal monitor 200 for monitoring. The two-state thixotropic signal monitor 200 can provide a final fault search signal CON_S (S40) in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2. The safety logic 30 may generate an indication whether the main signal M_S is correctly related to the comparison signal C_S in response to the final fault search signal CON_S provided by monitoring the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 Information.

FIG. 6 is another flowchart summarizing a method of operating the bi-state thixotropic signal monitor 200 according to an embodiment of the inventive concept in one example.

Referring to FIGS. 2, 3, 4 and 6, the two-state thixotropic signal monitor 200 can determine whether the error signal ER is applied to the two-state thixotropic signal monitor 200 (S100 ). For example, the error signal ER may be a signal indicating whether the gate included in each of the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200 is faulty. For example, the error signal ER may be a two-state thixotropic signal. In one embodiment, the error signal ER may be provided by the error injector 400 included in the device 1, and the error injector 400 may provide the error signal ER in response to the clock signal CLK.

When the error signal ER is applied to the two-state thixotropic signal monitor 200, the two-state thixotropic signal monitor 200 can respond to the first two-state thixotropic signal TG_S1, the second two-state thixotropic signal TG_S2, and the error signal ER. Provide the final fault search signal CON_S (S110). For example, the two-state thixotropic signal monitor 200 may provide the first fault search signal CON_S1 and the second fault search signal CON_S2 as the final fault search signal CON_S, in which the first error occurrence signal ER_B1 and the second error occurrence signal ER_B2 performs the inverse sum operation to generate the first fault search signal CON_S1 and generates the second fault search signal CON_S2 by performing the inverse OR operation on the first error occurrence signal ER_B1 and the second error occurrence signal ER_B2. However, the logical combination of each of the first fault search signal CON_S1 and the second search signal CON_S2 can depend on the logical state of the error signal ER, whether the main signal M_S is correctly related to the comparison signal C_S, and the generation of a two-state thixotropic signal Whether the gate included in each of the device 100 and the two-state thixotropic signal monitor 200 is faulty varies.

Therefore, according to some embodiments of the inventive concept, the device 1 including the safety logic 30 may not only provide information indicating whether the main signal M_S is correctly related to the comparison signal C_S but also provide an indication of the two-state thixotropic signal generator 100 and the dual Information on whether the gate included in each of the thixotropic signal monitors 200 has a fault is used as the final fault search signal CON_S. In addition, all this information can be provided during runtime operation without the need to suspend operation of the device or components of the device. In this way, the device 1 can accurately detect potential latent faults during runtime operation, thereby improving efficiency and operational stability.

FIG. 7 is a timing diagram showing exemplary settings of timing relationships that may exist between the various signals described in the foregoing embodiments. Here, it is assumed that the error signal ER is derived by dividing the clock signal CLK by four (4). Those skilled in the art will recognize that the nature and source of the signals and the timing relationship of the signals are exemplary only.

Referring to FIG. 7, it is assumed that at time t1, the first two-state thixotropic signal TG_S1 is abnormally provided. Such an abnormal output of the first two-state thixotropic signal TG_S1 may be caused by a difference between at least one bit of the main signal M_S and at least one bit of the comparison signal C_S. Specifically, the first two-state thixotropic signal TG_S1 can be kept fixed at a logic low and output from the first time point t1 to the second time point t2. In response to the abnormal first two-state thixotropic signal TG_S1, the first error occurrence signal ER_B1 is output at a logic low from the first time point t1 to the second time point t2. In addition, the first fault search signal CON_S1 can be output at a logic high, and the second fault search signal CON_S2 can be output at a logic low from the first time point t1 to the second time point t2.

The first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 are normally output from the second time point t2 to the third time point t3. When the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 are normally output, the first error occurrence signal ER_B1 and the second error occurrence signal ER_B2 can be from the second time point t2 to the third time point t3 to Logic high output. In addition, the first fault search signal CON_S1 can output a logic low, and the second fault search signal CON_S2 can output a logic high.

The second two-state thixotropic signal TG_S2 can be abnormally output at the third time point t3. For example, the abnormal output of the second two-state thixotropic signal TG_S2 may be caused by the difference between at least one bit of the main signal M_S and at least one bit of the comparison signal C_S. Specifically, the second two-state thixotropic signal TG_S2 remains fixed at a logic high from the third time point t3 to the fourth time point t4. Since the second two-state thixotropic signal TG_S2 is fixed to a logic high, the second error occurrence signal ER_B2 can be output at a logic low from the third time point t3 to the fourth time point t4. In addition, the first fault search signal CON_S1 can be output at a logic high, and the second fault search signal CON_S2 can be output at a logic low from the third time point t3 to the fourth time point t4.

