WO2015068207A1

WO2015068207A1 - Programmable device

Info

Publication number: WO2015068207A1
Application number: PCT/JP2013/079916
Authority: WO
Inventors: 山田　弘道; 山田　勉; 島村　光太郎; 雄介菅野; 真佐圓; 鳥羽　忠信
Original assignee: 株式会社日立製作所
Priority date: 2013-11-05
Filing date: 2013-11-05
Publication date: 2015-05-14
Also published as: JPWO2015068207A1

Abstract

In this programmable device, which has a dynamic component reconfiguration function: a logical circuit is triplexed and a majority decision is performed; when an error is detected, local reconfiguration of the failed logical circuit is performed; resource consumption of wires and duplication logical cells of a sequential circuit is suppressed; all the sequential circuits are updated to correct data; and the triplexing is restored. To achieve same, a means is provided that is configured in a manner so as to output a subset of FF input data in each logical circuit as data for duplication to another logical circuit and to select data for duplication from another logical circuit and input data of the selfsame means, and that reloads into CRAM and repairs logical circuit information for which a failure is determined when an error is detected in the majority decision process, applies a cycle count set uniquely to the logical circuits to perform duplication of the FF configured in a manner able to be duplicated, and restores the triplexing when the duplication is complete.

Description

Programmable device

The present invention relates to a technique effective when applied to a programmable device in which an internal logic circuit can be defined and changed by a user after manufacture.

Many devices such as home appliances, AV equipment, mobile phones, automobiles, and industrial machines use dedicated LSIs (ASICs), but these devices have higher performance, higher functionality, smaller size, lower power consumption, It is an important part that is indispensable for cost reduction. In recent years, development costs have increased due to miniaturization of semiconductor processes, making it difficult to develop ASICs. FPGA (Field Programmable Gate Array), which is a programmable device that allows the user to define and change the internal logic circuit, is more expensive than ASIC, but the development cost is low, especially for ASIC with fixed internal logic circuit. Utilization of FPGA is expected in industrial equipment that mainly develops a small variety of products. The logic circuit information of the FPGA is held in an external flash ROM. When power is turned on to the FPGA, the logic circuit information is loaded into the internal CRAM (configuration RAM), and the FPGA determines the logic circuit and starts operation. To do. However, there is a problem that a soft error occurs in the CRAM due to the influence of cosmic rays and the logic circuit information is rewritten, and the logic circuit is changed to a wrong function (failed) and malfunctions.

There is a triple as a method of preventing an output error even if a logic circuit fails. The majority of the output of the triple logic circuit is processed, and when the result becomes 2 to 1, the result of which the two match is selected. The logic circuit that outputs a result that does not match is regarded as a failure and stops its operation. Such triplet is called non-repair triplet. Designing a non-repair triple circuit as a logic circuit is effective to some extent against FPGA soft error countermeasures. However, if one logic circuit fails, majority processing can no longer be performed. If one of them fails, an output error cannot be prevented.

Some of the latest FPGAs have a dynamic partial reconfiguration function, and a part of logic circuit information can be reloaded from an external flash ROM to CRAM during operation. If this function is used, when the output of the triple logic circuit is divided into two-to-one, it is considered that the logic circuit that has output that does not match is faulty, and the logic circuit information in the CRAM is It can be reloaded to repair a failed logic circuit. Even if the logic circuit is repaired, the data held by the sequential circuit FF (flip-flop) does not always match the normal logic circuit. Therefore, a method of copying and matching data from the FF at the same position of the normal logic circuit to the FF of the repaired logic circuit can be considered.

Japanese Unexamined Patent Application Publication No. 2011-2116020 (Patent Document 1) discloses that in an FPGA having a dynamic partial reconfiguration function, a logic circuit is tripled and majority processing is performed, and when an error is detected, an unused portion of the FPGA is replaced. A method is disclosed in which a logic circuit is configured and data is copied in one cycle from all FFs of a normal logic circuit to all FFs of the newly configured logic circuit. Such a triple that can repair a failed logic circuit is called a repair triple. In the repair system triple, even if a logic circuit breaks down, it can be repaired and the original triple can be restored, so that higher reliability can be obtained than the non-repair system triple.

