Abstract:
The invention concerns a circuit protected against transitory perturbations, comprising a combinatorial logic circuit ( 10 ), having at least an output (A); a circuit ( 20 ) generating an error control code for said output, and a storage element ( 24 ) provided at said output, controlled by the circuit generating a control code to be transparent when the control code is correct, and to maintain its status when the control code is incorrect.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority benefit of and is a Continuation-In-Part (CIP) of co-pending U.S. application Ser. No. 12/456,477 filed on Jun. 17, 2009, which is a Continuation of U.S. application Ser. No. 11/820,714 filed on Jun. 19, 2007, which is now U.S. Pat. No. 7,565,590, which is a continuation of U.S. application Ser. No. 09/936,032 filed on Mar. 11, 2002, which is now U.S. Pat. No. 7,380,192 B1 issued May 27, 2008, which is a 371 of PCT/FR00573 filed on Mar. 8, 2000 and which claims foreign priority of foreign application FRANCE application serial no. 99/03027 filed on Mar. 9, 1999. 
     
    
     STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT 
       [0002]    None. 
       REFERENCE TO AN APPENDIX 
       [0003]    None 
       BACKGROUND OF THE INVENTION 
       [0004]    The present invention relates to digital circuits insensitized to external disturbances, especially to localized disturbances coming in particular from heavy ion bombardments. 
         [0005]    Such a disturbance is likely to untimely switch the state of a memory point, and specific memory point structures must be adopted to overcome this disadvantage. 
         [0006]    With past integrated circuit manufacturing technologies, a memory point was only likely to switch if the disturbance directly affected this memory point. For example, a heavy ion had to reach one of the transistors forming the memory point. Disturbances occurring outside of the memory points, that is, in combinatory logic circuits, had a very low probability of modifying the state of memory points. Indeed, such disturbances would translate as very short pulses, which would be practically filtered out by the high capacitances of the conductors. Even if such a disturbance caused a parasitic pulse reaching the input of a memory cell, this pulse had a low probability of modifying the state of the memory cell. 
         [0007]    With recent technologies, the capacitances of conductors become smaller and smaller and the circuits, especially memory cells, react more and more rapidly, so that parasitic pulses caused by disturbances have sufficient durations to modify the memory cell state if they occur in the vicinity of an edge of a clock which clocks the memory cells. 
         [0008]    Thus, if it is desired to insensitize a digital circuit of recent technology to localized disturbances, it is not enough to insensitize the memory points, but it must also be avoided for parasitic pulses that could be generated outside of the memory points to reach the memory points. 
         [0009]    The generation of a parasitic pulse by a combinatory logic circuit can be considered as a mistake that could be corrected by a conventional solution. 
         [0010]      FIG. 1  illustrates a conventional solution that could be used to correct errors generated by a combinatory logic circuit. It is a triple-redundancy error-correcting circuit. A same combinatory logic circuit  10  is duplicated twice, respectively at  11  and  12 . The outputs of circuits  10  to  12  are provided to a majority vote circuit  14 , which outputs the value which is provided by at least two of redundant circuits  10  to  12 . The output of majority vote circuit  14  is thus error-free in case of a failure of at most one of redundant circuits  10  to  12 , even if this failure is permanent. 
         [0011]    Of course, this solution triples the silicon surface area of the integrated circuit. 
         [0012]    There are other solutions, which consist of generating error-correcting codes for the outputs of a circuit. When all the outputs of a circuit are desired to be corrected, this solution is equivalent, in terms of surface area, to the triple redundancy of  FIG. 1 . 
       BRIEF SUMMARY OF THE INVENTION 
       [0013]    The invention concerns a circuit protected against transitory perturbations, comprising a combinatorial logic circuit ( 10 ), having at least an output (A); a circuit ( 20 ) generating an error control code for said output, and a storage element ( 24 ) provided at said output, controlled by the circuit generating a control code to be transparent when the control code is correct, and to maintain its status when the control code is incorrect. 
         [0014]    In this CIP, New claims  1 - 8  do not rely on New Matter. These claims are similar to some claims in the co-pending parent U.S. application Ser. No. 12/456,477 filed on Jun. 17, 2009, however the difference in these New Claims is that in this CIP, the principal New claim  1  protects in a manner independent of the circuit generating the error detection signal, including the concept of reducing the clock frequency during the execution of an application in response to the activation of the error detection signal. New claims  9 - 22  rely on New Matter in this CIP contained at the end of this application. 
         [0015]    An object of the present invention is to provide a solution to remove at the output of a combinatory logic circuit any parasitic pulse caused by a localized disturbance, while occupying a relatively small silicon surface area. 
         [0016]    To achieve this object, the present invention provides a circuit protected against transient disturbances, including a combinatory logic circuit having at least one output; a circuit for generating an error control code for said output; and a memory element arranged at said output, controlled by the control code generation circuit to be transparent when the control code is correct, and to keep its state when the control code is incorrect. 
         [0017]    According to an embodiment of the present invention, the error control code generation circuit includes a circuit for calculating a parity bit for said output and a circuit for checking the parity of the output and of the parity bit. 
