Safe double buffering using DMA safe linked lists

In some embodiments, a DMA controller includes a set of transaction control registers configured to receive a linked list sequence of transaction control sets. The transaction control sets collectively describe a data transfer by which the DMA controller is to move data from a peripheral alternatingly to a first memory buffer and a second memory buffer, wherein the first and second memory buffers are arranged in parallel with one another at an interface of the peripheral. The DMA controller is configured to transfer a first set of data from the peripheral to the first memory buffer according to a first transaction control set in the linked list sequence, and is configured to subsequently transfer a second set of data from the peripheral to the second buffer according to a second transaction control set in the linked list sequence.

BACKGROUND

For safety related applications, it is important to ensure microcontrollers correctly execute their intended functionality in all phases of the application. The execution assumes correctness of both hardware and software components with respect to their specification and fault-free execution of this functionality. In general, safety related applications are built using special measures to avoid systematic faults and to detect and react to possible random hardware faults during execution of the application.

DETAILED DESCRIPTION

The description herein is made with reference to the drawings, wherein like reference numerals are generally utilized to refer to like elements throughout, and wherein the various structures are not necessarily drawn to scale. In the following description, for purposes of explanation, numerous specific details are set forth in order to facilitate understanding. It may be evident, however, to one of ordinary skill in the art, that one or more aspects described herein may be practiced with a lesser degree of these specific details. In other instances, known structures and devices are shown in block diagram form to facilitate understanding.

Further, it will be appreciated that the terms “first”, “second”, “third”, and the like, are merely generic identifiers and do not suggest temporal, spatial, or other relationships between various elements. Also, the terms may be switched between various embodiments, such that a “first” memory buffer in one embodiment can correspond to a “second” memory buffer in another embodiment, and so on.

FIG. 1illustrates an example of a safety system100that includes a microprocessor102, actuator104, and sensor106. The microprocessor102includes a processing unit108, first and second sensor memory buffers110,112, and first and second actuator memory buffers114,116. A feedback path118couples an output terminal120through the sensor106back to a first input terminal122of comparator or adder123.

During operation, the actuator104is expected to promote a movement or control operation at the output terminal120. Ideally, the movement or control operation at the output terminal120exactly tracks a reference input signal provided at a second input terminal122of adder123, such that an error signal124, which represents a difference between the reference input signal and observed samples from the sensor106, is zero. Thus, so long as the movement or control operation at the output terminal120remains in line with the reference input signal at the second input terminal122, the output of the actuator104remains constant and the observed samples from the sensor106match the reference input signal.

However, when the observed samples deviate from the reference input signal, for example due to a disturbance126or due to a change in the reference input signal at the second input terminal122, the error signal124becomes non-zero. Based on this non-zero error signal, the microprocessor102provides control samples that tend to “tune” the output of the actuator104until the output on the output terminal120again matches the reference input signal. For example, if the frequency of the output signal is lower than dictated by the reference input signal (e.g., due to disturbance126or a recent change in the input reference signal), then the error signal124can induce an increase in the frequency of the output signal until the frequency of the output signal is as dictated by the reference input signal. Conversely, if the frequency of the output signal is higher than dictated by reference input signal, the error signal124can induce a decrease in the frequency of the output signal.

However,FIG. 1's system is less than optimal in that the processing unit108is required to manage the memory buffers110-116in on-going fashion, which uses system resources that could otherwise be devoted to other tasks. If the memory buffers are made “deeper”, the amount of time between which the processing unit108can unload the buffers is increased, but processor overhead is required nonetheless. Moreover, though deeper buffers can extend the time before which the memory buffers can be unloaded, the fact the memory buffers are deeper also means that when data is eventually moved, the actual act of moving the data will take longer than if shallower memory buffers were used. Also, if the microprocessor102is overloaded, there is perhaps some chance that an observed sample or control sample could be missed. This chance leaves open the possibility that a dangerous condition could perhaps be missed, and the safety system100does not provide suitable safeguards against such a situation. Thus,FIG. 1's safety system100is less than ideal for several reasons.