8A is a first table indicating the value of each of the first fault search signal CON_S1 and the second fault search signal CONS_S2 according to the value of the error signal ER and whether the end-view main signal M_S is correctly related to the comparison signal C_S TB1. 8B is an end-to-end relationship between each of the gates included in the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200 to indicate whether there is a fault and the relationship between the fault type situation and the value of the error signal ER. A second table TB2 of the values of a fault search signal CON_S1 and a second fault search signal CON_S2.

Referring to FIG. 8A, when the error signal ER has a value of 0 (or logic low) and the main signal M_S and the comparison signal C_S are correctly related, each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may have a value 0. When the error signal ER has a value of 0 and at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may have a value of 1 (Or logic high).

When the value of the error signal ER has a value of 1 and the main signal M_S and the comparison signal C_S are correctly related, each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may have a value of 1. When the error signal ER has a value of 1 and at least one bit of the main signal M_S is different from at least one bit of the comparison signal C_S, each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may have a value of 0 .

Referring to FIG. 8B, the first case assumes that the gate is faulty and the gate output is fixed at 0, and the second case assumes that the gate is faulty and the gate output is fixed at 1. For example, when the value of the error signal ER is 0 and at least one of the mutually exclusive or gates 112-1 to 112-N has a fault and corresponds to the first situation, the first fault search signal CON_S1 may have a value of 1, And the second fault search signal CON_S2 may have a value of 0. In addition, when the value of the error signal ER is 1 and at least one of the mutually exclusive OR gates 112-1 to 112-N has a fault and corresponds to the first situation, the first fault search signal CON_S1 and the second fault search signal CON_S2 Each of can have a value of zero.

For example, when the value of the error signal ER is 0 and at least one of the mutually exclusive or gates 112-1 to 112-N has a fault and corresponds to the second situation, the first fault search signal CON_S1 may have a value of 1 and The second fault search signal CON_S2 may have a value of 0. In addition, when the value of the error signal ER is 1 and at least one of the mutually exclusive OR gates 112-1 to 112-N has a fault and corresponds to the second situation, the first fault search signal CON_S1 and the second fault search signal CON_S2 Each of can have a value of zero.

Although only the values of the first fault search signal CON_S1 and the second fault search signal CON_S2 in each of the first and second cases where the mutual exclusion or the gates 112-1 to 112-N are faulty are described, but with The same explanation as above can be applied to the case where each of the other gates included in the second table TB2 has a fault. For example, when the value of the error signal ER is 0 and the first mutex or gate 210 has a fault and corresponds to the first situation, the first fault search signal CON_S1 may have a value of 1 and the second fault search signal CON_S2 may have a value 0. In addition, when the value of the error signal ER is 1 and the first mutual exclusion or gate 210 is faulty and corresponds to the first situation, each of the first fault search signal CON_S1 and the second fault search signal CON_S2 may have a value of 1. .

As mentioned above, in each case, in response to the error signal ER in which the value 0 and the value 1 are repeated (or repeated logic low and logic high) in a predetermined cycle, the first table TB1 and the second table TB2 Prepare the values of the first fault search signal CON_S1 and the second fault search signal CON_S2. Therefore, the first fault search signal CON_S1 and the second fault search signal CON_S2 may include information indicating whether the main signal M_S is correctly related to the comparison signal C_S. In addition, the first fault search signal CON_S1 and the second fault search signal CON_S2 may further include instructions indicating whether the gate included in each of the two-state thixotropic signal generator 100 and the two-state thixotropic signal monitor 200 is faulty News.

FIG. 9 is a flowchart summarizing a method of operating the device 1 shown in FIG. 1 according to an embodiment of the inventive concept in one example.

Referring to FIGS. 1 and 9, the device 1 may apply the sensing signal and the critical signal to the safety logic 30 (S200). In one example, the device 1 may apply the sensing signal as the main signal M_S to the safety logic 30, and further apply the critical signal as the comparison signal C_S to the safety logic 30. The sensing signal may be an output of the sensor indicating a specific condition associated with the device 1.

In one example, the first functional module 10 can be a temperature sensor, the temperature sensor provides the temperature sensing signal as the main signal M_S to the safety logic 30, and the second functional module 20 can be self-preset The critical signal (or limit value) derived from the temperature condition information is provided to the circuit of the safety logic 30 as the comparison signal C_S. In another example, the first functional module 10 may be a power sensor that provides the power sensing signal as the main signal M_S to the safety logic 30 (eg, voltage sensor, current sensor, signal waveform sensing And the second functional module 20 may be a circuit that provides the critical signal (or limit value) derived from the preset power condition information as the comparison signal C_S to the safety logic 30.

Next, the device 1 may generate the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 in response to the sensing signal and the critical signal (ie, in response to the main signal M_S and the comparison signal C_S) (S210). The safety logic 30 included in the device 1 may include a two-state thixotropic signal generator 100 (like the two-state thixotropic signal generator 100 described with respect to FIGS. 1 and 2) and configured to provide a first two-state The thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2, the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 vary depending on whether the sensing signal is correctly related to the critical signal.