         [0018]    According to an embodiment of the present invention, the error control code generation circuit includes a duplicated logic Circuit, said memory element being provided to be transparent when the outputs of the logic circuit and of the duplicated circuit are identical, and to keep its state when said outputs are different. 
         [0019]    According to an embodiment of the present invention, the error control code generation circuit includes an element for delaying said output by a predetermined duration greater than the maximum duration of transient errors, said memory element being provided to be transparent when the outputs of the logic circuit and of the delay element are identical, and to keep its state when said outputs are different. 
         [0020]    According to an embodiment of the present invention, said memory element is formed from a logic gate providing said output of the logic circuit, this logic gate including at least two first transistors controlled by a signal of the logic circuit and at least two second transistors controlled by the corresponding signal of the duplicated circuit, each of the second transistors being connected in series with a respective one of the first transistors. 
         [0021]    The present invention also provides a circuit protected against transient disturbances, including a combinatory logic circuit having at least one output connected to a first synchronization flip-flop rated by a clock, a second flip-flop connected to said output and rated by the clock delayed by a predetermined duration, and a circuit for analyzing the outputs of the flip-flops. 
         [0022]    According to an embodiment of the present invention, the analysis circuit indicates an error if the flip-flop outputs are different. 
         [0023]    According to an embodiment of the present invention, the circuit includes a third flip-flop connected to said output and rated by the clock delayed by twice the predetermined duration, the analysis circuit being a majority vote circuit. 
         [0024]    The present invention further provides a circuit protected against transient disturbances, including a combinatory logic circuit having at least one output connected to a first synchronization flip-flop rated by a clock, a second flip-flop rated by the clock and receiving said output delayed by a predetermined duration, and a circuit for analyzing the flip-flop outputs. 
         [0025]    According to an embodiment of the present invention, the analysis circuit indicates an error if the flip-flop outputs are different. 
         [0026]    According to an embodiment of the present invention, the circuit includes a third flip-flop rated by the clock and receiving said output delayed by twice the predetermined duration, the analysis circuit being a majority vote circuit. 
         [0027]    The present invention further provides a circuit protected against transient disturbances, including three identical logic circuits. Each of the logic circuits is preceded by a two-input memory element respectively receiving the outputs of the two other logic circuits, each memory element being provided to be transparent when its two inputs are identical, and to keep its state when the two inputs are different. 
         [0028]    According to an embodiment of the present invention, the logic circuits are inverters and the memory elements include, in series, two P-channel MOS transistors and two N-channel MOS transistors, a first one of the inputs of the memory element being connected to the gates of a first one of the P-channel MOS transistors and of a first one of the N-channel MOS transistors, and the second input of the memory element being connected to the gates of the two other transistors. 
     
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
         [0029]    The foregoing and other objects, features and advantages of the present invention, will be discussed in detail in the following non-limiting description of specific embodiments in connection with the accompanying drawings, wherein: 
           [0030]      FIG. 1  illustrates a conventional solution that could be used to correct errors generated by a combinatory logic circuit; 
           [0031]      FIG. 2A  schematically shows a first embodiment of a circuit according to the present invention enabling suppression of parasitic pulses generated by localized disturbances in a combinatory logic circuit; 
           [0032]      FIG. 2B  shows a timing diagram illustrating the operation of the circuit of  FIG. 2A ; 
           [0033]      FIGS. 3A and 3B  show two examples of state-keeping elements used in the circuit of  FIG. 2A ; 
           [0034]      FIG. 4  schematically shows a second embodiment of the circuits according to the present invention enabling suppression of parasitic pulses; 
           [0035]      FIG. 5  shows an example of a state-keeping element used in the circuit of  FIG. 4 ; 
           [0036]      FIGS. 6A ,  6 B, and  6 C show other examples of state-keeping elements of the type used in the circuit of  FIG. 4 ; 
           [0037]      FIG. 7A  schematically shows a third embodiment of a circuit according to the present invention enabling suppression of parasitic pulses; 
           [0038]      FIG. 7B  shows a timing diagram illustrating the operation of the circuit of  FIG. 7A ; 
           [0039]      FIG. 8A  shows an alternative to the embodiment of  FIG. 7A ; 
           [0040]      FIG. 8B  shows a timing diagram illustrating the operation of the circuit of  FIG. 8A ; 
           [0041]      FIG. 9A  shows a fourth embodiment of a circuit according to the present invention enabling suppression of parasitic pulses; 
           [0042]      FIG. 9B  shows a timing diagram illustrating the operation of the circuit of  FIG. 9A ; 
           [0043]      FIG. 10A  schematically shows a fifth embodiment of a circuit according to the present invention enabling suppression of parasitic pulses; 
           [0044]      FIG. 10B  shows a timing diagram illustrating the operation of the circuit of  FIG. 10A ; 
           [0045]      FIG. 11  shows an application of the embodiment of  FIG. 4  to an asynchronous loop; 
           [0046]      FIG. 12  shows an improvement of the structure of  FIG. 11 ; 
           [0047]      FIG. 13  shows a simplification of the structure of  FIG. 12 ; 
           [0048]      FIG. 14  shows an application of the principle of  FIG. 13  to a static memory cell; and 
           [0049]      FIG. 15  shows a majority vote circuit formed from the structure of  FIG. 14 . 
