METHOD FOR OPERATING A MICROCONTROLLER AND MICROCONTROLLER

• US 20200133803A1
• Filed: 10/29/2019
• Published: 04/30/2020
• Est. Priority Date: 10/30/2018
• Status: Active Grant

• Current Assignee: Infineon Technologies AG
• Original Assignee: Infineon Technologies AG
• Inventors: Kleeberger, Veit, Zalman, Rafael
• Granted Patent: US 11,301,328 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/1407 Checkpointing the instruction stream
• CPC Class Codes: G06F 11/1489 through recovery blocks
• CPC Class Codes: G06F 11/1497 Details of time redundant execution on a single processing unit

Abstract

A method for operating a microcontroller, which includes a processor and a peripheral circuit on a common chip, the method including initiating a process in the peripheral circuit, in the peripheral circuit generating recovery data, executing the process, checking whether the process has been executed successfully and, in the event that the check reveals that the process has not been executed successfully, generating recovered data from the recovery data, and executing the process again.

Claims

1. A method for operating a microcontroller, which comprises a processor and a peripheral circuit on a common chip, the method comprising:

initiating a process in the peripheral circuit;

in the peripheral circuit;

generating recovery data;

executing the process;

checking whether the process has been executed successfully;

in the event that the check reveals that the process has not been executed successfully, generating recovered data from the recovery data; and

executing the process again.

2. The method as claimed in claim 1, further comprising:

after the process has been executed again, checking again whether the process has been executed successfully.

3. The method as claimed in claim 1, further comprising:

before the generation of recovered data from the recovery data, determining a number of repetition attempts already carried out, the generation of recovered data from the recovery data and the execution of the process again taking place only if the number of repetition attempts already carried out is less than a predetermined maximum number of repetition attempts.

4. The method as claimed in claim 3, further comprising:

in the event that the new check reveals that the process has not been executed successfully and the number of repetition attempts already carried out is equal to the predetermined maximum number of repetition attempts, instigating an error handling process.

5. The method as claimed in claim 1, wherein the generation of recovery data comprises at least one of:

generating a direct copy of at least a part of working data of the peripheral circuit; and

generating an error correction code for at least a part of the working data of the peripheral circuit.

6. The method as claimed in claim 5,

wherein a further part of the working data remains unprotected.

7. The method as claimed in claim 6,

wherein the further part of the working data is not used when executing the process.

8. The method as claimed in claim 6,

wherein the process comprises at least a first subprocess and a second subprocess, and

wherein the part of the working data of the first subprocess is at least partially different to the part of the working data of the second subprocess, and the further part of the working data of the first subprocess is at least partially different to the further part of the working data of the second subprocess.

9. The method as claimed in claim 1,

wherein the initiation of the process in the peripheral circuit is executed by way of the processor, by way of a further peripheral circuit, or by way of an interrupt of a timer.

10. A microcontroller, comprising, on a common chip:

a processor; and

a peripheral circuit,

wherein the microcontroller is adapted to initiate a process in the peripheral circuit, and

wherein the peripheral circuit is adapted to generate recovery data, to execute the process, to check whether the process has been executed successfully, and in the event that the check reveals that the process has not been executed successfully, to generate recovered data from the recovery data, and to execute the process again.

11. The microcontroller as claimed in claim 10,

wherein the peripheral circuit is further adapted, after the process has been executed again, to check again whether the process has been executed successfully.

12. The microcontroller as claimed in claim 10,

wherein the peripheral circuit is further adapted, before the generation of recovered data from the recovery data, to determine a number of repetition attempts already carried out, the peripheral circuit being adapted to carry out the generation of recovered data from the recovery data and the execution of the process again only if the number of repetition attempts already carried out is less than a predetermined maximum number of repetition attempts.

13. The microcontroller as claimed in claim 12,

wherein the peripheral circuit is adapted, in the event that the new check reveals that the process has not been executed successfully and the number of repetition attempts already carried out is equal to the predetermined maximum number of repetition attempts, to instigate an error handling process.

14. The microcontroller as claimed in claim 10,

wherein the peripheral circuit is adapted to carry out the generation of recovery data by way of:

generating a direct copy of at least a part of working data of the peripheral circuit;

or

generating an error correction code for at least a part of the working data of the peripheral circuit.

15. The microcontroller as claimed in claim 14, wherein a further part of the working data remains unprotected.

16. The microcontroller as claimed in claim 15, wherein the further part of the working data is not used when executing the process.

17. The microcontroller as claimed in claim 14,

wherein the process comprises at least a first subprocess and a second subprocess, and

wherein the part of the working data of the first subprocess is at least partially different to the part of the working data of the second subprocess, and the further part of the working data of the first subprocess is at least partially different to the further part of the working data of the second subprocess.

18. The microcontroller as claimed in claim 10,

wherein the peripheral circuit forms a communication interface or a register.

19. The microcontroller as claimed in claim 10,

wherein the microcontroller is adapted to initiate the process in such a way that the initiation of the process in the peripheral circuit is executed by way of the processor, by way of a further peripheral circuit, or by way of an interrupt of a timer.