KR102677512B1 - Device including safety logic - Google Patents

Abstract

An apparatus comprising safety logic is disclosed. A device according to an exemplary embodiment of the present disclosure includes a first function module that outputs a master signal; a second function module outputting a comparison signal for the master signal; One or more comparators that generate a comparison operation result based on the master signal and the comparison signal, a feedback path that generates a first toggle signal based on the comparison operation result and outputs a feedback signal to the one or more comparators, and the comparison a toggle signal generator including a first multi-input gate that generates a second toggle signal based on an operation result; and a toggle signal monitor that outputs a fault detection signal based on the first and second toggle signals.

Description

DEVICE INCLUDING SAFETY LOGIC}

The technical idea of the present disclosure relates to a device including safety logic, and more specifically, to a device including safety logic that determines whether a master signal and a comparison signal are identical during run-time operation.

A latent fault in devices such as automobiles is a fault that is not detected by a safety mechanism performed within the detection interval of the fault and is not recognized by the user. These defects can start as silent defects and then expand into multiple defects, which can lead to serious consequences. A representative example of a latent defect is a memory bit defect.

To prevent these latent defects from occurring, the defect detection interval must be within the L-FTTI (Latent Fault Tolerant Time Interval). For example, detection of defects in memory bits must be performed for each memory access. However, in this case, methods such as logic BIST or STL (Software Test Library) that temporarily stop operations such as access and perform fault check are difficult to satisfy L-FTTI, and the hardware/software cost (HW/SW) for detection is difficult to satisfy. cost) is also large.

The technical idea of the present disclosure relates to safety logic and a device including the same, and provides a safety logic that detects whether a signal is faulty and whether a gate is broken, and a device including the same.

In order to achieve the above object, a device according to one aspect of the technical idea of the present disclosure includes: a first function module that outputs a master signal; a second function module outputting a comparison signal for the master signal; One or more comparators that generate a comparison operation result based on the master signal and the comparison signal, a feedback path that generates a first toggle signal based on the comparison operation result and outputs a feedback signal to the one or more comparators, and the comparison a toggle signal generator including a first multi-input gate that generates a second toggle signal based on an operation result; and a toggle signal monitor that outputs a fault detection signal based on the first and second toggle signals.

Meanwhile, according to another aspect of the technical idea of the present disclosure, a toggle signal generator configured to output a first toggle signal and a second toggle signal based on a master signal and a comparison signal each including a plurality of bits, and the first and second toggle signals 2 A device including a toggle signal monitor configured to output a fault detection signal by monitoring a toggle signal, wherein the toggle signal generator compares each bit of the master signal and each bit of the comparison signal for equality to produce a comparison operation result. a plurality of comparators configured to generate; a feedback path configured to generate the first toggle signal by performing a first gate operation based on the comparison operation result and output a feedback signal to each of the plurality of comparators based on the first toggle signal; and a first multi-input gate generating the second toggle signal by performing a second gate operation based on the result of the comparison operation.

Meanwhile, an apparatus according to another aspect of the technical idea of the present disclosure includes a plurality of comparators configured to generate comparison operation results by comparing input master signals and comparison signals on a bit-by-bit basis; a feedback path configured to generate a first toggle signal based on a result of the comparison operation and to generate a feedback signal output to each of the comparators based on a clock signal and the first toggle signal; a first multi-input gate configured to generate a second toggle signal by performing a first gate operation on the result of the comparison operation; and a toggle signal monitor configured to monitor the first toggle signal and the second toggle signal based on the clock signal to output a fault search signal including information on whether the master signal and the comparison signal are identical. You can.

A device according to the technical idea of the present disclosure can detect not only information about whether the master signal and the comparison signal are identical during runtime operation, but also information about whether the gates constituting the safety logic are broken. This allows the device to improve stability by detecting potential defects during runtime operation.

Figure 1 shows a block diagram of a device according to an exemplary embodiment of the present disclosure.
Figure 2 shows a detailed block diagram of safety logic according to an example embodiment of the present disclosure.
Figure 3 is a block diagram showing a specific configuration of a toggle signal generator according to an exemplary embodiment of the present disclosure.
Figure 4 is a block diagram showing a specific configuration of a toggle signal monitor according to an exemplary embodiment of the present disclosure.
Figure 5 shows a flowchart showing a method of operating a device according to an exemplary embodiment of the present disclosure.
Figure 6 shows a flowchart showing a method of operating a toggle signal monitor according to an exemplary embodiment of the present disclosure.
Figure 7 shows a timing diagram for various signals output according to an exemplary embodiment of the present disclosure.
FIGS. 8A and 8B each show a table showing the value of a fault detection signal output under each condition according to an exemplary embodiment of the present disclosure.
Figure 9 shows a flowchart showing a method of operating a device according to another exemplary embodiment of the present disclosure.
Figure 10 is a block diagram showing a specific configuration of a toggle signal generator according to another exemplary embodiment of the present disclosure.
Figure 11 shows a timing diagram for various signals output according to an exemplary embodiment of the present disclosure.
Figure 12 shows a detailed block diagram of safety logic according to another exemplary embodiment of the present disclosure.
Figure 13 shows a block diagram of a device according to another exemplary embodiment of the present disclosure.
Figure 14 shows a flowchart showing a method of operating a device according to an exemplary embodiment of the present disclosure.
Figure 15 is a block diagram showing a System On Chip (SoC) employing safety logic according to an exemplary embodiment of the present disclosure.
FIG. 16 is a block diagram illustrating a memory system employing safety logic according to an exemplary embodiment of the present disclosure.
Figure 17 schematically shows a vehicle employing safety logic according to an exemplary embodiment of the present disclosure.

Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings.

Figure 1 shows a block diagram of a device according to an exemplary embodiment of the present disclosure.

Referring to FIG. 1, the device 1 may include a first function module 10, a second function module 20, and safety logic (Safety Logic) 30. Device 1 may be designed to perform various functions, and its operation may be controlled based on various electrical signals. For example, device 1 may be a drone, a robotic device such as an Advanced Drivers Assistance System (ADAS), an autonomous vehicle, a smart TV, a smartphone, a medical device, or a mobile device. , can be applied to video display devices, measurement devices, IoT (Internet of Things) devices, etc., and can be mounted on at least one of various types of electronic devices.