           [0050]      FIG. 16  shows a clock circuit arrangement for use as a complex clock grid in order to adapt the circuit operation to the duration of transient faults. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0051]    Several solutions are provided according to the present invention to suppress parasitic pulses generated by a combinatory logic circuit after a localized disturbance, for example due to a heavy ion bombardment. All these solutions, to reach particularly simple structures, exploit the fact that the parasitic pulses form transient, and not permanent, errors. The embodiments of the present invention thus avoid use of conventional solutions, with a triple redundancy or multiple error correction codes, intended to correct a permanent failure of a circuit. 
         [0052]      FIG. 2A  schematically shows a first embodiment of the present invention exploiting this feature. A combinatory logic circuit  10  is associated with a checking circuit  20  which provides an error control code P for the output A of logic circuit  10 . Circuit  20  is for example a circuit, which conventionally calculates a parity bit P for output A of logic circuit  10 , with, of course, the possibility for output A to be multiple. At  22 , parity bit P is combined by X-OR with output A of logic circuit  10 , which provides an error signal E which is active when the parity is bad, that is, when output A or parity bit P includes an error. 
         [0053]    Error signal E and output A are provided to what will be called a “state-keeping” element  24 . This actually is a memory element similar to a controlled transparency flip-flop, that is, having a first mode, selected when error signal E is inactive, where output A is transmitted as such to output S of element  24 . In a second mode, selected when error signal E is active, element  24  keeps the state of output A such as it was before activation of error signal E. 
         [0054]    A flip-flop  26 , conventionally provided to lock the output of logic circuit  10 , receives output S of state-keeping element  24  instead of directly receiving output A of circuit  10 . Flip-flop  26  is rated by a clock CK intended to make the output of circuit  10  synchronous with the outputs of other circuit. Flip-flop  26  is a register in the case where output A is multiple. This flip-flop or this register have, preferably, a structure insensitive to localized disturbances. 
         [0055]      FIG. 2B  shows a timing diagram illustrating the operation of the circuit of  FIG. 2A . At a time t.sub.0, when a first active edge of clock CK appears, output A of logic circuit  10  is at any state X. Error signal E being inactive, element  24  is in “transparent” mode and transmits state X on its output S. State X is locked in flip-flop  26 . The output of flip-flop  26  being possibly fed back into logic circuit  10 , this logic circuit generates a new output A after a delay t.sub.c corresponding to the propagation time in the “critical path” of circuit  10 . 
         [0056]    At a time t.sub.1, output A of circuit  10  switches states, for example, switches to 0. The same occurs for output S of element  24 , which is again set to the “transparent” mode by signal E. 
         [0057]    At a time t.sub.2 starts a parasitic pulse on output A, which ends at a time t.sub.3.  FIG. 2B  illustrates an unfavorable case where the parasitic pulse on signal A risks causing an untimely modification of the state of flip-flop  26 . In this example, the end of the parasitic pulse coincides with the next active edge of clock CK, which edge causes the memorization in flip-flop  26  of the state of output S immediately preceding time t.sub.3. Now, error signal E becomes active for the duration t.sub.p of the parasitic pulse, making element  24  “opaque” to the variation of signal A between times t.sub.2 and t.sub.3. Accordingly, signal S does not switch states during the parasitic pulse and the flip-flop  26  memorizes a correct value. 
         [0058]    A flip-flop only switches states if the new state has been presented long enough thereto before the corresponding active clock cycle, for a so-called initialization duration. In fact, a risk of memorizing an erroneous value by flip-flop  26  appears in a variation range of the position of the parasitic pulse, from a position where the end of the pulse precedes the active edge of clock CK by the initialization duration, to a position where the beginning of the pulse occurs at the time of the active edge of clock CK. 
         [0059]    Further, given that state-keeping element  24  also is a memorization cell, the state that it must memorize must have been presented at least for one initialization time before the memorization order (activation of signal E). Thus, it is necessary for the duration separating times t.sub.1 and t.sub.2 to be longer that this initialization time. Further, it must also be guaranteed that an entire initialization time of element  24  has elapsed before or after the parasitic pulse between times t.sub.1 and t.sub.3, this to be sure that element  24  takes account of the level outside of the pulse. 
         [0060]    These constraints impose the choice of a minimum duration of the period of clock CK, equal to t.sub.c+2t.sub.h24+t.sub.p+t.sub.h26, where t.sub.c is the propagation time in the critical path of logic circuit  10 , t.sub.h24 is the initialization time of element  24 , t.sub.p is the maximum duration of a parasitic pulse, and t.sub.h26 is the initialization time of flip-flop  26 . In some cases, especially if element  24  has a capacitive memorization effect, this period can be reduced by t.sub.h24. 
         [0061]    This solution thus requires, with respect to a normal logic circuit, increasing the clock period. Indeed, in a normal circuit, the clock period must only be greater than t.sub.c+t.sub.h26. However, due to this time redundancy, the circuit provides the same security level as a conventional triple-redundancy circuit ( FIG. 1 ) with a substantially lower hardware cost. 
         [0062]    A state-keeping element  24  will generally be formed from logic gates providing the outputs of combinatory logic circuit  10  to flip-flops  26 . 
