WO2022152509A1 - Bus system with error identification function - Google Patents

Abstract

The present invention relates to a bus system with error identification function having: a bus master (10), a master monitoring module (15), a bus slave (20) and a slave monitoring module (25), wherein the master monitoring module (15) is configured to calculate a master checksum over slave address data, payload data and control data of a first signal (S1) generated by the bus master (10) and to compare said master checksum with a slave checksum which is calculated by the slave monitoring module (25) over the first signal (S1) received in the bus slave (20) and to output a checksum error signal if the master checksum does not match the slave checksum, wherein the slave monitoring module (25) is configured to receive the first signal (S1) with slave subaddress data, to determine, from predefined slave address information, the slave address data, to calculate a slave checksum over the slave address data, the payload data and the control data of the first signal (S1), and to transfer the slave checksum to the master monitoring module (15) by means of a second signal (S2).

Description

description

title

Bus system with error detection function

State of the art

The present invention relates to a bus system with an error detection function.

In electronic systems (e.g. system-on-chip (SoC) ASICs with and without microcontroller), a standardized bus architecture is often used as the internal data bus.

The specification of simpler bus systems often does not define any hardware-related measures for detecting permanent or temporary individual errors. This applies, for example, to the AMBA bus specification from ARM. Correspondingly, when using such a bus architecture in order to comply with safety requirements (eg according to the ASIL standard), the bus system must be secured in a predefined manner with regard to such errors. Related ASIL requirements are specified in the ISO26262 Part 5 standard.

ASIL-compliant protection for such bus implementations therefore provides for the following measures, for example:

Implementation of a fully redundant bus system, operation using the lock-step procedure, integrated self-tests of the bus system (e.g. when the system is started and/or during operation), securing of data and/or addresses using additional checksums, or reading back written data or Repetition of read operations.

Disclosure of Invention The present invention therefore proposes a bus system with an error detection function, which can be used in particular but not exclusively in a system-on-chip. The bus system has at least one bus master and at least one bus slave, the bus master having a master monitoring module according to the invention and the bus slave having a slave monitoring module according to the invention. If several bus masters and/or bus slaves are used in the bus system, each bus master and/or each bus slave preferably has a monitoring module according to the invention. If the safety requirements for the bus system permit, it is also conceivable that individual subnetworks and/or master/slave components of the bus system are used without the monitoring modules according to the invention. The respective master and slave monitoring modules are advantageously designed as independent (“add-on”) components for a bus system known from the prior art, which can be used as a basic system in connection with the present invention. In addition, the master and slave monitoring modules are particularly advantageously set up not to influence existing data communications or configurations of such a bus system used from the prior art, since the respective data or signals of the bus system are accessed exclusively for reading. This is preferably achieved by designing the master and slave monitoring modules as independent hardware components which, together with the respective bus master and bus slave components of the bus system known from the prior art, are connected by means of respective master wrapper components or Slave wrapper components are encapsulated in such a way that they have a common signal interface to the outside (outside the respective wrapper components). This signal interface preferably corresponds in an unchanged manner to the respective specification of the bus system used as the basis.

The master monitoring module is set up, a master checksum of slave address data (ie, data that identify / address that bus slave with which the bus master wants to exchange data), user data and control data generated by the bus master calculate the first signal and store the calculated checksum and compare the stored master checksum with a slave checksum, which is calculated by the slave monitoring module via the first signal received in the bus slave.

In addition, the master monitoring module is set up to output a checksum error signal if the master checksum does not match the slave checksum. The checksum error signal is transmitted, for example in the form of an interrupt signal, to an interrupt handler of a chip or computer having the bus system, so that a suitable interrupt service routine for error handling is executed in response to the signal. Alternatively or additionally, it is also conceivable to transmit the checksum error signal to hardware and/or software components of a chip or computer using the bus system that deviate from it, in order to carry out the error handling by them. The slave monitoring module is set up to receive the first signal with slave subaddress data, to determine the slave address from predefined slave address information and to calculate a slave checksum using the slave address data, the user data and the control data of the first signal .

The slave subaddress data should be understood to mean those address data of a bus slave addressed by means of this address data, which are received by the addressed bus slave or by the associated slave monitoring module in the course of a master/slave communication. Particularly in hierarchically structured bus systems and/or when using multiplexer and/or router components between the respectively communicating bus master and bus slave components, it is possible that the respectively addressed bus slave only has a part of a received the absolute or system-wide bus slave address originally used by the bus master. The reason for this is that a bus slave located in a subnet of the entire bus system only needs the respective subaddress data within this subnet in order to clearly identify the slave address addressed by the master. However, since the bus master uses the absolute or system-wide address of the addressed bus slave for the checksum calculation when sending data to the respective bus slave, it is necessary to compare the respective master checksum and the corresponding slave checksum required that the respectively addressed bus slave is the same full address used for slave checksum calculation. The full bus slave address is calculated on the basis of the received subaddress, for example, in such a way that the full bus slave address and/or that part of the full address is persistently stored in the addressed slave monitoring module, which in the course of routing the first signal the slave address data is removed.