Next, the device 1 can monitor the generated first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 (S220). The safety logic 30 included in the device 1 may include a two-state thixotropic signal monitor 200 (like the two-state thixotropic signal monitor 200 described with respect to FIGS. 1 and 3), and configured to The thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 are monitored. The two-state thixotropic signal monitor 200 can provide a final fault search signal CON_S in response to the first two-state thixotropic signal TG_S1 and the second two-state thixotropic signal TG_S2 (S230). That is, the safety logic 30 may generate information indicating whether the sensed signal is correctly related to the critical signal in response to the final fault search signal CON_S provided by monitoring the sensed signal and the critical signal.

FIG. 10 is a block diagram further illustrating the two-state thixotropic signal generator 100 shown in FIG. 1 according to an embodiment of the inventive concept in another example (100a). The configuration of the two-state thixotropic signal generator 100a shown in FIG. 10 is substantially similar to the configuration of the two-state thixotropic signal generator 100 explained with reference to FIG. However, the first multiple input gate 130a may include an AND gate, and the second multiple input gate 122a may include an OR gate. Therefore, the first multiple input gate 130a can perform and operate on the outputs of the mutually exclusive OR gates 112a-1 to 112a-N, and generate the second two-state thixotropic signal TG_S2a.

The second multiple input gate 122a can perform an OR operation on the outputs of the mutually exclusive OR gates 112a-1 to 112a-N and generate the first two-state thixotropic signal TG_S1a. In addition, the first delay circuit 124a can delay the first two-state thixotropic signal TG_S1a according to the clock signal CLKa, and the inverter 126a can invert the output of the first delay circuit 124a to generate a feedback signal and The generated feedback signal is provided to mutually exclusive OR gates 112a-1 to 112a-N.

FIG. 11 is a timing diagram showing exemplary settings that may exist in the timing relationship between various signals explained with respect to the embodiment shown in FIG. 10.

The timing chart shown in FIG. 11 is substantially similar to the timing chart shown in FIG. 7. For example, the timing chart shown in FIG. 11 shows each signal when the same main signal and comparison signal as in the embodiment shown in FIG. 7 are applied. However, referring to the timing diagram shown in FIG. 11, the second two-state thixotropic signal TG_S2a can be fixed to a logic low and output from the first time point t1a to the second time t2a, and the first two-state thixotropic signal TG_S1a can be fixed to Logic high and output from the third time point t3a to the fourth time point t4a.

FIG. 12 is a block diagram further illustrating the safety logic 30 shown in FIG. 1 according to an embodiment of the inventive concept in another example (30b). Here, the configuration of the safety logic 30b in FIG. 12 is substantially similar to the configuration of the safety logic 30 explained with reference to FIG.

It is worth noting that the safety logic 30 shown in FIG. 2 includes an internal error injector 400 that provides an error signal ER. In contrast, the safety logic 30b shown in FIG. 12 receives an externally generated error signal ERb (for example, an error signal supply source). However, the externally generated error signal ERb may be a toggle signal having a cycle longer than the cycle of the clock signal CLKb generated by the clock generator 300b.

13 is a block diagram of a device 1c according to an embodiment of the inventive concept. Here, the configuration of the device 1c in FIG. 13 is substantially similar to the configuration of the device 1 explained with reference to FIG. However, the device 1c further includes a controller 50 and an interrupt generator 40c, wherein the interrupt generator 40c is used to generate an interrupt signal ITc applied to the controller 50 in response to the final fault search signal CON_Sc.

Here, it is assumed that the controller 50 controls (CTRL) the overall operations of the first functional module 10c and the second functional module 20c. It is further assumed that the controller 50 responds to the interrupt signal ITc conditionally provided by the interrupt generator 40c in the operation of the controller 50.

For example, the interrupt generator 40c may obtain information indicating whether the main signal M_Sc is correctly related to the comparison signal C_Sc in response to the final fault search signal CON_Sc. The interrupt generator 40c can also obtain information indicating whether the gate included in the two-state thixotropic signal generator 100c and the two-state thixotropic signal monitor 200c is faulty in response to the final fault search signal CON_Sc.

It is further worth noting that in some embodiments, the interrupt generator 40c may operate according to the first table TB1 shown in FIG. 8A to provide an indication whether the main signal M_Sc is correctly related to the comparison signal C_Sc in response to the final fault search signal CON_Sc Information. Therefore, when it is determined that at least one bit of the main signal M_Sc is different from at least one bit of the comparison signal C_Sc, the interrupt generator 40c may provide the interrupt signal ITc in response to the determination result. In addition, when the first functional module 10c provides the main signal M_Sc as the sensing signal and the second functional module 20c provides the comparison signal C_Sc as the critical signal, it can be determined that the main signal M_Sc and the comparison signal C_Sc are correctly related, and the interrupt generator 40c may provide an interrupt signal ITc in response to the determined result.