         [0063]      FIGS. 3A and 3B  show two examples of state-keeping elements performing a two-input NAND function. Both inputs a and b will be provided to an AND gate  30  having its output connected to a first input of a NOR gate  32 . An XOR gate  22 ′, equivalent to XOR gate  22  of  FIG. 2A , receives inputs a and b, as well as parity bit P. Output E of gate  22 ′ is provided to a second input of NOR gate  32  and to a first input of an AND gate  34 . The outputs of gates  32  and  34  are provided to an OR gate  36 , which provides output S of the state-keeping element, which output is looped back on a second input of AND gate  34 . 
         [0064]    When there is no parity error, signal E is at zero. Then, the output of AND gate  30  is inverted by NOR gate  32  and transmitted to output S by OR gate  36 . 
         [0065]    In case of a parity error, signal E is at  1 , causing a memorization of the state of output S in a memory point formed by gates  34  and  36 . 
         [0066]    The circuit of  FIG. 3A  requires four gates to perform the function of a single gate. 
         [0067]      FIG. 3B  shows a solution requiring less hardware to form a state-keeping element performing a NAND function. Input signals a and b are provided to the two inputs of a NAND gate  38  having its output connected to a capacitor C via a switch K. 
         [0068]    Switch K is controlled by error signal E provided by XOR gate  22 ′. 
         [0069]    When error signal E is inactive, switch K is closed and capacitor C charges to the level provided by gate  38 . When error signal E is activated, switch K is open, but the state of output S of the element is kept by capacitor C for the duration of the parasitic pulse. It should be noted that capacitor C can be formed by the mere capacitance of output line S. 
         [0070]    State-keeping elements performing other logic functions may be formed by those skilled in the art. For example, to perform the identity function while using the solution of  FIG. 3B , the single input signal is directly provided to switch K. 
         [0071]    The embodiment of  FIG. 2A  has the disadvantage, especially if the number of outputs A of logic circuit  10  is large, that XOR gate  22 , with several inputs, reacts with a significant delay to activate error signal E. This results in that a portion of the beginning of the parasitic pulse is transmitted to output S. However, in most cases, the duration of this pulse portion will be smaller than the initialization time of flip-flop  26  and accordingly does not affect its state. 
         [0072]      FIG. 4  shows an embodiment avoiding this disadvantage. 
         [0073]    Combinatory logic circuit  10  is duplicated once at  11 . Output A of circuit  10  and duplicated output A* of circuit  11  are provided to a state-keeping element  24 ′ which transmits on its output S the state of its input A or A* when inputs A and A* are identical and which keeps its state when inputs A and A* become different. 
         [0074]    The operation of this circuit is similar to that of  FIG. 2A , considering that a condition where inputs A and A* are different corresponds to the activation of error signal E in  FIG. 2B . 
         [0075]      FIG. 5  shows a state-keeping element  24 ′ of the circuit of  FIG. 4  implementing a two-input AND function. Inputs a and b are provided to an AND gate  50  having its output provided to a first input of an AND gate  52  and to a first input of an OR gate  54 . Duplicated inputs a* and b* are provided to an AND gate  56  having its output connected to the second input of gate  52  and to the second input of gate  54 . The outputs of gates  52  and  54  are respectively connected to gates  36  and  34  similar to gates  36  and  34  of  FIG. 3A . 
         [0076]    It should be noted that gates  34 ,  36 ,  52 , and  54  form a state-keeping element having the logic “identity” function. To create any logic function, it is enough to connect two gates, each conventionally implementing this function, to gates  52  and  54 . 
         [0077]    According to another embodiment, the state-keeping elements are formed based on the internal structure of conventional logic gates. For this purpose, two series-connected transistors are provided for each transistor normally required in the conventional gate. The two transistors are controlled to be turned off at the same time, so that, if one of them turns on due to a disturbance, the second, remaining off, prevents any untimely current flow. Such a configuration is particularly well adapted to a structure of the type of that in  FIG. 4 , including two redundant logic circuits. Indeed, the two transistors of the series association are then respectively controlled by a signal and by its duplicated signal. 
         [0078]      FIG. 6A  shows a state-keeping element according to this principle having an inverter function. Output S of the circuit is connected to a high voltage via two P-channel MOS transistors in series, MP 1  and MP 2 . Output S is also connected to a low voltage by two N-channel MOS transistors in series MN 1  and MN 2 . A first one of the two P-channel MOS transistors and a first one of the two N-channel MOS transistors are controlled by a normal signal a while the remaining transistors are controlled by the duplicated signal a*. 
         [0079]    If signals a and a* are equal, which corresponds to a normal operation, the two MP transistors or the two MN transistors are on and force output S to the corresponding voltage to perform the inverter function. 
         [0080]    If signals a and a* are different, at least one of transistors MP and at least one of transistors MN is off, whereby output S is floating and keeps its preceding level by capacitive effect. 
         [0081]      FIG. 6B  shows a state-keeping element performing a NOR function. Its output S is connected to a high voltage via four P-channel MOS transistors in series, respectively controlled by the normal input signals a and b and their duplicated signals a* and b*. Output S is also connected to a low voltage via two series associations of N-channel MOS transistors, one of them including two transistors respectively controlled by signals a and a*, the other including two transistors respectively controlled by signals b and b*. 
