Abstract: A fault reaction handling time interval (FRTI) for a reaction to the fault is determined based on a domain identifier (DID) indicative of an application associated with a fault. A first reaction to recover from the fault is signaled and then a determination is made whether a safe state is reached after the FRTI. Based on the safe state not being reached, a second FRTI is determined for a second escalated reaction, the second FRTI also being based on the DID. Typically, the second reaction results in less system availability so by defining the FRTI based on the DID sufficient time is allowed for reaching a safe state before the reaction is escalated.

Abstract: A fault indication from a fault source is to be provided to a demultiplexer which is configured to output the fault indication. The demultiplexer is configurable to output the fault indication to an OR gate of a plurality of OR gates coupled to a respective fault channel of a plurality of fault channels based on an application which uses the fault source as a resource. A reaction to the fault indication is performed based on the fault channel which received the fault indication.

Abstract: A fault indication from a fault source is to be provided to a demultiplexer which is configured to output the fault indication. The demultiplexer is configurable to output the fault indication to an OR gate of a plurality of OR gates coupled to a respective fault channel of a plurality of fault channels based on an application which uses the fault source as a resource. A reaction to the fault indication is performed based on the fault channel which received the fault indication.

Abstract: A fault recovery system includes various fault management circuits that form a hierarchical structure. One fault management circuit detects a fault in a functional circuit and executes a recovery operation to recover the functional circuit from the fault. When the fault management circuit fails to recover the functional circuit from the fault within a predetermined time duration, a fault management circuit that is in a higher hierarchical level executes another recovery operation to recover the functional circuit from the fault. Such a fault management circuit is required to execute the corresponding recovery operation within another predetermined time duration to successfully recover the functional circuit from the fault. The fault recovery system thus implements the hierarchical structure of fault management circuits to recover the functional circuit from the fault.

Abstract: A central system coupled to a subsystem receives a fault indication associated with a fault in one or more circuits of the subsystem from a local fault collection and control (FCCS) of the subsystem when a software recovery of the fault fails. Based on the received fault indication, the local FCCS and a central FCCS of a central system is masked from additional fault indications from the one or more circuits. The central system then signals the reset of the one or more circuits of the subsystem after the masking of the additional fault indications, wherein the one or more circuits is reset based on the signaling and the additional faults are masked from one or more of the local FCCS and central FCCS during the reset.

Abstract: A method of dynamic configuration of reaction policies in virtualized fault management system includes disabling a fault handler circuit comprising a reaction core in response to receiving a request to modify a respective first reaction policy including a plurality of first recovery actions of the reaction core, wherein each of the first recovery actions is responsive to a respective fault indication. At least one event status is cleared from an event table of the fault handler circuit. The at least one event status is set in response to the fault handler circuit receiving the respective fault indication. The reaction core is configured with a second reaction policy including a plurality of second recovery actions.

Abstract: A method of dynamic configuration of reaction policies in virtualized fault management system includes disabling a fault handler circuit comprising a reaction core in response to receiving a request to modify a respective first reaction policy including a plurality of first recovery actions of the reaction core, wherein each of the first recovery actions is responsive to a respective fault indication. At least one event status is cleared from an event table of the fault handler circuit. The at least one event status is set in response to the fault handler circuit receiving the respective fault indication. The reaction core is configured with a second reaction policy including a plurality of second recovery actions.

Abstract: An event manager for filtering safety and security events of a system including an event sequence list including predetermined event sequences in which each sequence includes at least one event identifier identifying a corresponding one of multiple monitored events, an event sequence array that stores a received event sequence in response to received event notifications, and a controller that stores an event identifier into the event sequence array and that determines whether the received event sequence matches at least one of the predetermined event sequences for determining a composite event and a response for each received event notification. The matching determination may be made with or without consideration of chronological order. A suspected composite event may be identified when multiple possible matches may exist, and a final composite event is ratified when only one match is found. An exception may be generated upon timeout of a timer.