JP 2011-216002 A

In the above method disclosed in Patent Document 1, all FFs of a logic circuit to be repaired are to be copied. In the embodiment, copying of FFs without enable is described, the input data of the FF is output as copy data to another tripled logic circuit, and the input data of its own logic circuit at the input unit of the output destination FF In general, the input data of itself is selected, and the copy data from another logic circuit is selected at the time of copying. Also, FF has a type with enable, which is not disclosed in Patent Document 1, but when the enable is 0, the currently held signal is copied, and when the enable is 1, the input data is copied. There is a need to. If all the FFs are to be copied, the logic circuit for generating the copy data and the wiring between the FFs are required for the number of FFs, which consumes the logic cells and wiring resources of the FPGA and deteriorates the mounting efficiency, and the maximum delay. There was a problem that power consumption increased.

An object of the present invention is to provide a technology for realizing a triple repair system of an FPGA while suppressing the consumption of the logic cells and wiring resources of the FPGA.

In order to solve the above problems, in the present invention, when power is turned on, logic circuit information held in an external storage medium is loaded into an internal configuration memory, a logic circuit is configured, and an operation is started. A programmable device having a dynamic partial reconfiguration function for reloading a part of logic circuit information from an external storage medium during operation, a triple logic circuit, and a large number of outputs of the triple logic circuit In each of the majority circuit that outputs an error signal that identifies a logic circuit that outputs a mismatch and the triple logic circuit, the input data of some sequential circuits is one of the other two Is output to the logic circuit as copy data, and the copy data from another logic circuit and the data generated by the own logic circuit are selected and input to the sequential circuit. A copy circuit configured as described above, and error control for executing partial reconfiguration by inputting the error signal and overwriting logic circuit information on the configuration memory of the logic circuit in which an error has occurred by the partial reconfiguration function After partial reconfiguration of the circuit and the logic circuit in which an error has occurred, the sequential circuit from the logic circuit that is operating normally to the logic circuit in which the error has occurred is changed to a multistage number of sequential circuits that are not connected to the copy circuit. A sequential circuit copy control circuit for executing control for copying by applying a plurality of corresponding copy cycles is provided.

In order to solve the above problems, according to the present invention, in the programmable device, the copy circuit selects input data or output data to some sequential circuits in each of the triple logic circuits. Output to one of the other two logic circuits as copy data, and select the copy data from the other logic circuit and the data generated by its own logic circuit and input to the sequential circuit. It is characterized by being.

In order to solve the above-described problem, in the present invention, in each of the triple logic circuits of the programmable device, the number of copy cycles corresponding to the multi-stage number of sequential circuits not connected to the copy circuit has an allowable value. In order not to exceed this, the copy circuit is connected to a sequential circuit in the middle of a sequence circuit sequence not connected to the multi-stage continuous copy circuit, thereby reducing the number of copy cycles required for copying all the sequential circuits. It is characterized by that.

In the programmable device of the present invention, in each of the triple logic circuits, a copy circuit is connected to a part of the sequential circuit, and a plurality of copy cycles corresponding to the number of stages of the sequential circuit not connected to the copy circuit is performed. By providing the sequential circuit update means for copying all the sequential circuits, it can be realized with fewer logic cells and wiring resources than the conventional method, so that the mounting efficiency of the FPGA is improved, and the maximum delay and the increase in power consumption are improved. Can be reduced.

In the first embodiment to which the present invention is applied, in the FPGA having a dynamic partial reconfiguration function, the logic circuit is duplicated and majority processing is performed, and the repair of the failed logic circuit by reloading the CRAM is performed. It is a block diagram of a repair system triple logic circuit configured to be able to copy data from another logic circuit to some FFs of the logic circuit. FIG. 3 is an equivalent logic diagram of the majority circuit in the first embodiment. 3 is a truth table of the majority circuit in the first embodiment. 3 is a process flowchart of an error control circuit according to the first exemplary embodiment. 3 is a flowchart of error processing of a triple logic circuit MA according to the first embodiment. 3 is a timing chart of error processing of the logic circuit MA1 according to the first embodiment. It is a classification | category figure of the type | mold of FF of a sequential circuit. 2 is a block diagram of a triple logic circuit MA and an FF copy control circuit (FFCOPY) in Embodiment 1. FIG. 2 is a configuration diagram of an FF copying circuit from a triple logic circuit MA0 to MA1 in Embodiment 1. FIG. 3 is a timing chart of FF copying from a triple logic circuit MA0 to MA1 in the first embodiment. It is an example of a timing chart of copying failure. It is an example of a timing chart of successful copying.

