WO2014052936A1

WO2014052936A1 - Automatic safety logic insertion

Info

Publication number: WO2014052936A1
Application number: PCT/US2013/062486
Authority: WO
Inventors: Philippe Martin; Boris BOUTILLIER; Jonah Proujansky-Bell; Xavier Leloup
Original assignee: Arteris SAS
Priority date: 2012-09-28
Filing date: 2013-09-27
Publication date: 2014-04-03

Abstract

A method is disclosed for configurable insertion of safety in library-based designs. The invention can automatically harden the design according to a particular safety goal, without having to modify the original design description.

Description

AUTOMATIC SAFETY LOGIC INSERTION CROSS REFERENCE AND RELATED APPLICATION

[001] This application claims priority under 35 USC 1 19 from US Provisional Application Serial No. 61/707,659 (Attorney Docket No.: ART-025PRV) filed on September 28, 2012, titled A SYSTEM AND METHOD FOR AUTOMATICALLY INSERTING SAFETY LOGIC, the entire disclosure of which is incorporated herein by reference.

FIELD OF THE INVENTION

[002] Implementations are generally directed to automatic insertion of safety logic in digital logic designs (also referred to herein as "designs") for safety-critical applications such as automotive chips.

BACKGROUND

[003] Safety logic (i.e. error detection or error correction logic) is desirable in devices that are used in applications where reliability is important, for example automotive engine control units, power train control, etc. Other advanced industries, such as aerospace, use triplication of all systems and software. Safety logic is used in applications where triplication is too costly.

[004] Safety logic is inserted in electronic devices to detect, or detect and correct, errors before they disturb the correct operation of the system. Such errors may be transient, such as the flip of a Design Flip-Flop ("DFF") due to cosmic rays, or permanent, such as the deterioration of a wire in a system-on-chip. Furthermore, different levels of safety may be desirable for different applications, such that a function used in one application may require a different forms of safety logic than in another application.

[005] In the context of bus designs, traditional safety logic includes data parity for error detection or Error Correction Code ("ECC") or error correction. The safety logic is checked end-to-end between a processor and associated memory or peripheral. Some new processor cores provide parity on other signals besides data buses, such as address buses, to extend the scope of the safety logic to the entire fabric. However, it is extremely difficult to add safety logic to the control logic (for example, address decoding) of a bus because control parts are mostly "random" logic. Instead, duplication or triplication is used for safety of control logic. Therefore, what is needed is a system and method for automatically inserting safety logic in a digital logic design.

SUMMARY OF THE INVENTION

[006] In certain implementations and in accordance with the various aspects of the present invention, a method automatically inserts a desired amount of safety logic in a digital logic design that comprises a netlist of logic library elements implemented by unit instances, allowing the same design source to be used for different applications and meet their safety-cost trade-off requirement. In another implementation, the method further encompasses inserting test logic to report detected errors.

BRIEF DESCRIPTION OF THE DRAWINGS

[007] Various aspects and implementations will become more apparent from the detailed description set forth below when taken in conjunction with the drawings, in which like elements bear like reference numerals.

[008] FIGs. 1 (a)-1 (c) each show a 3-bit register with R=1 (FIGs. 1 (a) and 1 (b) and R=2 (FIG. 1 (c)) interface duplication in accordance with the teachings of the present invention.

[009] FIGs. 2(a)-2(b) each show a design with a register and multiplexer with R=1 and R=2 interface duplication, respectively, in accordance with the teachings of the present invention.

DETAILED DESCRIPTION

[0010] A design is a netlist of instances of units connected to each other by interfaces. According to certain implementations, a redundancy factor R is chosen for each library element. Typically, R is 1 , 2, or 3. Each interface of a unit is replicated R times. R indicates the amount of safety logic to be inserted within each unit to produce a safe design from the source library element.