Accordingly, aspects of the present disclosure provide for double-buffer systems and techniques using Direct Memory Access (DMA) safe linked lists. In some embodiments, a DMA controller includes a set of transaction control registers configured to receive a linked list sequence of transaction control sets. The transaction control sets collectively describe a data transfer by which the DMA controller is to move data from a peripheral alternatingly to a first memory buffer and a second memory buffer, wherein the first and second memory buffers are arranged in parallel with one another at an interface of the peripheral. The DMA controller is configured to transfer a first portion of the data from the peripheral to the first memory buffer according to a first transaction control set in the linked list sequence, and is configured to subsequently transfer a second portion of the data from the peripheral to the second buffer according to a second transaction control set in the linked list sequence. In some embodiments, a third transaction control set, which is between the first and second transaction control sets, can check that the first transaction control set executed properly. If the first transaction control set is determined to not have executed properly, the DMA controller halts execution of the sequence prior to the execution of the second transaction control set in the sequence. Thus, in addition to the DMA controller overtaking management of the first and second buffers to free up resources of the processing unit for other tasks, the DMA controller can also provide enhanced safeguards that limit the chances a dangerous condition is missed.

FIG. 2illustrates a safety system200in accordance with some embodiments. The safety system200includes a microprocessor202—which is made up of a first and second source memory buffers (204,206), a processing unit208, and first and second destination memory buffers (210,212). A source peripheral216, a destination peripheral218, an input/output (I/O) module220, and an interrupt controller222, among other peripherals (not shown), may also be coupled to the microprocessor202via a system bus214. In some embodiments, the source peripheral216may manifest as a sensor and the destination peripheral218may manifest as an actuator, and the microprocessor202can receive and analyze samples from the sensor via the first and second source memory buffers (204,206) and generate and transmit a control signal for the actuator via the first and second destination memory buffers (210,212) to keep control of the actuator in line with a reference signal, analogous to described inFIG. 1.

Each of the memory buffers (204,206,210,212) is implemented as a separate memory element, such as a shift register, first-in-first-out (FIFO) memory, last-in-first-out (LIFO) memory, random access memory, or other memory storage device. Each of the source memory buffers (204,206) and destination memory buffers (210,212) can transfer data between the processing unit208and one or more peripherals (e.g.,216,218,220) via the system bus214. For example, the first and second source memory buffers (204,206) are arranged in parallel with one another, and can receive observed data samples from the source peripheral216via the system bus214, and can then transfer the observed data samples to the processing unit208via the system bus214or via a first internal microprocessor bus215. The first and second destination memory buffers (210,212), which are also arranged in parallel with one another, can receive control samples from the processing unit208via the system bus214or via a second internal microprocessor bus217, and can then transmit the control samples to the destination peripheral218via the system bus214.

To effectuate efficient data transfer between any of the peripherals and memory buffers, a DMA controller224is included. The DMA controller224includes a set of transaction control set (TCS) registers226. The set of TCS registers226includes a control field229, source address field230, destination address field232, and size field234that describe how one or more blocks of data are to be transferred by the DMA controller224. Based on the information in the set of TCS registers226, the DMA controller224can retrieve one or more sequences of TCSs from memory228, wherein a sequence of TCSs is arranged in a linked list structure.

InFIG. 2's example, a first TCS sequence236collectively describes a first data transfer by which the DMA controller224moves data from the source peripheral216to the first and second source memory buffers (204,206); and a second TCS sequence238collectively describes a second data transfer by which the DMA controller224moves data from the first and second destination memory buffers (210,212) to the destination peripheral218. ThoughFIG. 2's example shows the first and second TCS sequences (236,238) each containing four TCSs or four “links”, where each link points to the next successive link in the sequence, it will be appreciated that any number of TCSs or “links” can be included in such a sequence. A more detailed description of how the first TCS sequence236and the second TCS sequence238operate is now described.

In the first TCS sequence236, each TCS stored in memory228specifies control information, a source address, a destination address, and a size regarding one or more blocks of data to be transferred by the DMA controller224. A DMA operation for the first TCS sequence236starts when the processing unit208loads the set of TCS registers226with the first source TCS240of the first TCS sequence236and/or points the DMA controller224to the memory address where the first source TCS240is stored. InFIG. 2's example, the first source TCS240has a source address that points to the source peripheral216, a destination address that points to the first source memory buffer204, and a size equal to a size of the first source memory buffer204. Thus, the DMA controller224will transfer the size of data from the specified source address (e.g., source peripheral216) to the specified destination address (e.g., first source memory buffer204) without intervention of the processing unit208. Accordingly, upon loading the first source TCS240, the DMA controller224monitors the source peripheral216and when the source peripheral216has data that is ready, the DMA controller224reads the data and writes the data to the first source memory buffer204without intervention from the processing unit208. In some instances where the size specified in the first source TCS240is the same as that of the first source memory buffer204, the DMA controller224moves successive words of data from the source peripheral216to the first source memory buffer204until the first source memory buffer204is full. When the DMA controller224is finished moving the data as specified in the first source TCS240, the DMA controller224identifies the location of the second source TCS242, wherein the memory address of the second source TCS242is specified in the first source TCS240.