Hereinafter, embodiments will be described in detail with reference to the drawings.

FIG. 1 shows a first embodiment to which the present invention is applied. In an FPGA having a dynamic partial reconfiguration function, a logic circuit is tripled and majority processing is performed, and a failed logic circuit is reloaded into a CRAM. FIG. 3 is a block diagram of a repair-type triple logic circuit configured to be able to copy data from another logic circuit to a repair and a part of the FF of the repaired logic circuit.

The logic circuit information of the FPGA 1 is held in an external flash ROM (FR) 2. When the FPGA 1 is powered on, the logic circuit information is loaded into the CRAM 4, and the logic circuit of the FPGA 1 is determined and started.
The FPGA 1 includes a user logic circuit 3, a CRAM 4, and a CRAM access interface circuit (CRAM_ACC_IF) 5. The user logic circuit 3 includes three types of logic circuits MA, MB, and MC, each of which is tripled. MA is tripled into MA0 (10), MA1 (11), and MA2 (12), processes the input signal INA, and outputs 13, 14, and 15 are majority determined by the majority circuit V16 (V is an abbreviation for Voter). The output signal OUTA is processed, and the error signal 18 at the time of occurrence of the error is input to the error control circuit ERRNG40. The logic circuit MB is tripled into MB0 (20), MB1 (21), and MB2 (22), processes the input signal INB, and outputs 23, 24, and 25 are processed by the majority circuit V26 to output the output signal 27. Thus, the error signal 28 is input to the ERRNG 40. The logic circuit MC is tripled to MC0 (30), MC1 (31), MC2 (32), processes the signal 27, and outputs 33, 34, 35 are processed by the majority circuit V36 to become an output signal OUTC. The error signal 38 is input to the ERRNG 40.

ERRMNG 40, when detecting that there is an error in error signals 18, 28, 38, requests partial reconfiguration of the failed logic circuit to partial reconfiguration control circuit PTRCFG50 (41). CRAM 4 includes triple logic circuits MA0, MA1, MA2, MB0, MB1, MB2, MC0, MC1, MC2, and majority circuit V, error control circuit ERRMNG, partial reconfiguration control circuit PTRCFG, and FF copy control circuit FFCOPY. An area for storing logic circuit information is divided.

PTRCFG 50 designates the address area of FR2 and CRAM4 where the information of the failed logic circuit is stored in CRAM_ACC_IF5, and requests reloading from FR2 to CRAM4 (51). The CRAM_ACC_IF 5 outputs an address to the FR 2 in accordance with the request 51 (6), reads the logic circuit information (7), outputs the address and the logic circuit information to the CRAM 4 and performs overwriting (8). When the reloading is completed, the CRAM_ACC_IF 5 outputs an end signal 9 to the PTRCFG 50, and the PTFRFG 50 outputs an end signal 52 to the ERRNG 40. ERRMNG 40 requests the FF copy control circuit FFCOPY 60 to make an FF copy of the repaired logic circuit (42). The FFCOPY 60 executes FF copying of the failed logic circuit in accordance with the request 42. 61 is an MA copy control signal, 62 is an MB copy control signal, and 63 is an MC copy control signal. When copying is completed, the FFCOPY 60 outputs an end signal 64, and the ERRMNG 40 recognizes that the repair of the logic circuit that detected the error has been completed. If the repaired logic circuit is operating normally, the majority circuit error output should disappear. If an error is output from the same logic circuit, it is not a CRAM soft error but a logic circuit hardware failure is suspected. ERRMNG 40 confirms whether the error disappears after the repair, and if it does not disappear, outputs an error signal ERR to notify the system of the abnormality. The ERRMNG 40 may have a register or a memory for recording information on the occurrence of an error. As information to be stored, an identifier of a module in which an error has occurred, the number of times an error has occurred, an error occurrence timing, and the like can be considered.