         [0082]      FIG. 6C  shows a state-keeping element performing a NAND function. Output S is connected to the low voltage via four N-channel MOS transistors in series respectively controlled by signals a and b and their duplicated signals a* and b*. Output S is also connected to the high voltage via two series associations of P-channel MOS transistors, the first one including two transistors respectively controlled by signals a and a*, and the second one including two transistors respectively controlled by signals b and b*. 
         [0083]    The elements of  FIGS. 6B and 6C  operate according to the principle described in relation with  FIG. 6A . More generally, this principle of arranging duplicated transistors in series applies to any logic gate. 
         [0084]    The circuit of  FIG. 6A  can be used as a dynamic memory cell insensitive to disturbances. For this purpose, the cell state is stored redundantly on both inputs a and a* by capacitive effect. If one of the inputs is disturbed, output S keeps its preceding state by capacitive effect, until the cell refreshment restoring the correct state of the disturbed input. This principle also applies to any state-keeping element ( FIGS. 3A ,  3 B,  5 ,  6 B,  6 C). For this purpose, it is enough to use a storage element (capacitor, static memory) on the inputs of the state-keeping element, and to lock the values provided by output A of circuit  10  and by the output of the error-checking circuit ( 20 ,  11 ). 
         [0085]    Other state-keeping elements may also be used, such as a specific storage element described in “Upset Hardened Memory Design for Submicron CMOS Technology”, 33.sup.rd International Nuclear and Space Radiation Effects Conference, July 1996, Indian Wells, Calif., by T. Calin, M. Nicolaidis, R. Velazco. 
         [0086]      FIG. 7A  shows a third embodiment of a combinatory circuit according to the present invention, insensitive to localized disturbances. It includes a single logic combinatory circuit  10 . The suppressing of parasitic pulses is exclusively obtained by means of a time redundancy, conversely to the preceding embodiment combining the time and hardware redundancy. Output A of circuit  10  is provided to three flip-flops  70 ,  71 , and  72  respectively rated by clock CK, by clock CK delayed by a duration. delta, and by clock CK delayed by a duration 2×delta. Outputs S 1 , S 2 , and S 3  of these flip-flops are provided to a majority vote circuit  74 , which provides corrected output S. 
         [0087]      FIG. 7B  shows a timing diagram illustrating the operation of the circuit of  FIG. 7A . This timing diagram show, in the form of vertical bars, the active edges of clock signals CK, CK+delta, and CK+2×delta. It is assumed that signal A exhibits a parasitic pulse overlapping the first edge of clock CK, occurring at a time t.sub.0. Flip-flop  70 , activated at time t.sub.0, erroneously stores the state of the parasitic pulse. 
         [0088]    At a time t.sub.2, signal A switches normally to 1. This transition occurs one time interval t.sub.c after a time t.sub.1 of occurrence of the last edge of clock CK+2.delta. Time t.sub.c is the propagation time through vote circuit  74  and logic circuit  10 . 
         [0089]    At times t.sub.3, t.sub.4, and t.sub.5, state 1 of signal A is sampled by the next respective edges of clocks CK, CK+.delta. and CK+2.delta. Signal S 1  remains at 1 while signals S 2  and S 3  switch to 1, respectively at times t.sub.3, t.sub.4 and t.sub.5. 
         [0090]    One time interval t.sub.c after time t.sub.5, signal A switches to 0. As a result, at the next edges of clocks CK, CK+.delta. and CK+2.delta., signals S 1 , S 2 , and S 3  successively switch to 0. 
         [0091]    Output S of vote circuit  74  is at 1 when at least two of signals S 1 , S 2 , and S 3  are at 1. This case occurs from time t.sub.4, while signal S 2  is at 1. 
         [0092]    It should be noted that the circuit of  FIG. 7A  does not switch to 1 at time t.sub.0 when the parasitic pulse occurs, but correctly switches to 1 at time t.sub.4 as a response to a normal switching to 1 of signal A. 
         [0093]    For this embodiment to operate properly, the parasitic pulse must be sampled by a single one of clocks CK, CK+.delta., and CK+2.delta. The maximum duration t.sub.p of the parasitic pulses may for this purpose reach value.delta.−t.sub.h, where t.sub.h is the initialization time of flip-flops  70  to  72 . Thus, it is chosen to have delta.=t.sub.p+t.sub.h. Further, the clock period must be chosen to be at least equal to t.sub.c+2.delta.+t.sub.h, which time corresponds to the maximum propagation time from the inputs of circuit  10  to output S. 
         [0094]      FIG. 8A  shows an alternative to the embodiment of  FIG. 7A . In this drawing, same elements as in  FIG. 7A  are designated with same references. Instead of rating flip-flops  70  to  72  with clocks delayed with respect to one another, these flip-flops are rated by the same clock CK. However, signal A is provided to two delay lines in cascade  80  and  81 , each introducing a delay delta. Signal A is directly provided to flip-flop  70 , output A 2  of delay line  80  is provided to flip-flop  71 , and output A 3  of delay line  81  is provided to flip-flop  72 . 