In addition, in some embodiments, the interrupt generator 40c may operate according to the second table TB2 shown in FIG. 8B to obtain an indication toggle signal generator 100c and a toggle signal monitor in response to the final fault search signal CON_Sc Information on whether any brakes included in 200c are faulty. Therefore, it can be determined that at least one of the gates included in the two-state thixotropic signal generator 100c and the two-state thixotropic signal monitor 200c has a fault, and the interrupt generator 40c can provide the interrupt signal ITc in response to the determination result.

For example, the interrupt generator 40c may provide the interrupt signal ITc to a controller (not shown) included in the device 1c. As another option, the interrupt generator 40c may provide the interrupt signal ITc to the superior controller located outside the device 1c.

FIG. 14 is a flowchart summarizing, in one example, a method of operating the device 1c shown in FIG. 13 according to an embodiment of the inventive concept.

13 and 14, the device 1c may apply the main signal M_Sc and the comparison signal C_Sc to the safety logic 30c (S300). The safety logic 30c may include a two-state thixotropic signal generator 100c and a two-state thixotropic signal monitor 200c. The two-state thixotropic signal generator 100c can provide the first two-state thixotropic signal TG_S1c and the second two-state thixotropic signal TG_S2c in response to the main signal M_Sc and the comparison signal C_Sc, and the two-state thixotropic signal monitor 200c can respond to The first two-state thixotropic signal TG_S1c and the second two-state thixotropic signal TG_S2c provide the final fault search signal CON_Sc (S310).

The interrupt generator 40c may determine whether a fault has occurred according to the final fault search signal CON_Sc (S320). For example, when it is determined that at least one bit of the main signal M_Sc is different from at least one bit of the comparison signal C_Sc in response to the fault search signal CON_Sc, the interrupt generator 40c may determine that a fault has occurred. Alternatively, when it is determined that at least one of the gates included in the two-state thixotropic signal generator 100c and the two-state thixotropic signal monitor 200c is faulty in response to the fault search signal CON_Sc, the interrupt generator 40c may determine A failure has occurred.

When a fault occurs, the interrupt generator 40c may provide an interrupt signal ITc (S330). For example, the device 1c may include a controller configured to control components of the device 1c, and the interrupt generator 40c may provide the interrupt signal ITc to the controller. In addition, the interrupt generator 40c may provide the interrupt signal ITc to the outside of the device 1c.

15 is a block diagram illustrating a system on chip (SoC) 1000 including security logic 1040 according to some embodiments of the inventive concept.

Referring to FIG. 15, SoC 1000 includes a plurality of intellectual properties (IP) (for example, first IP to third IP 1010, 1020, and 1030), security logic 1040, and system bus 1050. The SoC 1000 can be designed to perform various functions in semiconductor systems. For example, SoC 1000 may be an application processor.

SoC 1000 may include various types of IP. For example, the first IP to the third IP 1010, 1020, and 1030 may include a processing unit, a plurality of cores included in the processing unit, a multi-format codec (MFC), a video module (such as , Camera interface, joint photographic experts group (JPEC) processor, video processor or mixer), three-dimensional (3D) graphics core, audio system, driver, display driver, volatile memory , Non-volatile memory, memory controller, input/output (I/O) interface block or cache memory.

A connection scheme based on the system bus 1050 may be used as a technology for connecting the first IP to the third IP 1010, 1020, and 1030 to the safety logic 1040. For example, the Advanced Microcontroller Bus Architecture (AMBA) protocol from the Advanced RISC Machine (ARM) machine from the Advanced Reduced Instruction Set Computing (RISC) machine can be used as the standard bus agreement . AMBA protocol bus types can include Advanced High-Performance Bus (AHB), Advanced Peripheral Bus (APB), Advanced EXtensible Interface (AXI), AXI4, AXI Consistency extension (AXI Coherency Extension, ACE), etc. In the above bus types, AXI can be an interface protocol between IPs, and provides multiple pending address functions and data interleaving functions. In addition, other types of agreements (such as uNetwork from SONICs Inc), CoreConnect from International Business Machines (IBM), and open core agreements The Open Core Protocol (Open Core Protocol, OCP) of the OpenCore Protocol International Partnership (OCP-IP) is applied to the system bus 1050.

In an exemplary embodiment, the safety logic 1040 may detect whether there is a fault in the signal output from at least one of the first IP to the third IP 1010, 1020, and 1030. In an example, the second IP (or IP2) 1020 may include the same configuration as the first IP (or IP1) 1010 to determine whether there is a fault in the IP1 1010. Therefore, IP1 1010 can output the main signal to the safety logic 1040, and IP2 1020 can output the comparison signal to the safety logic 1040. The safety logic 1040 may be implemented based on the embodiments explained with reference to FIGS. 1 to 14. Therefore, the SoC 1000 can detect whether there is a fault in the signals output from the first IP to the third IP 1010, 1020, and 1030 during the runtime operation, and detect whether the gate included in the safety logic 1040 has a fault.