[0011] FIG. 1 (a) illustrates an internal view of a source (R=1 ) for an n-bit register unit (also referred to as "units" herein), shown as a 3-bit register unit 100, which comprises 3 flip-flops for FF(N): FF(0), FF(1 ), and FF(2) in accrodane with the various aspects of the present invention. The scope of the present invention is not limited by the number of bits that make up the register unit. The parameter N is an integer equal to 0 or greater that indicates the n-bit register unit's bit width. A 3-bit register unit has N=3. Each corresponding bit of an input bus l(0), 1(1 ), and l(2) drives the input of flip-flops FF(0), FF(1 ), and FF(2), respectively. Each corresponding bit of an output bus O(0), 0(1 ), and 0(2) is driven by the output of flip- flops FF(O), FF(1 ), and FF(2), respectively. Common clock CLK, reset RSTn, and enable En signals drive one or more flip-flops. Although only a 3-bit register unit 100 is illustrated in FIG. 1 (a), other n-bit register units are also contemplated such as a 2, 5, 10, 20, 30, 40 or 100-bit register unit.

[0012] FIG. 1 (b) shows an external view of the 3-bit register unit 100 in accordance with the various aspects of the present invention, which has N=3 and R=1 . FIG. 1 (c) shows an external view of 3-bit register unit 102, which has N=3 and R=2, in accordance with the various aspects of the present invention. 3-bit register unit 102 is functionally, substantially equivalent to 3-bit register unit 100, but has two functionally equivalent input busses 11 and I2 and has two functionally equivalent output busses O1 and O2. The enable En1 and En2 signals corresponds to respective input bus: 11 and I2.

[0013] With the appropriate set of functions, any logic can be described as a netlist of library elements. In accordance with the various aspects of the present invention and certain implementations, the digital logic design is made directly as netlists; alternatively, or in combination, the digital logic design are made in a description language such as Verilog or VHDL and a netlist synthesized from the language description.

[0014] According to certain aspects of the present invention and implementations, a factor R is chosen for a portion of the digital logic design, such as a subsection of the digital logic design or the entire digital logic design . For the portion of the design, each set of corresponding interfaces have substantially the same logic function in each element.

[0015] According to an aspect of the invention, although a number of replications of each interface is equal to R, the content of each element might not be so replicated. However, the content of each element includes an appropriate level of redundancy to implement a level of safety implied by the R factor.

[0016] FIG. 2(a) illustrates a design netlist with n-bit register 210 and n-bit combinatorial multiplexer 200 in accordance with various aspects of the present invention. R=1 . FIG. 2(b) illustrates a functionally equivalent design with n-bit register 212 and n-bit combinatorial multiplexer 202; R=2 in accordance with various aspects of the present invention.

[0017] Simple replication of all R=1 logic in the n-bit register 210 and multiplexer 202 can be costly in gates. Instead, according to an aspect of the invention, a different arrangement of logic redundancy is used. For example, for R=2, all elements without storage are duplicated, doubling the combinatorial logic. In the design of FIG. 2(b), the logic of multiplexer 202 is double. However, the logic of n-bit register 212 is not doubled. In accordance with another aspect and implementation, the logic of multiplexer 202 and the logic of the n-bit register 212, which in accordance with one aspect of the present invention is a 3-bit register unit, are each doubled.

[0018] In certain implementations, achieving a target level of safety for storage elements such as register 102, or n-bit register 212, is possible using parity or ECC. For n=1 and R=2, this implies duplication. Protecting N-bit storage, when N is larger than a predefined threshold, parity or ECC is used, which requires less logic than doubling the overall count of DFFs would. An amount of parity or ECC bits used varies by the corresponding predefined threshold value. In certain aspects of the present invention, the predefined thresholds are determined by the safety-cost tradeoff required by the design.

[0019] Adjusting the safety logic in each of the elements according to the goal allows a consistent safety level of the full design at a lower cost.

[0020] Errors detected by the various units must be gathered and reported outside of the considered logic function, often as interrupt signals to a processor. In accordance with certain aspects and certain implementations, in addition to the replication step, the netlist is modified by distributing a fixed set of signals to each one of the library elements. Such signals come from the outside (for example, a test mode signal to exercise the safety logic); are sent outside (for example, an error detected signal); or a combination thereof. Aggregation of error signals can be done using various methods.