The first function module 10 may perform at least one function among various operations of the device 1. As an example, the first function module 10 may output a master signal (M_S) to perform a predetermined operation or control to perform a predetermined operation. As another example, the first function module 10 may output a sensing value (or sensing signal) for temperature or power as the master signal (M_S).

The second function module 20 may output a comparison signal (C_S) for comparison with the master signal (M_S) output from the first function module 10. In an exemplary embodiment, the second function module 20 may include the same configuration as the first function module 10. Accordingly, the second function module 20 can output the comparison signal (C_S) that is the same as the master signal (M_S), under the assumption that there is no error. In other words, the first and second function modules 10 and 20 may be designed in lockstep to detect a fault in the master signal (M_S) output from the first function module 10.

In another exemplary embodiment, when the first function module 10 outputs a sensing value (or sensing signal) for temperature or power, etc. as a master signal (M_S), the second function module 20 outputs the sensing value (or sensing signal) for temperature or power, etc. The threshold for comparison with the value can be output as a comparison signal (C_S). For example, when the first function module 10 is a temperature sensor, the first function module 10 outputs the sensing temperature as a master signal (M_S), and the second function module 20 compares the threshold temperature value. It can be output as a signal (C_S).

The safety logic 30 may include a toggle signal generator (100) and a toggle signal monitor (200). In an exemplary embodiment, the toggle signal generator 100 receives the master signal (M_S) and the comparison signal (C_S) and generates a first toggle signal (TG_S1) and a second toggle signal (TG_S2) based on the master signal (M_S) and the comparison signal (C_S). You can. In this embodiment, the toggle signal may be a signal that repeats logic high and logic low at a predetermined period.

The toggle signal generator 100 may output the first and second toggle signals TG_S1 and TG_S2 to the toggle signal monitor 200. In an exemplary embodiment, the toggle signal generator 100 includes one or more comparators that generate a comparison operation result based on a master signal (M_S) and a comparison signal (C_S), and generate a first toggle signal based on the comparison operation result. It may include a feedback path that generates (TG_S1) and outputs a feedback signal to one or more comparators, and a first multi-input gate that generates a second toggle signal (TG_S2) based on the result of the comparison operation. For example, the master signal (M_S) (and the comparison signal (C_S)) includes a plurality of bits, and the toggle signal generator 100 may include as many comparators as the number of bits of the master signal (M_S). Accordingly, the toggle signal generator 100 can perform a comparison operation for each bit of the master signal (M_S) and the comparison signal (C_S).

The toggle signal generator 100 may transmit information regarding whether the master signal (M_S) and the comparison signal (C_S) are identical to the toggle signal monitor 200 through the first and second toggle signals (TG_S1 and TG_S2). . For example, when the master signal (M_S) and the comparison signal (C_S) are the same, the first and second toggle signals (TG_S1, TG_S2) are normal toggle signals (e.g., logic high and logic repeated at regular intervals). Low) can be. When at least one bit is different between the master signal (M_S) and the comparison signal (C_S), at least one of the first and second toggle signals (TG_S1 and TG_S2) may have an abnormal form. For example, when at least one bit is different between the master signal (M_S) and the comparison signal (C_S), at least one of the first and second toggle signals (TG_S1 and TG_S2) is not toggled for a predetermined time and is logic high. (or logic low).

The toggle signal monitor 200 may output a fault search signal (CON_S) based on the first toggle signal (TG_S1) and the second toggle signal (TG_S2). In an exemplary embodiment, the toggle signal monitor 200 includes a first XOR gate that outputs a first error signal based on the first and second toggle signals TG_S1 and TG_S2, and first and second toggle signals A second XOR gate that outputs a second error occurrence signal based on (TG_S1, TG_S2), a first output gate that outputs a first fault detection signal based on the first and second error occurrence signals, and the first and It may include a second output gate that outputs a second fault detection signal based on the second error occurrence signal.

The toggle signal monitor 200 may receive information regarding whether the master signal (M_S) and the comparison signal (C_S) are identical through the first and second toggle signals (TG_S1 and TG_S2). As the toggle signal monitor 200 outputs the fault search signal (CON_S) based on the first and second toggle signals (TG_S1 and TG_S2), the fault search signal (CON_S) is connected to the master signal (M_S) and the comparison signal (C_S). ) may include information on whether the two are identical.

In an exemplary embodiment, a predetermined error signal may be further input to the toggle signal monitor 200. For example, the first XOR gate provided in the toggle signal monitor 200 outputs a first error occurrence signal based on the error signal, and the second XOR gate outputs a second error occurrence signal based on the error signal. Can be printed. As the toggle signal monitor 200 outputs the fault search signal (CON_S) based on the preset error signal and the first and second toggle signals (TG_S1 and TG_S2), the fault search signal (CON_S) is transmitted to the toggle signal generator (100). ) and the toggle signal monitor 200 may further include information regarding whether or not gates included in at least one are broken.

Figure 2 shows a detailed block diagram of safety logic according to an example embodiment of the present disclosure.

Referring to FIG. 2 , the safety logic 30 may include a toggle signal generator 100, a toggle signal monitor 200, a clock generator 300, and an error injector 400. The toggle signal generator 100 may include a plurality of comparators 110-1 to 110-N (N is a positive integer of 2 or more), a feedback path 120, and a first multiple input gate 130.

The plurality of comparators 110-1 to 110-N may respectively receive a master signal (M_S) and a comparison signal (C_S) and perform a comparison operation based on them. For example, each of the master signal (M_S) and the comparison signal (C_S) includes a plurality of bits, and each of the comparators (110-1 to 110-N) contains bits of the master signal (M_S) and the comparison signal (C_S). Each of these can be entered. In other words, the toggle signal generator 100 can determine whether the master signal (M_S) and the comparison signal (C_S) are the same on a bit-by-bit basis through the comparators (110-1 to 110-N).