16 is a block diagram illustrating a memory system 1100 including security logic according to some embodiments of the inventive concept.

16, the memory system 1100 generally includes a memory controller 1200 and a memory device 1300, wherein the memory controller 1200 controls access to the memory device 1300 in response to commands from a host (not shown) (For example, read/write). Specifically, the memory controller 1200 may provide addresses, commands, and control signals to the memory device 1300, and control program operations, read operations, and erase operations performed on the memory device 1300.

The memory controller 1200 may include a first error checking and correction (ECC) encoder 1210, a second ECC encoder 1220, and a first security logic 1230. For example, the first ECC encoder 1210 and the second ECC encoder 1220 may perform an ECC encoding operation based on the input write data WD and output the first encoded write data WD_C1 and the second encoded write, respectively Enter the data WD_C2. For example, the second ECC encoder 1220 may include the same configuration as the first ECC encoder 1210 to determine whether there is a fault in the signal output by the first ECC encoder 1210.

The first safety logic 1230 may be implemented based on the embodiments explained with reference to FIGS. 1 to 14. In an exemplary embodiment, the first ECC encoder 1210 may output the first encoded write data WD_C1 as the main signal to the first security logic 1230. In addition, the second ECC encoder 1220 may output the second encoded write data WD_C2 as a comparison signal to the first security logic 1230. The first safety logic 1230 may output the first fault search signal CON_Sd_1 as the first encoded write data WD_C1 and the second encoded write data WD_C2.

The memory controller 1200 may further include a first ECC decoder 1240, a second ECC decoder 1250, and a second security logic 1260. For example, the first ECC decoder 1240 and the second ECC decoder 1250 may perform an ECC decoding operation based on the read data RD_C read from the memory device 1300 and output the first decoded read data RD_1 and the second Decoded read data RD_2. For example, the second ECC decoder 1250 may include the same configuration as the first ECC decoder 1240 to determine whether there is a fault in the signal output by the first ECC decoder 1240.

The second safety logic 1260 may be implemented based on the embodiments explained with reference to FIGS. 1 to 14. In an exemplary embodiment, the first ECC decoder 1240 may output the first decoded read data RD_1 as the main signal to the second security logic 1260. In addition, the second ECC decoder 1250 may output the second decoded read data RD_2 as a comparison signal to the second security logic 1260. The second safety logic 1260 may output a second fault search signal CON_Sd_2 in response to the first decoded read data RD_1 and the second decoded read data RD_2.

17 is a conceptual diagram illustrating a vehicle 1400 including safety logic according to some embodiments of the inventive concept.

Referring to FIG. 17, the vehicle 1400 includes a processing assembly 1402, at least one sensor 1420, a communication interface (I/F) 1430, a driving control element 1440, an autonomous navigation system 1450, and a user interface 1460. The sensor 1420 may include at least one camera device, an active scanning device (eg, at least one Light Detection And Ranging (LiDAR) sensor), at least one ultrasonic sensor, and at least one geospatial positioning Device. The sensor 1420 may monitor at least a part of the external environment around the vehicle 1400 and generate a sensing signal.

The communication interface 1430 may include a transceiver and/or a global positioning system (GPS). The driving control element 1440 may include: a vehicle steering device configured to control the direction of the vehicle 1400; a throttle device configured to control the motor or engine of the vehicle 1400 and controlling acceleration and/or deceleration; and a braking device configured to control Braking of the vehicle 1400; and external lighting.

The autonomous navigation system 1450 may include a computing device configured to implement autonomous control of the driving control element 1440. For example, the autonomous navigation system 1450 may include a memory configured to store multiple program commands and at least one processor configured to execute the program commands. The autonomous navigation system 1450 may be configured to control the driving control element 1440 based on the sensing signal output by the sensor 1420. The user interface 1460 may include a display indicating the dashboard of the vehicle 1400.

In an exemplary embodiment, the processing assembly 1402 may include security logic 1410. The safety logic 1410 may be implemented based on the embodiments explained with reference to FIGS. 1 to 14. Although not shown in the figure, the vehicle 1400 may further include the same configuration as each of the sensor 1420, the communication interface 1430, the driving control element 1440, the autonomous navigation system 1450, and the user interface 1460 to determine the sense of freedom Whether there is a fault in the signal output by each of the detector 1420, the communication interface 1430, the driving control element 1440, the autonomous navigation system 1450, and the user interface 1460. Therefore, the vehicle 1400 can detect the output of at least one of the sensor 1420, the communication interface 1430, the driving control element 1440, the autonomous navigation system 1450, and the user interface 1460 during runtime operation (eg, during driving operation) Whether there is a fault in the signal. In addition, the vehicle 1400 may detect whether the brake included in the safety logic 1410 is faulty. Therefore, the safety of the vehicle 1400 can be further improved.