         [0095]      FIG. 8B  shows a timing diagram illustrating the operation of the circuit of  FIG. 8A . At a time t.sub.0 occurs the first edge of clock CK. It is assumed that signal A exhibits a parasitic pulse overlapping this edge. As a result, signal S 1  switches to one at this time t.sub.0. Signals A 2  and A 3  exhibit the same parasitic pulse, but shifted respectively by .delta. and 2.delta. with respect to time t.sub.0. 
         [0096]    Delay. Delta, is chosen to be greater than duration t.sub.p+t.sub.h, where t.sub.p is the maximum duration of a parasitic pulse and t.sub.h is the initialization time of flip-flops  70  to  72 . It is thus ensured, in the example of  FIG. 8B , that the parasitic pulse of signal A 2  is not sampled at time t.sub.0. As a result, the value of signal S 2 , and a fortiori of signal S 3 , remains correct (here, equal to 0). 
         [0097]    At time t.sub.1 occurs the next edge of clock CK. Signals A to A 3  are sampled while they are at 0. As a result, signal S 1  switches to 0 and signals S 2  and S 3  remain at 0. 
         [0098]    At a time t.sub.2, between time t.sub.1 and the next edge of clock CK occurring at a time t.sub.3, signal A switches normally to 1 during a clock period. The duration separating times t.sub.1 and t.sub.2 corresponds to propagation time t.sub.c in the critical path of circuit  10  and in vote circuit  74 . In the example shown, delay t.sub.c is such that the corresponding rising edge of signals A 2  and A 3  occurs still before time t.sub.3. 
         [0099]    Thus, at time t.sub.3, signals A, A 2 , and A 3  are sampled while they are at 1. Signals S 1 , S 2 , and S 3  switch to 1. Signals S 1 , S 2 , and S 3  remain at 1 until the next edge of the clock signal occurring at a time t.sub.4. At this time t.sub.4, signals A, A 2 , and A 3  are switched to 0. As a result, signals S 1 , S 2 , and S 3  switch to 0. 
         [0100]    Signal S has a correct shape in remaining at 0 between times t.sub.0 and t.sub.1, and in switching to 1 between times t.sub.3 and t.sub.4, while signals S 1 , S 2 , and S 3  are all three at 1. 
         [0101]    The correct operation illustrated in  FIG. 8B  is obtained provided that the minimum value of the clock period is equal to t.sub.c+2.delta.+t.sub.h. 
         [0102]      FIG. 9A  schematically shows a fourth embodiment of a circuit according to the present invention enabling suppressing parasitic pulses. A state-keeping element  24 ′ of the type of that in  FIG. 4 , provided to operate with duplicated signals, is here used. This element receives output A of logic circuit  10  and this same output is delayed by a delay line  90  introducing a delay .delta. The signal provided by delay line  90  forms duplicated signal A*. Output S of element  24 ′ is provided to a flip-flop  26 . 
         [0103]      FIG. 9B  shows a timing diagram illustrating the operation of the circuit of  FIG. 9A . As in the preceding examples, signal A exhibits a parasitic pulse overlapping a first edge of clock CK occurring at a time t.sub.0. 
         [0104]    At a time t.sub.1, before the next rising edge of clock CK occurring at a time t.sub.3, signal A switches to 1. Times t.sub.0 and t.sub.1 are distant by propagation time t.sub.c in the critical path of circuit  10 . 
         [0105]    At a time t.sub.2, also occurring before time t.sub.3, delayed signal A* switches to 1. 
         [0106]    Signals A and A* remain at 1 for one clock period and switch to 0 at respective times t.sub.4 and t.sub.5 before the next clock edge occurring at time t.sub.6. 
         [0107]    Signal S provided by state-keeping circuit  24 ′ only switches state at the time when signals A and A* become equal. This only occurs at time t.sub.2 when signal A* switches to 1 while signal A already is at 1, and at time t.sub.5 when signal A* switches to 0 while signal A already is at 0 (the propagation time of element  24 ′ is here neglected for clarity reasons). 
         [0108]    Thus, signal S is at 1 between times t.sub.2 and t.sub.5. This state 1 is sampled by flip-flop  26  at time t.sub.3, and corresponds to the state to be effectively sampled in signal A. 
         [0109]    The operation of this circuit is correct if the clock period is at least equal to t.sub.c+.delta.+2t.sub.24′+t.sub.p+t.sub.h, where t.sub.24′ is the propagation time in element  24 ′ and th is the initialization time of flip-flop  26 . Value delta must be chosen to be greater than t.sub.p-t.sub.24′. 
         [0110]      FIG. 10A  schematically shows a fifth embodiment of the circuit according to the present invention, enabling simple detection of an error due to a parasitic pulse. Output A of logic circuit  10  is provided to two flip-flops  92  and  93 , one being rated by clock CK and the other one by the clock delayed by a duration .delta. As an alternative, flip-flop  92  can be controlled by an edge or level of a first type (rising or falling—high or low) of a clock CK, while flip-flop  93  is controlled by an edge or level of the opposite type of the same clock (falling or rising edge—low or high). Outputs S 1  and S 2  of these flip-flops are provided to a comparator  95 , the output of which is provided to a flip-flop  97 . Flip-flop  97  is rated by a clock CK+.delta.+.epsilon., slightly delayed with respect to signal CK+.delta. Flip-flop  93  is here used to synchronize signal A and its output S 2  may be looped back onto the inputs of logic circuit  10 . 