In some cases, the second source TCS242can check that the first source TCS240executed properly. If the second source TCS determines that an error occurred during execution of the first source TCS240, then the DMA controller224asserts an interrupt so the processing unit208can take appropriate remedial action. On the other hand, if the second source TCS242confirms that the first source TCS240executed properly, then the DMA controller224identifies the location of the third source TCS244, wherein the location of the third source TCS244is specified in the second source TCS242.

When the first source TCS240has executed properly (and the second source TCS242verifies proper execution), the first source memory buffer204is full. The illustrated first TCS sequence236anticipates this, and as such the third source TCS244specifies that when the source peripheral216has subsequent data that is ready to be read, the subsequent data is read from the source peripheral216and written to the second source memory buffer206. Thus, more particularly, the DMA controller224loads the third source TCS244, thereby identifying a source address (here the source peripheral216), a destination address (here the second source memory buffer206), and a data size (here the size of the second source memory buffer206). The DMA controller224again monitors the source peripheral216. When the source peripheral216has data that is ready, the DMA controller224reads the data and writes it to the second source memory buffer206without intervention from the processing unit208. While the DMA controller224is moving data from the source peripheral216to the second source memory buffer206, the processing unit208can be reading and analyzing data from the first source memory buffer204. During this time, the processing unit208can also be sending control samples to the destination peripheral218via the first and second destination memory buffers210,212, wherein the control samples are based on the analyzed data from the first source memory buffer204. In some instances where the size specified in the third source TCS244is the same as that of the second source memory buffer206, the DMA controller224moves successive words of data from the source peripheral216to the second source memory buffer206until the second source memory buffer206is full. When the DMA controller224is finished moving the data as specified in the third source TCS244, the DMA controller224identifies the location of the fourth source TCS246, wherein the location of the fourth source TCS246is specified in the third source TCS244.

In some cases, the fourth source TCS246can check that the third source TCS244executed properly. If the fourth source TCS246confirms that the third source TCS244executed properly, then the DMA controller224identifies the location of the next source TCS (not shown), if any. InFIG. 2's example, the fourth source TCS246is the last “link” in the first TCS sequence236, and the control information in the fourth source TCS246indicates this, and as such the DMA controller224can flag a first interrupt to notify the system the data movement task specified by the first TCS sequence236is complete. Also, if the fourth source TCS246determines that an error occurred during execution of the third source TCS244, then the DMA controller224asserts a second interrupt so the processing unit208can take appropriate remedial action. These interrupts may be separate and/or have different priority levels to notify the system whether the DMA controller224finished in a valid state or an error state; or alternatively only a single interrupt can be asserted but different status values can be present in a status register of the DMA controller224to indicate whether an error state occurred or data transfer ended without an error, and the microprocessor202determines this by reading the status register of the DMA controller224.

Although the first TCS sequence236has been illustrated and described above as containing four source TCSs (240-246), it will be appreciated that in many cases much more than four source TCSs can be included in the first TCS sequence236. In many cases, each successive source TCS in the first TCS sequence236reads data from the source peripheral216, but successive source TCSs alternate between writing data to the first source memory buffer204and the second source memory buffer206. In this way, while the DMA controller224is writing data to one source memory buffer (e.g.,204), the other source memory buffer (e.g.,206) is frozen and/or read from by processing unit208. For the next source TCS in the sequence, the DMA controller224writes data to the other source memory buffer (e.g.,206) while the one source memory buffer (e.g.,204) is frozen and/or read from by the processing unit208. In this way, a sequence of TCSs, which are arranged as a linked list, can continuously transfer data from the source peripheral216to dual source memory buffers204,206in alternating fashion. In other embodiments, more than two source memory buffers can be present, and successive TCSs or links can write to the source memory buffers in round-robin fashion. For example, a first TCS writes data to first source memory buffer until the first source memory is full, then a second TCS writes data to a second source memory buffer until the second source memory is full, then a third TCS writes data to a third source memory buffer until the third source memory is full, and so on. Intervening TCSs can again verify correct execution of the previous TCS before executing a data transfer specified in a subsequent TCS. Similar functionality for destination memory buffers.