The foregoing exemplary embodiments of the inventive concept have been disclosed above with reference to the drawings. Although specific terminology is used, the specific terminology is only used for general and descriptive meaning, not for limiting purposes. Those with ordinary knowledge in this technology should understand that various changes in form and details can be made to the disclosed embodiments without departing from the spirit and scope of the inventive concept defined by the patent application below.

1, 1c: equipment 10, 10c: the first functional module 20, 20c: second function module 30, 30b, 30c, 1040, 1410: safety logic 40c: Interrupt generator 50: controller 100, 100a, 100b, 100c: two-state thixotropic signal generator 110-1, 110-2, 110-N, 110a-1, 110a-2, 110a-N, 110b-1, 110b-2, 110b-N: comparator 112-1: Mutual Exclusion or Gate/First Mutual Exclusion or Gate 112-2, 112a-1, 112a-2, 112a-N, 112-N: mutually exclusive or gate 120, 120a, 120b: feedback path 122, 122a: Second multiple input gate 124, 124a: the first delay circuit 126, 126a: inverter 130, 130a, 130b: the first multiple input gate 200, 200b, 200c: two-state thixotropic signal monitor 210: first mutex or gate 220: Second delay circuit 230: second mutex or gate 240: Third delay circuit 250: first output gate 260: Second output gate 300, 300b: clock generator 400: Error injector 1000: System on chip (SoC) 1010: First IP/IP1 1020: Second IP/IP2 1030: Third IP 1050: System bus 1100: Memory system 1200: memory controller 1210: The first error checking and correction (ECC) encoder 1220: Second ECC encoder 1230: First safety logic 1240: First ECC decoder 1250: Second ECC decoder 1260: Second safety logic 1300: Memory device 1400: Vehicle 1402: Processing assembly 1420: Sensor 1430: Communication interface 1440: Driving control element 1450: Autonomous navigation system 1460: User interface C_S, C_Sb, C_Sc: comparison signal C_S1: the first comparison signal bit C_S1a, C_S2, C_S2a, C_SN, C_SNa: compare signal bits CLK, CLKa, CLKb: clock signal CON_S, CON_Sb, CON_Sc: final fault search signal CON_S1, CON_S1a, CON_Sd_1: the first fault search signal CON_S2, CON_S2a, CON_Sd_2: second fault search signal CTRL: control ER, ERa, ERb: error signal ER_B1, ER_B1a: first error occurrence signal ER_B2, ER_B2a: second error occurrence signal ITc: Interrupt signal M_S, M_Sb, M_Sc: main signal M_S1: the first main signal bit M_S1a, M_S2, M_S2a, M_SN, M_SNa: main signal bit RD_1: the first decoded read data RD_2: second decoded read data RD_C: read data S10, S20, S30, S40, S100, S110, S200, S210, S220, S230, S300, S310, S320, S330: steps t1: time/first time point t1a: the first time point t2, t2a: second time point t3, t3a: third time point t4, t4a: fourth time point TB1: the first table TB2: Second table TG_S1, TG_S1a, TG_S1b, TG_S1c: the first two-state thixotropic signal TG_S2, TG_S2a, TG_S2b, TG_S2c: the second two-state thixotropic signal WD: Write data WD_C1: the first encoded write data WD_C2: second encoded write data

By reading the following detailed description in conjunction with the accompanying drawings, embodiments of the inventive concept will be more clearly understood. In the drawings: FIG. 1 is a block diagram illustrating a device according to an embodiment of the inventive concept. FIG. 2 is a block diagram further illustrating the security logic shown in FIG. 1 according to an embodiment of the inventive concept in one example. FIG. 3 is a block diagram further illustrating the two-state thixotropic signal generator shown in FIG. 2 according to an embodiment of the inventive concept in one example. FIG. 4 is a block diagram further illustrating the two-state thixotropic signal monitor shown in FIGS. 1 and 3 according to an embodiment of the inventive concept in one example. FIG. 5 is a flowchart summarizing a method of operating a device according to an embodiment of the inventive concept. FIG. 6 is a flowchart summarizing a method of operating a two-state thixotropic signal monitor according to an embodiment of the inventive concept. 7 is a timing diagram illustrating an exemplary signal timing relationship according to an embodiment of the inventive concept. 8A and 8B are corresponding tables showing the values of the final fault search signal provided under various conditions. 9 is a flowchart summarizing a method of operating a device according to an embodiment of the inventive concept. FIG. 10 is a block diagram further illustrating a two-state thixotropic signal generator according to an embodiment of the inventive concept. FIG. 11 is a timing diagram illustrating an exemplary signal timing relationship according to an embodiment of the inventive concept. 12 is a block diagram illustrating safety logic showing exemplary signal timing relationships according to an embodiment of the inventive concept. 13 is a block diagram illustrating an apparatus showing an exemplary signal timing relationship according to an embodiment of the inventive concept. 14 is a flowchart summarizing a method of operating an apparatus showing an exemplary signal timing relationship according to an embodiment of the inventive concept. 15 is a block diagram of a system-on-chip (SoC) including security logic according to an embodiment of the inventive concept. 16 is a block diagram of a memory system including security logic according to an embodiment of the inventive concept. 17 is a conceptual diagram of a vehicle including safety logic according to a conceptual embodiment of the present invention.

