PROCESSOR SYSTEM AND FAULT MANAGING UNIT THEREOF

• US 20110029191A1
• Filed: 07/31/2009
• Published: 02/03/2011
• Est. Priority Date: 07/31/2009
• Status: Active Grant

• Current Assignee: Parades S.C.A.R.L., STMicroelectronics SRL (STMicroelectronics NV)
• Original Assignee: Parades S.C.A.R.L., STMicroelectronics SRL (STMicroelectronics NV)
• Inventors: Ferrari, Alberto, Baleani, Massimo, Anastasio, Antonio, Macri, Umberto
• Granted Patent: US 8,478,478 B2
• Time in Patent Office: Days
• US Class Current: 701/35
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24021 Separate processor for monitoring system
• CPC Class Codes: G05B 2219/24059 Diagnostic programmed in state logic

Abstract

A processor system having a processor core, a plurality of modules connected to the processor core and configured to generate respective fault signals, and a fault managing unit connected to the processor core and to the plurality of modules. The fault managing unit is adapted to collect a first fault signal generated by a first module of the plurality of modules which is in a fault condition, analyze said collected first fault signal, and generate a first reaction signal to be selectively transmitted to said processor core and said first module.

Claims

1. A processor system, comprising:

a processor core;

a plurality of modules connected to the processor core and configured to generate respective fault signals; and

a fault managing unit connected to the processor core and to the plurality of modules;

the fault managing unit adapted to;

collect a first fault signal generated by a first module of the plurality of modules which is in a fault condition;

analyze said collected first fault signal; and

generate a first reaction signal to be selectively transmitted to said processor core and said first module.

2. The system of claim 1 wherein said fault managing unit comprises:

an input module to collect the first fault signal and at least a second fault signal generated by at least a second module of the plurality of modules; and

a diagnosis and reaction module structured to analyze the first fault signal and the at least second fault signal and generate the first reaction signal and at least one second reaction signal.

3. The system of claim 2, further comprising:

a bus interconnecting the fault managing unit, the processor core and the plurality of modules to exchange said first fault signal, the at least a second fault signal and the at least a second reaction signal.

4. The system of claim 3 wherein said fault managing unit further comprises:

an output module connected to the diagnosis and reaction module to transmit the first reaction signal and the at least a second reaction signal on said bus in accordance with a communication protocol.

5. The system of claim 1 wherein the first reaction signal comprises one of the following signals:

an alarm signal to be transmitted to the processor core which is configured to recover the first module from fault condition;

a command signal to be received at said first module to recover the first module from fault condition.

6. The system of claim 5 wherein said first fault signal selectively represents a first fault condition and a second fault condition that is more critical than the first fault condition;

the managing unit adapted to generate the alarm signal when the first fault signal represents the first fault condition and to generate the command signal when the fault signal represents the second fault condition.

7. The system of claim 6 wherein the fault managing unit is configured to assume an alarm state in which the alarm signal is generated, and a safety signal to be generated from the core processor and informing of the recovering of the fault condition is held at the fault managing unit.

8. The system of claim 7 wherein the fault managing unit is structured to transition from the alarm state to a fault state when the managing unit holds said safety signal for a time equal or greater than a waiting time;

and in the fault state the command signal is generated by the fault managing unit.

9. The system of claim 1 wherein the fault managing unit is a finite state machine.

10. The system of claim 1 wherein the managing unit is structured to collect and manage fault signals due to at least one of the following errors:

random error;

random hardware error, random software error.

11. The system of claim 1 wherein said module is at least one of the following modules:

a memory error detection module, a digital word comparator, a power voltage monitor, a clock monitor.

12. The system of claim 5 wherein the fault managing unit is structured so that:

the alarm signal is an interrupt signal requesting the processor core to reset said first module; and

the command signal is a reset signal to be directly sent to and received at the first module.

13. The system of claim 8 wherein the fault managing unit is configured to further transition to:

an initial state after a destructive reset signal; and

a normal state in which the fault managing unit waits for one further fault signal.

14. The system of claim 1 wherein the system comprises a microcontroller integrated on a semiconductor chip.

15. An electrical system, comprising

a processor core,

a plurality of modules connected to the processor core and configured to generate respective fault signals;

and

an automotive apparatus controlled by said processor core; and

a fault managing unit configured so as to;

collect a fault signal generated by one module of the plurality of modules which is in a fault condition;

analyze said collected fault signal; and

generate a reaction signal to be selectively transmitted to said processor core and said module in fault condition.

16. The system of claim 15 wherein said fault managing unit comprises:

an input module to collect the first fault signal and at least a second fault signal generated by at least a second module of the plurality of modules; and

a diagnosis and reaction module structured to analyze the first fault signal and the at least second fault signal and generate the first reaction signal and at least one second reaction signal.

17. The system of claim 15 wherein the first reaction signal comprises at least one of the following signals:

an alarm signal to be transmitted to the processor core which is configured to recover the first module from fault condition;

a command signal to be received at said first module to recover the first module from fault condition.

18. The system of claim 17 wherein said first fault signal selectively represents a first fault condition and a second fault condition that is more critical than the first fault condition;

the managing unit adapted to generate the alarm signal when the first fault signal represents the first fault condition and to generate the command signal when the fault signal represents the second fault condition.

19. A circuit, comprising:

an input module connectable to a core processor and to a plurality of operative modules;

the input module configured to receive fault signals generated by the plurality of modules;

a diagnosis and reaction module structured to analyze a first fault signal received from one of said modules that is in a fault condition and to generate a reaction signal to be selectively sent to the processor core and the module in the fault condition in accordance with a criticality data associated with the fault signal;

an output module connected to the diagnosis and reaction module to selectively transmit the first reaction signal to the core processor and to the module in the fault condition.

20. The system of claim 19 wherein the fault signals selectively represent a first fault condition and a second fault condition that is more critical than the first fault condition;

the circuit adapted to generate the alarm signal when the first fault signal represents the first fault condition and to generate the command signal when the fault signal represents the second fault condition.

21. The system of claim 20 wherein the circuit is configured to transition to an alarm state in which the alarm signal is generated, and a safety signal to be generated from the core processor and informing of the recovering of the fault condition is held at the circuit.

22. The system of claim 21 wherein the circuit is structured to transition from the alarm state to a fault state when the circuit holds the safety signal for a time equal to or greater than a waiting time;

and in the fault state the command signal is generated by the circuit.

23. The system of claim 19 wherein the circuit comprises a finite state machine.