         [0111]      FIG. 10B  shows a timing diagram illustrating the operation of the circuit of  FIG. 10A . As in the preceding example, a parasitic pulse occurs in signal A overlapping an edge of signal CK occurring at a time t.sub.0. As a result, signal S 1  switches to 1. However, flip-flop  93  does not sample signal A yet and its output S 2  remains unchanged (at 0). Comparator  95  does not indicate an inequality of signals S 1  and S 2  yet, and signal ERR indicates no error by a state 0. 
         [0112]    At a time t.sub.1 occurs the next edge of clock CK+.delta., after the parasitic pulse in signal A. Signal S 2  remains unchanged. 
         [0113]    At a time t.sub.2, one duration .epsilon. after the first edge of signal CK+.delta., occurs the next edge of clock CK+.delta.+.epsilon., which edge causes the sampling of the comparator output by flip-flop  97 . Signals S 1  and S 2  being different, error signal ERR is activated. 
         [0114]    At a time t.sub.3, one interval t.sub.c after time t.sub.1, signal A normally switches to 1. This state 1 is sampled by clock CK at a time t.sub.4. Signal S 1  remains at 1. 
         [0115]    At a time t.sub.5 occurs the next edge of clock CK+.delta., which samples signal A while said signal still is at 1. Signal S 2  switches to 1. Signal A will switch to 0 after propagation interval t.sub.c. 
         [0116]    At a time t.sub.6 occurs the next edge of clock CK+.delta.+.epsilon., which samples the output of comparator  95 . Signals S 1  and S 2  being at the same state, error signal ERR is deactivated. 
         [0117]    At a time t.sub.7 occurs the next edge of clock CK, which samples signal A while said signal is at 0. Signal S 1  switches to 0. 
         [0118]    At a time t.sub.8 occurs the next edge of clock CK+.delta., which samples signal A while said signal is at 0. As a result, signal S 2  switches to 0. 
         [0119]    The clock period must be chosen to be at least equal to t.sub.c+t.sub.h+.delta., duration .delta. being at least equal to duration t.sub.p+t.sub.h. 
         [0120]    According to an alternative, not shown, of the circuit of  FIG. 10A , output S 1  is exploited. Then, it must be ascertained that a transition of output S 1  is not propagated towards output A before the next edge of clock CK+.delta. In other words, propagation time t.sub.c must be longer than .delta. In this case, the clock period will be equal to t.sub.c+t.sub.h, that is, equal to the clock period of the conventional circuit with no protection against transient errors. 
         [0121]    The error signal provided by the circuit of  FIG. 10A  may be exploited in various ways to correct the detected error. This error signal may for example trigger an operation resumption, for example, the repeating of a last “instruction” executed by the system. 
         [0122]    It may also be used to correct a synchronization error due to the use of too fast a clock. In case of an error, a resumption is triggered and the clock frequency is reduced during the resumption. This is particularly advantageous in the case of the alternative exploiting output S 1 , in which the circuit operates at the speed of the conventional circuit. 
         [0123]    According to another alternative, not shown, of the circuit of  FIG. 10A , flip-flops  92  and  93  are rated by the same clock CK and one of them receives signal A delayed by duration .delta. 
         [0124]    Many digital circuit form asynchronous loops, that is, their outputs are directly looped back onto their inputs, without passing through a synchronization flip-flop. Static memory cells are an example of this. Such circuits are likely. to memorize a state and are thus sensitive to disturbances risking to switch this state. 
         [0125]      FIG. 11  shows an arrangement according to the present invention to protect such a circuit, using the duplication principle of  FIG. 4 . The output of a logic circuit  10  and the output of a duplicated logic circuit  11  are respectively connected to the two inputs of a first state-keeping element  24   a  and of a second state-keeping element  24   b , both of the type of that in  FIG. 4 . The output of element  24   a  is looped back on circuit  10 , while the output of element  24   b  is looped back on circuit  11 . It is necessary to use two state-keeping elements, since if a single one was used, with its output looped back on both circuits  10  and  11 , a disturbance in the element would be transmitted to the two duplicated circuits, causing the same error in both circuits. This error condition would not be corrected. 
         [0126]    The structure of  FIG. 11  is however sensitive to a disturbance occurring on the output of one of the state-keeping elements. If the propagation time in the involved circuit  10  or  11  is shorter than the duration of the disturbance, the delayed disturbance arrives onto the input of the state-keeping element before the disturbance has disappeared on its output. As a result, the element tends to keep the erroneous state affected by the disturbance. 
         [0127]      FIG. 12  shows a structure avoiding this problem. Circuit  10  and its duplicated circuit  11  are each divided up into two portions,  10   a  and  10   b  for circuit  10 , and  11   a  and  11   b  for circuit  11 . Between the two portions of each circuit, an additional state-keeping element  24   c  is inserted between portions  10   a  and  10   b , and an element  24   d  is inserted between portions  11   a  and  11   b , elements  24   c  and  24   d  being connected in the same way as elements  24   a  and  24   b.    