In the case of an existing bus configuration in which there is no shortening of address data due to subnet routing etc. between a bus master and a bus slave communicating with this bus master, it is also possible that the bus slave via the first signal directly the full d. H. receives the absolute slave address and therefore does not have to calculate it itself.

The slave monitoring module is also set up to transmit the slave checksum to the master monitoring module by means of a second signal, for example before the end of a respective bus cycle. The slave checksum transmitted in this way is then, as described above, compared in the master monitoring module with the checksum stored in the master monitoring module.

The expansion of an existing bus system according to the invention offers e.g. the advantage that not only the respective user data that is transmitted between a bus master and a bus slave, but also the address data used to address a respective bus slave and the respective control data are secured on the hardware side by means of the checksums described above, which means that reliability and /or availability and/or performance and/or scope of error detection and/or handling of such a bus system is improved and/or general safety-critical requirements for data transmission of such a bus system can be met (e.g. requirements of ISO 26262- standards).

The dependent claims show preferred developments of the invention.

In an advantageous embodiment of the present invention, the master monitoring module is set up to output a timeout error signal when a transfer request to the bus slave generated by means of the first signal is not answered by the bus slave within a predefined period of time. The predefined period of time is established, for example, on the basis of a predefined maximum number of bus clock cycles in the bus system.

Alternatively or additionally, it is also conceivable to use a "watchdog" component for timeout monitoring of the bus slave responses, which preferably has a time base that is independent of the bus clock.

In a particularly preferred embodiment of the present invention, the bus system is an AMBA bus system which, in the basic configuration, meets the AMBA specification of the company ARM and preferably has an AHB (Advanced High-Performance) bus and/or an APB (Advanced Peripheral ) bus up. Furthermore, it is also possible for the AMBA bus system to have an ASB (Advanced System) bus. The expansion components according to the invention and their functions are particularly advantageous in connection with the AMBA bus system, but can also be used advantageously in connection with bus systems that deviate from it.

If an AMBA bus system is used, the AMBA bus system is preferably set up to transmit the second signal within an AHB bus using a standard user signal and within an APB bus using an additionally provided sideband signal, since the APB Bus does not provide for the use of AHB bus user signals. For the transmission of such a sideband signal, additional lines are preferably implemented between the respective bus master and bus slave components, via which the sideband signal is transmitted.

In one possible embodiment of the present invention, the bus system has at least one interconnect matrix for connecting a plurality of bus masters with respective master monitoring modules and/or a plurality of bus slaves with respective slave monitoring modules, via which respective data transmissions are coordinated .

If at least two bus subsystems are used, each of which implements different bus protocols, the bus system advantageously comprises at least one protocol converter, which has a master monitoring module for one of the two protocols to be converted and for the respective other of the two protocols to be implemented has a slave monitoring module. If an AMBA bus system is used, the protocol converter is an AHB/APB bridge, for example, which is set up to establish communication between an AHB bus and an APB bus of the AMBA bus system. In such a case, an information technology interface of the AHB/APB bridge that is connected to the AHB bus of the AMBA bus system functions as a bus slave, whose data communication with a bus master on the AHB bus is secured by means of a slave monitoring module according to the invention, while an APB bus interface of the AHB/APB bridge accordingly acts as a bus master on the APB bus, with this bus master having a master monitoring module according to the invention to protect data communication on the APB bus.

To ensure the integrity of all bus signals that are converted by means of such a protocol converter, the protocol converter preferably has a redundant structure and/or lock-step operation to check the data to be converted for plausibility. In the event of an error in the plausibility check of the data to be converted determined by the redundant design of the protocol converter, a protocol converter error signal is preferably output so that such an error can be evaluated and treated at a suitable point in the system. Error handling takes place, for example, in the manner suggested in connection with the checksum error signal. The bus system according to the invention is thus able to completely protect data communication from a bus master of a specific bus protocol to a bus slave of another bus protocol against errors, since the protocol converter is also protected in this way, while the data on the protocol converter are protected by the respective Bus systems incoming data are secured by means of the above-described master and slave monitoring components of the protocol converter.