FIG. 3shows a more detailed example of some embodiments of how the DMA controller224ofFIG. 2can load data into the first and second source memory buffers204,206during operation. The upper portion ofFIG. 3illustrates how samples are stored and emptied from the first source memory buffer204and second source memory buffer206over time, while the lower portion ofFIG. 3illustrates a corresponding timing diagram.

At time T0, the source peripheral216has a first sample that is ready. To prepare to move the first sample from the source peripheral216, the DMA controller224loads a first source TCS240(301) into its set of TCS registers. InFIG. 3's example, the first source TCS240specifies a source address of the source peripheral216, a destination address of the first source memory buffer204, and a data size of four samples (e.g., four words, which corresponds to the size of the first source memory buffer in this example). Of course, in other embodiments the first source memory buffer204is often much larger than 4 words, for example on the order of hundreds of bytes, thousands of bytes, millions of bytes, and so on; but four samples/words is illustrated herein for clarity of understanding.

At time T1, the DMA controller224moves the first sample from the source peripheral216to the first source memory buffer204. With each sample that is moved, the DMA controller224keeps track of the total data size that has been moved for the first source TCS240. Thus, at time T1, one sample has been moved and the data size of four samples to be moved has not yet been reached.

At time T2, after the source peripheral216has a second sample that is ready, the DMA controller224moves the second sample to the first source memory buffer204. Thus, at time T2, two samples have been moved and the data size of four samples to be moved has not yet been reached.

At time T3, after the source peripheral216has a third sample that is ready, the DMA controller224moves the third sample to the first source memory buffer204. Thus, at time T3, three samples have been moved and the data size of four samples to be moved has not yet been reached.

At time T4, after the source peripheral216has a fourth sample that is ready, the DMA controller224moves the fourth sample to the first source memory buffer204. At this time, the DMA controller224determines that the data size of 4 samples has been moved, as dictated by the first source TCS240. Therefore, the DMA controller224can assert an interrupt302at time T4to notify the processing unit208that the first source memory buffer204is full, and the processing unit208can analyze the samples stored in the source memory buffer204.

At time T5, the processing unit208freezes (304) the first source memory buffer204, and also begins to analyze (306) the data samples stored in the first source memory buffer204. The DMA controller224can also now identify, based on the control information in the first source TCS240, whether the sequence of TCSs includes a second TCS. In this example, a second source TCS242is included in the sequence (and is pointed to by the first source TCS240), and so the DMA controller224loads the second source TCS242(308). InFIG. 3's example, the second source TCS242specifies a source address of the source peripheral216and a destination address of the second source memory buffer206. The second source memory buffer206has a buffer size of 4 samples and the data size specified in the second source TCS242is also four samples.

At time T6, the DMA controller224moves the fifth sample from the source peripheral216to the second source memory buffer206. With each sample that is moved, the DMA controller224again keeps track of the total data size that has been moved for the second source TCS242. Thus, at time T6, one sample has been moved for the second source TCS242and the data size of four samples to be moved has not yet been reached. The processing unit208continues to analyze (306) the samples in the first source memory buffer204during time T6.

At time T7, after the source peripheral216has a sixth sample that is ready, the DMA controller224moves the sixth sample to the second source memory buffer206. Thus, at time T7, two samples have been moved for the second source TCS242and the data size of four samples to be moved has not yet been reached.

At time T8the processing unit208has now completed analysis of the samples in the first source memory buffer204. Accordingly, the processing unit208sets up (310) the first source memory buffer204for another set of data to be received, for example, by clearing the samples stored in the first source memory buffer204.

At time T9, after the source peripheral216has a seventh sample that is ready, the DMA controller224moves the seventh sample to the second source memory buffer206. Thus, at time T9, three samples have been moved for the second source TCS242and the data size of four samples to be moved has not yet been reached. Thus, even though the first source memory buffer204is again available to be written to, the DMA controller224continues to write data samples to the second source memory buffer206.