The feedback path 120 generates a first toggle signal TG_S1 based on the comparison operation results of the comparators 110-1 to 110-N, and provides a feedback signal to each of the comparators 110-1 to 110-N. can be output. Additionally, the feedback path 120 may receive a clock signal CLK from the clock generator 300.

In an exemplary embodiment, the feedback path 120 includes a second multi-input gate that generates a first toggle signal TG_S1 based on the comparison operation results output from the comparators 110-1 to 110-N. can do. For example, the second multi-input gate may be one of an AND gate and an OR gate.

Additionally, the feedback path 120 may delay the first toggle signal TG_S1 based on the clock signal CLK and output this as a feedback signal to the comparators 110-1 to 110-N. According to the feedback operation of the feedback path 120 for the comparators 110-1 to 110-N, the first toggle signal TG_S1 and the second toggle signal TG_S2 are connected to the master signal M_S and the comparison signal ( If C_S) is the same, logic high and logic low may be output in a repetitive manner at a predetermined period.

The first multi-input gate 130 may generate a second toggle signal TG_S2 based on the comparison operation results of the comparators 110-1 to 110-N. In an exemplary embodiment, the first multiple input gate 130 may be one of an AND gate and an OR gate. For example, the first multiple input gate 130 may be an AND gate, and the second multiple input gate provided in the feedback path 120 may be an OR gate. As another example, the first multiple input gate 130 may be an OR gate, and the second multiple input gate provided in the feedback path 120 may be an AND gate.

The toggle signal monitor 200 may receive the first and second toggle signals TG_S1 and TG_S2 generated from the toggle signal generator 100. Additionally, the toggle signal monitor 200 may further receive a clock signal CLK from the clock generator 300 and an error signal ER from the error injector 400.

The toggle signal monitor 200 may perform a monitoring operation on the first and second toggle signals TG_S1 and TG_S2. In an exemplary embodiment, the toggle signal monitor 200 monitors the first and second toggle signals TG_S1 and TG_S2 based on the clock signal CLK and the error signal ER to generate a fault detection signal. (CON_S) can be output.

By being output based on the first and second toggle signals (TG_S1 and TG_S2), the fault search signal (CON_S) may include information regarding whether the master signal (M_S) and the comparison signal (C_S) are identical. In addition, by being output based on the clock signal (CLK) and the error signal (ER), the fault detection signal (CON_S) provides information about whether the gates included in the toggle signal generator 100 and the toggle signal monitor 200 are broken. may further include.

The clock generator 300 may include, for example, a Phase Locked Loop (PLL). In this embodiment, it has been described that the safety logic 30 includes the clock generator 300, but it is not limited thereto. In another example, the clock generator may be provided external to the safety logic 30, and the feedback path 120, toggle signal monitor 200, and error injector 400 may receive clock signals from the outside.

The error injector 400 may output the error signal ER based on the clock signal CLK. In an exemplary embodiment, the error injector 400 may include a clock divider that divides the clock signal CLK. Accordingly, the error signal ER may be a divided clock signal.

The safety logic 30 may be implemented in various forms and may be implemented in software form or hardware form depending on the exemplary embodiment. For example, when the safety logic 30 is implemented in hardware, each component included in the safety logic 30 may include various circuits that perform the above-described operations. Additionally, for example, when the safety logic 30 is implemented in software form, the above-described operations may be performed by executing programs and/or instructions loaded in memory (not shown) by a processor (not shown). However, it is not limited to this, and the safety logic 30 may be implemented in a form that combines software and hardware, such as firmware.

Figure 3 is a block diagram showing a specific configuration of a toggle signal generator according to an exemplary embodiment of the present disclosure. For example, FIG. 3 may be a detailed block diagram of the toggle signal generator 100 of FIG. 2.

Referring to FIG. 3, each of the comparators 110-1 to 110-N may include each of XOR gates 112-1 to 112-N. Additionally, the feedback path 120 may include a second multiple input gate 122, a first delay circuit 124, and an inverter 126.

The second multiple input gate 122 may generate the first toggle signal TG_S1 based on the outputs of the XOR gates 112-1 to 112-N. Additionally, the first multiple input gate 130 may generate a second toggle signal TG_S2 based on the outputs of the XOR gates 112-1 to 112-N. The first multiple input gate 130 may be an OR gate, and the second multiple input gate 122 may be an AND gate.

The first delay circuit 124 may delay the first toggle signal TG_S1 based on the clock signal CLK. For example, the first delay circuit 124 may include a flip-flop that operates in response to the clock signal CLK. The inverter 126 may invert the output of the first delay circuit 124 and output it as a feedback signal to the XOR gates 112-1 to 112-N.

The XOR gates 112-1 to 112-N may each receive each bit of the master signal (M_S) and each bit of the comparison signal (C_S). Additionally, the XOR gates 112-1 to 112-N may each receive a feedback signal output from the inverter 126. In a specific embodiment, the first

Figure 4 is a block diagram showing a specific configuration of a toggle signal monitor according to an exemplary embodiment of the present disclosure. For example, FIG. 4 may be a detailed block diagram of the toggle signal monitor 200 of FIG. 2.

Referring to FIG. 4, the toggle signal monitor 200 includes a first XOR gate 210, a second delay circuit 220, a second XOR gate 230, a third delay circuit 240, and a first output gate ( 250) and a second output gate 260. The first It can be done. The second delay circuit 220 may delay the first error signal ER_B1 based on the clock signal CLK. Accordingly, the first XOR gate 210 can output the first error occurrence signal ER_B1.

The second XOR gate 230 receives the error signal ER, the second toggle signal TG_S2, and the second error occurrence signal ER_B2 delayed from the third delay circuit 240, and performs an It can be done. The third delay circuit 240 may delay the second error occurrence signal ER_B2 based on the clock signal CLK. Accordingly, the second XOR gate 230 can output the second error occurrence signal ER_B2.

The first output gate 250 may output the first fault detection signal CON_S1 based on the first and second error occurrence signals ER_B1 and ER_B2. Additionally, the second output gate 260 may output a second fault detection signal CON_S2 based on the first and second error occurrence signals ER_B1 and ER_B2.