In a further advantageous embodiment of the present invention, the bus system has at least one slave multiplexer, with each slave multiplexer being connected to a select monitoring module which is set up to output a select error signal if the slave multiplexer sends more than one bus slave is selected at the same time. Such a slave multiplexer, it is possible to have a plurality of bus slaves with one or to connect several bus masters in terms of information technology. If an AMBA bus system is used, the standard signals HSEL (on the AHB BUS) or PSEL/PENABLE (on the APB bus) are preferably evaluated. For example, the select error signal is registered and processed in the system in a manner similar to the checksum error signal.

If segmented data transmissions are used (i.e. if a data packet to be transmitted is too large to be transmitted in a single data transfer), the bus system is also set up to secure each data segment using a respective master/slave checksum, so that in the sum of all data of the data packet to be transmitted is secured accordingly.

Furthermore, the bus system is set up to assign respective slave checksums to their respective corresponding master checksums in that the second signal, which is sent by a respective bus slave, contains a unique identifier for the respective bus slave. This unique identifier for assigning the respective slave checksum preferably includes the complete address information of the respective bus slave. In this way it is ensured that a checksum stored in a master monitoring module of a requesting bus master only ever corresponds to that checksum of the bus slave addressed for this request. In the event that, due to a malfunction in the bus system, a bus slave other than the bus slave addressed by the bus master responds to the first signal, the master is based on the slave address information contained in the slave checksum in able to detect such an error.

This always applies with the restriction that the addressed bus slave is able to respond within the timeout period described above. If this is not the case, a current transfer request from a respective bus master is aborted, for example, and the timeout error handling described above is carried out instead.

Brief description of the drawings Exemplary embodiments of the invention are described in detail below with reference to the accompanying drawings. It shows:

FIG. 1 shows a schematic overview of an example configuration of a bus system according to the invention.

Embodiments of the invention

FIG. 1 shows a schematic overview of an example configuration of a bus system according to the invention, the bus system being an AMBA bus system with AHB and APB bus segments in accordance with the specification from the ARM company. The bus system has an interconnect matrix 50 here, which is connected in terms of information technology to a plurality of bus masters 10 directly and to a plurality of bus slaves 20 directly and indirectly (ie via other components of the bus system). The components connected to the interconnect matrix 50 in terms of information technology each implement the AHB protocol of the AMBA bus system. Respective data communications between respective bus masters 10 and bus slaves 20 addressed by the bus masters 10 are coordinated via the interconnect matrix 50 . The respective bus masters 10 of the AHB bus are supplemented here by respective master monitoring modules 15, which implement protection according to the invention for data to be transmitted.

The master monitoring modules 15 each include a checksum generation unit 80, a checksum comparison unit 82 and a timeout determination unit 84. It should be noted that the aforementioned units of the master monitoring modules 15 are present here in all master monitoring modules 15, im For the purposes of a simplified overview, however, only one of the bus masters 10 is shown as an example. The respective bus masters 10 and their associated master monitor modules 15 are encapsulated to the outside (i.e., to the interconnect matrix 50) by means of respective master wrapper components 17.

The respective master monitoring modules 15 are set up, in the course of a transfer request by a respective associated bus master 10, to a master checksum of address data HADDR, control data HCTRL and user data HDATA of a first signal generated by the respective bus master 10 calculate and store this checksum in a memory unit. It should be noted that the identifiers of respective signals (such as HADDR, HCTRL, HDATA, HSEL, HRUSER, PRUSER, PSEL, etc.) are given by means of reference symbols, for reasons of clarity in Figure 1, as representative of only some of the illustrated components. A bus slave 20 addressed by means of the transfer request, which, analogous to the bus master 10, has an associated slave monitoring module 25, which is encapsulated together with the bus slave 10 by a slave wrapper component 27, is set up Based on the data received by the bus master 10 to calculate a slave checksum. For this purpose, each slave monitoring module 25 has a checksum generation unit 80 and an address calculation unit 86, the latter being set up to assign the absolute bus slave address on the basis of the subaddress data of the bus slave contained in the first signal in the slave monitoring module 25 determine.

It should be pointed out that each bus slave 20 has a checksum generation unit 80 and an address calculation unit 86, but that these are only shown here as an example for one of the bus slaves 20 in the interests of a simplified overview. The slave monitoring module 25 is accordingly set up to calculate a slave checksum using the address data HADDR, the control data HCTRL and the user data HDATA, which were transmitted to the bus slave 20 by the transfer request from the bus master 10 . Furthermore, the slave monitoring module 25, in conjunction with the bus slave 20 and the slave wrapper component 27, is set up to transmit a second signal to the master monitoring module 15, which contains the slave checksum determined in the slave monitoring module 25 in standard User data HRUSER contains.