FIG. 2 is an equivalent logic diagram of the majority circuit V in the first embodiment. The output signals of the triple logic circuit are input to vin0, vin1, and vin2, respectively. When the output signal has N bits, N circuits are connected for each bit. vout is a majority output signal, and err [1: 0] is an error signal.

FIG. 3 is a truth table of the majority circuit V in the first embodiment. The input signals vin0, vin1, and vin2 each take a value of 0 or 1, and there are 8 combinations. The majority output signal vout outputs the larger value of the three inputs. The error signal err [1: 0] is 00 (no error) when all three input signals match, and the input signal identification number that does not match when divided into 2: 1 (in the case of vin0, 01, in case of vin1) 10. When vin2, 11) is output.

FIG. 4 is a process flowchart of the error control circuit ERRNG 40 in the first embodiment. In process P1, the error signals of the majority circuits (V) 16, 26, and 36 are checked. If there is no error in the branch process S1, the process ends. If there is an error, the process proceeds to branch process S2, and if MA is an error, MA error process (P2) is executed. If MA is not an error, the process proceeds to branch process S3. If MB is an error, MB error process (P3) is executed. If the MB is not an error, MC error processing (P4) is executed. If a plurality of MAs, MBs, and MCs are in error, error processing is executed with a priority order of MA> MB> MC.

FIG. 5 is a flowchart of error processing of the triple logic circuit MA in the first embodiment. In process P20, the error signal 18 of the majority circuit (V) 16 is checked. If MA0 is an error in branch processing S20, MA0 is partially reconfigured in process P21, and FF of MA0 is copied from MA2 in process P22. If MA0 is not an error, the process proceeds to branch process S21. If MA1 is an error, MA1 is partially reconfigured in process P23, and FF of MA1 is copied from MA0 in process P24. If MA1 is not an error, MA2 is partially reconstructed in process P25, and the FF of MA2 is copied from MA1 in process P26.

FIG. 6 is a timing chart example of MA1 error processing in the first embodiment. It is assumed that the logic circuit information (CRAM) of MA0, MA1, and MA2 is normal in the cycle in which the clock clk is 1. Since the user logic circuits (MA0, MA1, MA2) operate normally and the inputs of the majority circuit (V) match, vout is normal and err is error free.
If a soft error occurs in the MA1 logic circuit information on the CRAM in the cycle where the clock clk is 4 and a failure occurs (information error), the MA1 logic circuit fails (function error) and malfunctions.
If the influence of the malfunction appears in the output with the clock clk being 7 cycles, the inputs of the majority circuit match MA0 and MA2, and MA1 does not match the others, so the outputs of MA0 and MA2 are set to normal values for vout. It is assumed that MA1 is in error and is output to err.
ERRMNG 40 requests PTRCFG 50 to reconfigure MA1 (clk = 10).
The PTFCFG 50 issues a request to the CRAM_ACC_IF 5 to load the logic circuit information of MA1 from the external flash ROM 2 into the CRAM 4. The time required for loading the logic circuit information (reconfiguration time) depends on the circuit scale of MA1, but it is assumed that 1200 clk is required in this embodiment.
When the loading is completed (clk = 1215), ERRMNG 40 requests the FFCOPY 60 from the FFCOPY 60, and the FFCOPY 60 executes the FF copy of the repaired logic circuit MA1 (clk = 1220). Since MA1 that was in a state failure (gate and wiring (circuit) corrected correctly, but FF value is incorrect) became normal, the majority circuit inputs matched and err was error free. .

When the clock clk is 1302 and a software error occurs in the MA2 logic circuit information on the CRAM and fails, the MA2 logic circuit fails and malfunctions. When the influence of malfunction appears in the output with the cycle of clk 1305, MA0 and MA1 match the inputs of the majority circuit, and MA2 does not match the others, so the outputs of MA0 and MA1 are regarded as normal values for vout. And that err is output that MA2 is an error. As in the case of MA1, MA2 is repaired by partial reconstruction and FF copying. As described above, the repair system triple prevents the two logic circuits from failing at the same time by repairing the failed logic circuit and restoring the triple.