In an exemplary embodiment, the first output gate 250 may be a NAND gate. Additionally, the second output gate 260 may be a NOR gate. The toggle signal monitor 200 is a combination of the first and second fault search signals (CON_S1, CON_S2) included in the fault search signal (CON_S), and determines whether the master signal (M_S) and the comparison signal (C_S) are identical. Information can be transmitted externally. In addition, the toggle signal monitor 200 is a combination of the first and second fault search signals CON_S1 and CON_S2, and provides information about whether the gates provided in the toggle signal generator 100 and the toggle signal monitor 200 are broken. can be transmitted externally.

Figure 5 shows a flowchart showing a method of operating a device according to an exemplary embodiment of the present disclosure.

Referring to FIG. 5, the device 1 can determine whether the master signal (M_S) and comparison signal (C_S) are input (S10). For example, the master signal (M_S) may be output from the first function module 10 and the comparison signal (C_S) may be output from the second function module 20. In an exemplary embodiment, the second function module 20 may be configured identically to the first function module 10 in order to test whether the first function module 10 operates normally. Accordingly, if there is no failure, the master signal (M_S) and the comparison signal (C_S) may be the same signal.

The device 1 may generate toggle signals (TG_S1 and TG_S2) based on the master signal (M_S) and the comparison signal (C_S) (S20). The device 1 includes safety logic 30 with a toggle signal generator 100, which generates first and second toggles based on a master signal (M_S) and a comparison signal (C_S). Signals (TG_S1, TG_S2) can be generated. In an exemplary embodiment, the toggle signal generator 100 includes a plurality of comparators 110-1 to 110-N that compare the master signal M_S and the comparison signal C_S in bit units, and the comparators 110 It may include a feedback path 120 that generates a feedback signal based on the output of -1 to 110-N) and outputs it to the comparators (110-1 to 110-N). The toggle signal generator 100 generates first and second toggles in the form of repeating logic high and logic low at a predetermined period based on the feedback operation of the feedback path 120 and the master signal (M_S) and comparison signal (C_S). Signals (TG_S1, TG_S2) can be generated.

The device 1 can monitor the generated first and second toggle signals TG_S1 and TG_S2 (S30). The safety logic 30 provided in the device 1 may include a toggle signal monitor 200 that monitors the first and second toggle signals TG_S1 and TG_S2. The toggle signal monitor 200 may output a fault search signal CON_S based on the received first and second toggle signals TG_S1 and TG_S2 (S40). The safety logic 30 monitors the first and second toggle signals (TG_S1 and TG_S2) and provides information about whether the master signal (M_S) and the comparison signal (C_S) are identical through the fault search signal (CON_S) output. can be created.

Figure 6 shows a flowchart showing a method of operating a toggle signal monitor according to an exemplary embodiment of the present disclosure.

Referring to FIG. 6, the toggle signal monitor 200 can determine whether the error signal ER is input (S100). For example, the error signal ER is a signal for checking whether the gates provided in each of the toggle signal generator 100 and the toggle signal monitor 200 are broken, and has a form in which logic high and logic low are repeated at a predetermined period. It could be a signal of In an exemplary embodiment, the error signal ER is output through the error injector 400 provided in the device 1, and the error injector 400 generates the error signal ER based on the clock signal CLK. Can be printed. As an example, the error injector 400 may include a divider that divides the clock signal CLK.

When the error signal (ER) is input, the toggle signal monitor 200 outputs a fault search signal (CON_S) based on the first toggle signal (TG_S1), the second toggle signal (TG_S2), and the error signal (ER). (S110). For example, the toggle signal monitor 200 detects a first fault search signal (CON_S1) that performs a NAND operation on the first and second error occurrence signals (ER_B1, ER_B2), and the first and second error occurrence signals (ER_B1, ER_B2). The second fault search signal (CON_S2) obtained by performing the NOR operation on ER_B1 and ER_B2) may be output as the fault search signal (CON_S). For example, the logic state of the error signal (ER), whether the master signal (M_S) and the comparison signal (C_S) are the same, and whether the gates provided in the toggle signal generator 100 and the toggle signal monitor 200 are broken, respectively. Accordingly, the logic combination of each of the first fault detection signal (CON_S1) and the second fault detection signal (CON_S2) may vary.

Accordingly, according to the technical spirit of the present disclosure, the device 1 including the safety logic 30 provides not only information regarding whether the master signal M_S and the comparison signal C_S are identical during runtime operation, but also the signal generator 100. ) and information on whether the gates provided in each of the toggle signal monitors 200 are broken can be output as a fault search signal (CON_S). Accordingly, the stability of the device 1 can be improved by detecting latent faults during runtime operation.

Figure 7 shows a timing diagram for various signals output according to an exemplary embodiment of the present disclosure. FIG. 7 shows an example in which the error signal ER is a signal obtained by dividing the clock signal CLK by 4. However, this is only one embodiment, and those skilled in the art will fully understand that the form of the error signal ER may be modified in various ways.

Referring to FIG. 7, the first toggle signal TG_S1 may be abnormally output at the first time point t1. For example, the abnormal output of the first toggle signal TG_S1 may be the result of one or more bits being different between the master signal M_S and the comparison signal C_S. Specifically, from the first time point t1 to the second time point t2, the first toggle signal TG_S1 may be output in a fixed logic low state. As the first toggle signal TG_S1 is output in a fixed state at logic low, the first error occurrence signal ER_B1 may be output at logic low from the first time point t1 to the second time point t2. Additionally, from the first time t1 to the second time t2, the first fault detection signal CON_S1 may be output as logic high and the second fault detection signal CON_S2 may be output as logic low.

From the second time point t2 to the third time point t3, the first toggle signal TG_S1 and the second toggle signal TG_S2 may be output normally. As the first toggle signal (TG_S1) and the second toggle signal (TG_S2) are output normally, the first error occurrence signal (ER_B1) and the second error occurrence signal (ER_B1) from the second time point (t2) to the third time point (t3) ER_B2) can be output as logic high. Additionally, the first fault detection signal (CON_S1) may be output as logic low, and the second fault detection signal (CON_S2) may be output as logic high.

