WO1990004287A1

WO1990004287A1 - Process and device for monitoring failures of timing signals

Info

Publication number: WO1990004287A1
Application number: PCT/DE1988/000671
Authority: WO
Inventors: Hermann-Josef Wiegand
Original assignee: Siemens Aktiengesellschaft
Priority date: 1988-10-05
Filing date: 1988-10-31
Publication date: 1990-04-19
Also published as: EP0437425A1

Abstract

The timing signals to be monitored are preferably converted by a binary divider into a square pulse sequence having a pulse-duty factor equal to 2 (interpulse period = pulse duration) and a period that is more than twice as long as the period of a test timing signal. The timing signals thus converted are then scanned by the test timing signal of the signal level of the square pulse sequence. The absence of changes in the signal level during a test cycle is taken as a criterion for a disturbed timing signal.

Description

Method and device for monitoring the failure of a clock signal

The present invention relates to a method and a device for monitoring the failure of a clock signal, which is particularly important in the case of highly secure microprocessors. There, clock errors are to be recognized and, if necessary, the system part which is defective in this regard is to be switched off to prevent repercussions. Cycle monitoring - also known as "watch dogs" - should be able to actively initiate the error response independently.

One could think of implementing such independent cycle monitors with retriggerable monostable flip-flops which are triggered by the clock signal to be monitored and produce an error message if the clock signal fails. However, a monostable multivibrator contains, as an essential element, a capacitor, the installation of which in today's highly integrated semiconductor circuits is difficult, if not impossible.

The invention has for its object to provide a simple clock signal failure monitoring, which does not require the use of capacitors. This object is achieved according to the invention with the measures specified in the patent claim.

The invention together with its further refinements, which are characterized in the subclaims, will be explained in more detail below with reference to the figures. Show it:

1 shows exemplary pulse diagrams for explaining the method according to the invention, 2 shows an advantageous technical implementation of the method according to the invention, FIG. 3 shows a block diagram for mutual failure monitoring of two clock signals, FIG. 4 shows a block diagram for clock monitoring in a multiple redundant clock supply system, and FIG. 5 shows a fault-tolerant variant of the clock monitoring according to FIG. 4.

The top line of the pulse diagram shown in FIG. 1 shows the clock signal T to be monitored, the frequency of which is f _τ and thus the period duration is l / f _τ . The third line of FIG. 1 shows the test clock signal PT with the frequency f _pτ or the period l / f _pτ . The clock signal T to be monitored is converted into a rectangular pulse sequence T ¹ with the duty cycle 2 (pulse duration = pulse pause), which can be done very simply with a binary divider used as a frequency divider, with a corresponding choice of the divider ratio the period of the rectangular pulse train T ¹ is set so that it is more than twice as large as the period of the test clock signal PT, from which another pulse train PT 'is derived with frequency division, the period l / f _pτι the duration of each other following test cycles PZ determined. The test cycle duration PZ or the frequency divider ratio with which the frequency of the test clock signal PT is reduced should be selected so that it is equal to or greater than the period of the rectangular pulse train T ¹ . This ensures that, with a correct clock supply T, a change in the signal level of those derived from the clock signal T within each test cycle PZ

Rectangular pulse sequence T 'occurs, which can be detected by sampling the rectangular signal T' at the time of rising pulse edges of the test clock signal PT. If, for example, an H signal level of the rectangular pulse sequence T ^{1 is} present at the time t on a rising pulse edge of the test clock signal PT, the output AI of a first memory device is opened H signal set, while an L signal level of the rectangular pulse train T ¹ at time t would cause an ascending pulse edge of the test clock signal PT at output A2 of a second memory device to produce an H signal. At the end of each test cycle PZ, if the clock supply T is correct, both signals AI and A2 must be H (high) signals. The two memory devices for the level values are reset at the end of each test cycle PZ, which takes place within a negligibly short time t _R caused by the signal propagation times of the components used, and a new test cycle PZ can begin. If the clock supply T fails, the output signals AI and A2 of the scan memory devices do not both have an H signal, which can be recognized as a clock error with the output of a corresponding warning signal.