1: Equipment

10: The first functional module

20: Second function module

30: Safety logic

100: two-state thixotropic signal generator

200: Two-state thixotropic signal monitor

C_S: comparison signal

CON_S: Final fault search signal

M_S: main signal

TG_S1: the first two-state thixotropic signal

TG_S2: the second two-state thixotropic signal

Claims (25)

A testing equipment, including: The first functional module is configured to provide the main signal; The second functional module is configured to provide a comparison signal; and Safety logic, including: A two-state thixotropic signal generator includes at least one comparator, a feedback path, and a first multiple input gate. The at least one comparator is configured to provide a comparison result in response to the main signal and the comparison signal. The feedback path is configured to generate a first two-state thixotropic signal in response to the comparison result and provide a feedback signal to the at least one comparator, and the first multiple input gate is configured to respond to the comparison result And generate a second two-state thixotropic signal; and A two-state thixotropic signal monitor is configured to provide a final fault search signal in response to the first two-state thixotropic signal and the second two-state thixotropic signal. The detection device according to item 1 of the patent application scope, wherein the feedback path includes: The second multiple input gate is configured to generate the first two-state thixotropic signal in response to the comparison result; the first delay circuit is configured to delay the output of the second multiple input gate; And an inverter configured to provide the feedback signal by inverting the output of the first delay circuit. The detection device according to item 2 of the patent application scope, wherein the first multiple input gate includes an AND gate and the second multiple input gate includes an OR gate. The detection device according to item 2 of the patent application scope, wherein the first multiple input gate includes an OR gate and the second multiple input gate includes an AND gate. The detection device according to item 1 of the patent application scope, wherein the two-state thixotropic signal monitor includes: The first mutex or gate is configured to provide a first error occurrence signal in response to the first two-state thixotropic signal; The second mutex or gate is configured to provide a second error occurrence signal in response to the second two-state thixotropic signal; A first output gate configured to provide a first fault search signal in response to the first error occurrence signal and the second error occurrence signal; and The second output gate is configured to provide a second fault search signal in response to the first error occurrence signal and the second error occurrence signal. The detection device according to item 5 of the patent application scope, wherein the first output gate includes an inverting gate and the second output gate includes an inverting or gate. The detection device according to item 5 of the patent application scope, wherein the two-state thixotropic signal monitor includes: A second delay circuit configured to delay the first error occurrence signal and provide the delayed first error occurrence signal to the first mutex or gate; and A third delay circuit is configured to delay the second error occurrence signal and provide the delayed second error occurrence signal to the second mutex or gate. As for the detection device described in item 7 of the patent application scope, the safety logic further includes: The clock generator is configured to generate a clock signal, wherein the second delay circuit and the third delay circuit respectively generate a signal for the first error and the second error in response to the clock signal Signals are delayed. As for the detection equipment described in item 8 of the patent application scope, the safety logic further includes: An error injector is configured to provide an error signal in response to the clock signal, wherein the first mutex or gate further provides the first error occurrence signal in response to the error signal, and the second The mutual exclusion or gate further provides the second error occurrence signal in response to the error signal. The detection device according to item 9 of the patent application range, wherein the error injector includes a clock divider, and the clock divider is configured to divide the clock signal. As described in item 1 of the patent application scope, the detection device further includes: A controller configured to control the first functional module and the second functional module; and An interrupt generator is configured to generate an interrupt signal in response to the final fault search signal and provide the interrupt signal to the controller. The detection device according to item 1 of the patent application scope, wherein the first functional module senses the temperature of the detection device and provides a temperature sensing value as the main signal, and The second functional module provides a critical temperature value as the comparison signal. A detection device including safety logic, the safety logic includes: A two-state thixotropic signal generator is configured to provide a first two-state thixotropic signal and a second two-state thixotropic signal in response to the main signal and the comparison signal, wherein each of the main signal and the comparison signal It includes multiple bits; and The two-state thixotropic signal monitor is configured to provide a final fault search signal in response to the detection of the first two-state thixotropic signal and the second two-state thixotropic signal, The two-state thixotropic signal generator includes: A plurality of comparators, configured to compare the main signal with the comparison signal bit by bit and generate a comparison result; The feedback path is configured to perform a first gate operation in response to the comparison result, generate the first two-state thixotropic signal, and provide a feedback signal to the multiple in response to the first two-state thixotropic signal Each of the comparators; and The first multiple input gate is configured to perform a second gate operation in response to the comparison result and generate the second two-state thixotropic signal. The detection device according to item 13 of the patent application range, wherein during the running time of the detection device, the two-state thixotropic signal generator provides the first in response to the main signal and the comparison signal A two-state thixotropic signal and the second two-state