The second toggle signal TG_S2 may be abnormally output at the third time point t3. For example, the abnormal output of the second toggle signal TG_S2 may be the result of one or more bits being different between the master signal M_S and the comparison signal C_S. Specifically, from the third time point t3 to the fourth time point t4, the second toggle signal TG_S2 may be output in a fixed logic high state. As the second toggle signal TG_S2 is output in a fixed state at logic high, the second error occurrence signal ER_B2 may be output at logic low from the third time t3 to the fourth time t4. Additionally, from the third time t3 to the fourth time t4, the first fault detection signal CON_S1 may be output as logic high and the second fault detection signal CON_S2 may be output as logic low.

FIGS. 8A and 8B each show a table showing the value of a fault detection signal output under each condition according to an exemplary embodiment of the present disclosure. Specifically, Figure 8a shows the value of the error signal (ER) and the values of the first and second fault search signals (CON_S1, CON_S2) depending on whether the master signal (M_S) and the comparison signal (C_S) are the same. A table TB1 is shown. In addition, Figure 8b shows a case regarding the failure and failure type of each gate included in the toggle signal generator 100 and the toggle signal monitor 200, and the first and second fault search signals according to the value of the error signal ER. (CON_S1, CON_S2) shows a second table (TB2) representing each value.

Referring to FIG. 8A, when the value of the error signal (ER) is 0 (or logic low) and the master signal (M_S) and the comparison signal (C_S) are the same, the first and second fault search signals (CON_S1, CON_S2) Each can have the value 0. If the value of the error signal (ER) is 0 and one or more bits are different between the master signal (M_S) and the comparison signal (C_S), the first and second fault search signals (CON_S1, CON_S2) are each 1 (or logic high) ) can have any value.

When the value of the error signal ER is 1 and the master signal M_S and the comparison signal C_S are the same, each of the first and second fault search signals CON_S1 and CON_S2 may have a value of 1. If the value of the error signal (ER) is 1 and one or more bits are different between the master signal (M_S) and the comparison signal (C_S), each of the first and second fault search signals (CON_S1 and CON_S2) may have a value of 0. .

Referring to FIG. 8B, the first case may be a failure in which the output of the gate is fixed to a value of 0, and the second case may be a failure in which the output of the gate is fixed to a value of 1. For example, if the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N fails in the first case, the first fault search signal CON_S1 has a value of 1, The second fault detection signal (CON_S2) may have a value of 0. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N fails in the first case, each of the first and second fault search signals CON_S1 and CON_S2 is It can have the value 0.

For example, if the value of the error signal ER is 0 and at least one of the XOR gates 112-1 to 112-N fails in the second case, the first fault search signal CON_S1 has the value 1, The second fault detection signal (CON_S2) may have a value of 0. In addition, when the value of the error signal ER is 1 and at least one of the XOR gates 112-1 to 112-N fails in the second case, each of the first and second fault search signals CON_S1 and CON_S2 is It can have the value 0.

For convenience of explanation, only the values of the fault search signals (CON_S1, CON_S2) for each case according to failure of the XOR gates (112-1 to 112-N) are described, but other gates included in the second table (TB2) The same table analysis can be applied to each failure. For example, if the value of the error signal (ER) is 0 and the first can have the value 0. Additionally, when the value of the error signal ER is 1 and the first XOR gate 210 fails in the first case, each of the first and second fault detection signals CON_S1 and CON_S2 may have a value of 0.

As described above, depending on the error signal (ER) in which 0 and 1 values are repeated at a predetermined period (or logic low and logic high are repeated), fault search signals (CON_S1, CON_S2) may be present for each situation. The values can be prepared as tables (TB1, TB2). Accordingly, the fault search signals (CON_S1, CON_S2) may include information regarding whether the master signal (M_S) and the comparison signal (C_S) are identical. In addition, the fault detection signals CON_S1 and CON_S2 may further include information regarding whether gates provided in each of the toggle signal generator 100 and the toggle signal monitor 200 are broken.

Figure 9 shows a flowchart showing a method of operating a device according to another exemplary embodiment of the present disclosure.

Referring to FIG. 9, the device 1 can input a sensing signal and a threshold signal to the safety logic 30 (S200). In an exemplary embodiment, the device 1 may input a sensing signal as the master signal (M_S) and a threshold signal as the comparison signal (C_S) to the safety logic 30, respectively. The sensing signal may be output from a sensor provided in the device 1.

For example, the first function module 10 includes a temperature sensor and can output a sensing signal for temperature as the master signal (M_S) to the safety logic 30. Additionally, the second function module 20 may output a threshold signal for a preset threshold temperature to the safety logic 30 as a comparison signal (C_S).

As another example, the first function module 10 may output a sensing signal for power consumption of the device 1 to the safety logic 30 as a master signal (M_S). Additionally, the second function module 20 may output a threshold signal for a preset threshold power consumption to the safety logic 30 as a comparison signal (C_S).

Next, the device 1 may generate toggle signals TG_S1 and TG_S2 based on the sensing signal and the threshold signal (or based on the master signal M_S and the comparison signal C_S) (S210). The safety logic 30 provided in the device 1 may include a toggle signal generator 100 that outputs toggle signals TG_S1 and TG_S2 that vary based on whether the sensing signal and the threshold signal are the same.

Next, the device 1 can monitor the generated first and second toggle signals (TG_S1 and TG_S2) (S220). The safety logic 30 provided in the device 1 may include a toggle signal monitor 200 that monitors the first and second toggle signals TG_S1 and TG_S2. The toggle signal monitor 200 may output a fault search signal CON_S as the same determination signal based on the received first and second toggle signals TG_S1 and TG_S2 (S230). The safety logic 30 may generate information regarding whether the sensing signal and the critical signal are identical through a fault search signal (CON_S) output as it monitors the sensing signal and the critical signal.