At time T10, after the source peripheral216has a fourth sample that is ready, the DMA controller224moves the fourth sample to the second source memory buffer206(not shown). At this time, the DMA controller224determines that the data size of 4 samples has been moved to the second source memory buffer206, as dictated by the second source TCS242. Therefore, the DMA controller224can assert an interrupt (312) at time T11to notify the processing unit208that the second source memory buffer206is full. The DMA controller224can again determine if another source TCS is present in the sequence or if the second source TCS242was the last link in the sequence; and continue to write data as specified in the source TCSs and alternately write data between the first and second source memory buffers (204,206). For example, a third source TCS244can then transfer data from the source peripheral216to the first source memory buffer204; and subsequently a fourth source TCS can transfer data from the source peripheral to the second source memory buffer206, as previously described inFIG. 2.

Turning now toFIGS. 4-5, one can see additional depictions of some embodiments of a safety system400in accordance with the present disclosure. Briefly,FIG. 4shows the safety system400as a DMA controller424moves data from a source peripheral416to first and second source memory buffers404,406using a first TCS sequence436; whileFIG. 5shows the safety system400as the DMA controller424moves data from first and second destination memory buffers410,412to a destination peripheral418using a second TCS sequence438.

InFIGS. 4-5, the DMA controller424includes an integrity checking module450, bus controller452, and transaction control set (TCS) registers454. As will be appreciated in greater detail herein, a DMA operation can start when the processing unit408loads TCS registers454with a first transaction control set (TCS) of a linked list structure. This first TCS specifies a source address, destination address, size, and control information regarding one or more blocks of data to be transferred within memory428, as well as an address of the next link, if any, in the TCS sequence.

InFIG. 4, the first source TCS440is written to the TCS registers454(see numeral 1), and the bus controller452then carries out the data transfer specified by the first source TCS440, for example, by reading one or more words of data from the source peripheral416(see numeral 2), and writing those words to the first source buffer404(see numeral 3). As each word is transferred, the integrity checking module450calculates an actual cyclic redundancy checksum. This actual cyclic redundancy checksum can take the form of an actual address cyclic redundancy checksum (stored in actual address CRC register464), which is based on the memory addresses actually accessed by the DMA controller424while executing the first source TCS440. The actual cyclic redundancy checksum can also take the form of an actual data cyclic redundancy checksum (stored in actual data CRC register466), which is based on the data actually transferred by the DMA controller424while executing the first source TCS440.

After data specified by the first source TCS440has been transferred, the DMA controller424identifies the second source TCS442(see numeral 4), based on a pointer field468contained in the first source TCS440. The DMA controller424then loads the second source TCS442. The second source TCS442defines a safe linked list operation that verifies that the first source TCS440executed properly. In particular, the second source TCS442includes an expected cyclic redundancy checksum470; and thus, logic472in the DMA controller424can compare the expected cyclic redundancy checksum470to the actual cyclic redundancy checksum (e.g., stored in464or466) calculated for the first source TCS440. If the actual cyclic redundancy checksum(s) stored in464/466is different from the expected cyclic redundancy checksum(s) in470, the DMA controller424halts data transfers and flags an error (e.g., an interrupt IRQ) to limit damage. If no error is detected, the DMA controller424identifies the next source TCS in the first TCS sequence436(see numeral 5) without flagging an interrupt so the processing unit408can continue with other tasks un-interrupted. Thus, by comparing the actual and expected cyclic redundancy checksums and putting adequate safeguards in place, the DMA controller424helps to ensure that the DMA has read data from the correct source address and written data to the correct destination addresses.

The third source TCS444is then written to the TCS registers454, and the bus controller452carries out the data transfer specified by the third source TCS444, for example, by reading one or more words of data from the source peripheral416(see numeral 6), and writing those words to the second source buffer406(see numeral 7). The first source buffer404is typically full at this point, and as such is frozen and/or being read from by the processing unit408. As each word is transferred from the source peripheral416to the second source buffer406, the integrity checking module450calculates an actual cyclic redundancy checksum. This actual cyclic redundancy checksum can take the form of an actual address cyclic redundancy checksum (stored in actual address CRC register464), which is based on the memory addresses actually accessed by the DMA controller424while executing the third source TCS444. The actual cyclic redundancy checksum can also take the form of an actual data cyclic redundancy checksum (stored in actual data CRC register466), which is based on the data actually transferred by the DMA controller424while executing the third source TCS444.