thixotropic signal. As for the detection device described in item 13 of the patent application scope, the safety logic further includes: The clock generator is configured to provide a clock signal, wherein the feedback path further provides the feedback signal in response to the clock signal. As for the detection device described in item 15 of the patent application scope, the safety logic further includes: An error injector is configured to generate an error signal in response to the clock signal, wherein the two-state thixotropic signal monitor is configured to monitor the first two-state thixotropic signal in response to the error signal And the second two-state thixotropic signal. The detection device according to item 15 of the patent application scope, wherein the feedback path includes: A first delay circuit configured to delay the first two-state thixotropic signal in response to the clock signal; and An inverter is configured to provide the feedback signal by inverting the output of the first delay circuit. The detection device according to item 15 of the patent application scope, wherein the two-state thixotropic signal monitor includes: The first mutex or gate is configured to provide a first error occurrence signal in response to the first two-state thixotropic signal; A second delay circuit configured to delay the first error occurrence signal in response to the clock signal and provide the delayed first error occurrence signal to the first mutex or gate; The second mutex or gate is configured to provide a second error occurrence signal in response to the second two-state thixotropic signal; A third delay circuit configured to delay the second error occurrence signal in response to the clock signal and provide the delayed second error occurrence signal to the second mutex or gate; and A plurality of output gates are configured to provide the final fault search signal in response to the first error occurrence signal and the second error occurrence signal. The detection device according to item 18 of the patent application scope, wherein the plurality of output gates include: A buck gate is configured to provide a first fault search signal in response to the first error occurrence signal and the second error occurrence signal; and An anti-OR gate is configured to provide a second fault search signal in response to the first error occurrence signal and the second error occurrence signal. A detection device including safety logic, the safety logic includes: A plurality of comparators respectively receive at least one bit of the main signal and at least one bit of the comparison signal, and are configured to compare the main signal with the comparison signal bit by bit to generate the comparison result; The feedback path is configured to generate a first two-state thixotropic signal in response to the comparison result, and is further configured to generate a feedback signal in response to the clock signal and the first two-state thixotropic signal, wherein the The feedback signal is provided to each of the plurality of comparators; The first multiple input gate is configured to perform a first gate operation on the comparison result to generate a second two-state thixotropic signal; A two-state thixotropic signal monitor is configured to monitor the first two-state thixotropic signal and the second two-state thixotropic signal in response to the clock signal, and provide a final fault search signal, the final The fault search signal provides information indicating whether the main signal is correctly associated with the comparison signal; and An error injector is configured to generate an error signal in response to the clock signal, wherein the two-state thixotropic signal monitor further monitors the first two-state thixotropic signal and the in response to the error signal The second two-state thixotropic signal provides the final fault search signal, and the final fault search signal further provides instructions to the plurality of comparators, the feedback path, the first multiple input gate, and the dual Information on whether at least one of the thixotropic signal monitors has a fault. A method of operating a detection device that includes safety logic, the method includes: Judging whether the main signal is correctly associated with the comparison signal, and generating a first two-state thixotropic signal and a second two-state thixotropic signal in response to the judgment whether the main signal is correctly associated with the comparison signal; and Generating a final fault search signal in response to the first two-state thixotropic signal and the second two-state thixotropic signal, Wherein the final fault search signal provides information indicating whether the main signal is correctly associated with the comparison signal, and further provides an indication used in the process of determining whether the main signal is correctly associated with the comparison signal There is information on whether at least one of the logic gates of the fault exists. The method of claim 21, wherein the main signal includes a first plurality of bits and the comparison signal includes a second plurality of bits, and The judging whether the main signal is correctly associated with the comparison signal is performed using a plurality of comparators, which respectively compare one of the first plurality of bits with the second The other of the multiple bits is compared. The method of claim 22, wherein the judging whether the main signal is correctly associated with the comparison signal includes: Use the multiple comparators to provide a comparison result to a feedback path; The feedback path is used to generate the first two-state thixotropic signal in response to the comparison result, wherein a feedback signal is applied to the plurality of comparators. The method as described in item 21 of the patent application scope further includes: Generating a first error occurrence signal in response to the first two-state thixotropic signal; Generating a second error occurrence signal in response to the second two-state thixotropic signal; Generating a first fault search signal in response to the first error occurrence signal and the second error occurrence signal; and A second fault search signal is generated in response to the first error occurrence signal and the second error occurrence signal. The method described in item 24 of the patent application scope further includes: Delaying the first error occurrence signal to provide the delayed first error occurrence signal to the first mutex or gate; and Delaying the second error occurrence signal to provide the delayed second error occurrence signal to the second mutex or gate.

Images