Figure 10 is a block diagram showing a specific configuration of a toggle signal generator according to another exemplary embodiment of the present disclosure. The configuration of the toggle signal generator 100a of FIG. 10 is similar to the configuration of the toggle signal generator 100 described with reference to FIG. 3. However, according to this embodiment, the first multiple input gate 130a may be an AND gate, and the second multiple input gate 122a may be an OR gate. Accordingly, the first multiple input gate 130a can generate the second toggle signal TG_S2a by performing an AND operation on the outputs of the XOR gates 112a-1 to 112a-N.

The second multiple input gate 122a may generate the first toggle signal TG_S1a by performing an OR operation on the outputs of the XOR gates 112a-1 to 112a-N. In addition, the first delay circuit 124a delays the first toggle signal TG_S1a based on the clock signal CLKa, and the inverter 126a generates a feedback signal by inverting the output of the first delay circuit 124a. can be output to XOR gates (112a-1 to 112a-N).

Figure 11 shows a timing diagram for various signals output according to an exemplary embodiment of the present disclosure. FIG. 11 may show an example of each signal according to an embodiment in which the toggle signal generator 100a of FIG. 10 is employed.

The timing diagram of FIG. 11 is similar to the timing diagram described with reference to FIG. 7. For example, the timing diagram of FIG. 11 may represent each signal when the same master signal and comparison signal as the embodiment of FIG. 7 are input. However, according to the timing diagram of FIG. 11, the second toggle signal TG_S2a is output in a fixed logic low state from the first time point t1a to the second time point t2a, and the second toggle signal TG_S2a is output in a fixed logic low state from the third time point t3a. The first toggle signal (TG_S1a) may be output in a fixed logic high state until time point 4 (t4a).

Figure 12 shows a detailed block diagram of safety logic according to another exemplary embodiment of the present disclosure. The configuration of the safety logic 30b in FIG. 12 is similar to the configuration of the safety logic 30 described with reference to FIG. 2 . However, while the safety logic 30 of FIG. 2 includes an error injector 400 and the error signal ER is output from the error injector 400, according to this embodiment, the safety logic 30b is injected from the outside. An error signal (ERb) can be received. For example, the safety logic 30b may receive the error signal ERb through an external error signal source. In an exemplary embodiment, the error signal ERb may be a signal in which logic high and logic low are repeated at a longer period than the clock signal CLKb.

Figure 13 shows a block diagram of a device according to another exemplary embodiment of the present disclosure. The configuration of device 1c in FIG. 13 is similar to the configuration of device 1 described with reference to FIG. 1 . However, according to this embodiment, the device 1c may further include an interrupt generator 40c. The interrupt generator 40c may generate an interrupt signal ITc based on the fault detection signal CON_S.

For example, the interrupt generator 40c may obtain information regarding whether the master signal M_Sc and the comparison signal C_Sc are identical based on the fault detection signal CON_Sc. Additionally, the interrupt generator 40c may obtain information about whether each of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c is broken based on the fault detection signal CON_Sc.

In an exemplary embodiment, the interrupt generator 40c includes the first table TB1 of FIG. 8A and generates a master signal M_Sc and a comparison signal based on the fault detection signal CON_Sc and the first table TB1. (C_Sc) You can obtain information on whether the two are identical. As an example, in response to determining that one or more bits are different between the master signal (M_Sc) and the comparison signal (C_Sc), the interrupt generator (40c) may output the interrupt signal (ITc). As another example, when the first function module 10c outputs the master signal (M_Sc) as a sensing signal and the second function module 20c outputs the comparison signal (C_Sc) as a threshold signal, the interrupt generator 40c outputs the master signal (M_Sc) An interrupt signal (ITc) may be output in response to determining that the signal (M_Sc) and the comparison signal (C_Sc) are the same.

In addition, in an exemplary embodiment, the interrupt generator 40c includes the second table TB2 of FIG. 8B, and the toggle signal generator 100c is generated based on the fault detection signal CON_Sc and the second table TB2. And information on whether each of the gates included in the toggle signal monitor 200c is broken can be obtained. For example, in response to determining a failure of at least one of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c, the interrupt generator 40c may output the interrupt signal ITc.

For example, the interrupt generator 40c may output an interrupt signal ITc to a predetermined controller (not shown) included in the device 1c. Alternatively, the interrupt generator 40c may output the interrupt signal ITc to a higher level controller external to the device 1c.

Figure 14 shows a flowchart showing a method of operating a device according to an exemplary embodiment of the present disclosure. FIG. 14 may show, for example, a method of operating the device 1c shown in FIG. 13.

Referring to FIG. 14, the device 1c can input the master signal (M_Sc) and comparison signal (C_Sc) to the safety logic 30c (S300). Safety logic 30c may include a toggle signal generator 100c and a toggle signal monitor 200c. The toggle signal generator 100c outputs first and second toggle signals (TG_S1c, TG_S2c) based on the master signal (M_Sc) and comparison signal (C_Sc), and the toggle signal monitor 200c outputs a fault search signal based on this. (CON_Sc) can be output (S310).

The interrupt generator 40c can determine whether a fault has occurred based on the fault detection signal CON_Sc (S320). For example, when the interrupt generator 40c determines that one or more bits between the master signal (M_Sc) and the comparison signal (C_Sc) are different based on the fault detection signal (CON_Sc), it may determine that a fault has occurred. Alternatively, when the interrupt generator 40c determines that at least one of the gates included in the toggle signal generator 100c and the toggle signal monitor 200c is broken based on the fault search signal CON_Sc, it determines that a fault has occurred. can do.

When a fault occurs, the interrupt generator 40c can output an interrupt signal (ITc) (S330). For example, device 1c may include a controller that controls components within device 1c, and interrupt generator 40c may output an interrupt signal ITc to the controller. Additionally, the interrupt generator 40c may output the interrupt signal ITc to the outside of the device 1c.

Figure 15 is a block diagram showing a System On Chip (SoC) employing safety logic according to an exemplary embodiment of the present disclosure.

Referring to FIG. 15, the system-on-chip 1000 may include a plurality of IPs (Intellectual Properties) 1010, 1020, and 1030, safety logic 1040, and a system bus 1050. The system-on-chip 1000 may be designed to perform various functions in a semiconductor system. For example, the system-on-chip 1000 may be an application processor.