[0021] Occurrence of errors does not need to be checked in each of the elements. For example, if R=2 with a library that causes all logic to be strictly duplicated in each element, the entire design is effectively duplicated. In that case, the only necessary checks are at the design inputs, which are identical when there are no errors in inputs, and at the design outputs, which are identical when there are no errors in output; any discrepancy between the inputs and/or between the outputs indicates that an error has occurred.

[0022] In accordance with another aspect of the present invention and in certain implementations, if R = 3 and all logic has been triplicated, design inputs are checked and corrected, such as with a majority vote; outputs are likewise checked and are corrected, such as with a majority vote, for example.

[0023] Checking only inputs and outputs of designs or portions of the design where the logic has been fully replicated reduces the amount of error detection/correction logic.

[0024] In general, when a library element strictly replicates its function on its R interfaces, then errors do not need to be checked or corrected in that element. Error checking is delegated to the elements that provide its inputs, or sink its outputs, and so forth, until reaching either primary inputs or outputs of a second design or second element that does not apply a strict replication policy.

[0025] In accordance with another aspect of the present invention and in certain implementations, the safety logic in elements that do not implement strict replication of logic conduct one or more of the following:

[0026] check their inputs;

[0027] implement a proper internal protection scheme; and

[0028] replicate their outputs.

[0029] For example, an N-bit storage element with R inputs implements a N+K bit storage, where K depends on a chosen parity or ECC scheme. In this case the storage element:

[0030] checks the consistency of the R inputs (and if inconsistent, reports an error);

[0031] computes the K-bit parity or ECC for the checked N-bit vector; [0032] stores the checked N-bit vector and the K-bit parity or ECC;

[0033] replicates the stored N-bit vector on its R outputs; and

[0034] persistently checks that the stored K-bit parity or ECC is consistent with the outputs in order to check that no flip-flop storage bit has accidentally flipped.

[0035] In accordance with another aspect of the present invention and in certain embodiments, the described method(s) are applied with R=1 , in which case partial protection is possible {e.g., only for those elements that implement a special safety logic function). Typically, parity or ECC on storage is applied with R=1 , providing error detection and/or correction against DFF bit flips in a design without requiring a duplication of the combinatorial logic, and without requiring a duplication of all DFFs.

[0036] When applied to a portion of a design with R > 1 , all inputs and outputs of the design are replicated by factor R. If some of the inputs and outputs are to be connected to another portion of a design for which the same method has been applied, direct connections can be made on each of the R interfaces. Connections between portions of designs with different R factors require special library elements that implement a conversion between R=r1 and R=r2.

[0037] The general method(s) are applicable to many safety-cost trade-offs. Some commonly used trade-offs and exemplary R values are:

[0038] Partial detection goal: R=1 , DFF parity or ECC, which detects or

corrects DFF bit flips;

[0039] Full detection goal: R=2, random logic duplication and DFF parity or ECC, which detects logic errors and detects or correct DFF bit flips;

[0040] Full single error correction goal: R=3, random logic triplication and DFF

ECC, which detects and corrects all single-bit errors; and

[0041] Full multi-bit errors correction goal: R=3, random logic triplication and DFF triplication, which detects and corrects substantially all multi-bit errors.

[0042] In accordance with another aspect of the present invention and in certain implementations, special inputs and outputs such as clock, reset, test modes, error indications, and power supply are not replicated as the interfaces described above. Here, common cause errors are possible, which are errors that occur sympathetically on multiple replicated interfaces. Common cause errors can occur, for example, on a clock signal glitch or power supply glitch.

[0043] In accordance with another aspect of the present invention and in certain implementations, units have two clock inputs, and one is the inverse of the other. According to another aspect of the invention, units have two logically identical clocks, in phase, but physically separate. When storage is replicated, at least one copy has a different clock from at least one other copy. When storage is not replicated, but includes parity or ECC bits, one clock is used for the source data and the other clock is used for the parity or ECC storage. A stoppage or glitch in one or more clocks triggers a parity or ECC error.