Before describing the partial copying of the FF, which is a feature of the present invention, the type of the FF that is a sequential circuit will be described with reference to FIG.
(1) The free-run counter is an N-bit FF with a reset input (rst) and is initialized to all 0s by rst. When rst is released, the free-run counter is incremented by 1 every time the clock clk is input. The free-run counter adds 1 to the output data q by an incrementer to obtain FF input data d. The output data q forms a feedback loop for determining the input data d, and FF copying is essential to update the FF.
(2) In the state machine, the next state d is determined in the combinational circuit C by the output data q of the FF which is the current state and the input i. In the state machine, the output data q of the FF forms a feedback loop that determines the input data d, and FF copying is essential to update the FF.
(3) The non-enable register is a temporary storage circuit for data that does not form a feedback loop. The input data d of the FF becomes output data q with a delay of one clock cycle. In this type, the output data q of the FF does not affect the input data d, and if d becomes normal, q becomes normal in the next cycle, so the necessity for FF copying is low. However, when this type of FF is connected in multiple stages, a cycle corresponding to the number of FF stages is required from when the input of the first stage FF becomes normal until the output of the final stage FF becomes normal. You have to consider that.
(4) In the register with enable, the input data d when the enable en is 1 becomes the output data q with a delay of 1 clock. In this type, the output data q of the FF does not affect the input data d, but q is not updated unless enable en becomes 1 even if d becomes normal. The need for FF copying depends on the frequency of en. The need for FF copying is low if the frequency at which en becomes 1 is high, but the need is high if the frequency is low.

In the present invention, (1) the free-run counter and (2) the state machine require FF copying, and the registers (3) and (4) may be written with a normal input d within an allowable cycle time. Copy only at low points. A part of the FFs of the logic circuit are copied to normalize, and the other FFs wait until the input becomes normal as the cycle progresses and is written and normalized.

FIG. 8 is a block diagram of the triple logic circuit MA and the FF copy control circuit (FFCOPY) in the first embodiment. In the logic circuits MA0 (10), MA1 (11), and MA2 (12), F is a register without enable and FE is a register with enable. C is a combinational circuit. In this embodiment, the first and fourth FFs are copied and the second and third FFs are not copied. 70 is copy data from MA0 to MA1, 71 is copy data from MA1 to MA2, and 72 is copy data from MA2 to MA0. The FFCOPY 60 executes the FF copy of the failed logic circuit in accordance with the FF copy request 42 from the error control circuit ERRMNG 40. Reference numeral 610 denotes FF copy control of MA0, 611 denotes FF copy control of MA1, and 612 denotes FF copy control of MA2. The MA copy control signal 61 in FIG. 1 is a bundle of three

signals

610, 611 and 612. The FFCOPY 60 has a copy cycle setting information storage unit CPCYC 65, and executes copying according to the stored information (cycle). The CPCYC65 stored information may be a constant or a variable (register setting). When FFCOPY 60 executes FF copying, it outputs an end signal 64 to ERRNG 40.

FIG. 9 is a configuration diagram of the FF copying circuit from the triple logic circuit MA0 to MA1 in the first embodiment. In MA0 (10), the outputs d101 and en102 of the combinational circuit 100 are the input data and enable of the FF (FE) 107 with enable before the copying circuit is added. ma2_ff_out72 is copy data from MA2 (not shown). copy_ff_ma0 (610) is an FF copy control signal of MA0. The multiplexer MUX 103 generates the input data d_mux 104 of the FE 107. When copy_ff_ma0 (610) is 0, d101 is selected, and when it is 1, ma2_ff_out72 is selected. The logical sum circuit 105 generates the enable 106 of the FE 107 (logical sum of en102 and copy_ff_ma0 (610)). The multiplexer MUX 109 generates copy data ma0_ff_out70 from MA0 to MA1. When en102 is 0, the output data q108 of the FE 107 is selected, and when it is 1, d101 is selected. The internal configuration of MA1 is the same as MA0.