The system-on-chip 1000 may include various types of IPs. For example, the IPs 1010, 1020, and 1030 include a processing unit, a plurality of cores included in the processing unit, a Multi-Format Codec (MFC), and a video module (e.g., a camera interface ( camera interface), JPEG (Joint Photographic Experts Group) processor, video processor, or mixer, etc.), 3D graphics core, audio system, driver, display driver (display driver), volatile memory, non-volatile memory, memory controller, input and output interface block, or cache memory, etc. can do.

As a technology for connecting the IPs (1010, 1020, 1030) and the safety logic (1040), a connection method based on the system bus (1050) can be used. For example, as a standard bus standard, the Advanced Microcontroller Bus Architecture (AMBA) protocol of ARM (Advanced RISC Machine) can be applied. Bus types of the AMBA protocol may include Advanced High-Performance Bus (AHB), Advanced Peripheral Bus (APB), Advanced eXtensible Interface (AXI), AXI4, and AXI Coherency Extensions (ACE). Among the above-described bus types, AXI is an interface protocol between IPs and can provide multiple outstanding address functions and data interleaving functions. In addition, other types of protocols, such as SONICs Inc.'s uNetwork, IBM's CoreConnect, or OCP-IP's Open Core Protocol, may be applied to the system bus.

In an exemplary embodiment, the safety logic 1040 may detect whether a signal output from at least one of the IPs 1010, 1020, and 1030 has a fault. As an example, IP2 (1020) may include the same configuration as IP1 (1010) to determine whether IP1 (1010) has a fault. Accordingly, IP1 (1010) can output a master signal to the safety logic (1040), and IP2 (1020) can output a comparison signal to the safety logic (1040). Safety logic 1040 may be implemented based on the embodiments described with reference to FIGS. 1 to 14 . As a result, the system-on-chip 1000 can detect whether signals output from IPs are faulty during runtime operation, and can also detect whether gates provided inside the safety logic 1040 are faulty.

FIG. 16 is a block diagram illustrating a memory system employing safety logic according to an exemplary embodiment of the present disclosure.

Referring to FIG. 16 , the memory system 1100 may include a memory controller 1200 and a memory device 1300. For example, the memory controller 1200 controls the memory device 1300 to read data stored in the memory device 1300 or to write data to the memory device 1300 in response to a command from a host (not shown). can do. Specifically, the memory controller 1200 can control program, read, and erase operations for the memory device 1300 by providing addresses, commands, and control signals to the memory device 1300.

The memory controller 1200 may include a first ECC encoder 1210, a second ECC encoder 1220, and a first safety logic 1230. For example, the first and second ECC encoders 1210 and 1220 may perform ECC encoding based on the input write data WD, thereby outputting encoded write data WD_C1 and WD_C2, respectively. For example, the second ECC encoder 1220 may include the same configuration as the first ECC encoder 1210 to determine whether a signal output from the first ECC encoder 1210 has a fault.

The first safety logic 1230 may be implemented based on the embodiments described with reference to FIGS. 1 to 14 . In an exemplary embodiment, the first ECC encoder 1210 may output first encoded write data WD_C1 as a master signal to the first safety logic 1230. Additionally, the second ECC encoder 1220 may output the second encoded write data WD_C2 as a comparison signal to the first safety logic 1230. The first safety logic 1230 may output the first fault detection signal CON_Sd_1 based on the encoded write data WD_C1 and WD_C2.

The memory controller 1200 may further include a first ECC decoder 1240, a second ECC decoder 1250, and a second safety logic 1260. For example, the first and second ECC decoders 1240 and 1250 perform ECC decoding based on the read data RD_C read from the memory device 1300, thereby generating the decoded read data RD_1 and RD_2, respectively. Can be printed. For example, the second ECC decoder 1250 may include the same configuration as the first ECC decoder 1240 to determine whether a signal output from the first ECC decoder 1240 has a fault.

The second safety logic 1260 may be implemented based on the embodiments described with reference to FIGS. 1 to 14 . In an exemplary embodiment, the first ECC decoder 1240 may output the first decoded read data RD_1 as a master signal to the second safety logic 1260. Additionally, the second ECC decoder 1250 may output the second decoded read data RD_2 to the second safety logic 1260 as a comparison signal. The second safety logic 1260 may output a second fault detection signal (CON_SD_2) based on the decoded read data (RD_1, RD_2).

Figure 17 schematically shows a vehicle employing safety logic according to an exemplary embodiment of the present disclosure.

17, vehicle 1400 includes a processing assembly 1402, one or more sensors 1420, a communication interface 1430, a driving control element 1440, an autonomous driving system 1450, and a user interface 1460. It can be included. Sensors 1420 may include one or more camera devices, an active scanning device (e.g., one or more LiDAR sensors), one or more ultrasonic sensors, and one or more geospatial positioning devices. It may include etc. The sensor 1420 may generate a sensing signal by monitoring at least part of the external environment surrounding the vehicle 1400.

The communication interface 1430 may include a wireless transceiver and/or a Global Positioning System (GPS). The driving control element 1440 includes a vehicle steering device configured to control the direction of the vehicle 1400, a throttle device configured to control acceleration and/or deceleration by controlling a motor or engine of the vehicle 1400, and a vehicle ( 1400) may include a brake device configured to control braking, an external lighting device, etc.

Autonomous driving system 1450 may include a computing device configured to implement autonomous control of driving control elements 1440 . For example, the autonomous driving system 1450 may include a memory that stores a plurality of program instructions and one or more processors that execute the program instructions. The autonomous driving system 1450 may be configured to control the driving control element 1440 based on the sensing signal output from the sensor 1420. The user interface 1460 may include a display representing the instrument panel of the vehicle 1400, etc.