[0044] According to an aspect of the invention, where logic is replicated, at least one copy is driven by inverted logic of the copied logic. Here, because power glitches cause different behavior in positive and negative logic, a power glitch will cause a comparison error.

[0045] Safety features add an otherwise lesser amount of logic in comparison to the logic of the digital logic design. The decision of how much redundancy is mainly made by a required safety level for the design, but limits the actual area and power budget of the netlist. An electronic design automation (EDA) software tool where you would constrain the number of additional flip flops and combinatorial logic allows the designer to constrain how much "safety logic" is added to the design.

[0046] An EDA software tool for synthesizing a netlist from a description of a design written in a description language, according to the various aspects of the present invention and in certain implementations, reads a library comprising a number of alternate implementations. The synthesis tool accepts as input alternative constraints such as timing constraints, and area constraints. When choosing combinations of library elements to instantiate in a particular configuration to the function described in the description, the synthesis tool uses a model of the timing and area of the implementation chosen by the R factor.

[0047] According to another aspect of the invention, a synthesis tool has the freedom to choose an implementation of each library element to use for each unit instantiation. The choice is made based so as to meet, for example, a combination of area, timing, threshold voltage cell choice, power, wire congestion, or other constraints conventionally used by synthesis tools. A synthesis tool, according to another aspect of the invention generates a report of the R factor chosen for each unit instantiation and an estimate of the safety level of the whole synthesized design. In accordance with another aspect of the present invention and in certain implementations, the synthesis tool furthermore allows an R factor to be assigned to specific parts of a whole design. This is useful, for example, when implementing relatively high redundancy on buses that are likely to be physically implemented with long wires, prone to cross-talk, while closely placed "random" logic needs less protection. This is also useful, for example, when implementing relatively higher redundancy on a CPU than on a video processor.

[0048] In certain embodiments, a method of providing automatic safety logic within a digital logic design includes obtaining a netlist that includes a library element. A value for the redundancy factor (R) for the netlist that includes an original library element for an n-bit register unit is received. The original library element is copied according to the value {e.g., if value = 2, then the library element is copied twice to produce 2 copies of the original library element). The original library element and each copied library element is configured within the digital logic design such that each original library element and copied library element receives a corresponding input from the same logical origin.

[0049] Reference throughout this specification to "one implementation," "an embodiment," "an implementation," or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, appearances of the phrases "in one embodiment," "in an embodiment," "in certain implementations," and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Any methods and materials similar or equivalent to those described herein can also be used in the practice or testing of the present invention.

[0050] As will be apparent to those of skill in the art upon reading this disclosure, each of the aspects described and illustrated herein has discrete components and features which may be readily separated from or combined with the features and aspects to form embodiments, without departing from the scope or spirit of the present invention. Any recited method can be carried out in the order of events recited or in any other order, which is logically possible.

[0051] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Although any methods and materials similar or equivalent to those described herein can also be used in the practice or testing of the present invention, representative illustrative methods and materials are now described.

[0052] All publications and patents cited in this specification are herein incorporated by reference as if each individual publication or patent were specifically and individually indicated to be incorporated by reference and are incorporated herein by reference to disclose and describe the methods and/or system in connection with which the publications are cited. The citation of any publication is for its disclosure prior to the filing date and should not be construed as an admission that the present invention is not entitled to antedate such publication by virtue of prior invention. Further, the dates of publication provided may be different from the actual publication dates, which may need to be independently confirmed.

[0053] In accordance with the teaching of the present invention a computer and a computing device are articles of manufacture. Other examples of an article of manufacture include: an electronic component residing on a mother board, a server, a mainframe computer, or other special purpose computer each having one or more processors (e.g., a Central Processing Unit, a Graphical Processing Unit, or a microprocessor) that is configured to execute a computer readable program code {e.g., an algorithm, hardware, firmware, and/or software) to receive data, transmit data, store data, or perform methods.