When FF copying from MA0 to MA1 is executed, copy_ff_ma0 = 0 and copy_ff_ma1 = 1. In MA0, the input data d_mux 104 = d101 of the FE 107 and the enable 106 = en102 are obtained, and the normal operation is performed. Further, ma0_ff_out70 becomes FE output data q108 when en102 is 0, and becomes d101 when en102 is 1, and becomes data held by the FE 107 in the next cycle. In MA1, FE117 input data d_mux 114 = ma0_ff_out70 and enable 116 = (en112 | copy_ff_ma1) = 1, which coincides with the data held in FE 107 of MA0 in the next cycle.

FIG. 10 is a timing chart of FF copying from the triple logic circuit MA0 to MA1 in the first embodiment. Assume that FF is a 4-bit enabled register. The FF input data d, the FF output data q, and the FF copy data ma0_ff_out are expressed as 4-bit binary numbers. In a cycle where clk is 1, the FF input data d, enable en, and output data q do not match between MA0 and MA1. The FF copy control signal copy_ff_ma1 from MA0 to MA1 is asserted in a cycle in which clk is 2. Since en is 1 in MA0, the FF copy data ma0_ff_out is input data d = 0101, data 0101 is written in the FFs of MA0 and MA1, and the output data q of the FF matches MA0 and MA1 in the cycle of clk 3. .

The necessity of multi-cycle copying will be described with reference to FIG. 11 and FIG. FIG. 11 is a timing chart of copying failure due to one-cycle copying. The logic circuit has a configuration in which the same four-stage FFs as in FIG. 8 are connected, and shows the signal of the copy destination FF. Assume that the input and output of four FFs are incorrect in the cycle of clk = 1. In the first stage FF with enable, enable en1 is not asserted in the 6 cycles shown in the figure. The second and third stages are FFs without enable. In the fourth stage FF with enable, enable en4 is asserted in a cycle in which clk is 1 and 4. When the FF copy control signal ff_copy is asserted in a cycle in which clk is 2, copying is performed to the first-stage and fourth-stage enabled FFs in a cycle in which clk is 3, and the output data q1 of the first-stage FF in the cycle of 3 The output data q4 of the fourth stage FF becomes correct. In this cycle, the output data q2 and q3 of the second and third stage non-enabled FFs are incorrect. q2 is correct when clk is 4 and q3 is correct when clk is 5. However, the enable en4 of the fourth-stage enabled FF is asserted in the cycle where clk is 4, and d4 generated by the erroneous output data q3 of the third-stage FF is written, so that the cycle where clk is 5 Thus, q4 becomes incorrect data. This is called copying failure. In such a configuration in which FFs are connected in multiple stages, if there is an FF that does not copy before (input-side connection), even if the FF itself has been copied and the output is correct, the subsequent input data is not It turns out that a cycle is required to be correct.

FIG. 12 is a timing chart of successful copying by multiple cycle copying. Since there are two FFs that do not perform FF copying before the fourth stage FF with enable, the arrival of correct data is delayed by two cycles. Therefore, FF copying is performed in 3 cycles with 2 cycles added. By doing so, it becomes possible to copy only a part of the FFs and normalize the entire FFs.

The logic circuits MA0 (10), MA1 (11), and MA2 (12) in FIG. 8 copied only the FF (FE) with enable and did not copy the FF (F) without enable. FF copying may be effective. In the case of a logic circuit in which FFs with no enable are connected in multiple stages, a copy cycle until the entire FF is made normal can be shortened by configuring the FF in the middle to be copied. For example, when 100 stages of FFs are connected, if copying is not performed at all, 100 cycles are required until correct data is output from the 100th stage of FFs. Halve to 51 cycles. Thus, an embodiment in which the non-enable FF is copied is also conceivable.

In FIG. 1, an embodiment in which ERRNGG40, PTFCFG50, and FFCOPY60 are doubled and the respective output signals are compared to detect a failure is also conceivable. Since ERRMNG 40, PTFCFG 50, and FFCOPY 60 are also made of FPGA user logic circuits, there is a possibility that the logic circuits may fail due to CRAM soft errors.