After data specified by the third source TCS444has been transferred, the DMA controller424identifies the fourth source TCS446(see numeral 8), based on a pointer field contained in the third source TCS444. The DMA controller424then loads the fourth source TCS446. The fourth source TCS446defines a safe linked list operation that verifies that the third source TCS444executed properly. In particular, the fourth source TCS446includes an expected cyclic redundancy checksum471; and thus, logic472in the DMA controller424can compare the expected cyclic redundancy checksum471to the actual cyclic redundancy checksum (e.g., stored in464or466) calculated for the third source TCS444. If the actual cyclic redundancy checksum(s) stored in464/466is different from the expected cyclic redundancy checksum(s) in471, the DMA controller424halts data transfers and flags an error (e.g., an interrupt IRQ) to limit damage. If no error is detected, the DMA controller424identifies the next source TCS, if any, in the first TCS sequence436. Thus, by comparing the actual and expected cyclic redundancy checksums and putting adequate safeguards in place, the DMA controller424helps to ensure data has been moved accurately. When the last source TCS in the first sequence is reached, the DMA controller424can assert an interrupt to notify the processing unit the specified data transfer is complete.

InFIG. 5, the first destination TCS441is written to the TCS registers454(see numeral 1), and the bus controller452then carries out the data transfer specified by the first destination TCS441, for example, by reading one or more words of data from the destination buffer410(see numeral 2), and writing those words to the destination peripheral418(see numeral 3). As each word is transferred, the integrity checking module450calculates an actual cyclic redundancy checksum. This actual cyclic redundancy checksum can take the form of an actual address cyclic redundancy checksum (stored in actual address CRC register464), which is based on the memory addresses actually accessed by the DMA controller424while executing the first destination TCS441. The actual cyclic redundancy checksum can also take the form of an actual data cyclic redundancy checksum (stored in actual data CRC register466), which is based on the data actually transferred by the DMA controller424while executing the first destination TCS441.

After data specified by the first destination TCS441has been transferred, the DMA controller424identifies the second destination TCS443(see numeral 4), based on a pointer field contained in the first destination TCS441. The DMA controller424then loads the second destination TCS443. The destination second TCS443defines a safe linked list operation that verifies that the first destination TCS441executed properly. In particular, the second destination TCS443includes an expected cyclic redundancy checksum473; and thus, logic472in the DMA controller424can compare the expected cyclic redundancy checksum473to the actual cyclic redundancy checksum (e.g., stored in464or466) calculated for the first destination TCS441. If the actual cyclic redundancy checksum(s) stored in464/466is different from the expected cyclic redundancy checksum(s) in473, the DMA controller424halts data transfers and flags an error (e.g., an interrupt IRQ) to limit damage. If no error is detected, the DMA controller424identifies the next TCS in the second TCS sequence438(see numeral 5) without flagging an interrupt so the processing unit408can continue with other tasks un-interrupted. For example, the processing unit can continue analyzing data in the first and/or second source buffers404,406, and/or can be writing control samples to the second destination buffer412which is frozen. Thus, by comparing the actual and expected cyclic redundancy checksums and putting adequate safeguards in place, the DMA controller424helps to ensure data has been moved accurately.

The third destination TCS445is then written to the TCS registers454, and the bus controller452carries out the data transfer specified by the third destination TCS445, for example, by reading one or more words of data from the second destination buffer412(see numeral 6), and writing those words to the destination peripheral418(see numeral 7). The first destination buffer404has been fully read or emptied at this point, and as such is frozen and/or being re-filled by the processing unit408. As each word is transferred from the second destination buffer412to the destination peripheral418, the integrity checking module450calculates an actual cyclic redundancy checksum. This actual cyclic redundancy checksum can take the form of an actual address cyclic redundancy checksum (stored in actual address CRC register464), which is based on the memory addresses actually accessed by the DMA controller424while executing the third destination TCS445. The actual cyclic redundancy checksum can also take the form of an actual data cyclic redundancy checksum (stored in actual data CRC register466), which is based on the data actually transferred by the DMA controller424while executing the third destination TCS445.

After data specified by the third destination TCS445has been transferred, the DMA controller424identifies the fourth destination TCS447(see numeral 8), based on a pointer field contained in the third destination TCS445. The DMA controller424then loads the fourth destination TCS447. The fourth destination TCS447defines a safe linked list operation that verifies that the third destination TCS445executed properly. In particular, the fourth destination TCS447includes an expected cyclic redundancy checksum475; and thus, logic472in the DMA controller424can compare the expected cyclic redundancy checksum475to the actual cyclic redundancy checksum (e.g., stored in464or466) calculated for the third destination TCS445. If the actual cyclic redundancy checksum(s) stored in464/466is different from the expected cyclic redundancy checksum(s) in475, the DMA controller424halts data transfers and flags an error (e.g., an interrupt IRQ) to limit damage. If no error is detected, the DMA controller424identifies the next TCS, if any, in the second TCS sequence438. When the last TCS in the second sequence is reached, the DMA controller424can assert an interrupt to notify the processing unit the specified data transfer is complete.