[0054] The article of manufacture {e.g., computer or computing device) includes a non-transitory computer readable medium or storage that includes a series of instructions, such as computer readable program steps or code encoded therein. In certain aspects of the present invention, the non-transitory computer readable medium includes one or more data repositories. Thus, in certain embodiments that are in accordance with any aspect of the present invention, computer readable program code (or code) is encoded in a non-transitory computer readable medium of the computing device. The processor, in turn, executes the computer readable program code to create or amend an existing computer-aided design using a tool. In other aspects of the embodiments, the creation or amendment of the computer-aided design is implemented as a web-based software application in which portions of the data related to the computer-aided design or the tool or the computer readable program code are received or transmitted to a computing device of a host.

[0055] An article of manufacture or system, in accordance with various aspects of the present invention, is implemented in a variety of ways: with one or more distinct processors or microprocessors, volatile and/or non-volatile memory and peripherals or peripheral controllers; with an integrated microcontroller, which has a processor, local volatile and non-volatile memory, peripherals and input/output pins; discrete logic which implements a fixed version of the article of manufacture or system; and programmable logic which implements a version of the article of manufacture or system which can be reprogrammed either through a local or remote interface. Such logic could implement either a control system either in logic or via a set of commands executed by a soft-processor.

[0056] Accordingly, the preceding merely illustrates the various aspects and principles of the present invention. It will be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the invention and are included within its spirit and scope. Furthermore, all examples and conditional language recited herein are principally intended to aid the reader in understanding the principles of the invention and the concepts contributed by the inventors to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and embodiments of the invention as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known equivalents and equivalents developed in the future, i.e., any elements developed that perform the same function, regardless of structure. The scope of the present invention, therefore, is not intended to be limited to the various aspects discussed and described herein. Rather, the scope and spirit of present invention is embodied by the appended claims.

Claims

CLAIMS What is claimed is:

1 . A method of providing automatic safety logic within a digital logic design, the method comprising:

receiving a value for a redundancy factor for a netlist that includes an original library element for an n-bit register unit;

creating a number, equal to the value, of copies of the original library element; and

configuring, within the digital logic design, the original library element and each copied library element such that each original library element and copied library element receives a corresponding input from the same logical origin.

2. The method of claim 1 wherein the value is one.

3. The method of claim 1 wherein the digital logic design includes a first clock and a second clock, the second clock being an inverse of the first clock.

4. The method of claim 1 further comprising replicating a first interface, according to the value of the redundancy factor, to create a second interface.

5. The method of claim 4 wherein the first interfaces uses logic that is the inverse of the logic used by the second interface.

6. The method of claim 1 wherein the digital logic design further includes at least one of a parity and an Error Correction Code for storage.

7. The method of claim 6 wherein a first clock is used for the storage and a second clock is used for at least one of the parity or the Error Correction Code.

8. A non-transitory computer readable medium comprising computer program instructions that, when executed by a computing device, causes the computing device to at least:

receive a value for a redundancy factor for a netlist that includes an original

library element for an n-bit register unit;

create a number, equal to the value, of copies of the original library element; and configure, within the digital logic design, the original library element and each copied library element such that each original library element and copied library element receives a corresponding input from the same logical origin.

9. A method of synthesizing a netlist comprising:

receiving a description of a digital logic design;

receiving a value for a redundancy factor for the netlist;

receiving an alternative constraint; and

using the value of the redundancy factor and the alternative constraint to choose a combination of library elements to instantiate in the netlist.

10. A method of synthesizing a netlist comprising:

receiving a description of a digital logic design;

receiving at least one alternative constraint selected from the group consisting of: a timing constraint and an area constraint;

determining a redundancy factor for at least one element instantiated within the netlist; and

using the redundancy factor and the alternative constraint to synthesize the netlist.

1 1 . A method of automatically inserting safety logic within a design, the method comprising:

receiving a netlist including at least one library element;

receiving a redundancy factor; and

using the redundancy factor to select an implementation of the library element for a unit in the design from a plurality of implementations.