When one of the duplicated logic circuits is the main logic circuit and the other is the auxiliary logic circuit, the outputs of both logic circuits are compared, and if they match, the output of the main logic circuit is used. If an error occurs, both logic circuits can be partially reconfigured and restarted by initialization. Since all of ERRMNG40, PTRCFG50, and FFCOPY60 are not large in circuit scale, the time required for partial reconfiguration is not large. Therefore, when a failure is detected in these circuits, these functions are stopped, and partial reconfiguration is performed. Let it resume.

1 FPGA
2 Flash ROM
3 User logic circuit inside the FPGA 4 Configuration RAM inside the FPGA
5 FPGA internal CRAM

access interface circuit

10, 11, 12 Triple logic circuit MA
20, 21, 22 Triple logic circuit MB
30, 31, 32 Triple logic circuit MC16, 26, 36 Majority circuit 40 Error control circuit 50 Partial reconfiguration control circuit 60 FF copy control circuit 65 Copy cycle setting information storage unit

Claims

When the power is turned on, the logic circuit information held in the external storage medium is loaded into the internal configuration memory, the logic circuit is configured to start operation, and part of the logic circuit information is externally output during operation. In a programmable device having a dynamic partial reconfiguration function of reloading from a storage medium of
A triple logic circuit;
A majority voting circuit that outputs a large number of outputs of the tripled logic circuit and outputs an error signal that identifies the logic circuit whose output does not match;
In each of the triple logic circuits, the input data of some sequential circuits are output as copy data to one of the other two logic circuits, and the copy data from other logic circuits and its own logic circuit A copying circuit configured to select and input the data generated in step S to the sequential circuit;
An error control circuit that inputs the error signal and executes partial reconfiguration that overwrites logic circuit information on the configuration memory of the logic circuit that has generated an error by the partial reconfiguration function;
After partial reconfiguration of the logic circuit in which an error has occurred, a plurality of sequential circuits from a logic circuit that is operating normally to the logic circuit in which an error has occurred, in accordance with the number of stages in the sequential circuit not connected to the copy circuit A programmable device comprising a sequential circuit copy control circuit for executing a copy control by applying a copy cycle.
In each of the triple logic circuits, the copy circuit selects input data to some sequential circuits or output data and outputs it as copy data to one of the other two logic circuits. 2. The programmable device according to claim 1, wherein copy data from another logic circuit and data generated by its own logic circuit are selected and input to the sequential circuit.
In each of the triple logic circuits, in order to prevent the number of copying cycles corresponding to the number of multi-stage sequential circuits not connected to the copying circuit from exceeding an allowable value, the copying circuits connected in multiple stages are connected. 2. The programmable device according to claim 1, wherein the copy circuit is connected to a sequential circuit in the middle of a sequence of sequential circuits to reduce the number of copy cycles required for copying all the sequential circuits.
The programmable device of claim 1, wherein
The sequential circuit copy control circuit has a storage unit for presetting the number of cycles for copying the sequential circuit, and reads out the number of copy cycles from the storage unit and performs control for copying all the sequential circuits. A programmable device.
The programmable device of claim 1, wherein
The error control circuit further monitors the error output of the majority circuit after the sequential circuit copy control circuit completes copying, and if the error does not disappear, considers that repair has not been completed and outputs an abnormality signal to the outside. A programmable device characterized by output.
The programmable device of claim 1, wherein
2. A programmable device according to claim 1, wherein a sequential circuit for performing copying included in each of the triple logic circuits is limited to a sequential circuit forming a feedback loop.
The programmable device of claim 1, wherein
The error control circuit and the sequential circuit duplication control circuit are respectively duplicated, and when the output signals of both the duplicated circuits are compared and a mismatch is detected, a failure is detected, and the failure is detected by these circuits. A programmable device characterized in that when it is done, these circuits are stopped and both circuits are partially reconfigured to resume operation.
The programmable device of claim 1, wherein
The error control circuit includes a storage unit that stores an identifier of a module in which an error has occurred, the number of occurrences of an error, and the timing of occurrence of an error, and is programmable from the outside.