It will be appreciated that “cyclic redundancy checksum” as referred to herein can be used to detect a data error present in bits, words, or other sizes of data. The term cyclic redundancy checksum can include, but is not limited to error detection codes, parity bit(s), and hash values, among others. In some instances, an error detection code can be implemented as an error correction code, wherein the information in the error correction code not only detects whether an error is present but also helps to correct the error.

Turning now toFIG. 6, one can see a flow chart illustrating a method in accordance with some embodiments of the present disclosure. The method starts at602, when a first DMA Transaction Control Set (TCS1) is used to transfer observed samples from a sensor to a first source memory buffer. In some cases, TCS1specifies a data size to be transferred is the same as the size of the first source memory buffer, such that TCS1fills the first source memory buffer. In some cases, a second source memory buffer is frozen while TCS1is executing, and/or a processing unit can be reading from the second source memory buffering while TCS1is executing.

At604, a second DMA Transaction Control Set (TCS2), a base address of which is pointed to by the first DMA Transaction Control Set, is used to verify TCS1executed correctly.

At606, a third DMA Transaction Control Set (TCS3), a base address of which is pointed to by the second DMA Transaction Control Set, is used to transfer observed samples from the sensor to a second source memory buffer. In some cases, TCS3specifies a data size to be transferred is the same as the size of the second source memory buffer, such that TCS3fills the second source memory buffer. In some cases, the first source memory buffer is frozen while TCS3is executing, and/or a processing unit can be reading from the first source memory buffering while TCS3is executing.

At608, a fourth DMA Transaction Control Set (TCS4), a base address of which is pointed to by the third DMA Transaction Control Set, is used to verify TCS3executed correctly.

At610, a fifth DMA Transaction Control Set (TCS5) is used to transfer control samples from a first destination memory buffer sensor to a destination peripheral. In some cases, TCS5specifies a data size to be transferred is the same as the size of the first destination memory buffer, such that TCS5moves the entire contents of the first destination memory buffer to the destination peripheral. In some cases, a second destination memory buffer is frozen while TCS5is executing, and/or a processing unit can be writing to the second destination memory buffering while TCS5is executing.

At612, a sixth DMA Transaction Control Set (TCS6), a base address of which is pointed to by the fifth DMA Transaction Control Set, is used to verify TCS5executed correctly.

At614, a seventh DMA Transaction Control Set (TCS7), a base address of which is pointed to by the sixth DMA Transaction Control Set, is used to transfer control samples from a second destination memory buffer to the destination peripheral. In some cases, TCS7specifies a data size to be transferred is the same as the size of the second destination memory buffer, such that TCS7moves the entire contents of the second destination memory buffer to the destination peripheral. In some cases, the first destination memory buffer is frozen while TCS7is executing, and/or the processing unit can be reading from the first destination memory buffering while TCS7is executing.

At616, an eighth DMA Transaction Control Set (TCS8), a base address of which is pointed to by the seventh DMA Transaction Control Set, is used to verify TCS7executed correctly.

It is to be understood that in the description of embodiments contained herein any direct connection or coupling between functional blocks, devices, components, circuit elements or other physical or functional units shown in the drawings or described herein could also be implemented by an indirect connection or coupling, i.e., a connection or coupling comprising one or more intervening elements. Furthermore, it should be appreciated that functional blocks or units shown in the drawings may be implemented as separate circuits in some embodiments, but may also be fully or partially implemented in a common circuit or common integrated circuit in other embodiments, or in some cases may also be implemented jointly by programming a processor accordingly.

It should be noted that the drawings are provided to give an illustration of some aspects and features of embodiments of the present invention and are to be regarded as schematic only. In particular, the elements shown in the drawings are not necessarily to scale with each other, and the placement of various elements in the drawings is chosen to provide a clear understanding of the respective embodiment and is not to be construed as necessarily being a representation of the actual relative location of the various components and elements shown. The features of the various embodiments described herein may be combined with each other. On the other hand, describing an embodiment with a plurality of features is not to be construed as indicating that all those features are necessary for practicing the present invention, as other embodiments may comprise less features and/or alternative features.