Abstract: A fault recovery system includes various fault management circuits that form a hierarchical structure. One fault management circuit detects a fault in a functional circuit and executes a recovery operation to recover the functional circuit from the fault. When the fault management circuit fails to recover the functional circuit from the fault within a predetermined time duration, a fault management circuit that is in a higher hierarchical level executes another recovery operation to recover the functional circuit from the fault. Such a fault management circuit is required to execute the corresponding recovery operation within another predetermined time duration to successfully recover the functional circuit from the fault. The fault recovery system thus implements the hierarchical structure of fault management circuits to recover the functional circuit from the fault.

Abstract: A control system, that includes a primary controller and various auxiliary controllers, is configured to facilitate a built-in self-test (BIST) of a system-on-chip (SoC). The primary controller is configured to initiate a BIST sequence associated with the SoC. Based on the BIST sequence initiation, each auxiliary controller is configured to schedule execution of various self-test operations on various functional circuits, various memories, and various logic circuits of the SoC by various functional BIST controllers, various memory BIST controllers, and various logic BIST controllers of the SoC, respectively. Based on the execution of the self-test operations, each auxiliary controller further generates various status bits with each status bit indicating whether at least one functional circuit, at least one memory, or at least one logic circuit is faulty. Based on the status bits generated by each auxiliary controller, a fault diagnosis of the SoC is initiated.

Abstract: A control system, that includes a primary controller and various auxiliary controllers, is configured to facilitate a built-in self-test (BIST) of a system-on-chip (SoC). The primary controller is configured to initiate a BIST sequence associated with the SoC. Based on the BIST sequence initiation, each auxiliary controller is configured to schedule execution of various self-test operations on various functional circuits, various memories, and various logic circuits of the SoC by various functional BIST controllers, various memory BIST controllers, and various logic BIST controllers of the SoC, respectively. Based on the execution of the self-test operations, each auxiliary controller further generates various status bits with each status bit indicating whether at least one functional circuit, at least one memory, or at least one logic circuit is faulty. Based on the status bits generated by each auxiliary controller, a fault diagnosis of the SoC is initiated.

Abstract: A fault collection and reaction system on a system-on-chip (SoC) includes a plurality of reaction cores assigned to a plurality of applications being executed by a plurality of processor cores on the SoC, at least one look-up table (LUT), and a controller. The at least one LUT stores therein a first mapping between the plurality of reaction cores and corresponding plurality of domain identifiers, and a second mapping between a plurality of faults and a set of reaction combinations. The controller receives a fault indication and a first domain identifier in response to occurrence of a first fault and selects from the plurality of reaction cores, a first reaction core mapped to the first domain identifier, and from the set of reaction combinations, a first reaction combination mapped to the first fault. The first reaction core responds to the fault indication with a reaction based on the selected reaction combination.

Abstract: A fault collection and reaction system on a system-on-chip (SoC) includes a plurality of reaction cores assigned to a plurality of applications being executed by a plurality of processor cores on the SoC, at least one look-up table (LUT), and a controller. The at least one LUT stores therein a first mapping between the plurality of reaction cores and corresponding plurality of domain identifiers, and a second mapping between a plurality of faults and a set of reaction combinations. The controller receives a fault indication and a first domain identifier in response to occurrence of a first fault and selects from the plurality of reaction cores, a first reaction core mapped to the first domain identifier, and from the set of reaction combinations, a first reaction combination mapped to the first fault. The first reaction core responds to the fault indication with a reaction based on the selected reaction combination.

Abstract: A processing system, such as for an automobile, includes multiple processor cores, including an application core and a safety core, and a fault detection circuit in communication with the processor cores. The fault detection circuit includes a progress register for storing progress data of an application executed on the application core. The safety core, which executes a fault detection program, reads the progress data from the progress register, and generates an output based on the progress data and an expected behavior of the application. The safety core writes the output to a status register of the fault detection circuit. The fault detection circuit includes a controller that reads the status register and generates a fault signal when the output indicates there is a fault in the execution of the application. In response, the application core either recovers from the fault or runs in a safe mode.