Denote by n _τ the ratio of clock signal frequency f _γ to the frequency of the rectangular _{pulse train} T ¹ derived from it by frequency division, and by n _pτ the ratio of the test clock frequency f _pτ to the frequency fp - * - * of that also obtained from it by frequency division and the rectangular pulse sequence PT 'determining the test cycle PZ, then clock failure monitoring can be implemented for any values of clock signal frequency and test clock signal frequency if the following conditions are met according to the invention:

n _τ ^ 2. f _τ / f _pτ (1)

In the example shown in FIG. 1, the frequencies of clock signal T and test clock signal PT should behave as 4: 5. According to equation (1) above, this would result in a divider ratio between clock signal T and square-wave pulse train T ¹ of f_ / f _pτ w 1.6, so for _divider ratios that can generally only be implemented as an integer, a divider ratio of n _τ = 2 Equation (2) to be provided _divider factor n _pτ be equal to or greater than 2.5. In the example of FIG. 1, a division ratio n _pτ of 4 was chosen, which can be realized in a very simple manner using a binary divider. However, a division ratio of 3 would have been possible to fulfill equation (2), which would have shortened the test cycle time PZ and thus would have led to a faster output of a warning signal in the event of a clock signal failure.

2 shows an advantageous implementation in terms of device technology of a clock monitor TM operating according to the inventive method. It contains four edge-controlled D flip-flops Kl to K4. In the case of edge-controlled D flip-flops, when the pulse edges of the signal present at control input C rise, the information of the signal present at the D input is adopted and appears as the output signal of output Q assigned to controlled input D. Control inputs C of D flip-flops K1 and K2 are applied to the clock signal T to be monitored at the input terminal 1 via a frequency expensive FT1 with the divider ratio n _τ , while the test clock signal PT applied to the input terminal 2 is fed directly to the control inputs C of the D flip-flops K1 and K2 . A second frequency divider FT2 with the _divider factor n _pτ reduces the frequency of the test clock signal PT and the frequency-reduced voltage corresponding to this divider factor n _pτ is fed to the control inputs C of the D flip-flops K3 and K4. The _{divider factors} n _τ and n _pτ are _dimensioned according to equations (1) and (2), the frequency dividers themselves consisting either of repetitive preset counters or of binary dividers. In the case of the D flip-flops Kl and K2, the outputs Q are each fed back to their set inputs S, so that latching is achieved in such a way that, once the output H signal has been received, this state, which is fed back to the set input S, is maintained until on dominating reset input R an H signal is applied. The outputs AI and A2 of the flip-flops Kl and K2 are each connected to the inputs of an AND gate AN and a NAND gate N, the outputs of which act on the D inputs of the Kippglie¬ der K3 and K4. The output Q of the flip-flop K3 is connected to the reset inputs R of the flip-flops K1 and K2, while the Q output of the flip-flop K4 is connected to the output terminal 3 for emitting a clock error signal TF in the event of a clock signal failure. To reset the flip-flop K4, there is a further input terminal, designated RS, which is to be briefly supplied with an H signal to restart the clock monitor after the clock system has been repaired.