In an example embodiment, processing assembly 1402 may include safety logic 1410. Safety logic 1410 may be implemented based on the embodiments described with reference to FIGS. 1 to 14 . Although not shown, the vehicle 1400 determines whether a signal output from each of the sensor 1420, the communication interface 1430, the driving control element 1440, the autonomous driving system 1450, and the user interface 1460 is faulty. To do this, it may further include the same configuration as each of these. Accordingly, the vehicle 1400 may use at least one of the sensor 1420, the communication interface 1430, the driving control element 1440, the autonomous driving system 1450, and the user interface 1460 during runtime operation (e.g., while driving). It is possible to detect whether the signal output from one is faulty. Additionally, it is possible to detect whether gates provided inside the safety logic 1410 are malfunctioning. Accordingly, the safety of the vehicle 1400 can be further improved.

As above, exemplary embodiments are disclosed in the drawings and specifications. In this specification, specific terms have been used to describe embodiments, but this is only used for the purpose of explaining the technical idea of the present disclosure and is not used to limit the meaning or scope of the present disclosure as set forth in the patent claims. . Therefore, those skilled in the art will understand that various modifications and other equivalent embodiments are possible. Therefore, the true technical protection scope of the present disclosure should be determined by the technical spirit of the attached patent claims.

Claims (20)

a first functional module that outputs a master signal;
a second function module outputting a comparison signal for the master signal;
One or more comparators that generate a comparison operation result based on the master signal and the comparison signal, a feedback path that generates a first toggle signal based on the comparison operation result and outputs a feedback signal to the one or more comparators, and the comparison a toggle signal generator including a first multi-input gate that generates a second toggle signal based on an operation result; and
A device comprising a toggle signal monitor that outputs a fault detection signal based on the first and second toggle signals. According to claim 1,
The feedback path is,
A second multi-input gate for generating the first toggle signal based on the result of the comparison operation, a first delay circuit for delaying the output of the second multi-input gate, and the feedback signal by inverting the output of the first delay circuit A device further comprising an inverter that outputs. According to clause 2,
The first multiple input gate is an AND gate,
A device wherein the second multiple input gate is an OR gate. According to clause 2,
The first multiple input gate is an OR gate,
A device characterized in that the second multiple input gate is an AND gate. According to claim 1,
The toggle signal monitor is,
a first XOR gate that outputs a first error occurrence signal based on the first toggle signal;
a second XOR gate outputting a second error occurrence signal based on the second toggle signal;
a first output gate that outputs a first fault detection signal based on the first and second error occurrence signals; and
The device further includes a second output gate that outputs a second fault detection signal based on the first and second error occurrence signals. According to clause 5,
The toggle signal monitor is,
a second delay circuit that delays the first error signal and outputs the delayed first error signal to the first XOR gate; and
The device further includes a third delay circuit that delays the second error signal and outputs the delayed second error signal to the second XOR gate. According to clause 6,
Further comprising a clock generator that generates a clock signal,
The second and third delay circuits respectively delay the first error occurrence signal and the second error occurrence signal based on the clock signal. According to clause 7,
Further comprising an error injector that outputs an error signal based on the clock signal,
The first XOR gate outputs the first error occurrence signal further based on the error signal,
The second XOR gate is characterized in that it outputs the second error occurrence signal further based on the error signal. According to clause 8,
The error injector includes a clock divider that divides the clock signal. According to clause 5,
The first output gate is a NAND gate,
A device wherein the second output gate is a NOR gate. According to claim 1,
a controller controlling the first function module and the second function module; and
The device further includes an interrupt generator that generates an interrupt signal to the controller based on the fault detection signal. According to claim 1,
The first function module senses the temperature of the device and outputs the sensed value for the temperature as the master signal,
The second function module is characterized in that it outputs a threshold value for comparison with the sensing value as the comparison signal. A toggle signal generator configured to output a first toggle signal and a second toggle signal based on a master signal and a comparison signal each including a plurality of bits, and configured to output a fault search signal by monitoring the first and second toggle signals. 1. A device comprising a toggle signal monitor, comprising:
The toggle signal generator,
a plurality of comparators configured to generate a comparison operation result by comparing each bit of the master signal and each bit of the comparison signal for equality;
a feedback path configured to generate the first toggle signal by performing a first gate operation based on the comparison operation result and output a feedback signal to each of the plurality of comparators based on the first toggle signal; and
A device comprising a first multi-input gate that generates the second toggle signal by performing a second gate operation based on the comparison operation result. According to claim 13,
Further comprising a clock generator outputting a clock signal,
The feedback path outputs the feedback signal further based on the clock signal. According to claim 14,
The feedback path is,
a first delay circuit configured to delay the first toggle signal based on the clock signal; and
and an inverter configured to output the feedback signal by inverting the output of the first delay circuit. According to claim 14,
The toggle signal monitor is,
a first XOR gate configured to output a first error occurrence signal based on the first toggle signal;
a second delay circuit configured to delay the first error signal based on the clock signal and output the delayed first error signal to the first XOR gate;
a second XOR gate configured to output a second error occurrence signal based on the second toggle signal;
a third delay circuit configured to delay the second error signal based on the clock signal and output the delayed second error signal to the second XOR gate; and
The device further includes a plurality of output gates configured to output the fault detection signal based on the first and second error occurrence signals. According to claim 16,
The plurality of output gates are:
a NAND gate that outputs a first fault detection signal based on the first and second error occurrence signals; and
A device comprising a NOR gate that outputs a second fault detection signal based on the first and second error occurrence signals. According to claim 14,
Further comprising an error injector that generates an error signal based on the clock signal,
The toggle signal monitor is configured to monitor the first and second toggle signals further based on the error signal. According to claim 13,
The toggle signal generator,
A device configured to output the first toggle signal and the second toggle signal based on the master signal and the comparison signal during run-time of the device. A plurality of comparators configured to generate comparison operation results by comparing each input master signal and comparison signal in bit units;
a feedback path configured to generate a first toggle signal based on a result of the comparison operation and to generate a feedback signal output to each of the comparators based on a clock signal and the first toggle signal;
a first multi-input gate configured to generate a second toggle signal by performing a first gate operation on the result of the comparison operation; and
A device comprising a toggle signal monitor configured to monitor the first toggle signal and the second toggle signal based on the clock signal to output a fault search signal including information on whether the master signal and the comparison signal are identical. .

Images