Abstract: A processing system, such as for an automobile, includes multiple processor cores, including an application core and a safety core, and a fault detection circuit in communication with the processor cores. The fault detection circuit includes a progress register for storing progress data of an application executed on the application core. The safety core, which executes a fault detection program, reads the progress data from the progress register, and generates an output based on the progress data and an expected behavior of the application. The safety core writes the output to a status register of the fault detection circuit. The fault detection circuit includes a controller that reads the status register and generates a fault signal when the output indicates there is a fault in the execution of the application. In response, the application core either recovers from the fault or runs in a safe mode.

Abstract: A communication system for communicating control data between a processor and an interface includes configuration registers, a packet processor, an interrupt processor, a timing monitor, a configuration sampler, a control-frame processor, a mode selector, and a transceiver. The processor, timing monitor, and configuration sampler generate control data, a timing signal and frame structure data, respectively. The packet processor generates a transmit control configuration packet, which includes the control data. The control-frame processor inserts the transmit control configuration packet into a first control frame, outputs the control frame to the interface and extracts a receive-configuration packet from a second control frame for generating one or more interrupts. The mode selector generates mode and idle signals for determining the mode of the interface, based on the idle signal. In one implementation, the system uses JESD control frames to reduce GPIO pin usage.

Abstract: A communication system for communicating control data between a processor and an interface includes configuration registers, a packet processor, an interrupt processor, a timing monitor, a configuration sampler, a control-frame processor, a mode selector, and a transceiver. The processor, timing monitor, and configuration sampler generate control data, a timing signal and frame structure data, respectively. The packet processor generates a transmit control configuration packet, which includes the control data. The control-frame processor inserts the transmit control configuration packet into a first control frame, outputs the control frame to the interface and extracts a receive-configuration packet from a second control frame for generating one or more interrupts. The mode selector generates mode and idle signals for determining the mode of the interface, based on the idle signal. In one implementation, the system uses JESD control frames to reduce GPIO pin usage.

Abstract: A system provides synchronous read data sampling between a memory and a memory controller, which includes an asynchronous FIFO buffer and which outputs a clock and other control signals. An outbound control signal (e.g., read_enable) is used to time-stamp the beginning of a read access using a clock edge counter. The incoming read data is qualified based on the time-stamped value of the read_enable signal plus typical access latency by counting FIFO pops. The system performs correct data sampling irrespective of propagation delays between the controller and memory. The system may be implemented in a System on a Chip (SOC) device having a synchronous communication system.

Abstract: In a processing system, an integrated function controller (IFC) for one or more memory devices, including a NAND flash memory device, provides direct memory access (DMA) functionality for writing data to and reading data from the NAND flash memory device, thereby reducing the level of CPU intervention required to support such operations. In one implementation, the CPU stores in system memory a descriptor-based DMA operation sequence of NAND flash operations and then triggers the IFC to implement the descriptor sequence. The IFC sequentially fetches and implements individual stored descriptors without interrupting the CPU or requiring any real-time CPU intervention using, for example, a “repeat while busy” polling descriptor type. The IFC frees up the CPU to perform other system-level operations, thereby increasing the efficiency of the processing system.

Abstract: A system provides synchronous read data sampling between a memory and a memory controller, which includes an asynchronous FIFO buffer and which outputs a clock and other control signals. An outbound control signal (e.g., read_enable) is used to time-stamp the beginning of a read access using a clock edge counter. The incoming read data is qualified based on the time-stamped value of the read_enable signal plus typical access latency by counting FIFO pops. The system performs correct data sampling irrespective of propagation delays between the controller and memory. The system may be implemented in a System on a Chip (SOC) device having a synchronous communication system.