The mode of operation of the clock monitor TM shown in FIG. 2, using the pulse diagrams of FIG. 1, is as follows: If no clock error was found in the previous test cycle PZ, the flip-flops K1 and K2 are reset by the output signal Q of the flip-flop K3, which has an H signal, ie they are then in the state in which their Q outputs each have an L (low) signal. As a result of this, the output signal of the AND gate AN is an L signal which, when inverted and acting on the reset input of the trigger circuit K3, forces an L signal at the Q output thereof. At the next pulse of the test clock signal PT arriving at the control inputs of the D flip-flops K1 and K2, one of the two flip-flops is set, depending on whether the signal level of the rectangular pulse train T ^{1 is} an L or an H signal. In accordance with the curve shown in FIG. 1, it should be assumed that at time t the first pulse of the test clock signal PT arriving after the start of the test cycle finds an H signal level in the signal T ¹ , so that an H signal is taken over by the flip-flop Kl and the signal AI also becomes an H signal. If, on the other hand, the signal level of the rectangular pulse train T ^{1 is} an L signal on a rising pulse edge of the test clock signal PT, which is the case in FIG. 1 for example at time t, then an H signal is present as a result of the inversion at the D input of the flip-flop K2. which is stored by this flip-flop so that the output signal A2 at its Q output also becomes an H signal. As a result of the self-holding effect of the feedback output signals AI and A2, these states of the flip-flops K1 and K2 are retained for the rest of the test cycle. If a change in the signal level in the test clock pulse sequence T ¹ derived from the clock signal T to be monitored has occurred during a test cycle PZ, then the output signal of the AND gate AN consists of an H signal and at the end of the test cycle the rising pulse edge acts the rectangular pulse train PT ¹ at the C input of the D flip-flop K3 that an H signal is present at its Q output and a reset of the flip-flops Kl and K2 a new test cycle is prepared, which then runs again in the manner just described. However, if there was no signal change in the rectangular pulse train T ¹ within a test cycle due to the failure of the clock signal T, then at the end of the test cycle the output signals AI and A2 are not simultaneously H signals and the output of the NAND gate NA has one H signal which, at the end of the test cycle, causes a clock error signal TF at the output terminal 3 which indicates a disturbed clock signal.

The method according to the invention can be implemented with any frequency relation of the clock signal and test clock signal to be monitored, i.e. the frequency of the clock signal to be monitored can be greater than, equal to or less than the test clock signal. This is used in the further development of the invention shown in FIG. 3 for the simultaneous mutual failure monitoring of the clock and test clock signals, which results in highly reliable clock monitoring.

The arrangement shown in FIG. 3 contains, in addition to a first clock monitor TM1 like the clock monitor TM shown in FIG. 2, an additional clock monitor TM2 and is based on the idea of exchanging the roles of clock signal T and test clock signal in this additional clock monitor, ie with the clock signal T, the test clock signal in exactly the same way as in Monitor TMl clock monitor for failure. For this purpose, the test clock signal PT is fed to the clock signal input 1 of the clock monitor TM2 and the clock signal T is fed to the test clock input 2. The error signal outputs 3 of the two clock monitors are connected to indicator lamps L1 and L2 and to the inputs of an OR gate 0, on the latter Output then a failure collective signal FS would appear if the clock signal T or the clock signal PT fails. If one bases the previously mentioned values of FIG. 1 on the frequency relation of the clock signal T and the test clock signal PT (f _τ / f _p _ = 0.8), then the determination of the divider factors n _τ and n changes _pτ for the clock monitor TM2 due to the role reversal of the signals T and PT this relation around and it results for n _γ and n _pτ according to equations (1) and (2) both the same integer minimally realizable value of 3 or when using Binary divisors the value of 4.