The master monitoring module 15 is in turn set up to compare the slave checksum transmitted by means of the user data HRUSER with the master checksum stored in the master monitoring module 15 . In the event of a discrepancy between the two checksums, the master monitoring module is set up to output a checksum error signal which can be used by an error monitoring module of a higher-level overall system for further processing of errors that have occurred. In addition, FIG. 1 shows a slave multiplexer 70 on the AHB bus of the overall bus configuration described here. This is set up to select a bus slave 20 that corresponds to the slave address in accordance with a slave address of a bus master 10 transfer request. A select monitoring module 75 ensures that only a single bus slave 20 is ever selected by the slave multiplexer 70 . If several bus slaves 20 are incorrectly selected, the select monitoring module 75 generates a select error signal for handling this error.

1 also shows an AHB/APB bridge 60 which is set up to convert signals of the AHB bus into signals of an APB bus which is connected to the AHB/APB bridge 60 in terms of information technology. On the AHB bus side of the AHB/APB bridge 60, a slave monitor module 25 is provided, while on the APB bus side of the AHB/APB bridge 60, a master monitor module 15 is provided to monitor respective data communications of the respective Securing sub-buses with the AHB/APB-Bridge 60. The data transmission between an AHB bus interface 30 and an APB bus interface 40 of the AHB/APB bridge 60 is protected by a redundant design of a protocol conversion unit of the AHB/APB bridge 60, so that any discrepancies between the redundant protocol conversion units can be determined . AHB bus respective data (HADDR, HCTRL, HDATA, HRIISER) is mapped to APB bus respective data (PADDR, PCTRL, PDATA, PRIISER) and vice versa. 1 shows that respective PRUSER signals of the APB bus are transmitted between the components of the APB bus by means of additional data lines.

An APB arbiter/slave multiplexer 90 is arranged here on the side of the APB bus of the AHB/APB bridge 60, via which communication between a bus master 10 of the APB bus and the respective bus slave 20 of the APB bus is carried out. The other components of the APB bus shown here are constructed analogously to the above description, which is why reference is made to the above explanations to avoid repetition.

It should be noted that numerous deviating from this

Bus configurations based on the present invention can be implemented and that the exemplary bus configuration shown here does not represent any limitation in this regard.

Claims

Expectations 1. Bus system with error detection function having: • a bus master (10), • a master monitoring module (15), • a bus slave (20), and • a slave monitoring module (25), wherein • the master monitoring module (15) is set up to calculate a master checksum for slave address data, user data and control data of a first signal (S1) generated by the bus master (10) and to store the calculated checksum, o the to compare the stored master checksum with a slave checksum, which is calculated by the slave monitoring module (25) via the first signal (S1) received in the bus slave (20), and o to output a checksum error signal if the master checksum does not match the slave checksum, • the slave monitoring module (25) is set up o to receive the first signal (S1) with slave sub-address data, o to determine the slave address data from predefined slave address information, o a slave checksum for the slave address data, to calculate the user data and the control data of the first signal (S1), and o to transmit the slave checksum to the master monitoring module (15) by means of a second signal (S2). 2. Bus system according to claim 1, wherein the master monitoring module (15) is set up to output a timeout error signal when a means of the first signal (S1) generated transfer request to the bus slave (20) is not answered within a predefined period of time by the bus slave (20). Bus system according to one of the preceding claims, wherein the bus system is an AMBA bus system and preferably has an AHB bus (30) and/or an APB bus (40). Bus system according to claim 3, wherein the AMBA bus system is set up, the second signal (S2) • within an AHB bus (30) by means of a standard user signal (HRUSER), and • to be transmitted within an APB bus (40) by means of an additionally provided sideband signal (PRUSER). Bus system according to one of the preceding claims, having at least one interconnect matrix (50) for connection • a plurality of bus masters (10) with respective master monitoring modules (15), and/or • a plurality of bus slaves (20) with respective slave monitoring modules (25). Bus system according to one of the preceding claims, having at least one protocol converter (60) which has a master monitoring module (15) for one of the two protocols to be converted and a slave monitoring module (25) for the other of the two protocols to be converted. Bus system according to Claim 6, in which each protocol converter (60) has a redundant structure and/or lock-step operation for plausibility checking of the data to be converted. Bus system according to one of the preceding claims, having at least one slave multiplexer (70), wherein a select monitoring module (75) is connected to each slave multiplexer (70), which is set up to output a select error signal when the slave Multiplexer (70) selected more than one bus slave (20) at the same time becomes. Bus system according to one of the preceding claims, wherein the bus system is set up, in the case of segmented data transmissions, to secure each data segment by means of a respective master/slave checksum. Bus system according to one of the preceding claims, wherein the bus system is set up to assign respective slave checksums to their respective corresponding master checksums in that the second signal (S2), which is sent by a respective bus slave (20), contains a unique identifier of the respective bus slave (20) is included.