In complex microprocessor systems, multiple clock supplies are often available and have to be monitored for failure. One could assign a separate test clock signal with an additional clock monitor according to the arrangement according to FIG. 3 to each clock signal to be monitored. 4 shows an embodiment with which multiple clock supply can be used without such additional clock monitors. There are n clock signals T1 to Tn, which are to be monitored for failure and are accordingly connected to the clock signal inputs of the clock monitors TM1 to TMn, which are designated by 1. In cyclical assignment, each of the clock signals T1 to Tn is used as a test clock signal for another clock signal and is consequently connected to the test clock signal input 2 of the adjacent clock monitor. As in the arrangement according to FIG. 3, the clock error outputs 3 are individually monitored by means of indicator lamps and connected to the inputs of an OR gate which, in the event of failure of one of the clock signals T1 to Tn, outputs the error collective signal FS. A malfunction of the clock supply can thus be recognized centrally, identified by means of display lamps or other display devices, and a targeted error reaction can be initiated. 5 shows a fault-tolerant embodiment of the arrangement according to FIG. 4, with which, if one clock signal fails, the mutual monitoring of the remaining clock signals can continue undisturbed. For example, four clock signals T1 to T4 with the associated clock monitors TM1 to TM4 are present, which act on the clock monitors TM1 to TM4 in the manner shown in FIG. 4 when the switches S1 to S4 assigned to the test clock inputs 2 are shown . When the changeover switch assigned to its test clock input 2 is actuated by the error signal at output 3 of the clock monitor which is directly (cyclically) adjacent to it, the individual clock monitor has the possibility of the undisturbed test clock signal instead of the disturbed clock signal of the immediately adjacent monitor Obtain clock signal from a further adjacent clock monitor. If a clock signal fails, its function as a test clock signal is transferred to the test clock signal assigned to the failed clock signal. Since each clock signal T1 to T4 is prepared in this way to apply the test clock input 2 of a further adjacent clock monitor when the switch assigned to this input is actuated accordingly, the disturbed clock signal can be removed from the chain of self-monitoring clock signals and the Clock signal monitoring of the other clock signals is still fully secured.

Claims

1. Method for monitoring the failure of a clock signal, in particular for high-security microprocessor systems, g e k e n n - z e i c h n e t by the following steps:

a) The clock signal (T) to be monitored is converted into a periodic pulse pulse sequence (T ¹ ) having a pulse duty factor of 2, the period of which is more than twice as long as the period of a test clock signal (PT); b) in each case during a test cycle (PZ) derived from the test clock signal (PT), which is at least equal to the period of the rectangular pulse train (T ¹ ), the signal level of the rectangular pulse train is sampled with the test clock * signal; c) in the event that no change in the signal level of the rectangular pulse train (T ¹ ) is found at the end of a test cycle, a clock error signal (TF) is output.

2. The method according to claim 1, g e k e n e z e i c h n e t by a simultaneous, mutual failure monitoring of the clock signal (T) and test clock signal (PT).

3. The method of claim 1 with several clock signals (Tl -Tn), d a d u r c h g e k e n n z e i c h n e t that a clock signal is used as a test clock signal of another in cyclical assignment.

4. The method according to claim 3, characterized in that if a clock signal fails, its function as a test clock signal is transferred to the test clock signal assigned to it.

5. Device for performing the method according to one of the preceding claims, characterized by the following features: a) the clock signal (T) to be monitored is fed to a first binary device (FT1), the output signal and the signal inverted for this purpose are the D inputs of two first D-flip-flops (K1, K2) are supplied, the setting inputs (S) of which are each acted upon by the output signal assigned to their D-input; b) the test clock signal (PT) acts directly on the control inputs of the two first D flip-flops and the control inputs of two second D-flip-flops (K3, K4) via a second binary divider (FT2); c) the output signals of the first two D flip-flops (K1, K2) act via a NAND gate (NA) on the D input of one of the two second D-flip-flops (K4), which is provided for emitting a clock error signal (TF), and via an AND gate (AN) the D input of the other D flip-flop (K3), which is provided for resetting the first two D flip-flops.

6. Device according to claim 5, characterized in that, in the event of mutual failure monitoring of a plurality of clock signals (Tl - Tn), all clock error signal outputs (3) with display devices and for forming an error signal signal (FS) with the inputs of an OR gate ver ¬ are bound.

7. Device according to claim 6, characterized in that the test clock inputs (2) of the clock monitors (TMl - TM4) are each provided with a changeover switch (S1 - S4) which, when actuated by the error signal of a cyclically adjacent clock monitor connects its test clock input to its test clock input.