         [0128]      FIG. 13  shows a simplification of the structure of  FIG. 12 , made possible if portions  10   a ,  10   b  and their duplicated portions have the same logic function and receive the same inputs. As compared to  FIG. 12 , circuit  11   b  and element  24   d  have been omitted. State-keeping elements  24   a  and  24   b  respectively receive the output of circuit  11   a  and the output of circuit  10   a  instead of the output of circuit  11   b  of  FIG. 12 . 
         [0129]      FIG. 14  shows an application of the principle of  FIG. 13  to form a static memory cell. State-keeping elements  24   a ,  24   b  and  24   c  are state-keeping inverters of the type in  FIG. 6A . Circuit portions  10   a ,  11   a , and  10   b  are conventional inverters. A state-keeping inverter followed by a conventional inverter have an identity function. This ensures that elements  24   a ,  24   b , and  24   c  receive identical input values, which is also valid for inverters  10   a ,  11   a , and  10   b.    
         [0130]    The memory cell thus obtained is insensitive to disturbances, in static operation as well as in dynamic operation. 
         [0131]      FIG. 15  shows an alternative of the cell of  FIG. 14 . A P-channel MOS transistor controlled by a clock signal CK has been inserted in series with each of the P-channel MOS transistor pairs. An N-channel MOS transistor controlled by the complement of clock signal CK has been inserted in series with each of the N-channel MOS transistor pairs. These transistors suppress cell switching current surges. 
         [0132]    Further,  FIG. 15  shows an application of the structure of  FIG. 14  to a vote circuit usable in the circuits of  FIGS. 7A and 8A . For this purpose, with respect to  FIG. 14 , the access transistors have been omitted. The three input signals S 1 , S 2 , and S 3  of the vote circuit are applied to the inverter inputs. 
         [0133]    A vote circuit, which is used to memorize the result of the vote in a way insensitive to disturbances, is thus obtained. If this vote circuit is used in  FIGS. 7A and 8A , flip-flops  70  to  72 , which come before the vote circuit, are mere controlled-transparency flip-flops. 
         [0134]    A conventional memory cell controlled by a clock signal may further be connected to each of inputs S 1 , S 2 , and S 3 . A master-slave flip-flop is thus formed. 
         [0135]    In the foregoing description, the case where flip-flops sensitive to transitions are used to lock the output states of a logic circuit has been considered. The present invention also applies to flip-flops sensitive to states (controlled-transparency flip-flops). 
         [0136]      FIG. 10A  does not show where the signals feeding the inputs of logic circuit  1   10  are coming from. As illustrated in  FIG. 16 , these signals are typically coming from sampling elements like flip-flops  99  referred hereafter as the input flip-flops of logic circuit  1   10 , which are rated by the same clock signal CK as the flip-flop  92  providing signal S 1  to the next stage of the circuit. Thus, at the latching edge of cycle i of clock signal CK (considered hereafter to be its rising edge) new values are latched in the input flip-fop and are applied to the inputs of logic circuit  1   10 . At the same edge of the clock signal CK, the flip-flop generating signal S 1  latches the value generated at the output A of logic circuit  1  during the previous cycle (cycle i−1) of clock signal CK. Because the flip-flop  93  generating signal S 2  is rated by a clock signal CK+δ delayed by a time interval δ with respect to the clock signal CK, it will latch the value present at the output A of logic circuit  1  at a time δ after the latching edge of CK. This delay determines the duration of faults detected by the comparator  95 . 
         [0137]    When the circuit of  FIG. 10A  is used in an environment producing large disturbances it will be useful to increase the delay δ of the delayed clock signal CK+δ that drives the flip-flop  93  generating signal S 2 , in order to detect faults of larger duration. For instance, if the flip-flop  99  feeding the input of logic circuit  1   10  and the flip-flop  92  generating signal S 1  latch the values present on their inputs at the rising edge of clock signal CK and the flip-flop  92  generating signal S 2  latches the value present on its input at the falling edge of the clock signal CK (as described in the original text, column 9 lines 51 to 55,), the delay  8  determining the duration of detectable faults will be equal to the time separating the rising from the falling edge of the clock signal CK (the duration of the high level of this signal). In this case, to increase the duration of detectable faults we can increase the duration of the high level of clock signal CK. However, if δ becomes larger than the shortest delays of the circuit  1   10 , the output A of this circuit may change its value before the flip-flop  93  generating signal S 2  latches it. In this case, the comparator  95  will produce a false error detection (referred also as false alarm). Thus, delay δ should be maintained shorter than the shortest delays of the circuit  1   10 . This is pointed out in the text of the original application (column 10, lines 31, 32: “In other words propagation time tc must be longer than δ.”). 
         [0138]    Thus, the above constraint imposes an operating mode in which δ must be shorter than the shortest delays of the circuit, which prohibits increasing the delay δ at will to guaranty detection of faults of large duration and restricts the versatility of the invention. In the present extension we bring new material that highlights a second operating mode enabling increasing  5  at will. 
         [0139]    In this mode we use a delay δ which is larger than the largest delays of circuit  1   10 . In this case, the value latched at the flip-flop  99  generating the input of circuit  1   10  at the latching edge of cycle i of clock signal CK will have the time to propagate to the output A of this circuit  1   10  within the delay  8 . Thus, at the latching edge of cycle i of the delayed clock signal CK+δ, the flip-flop  93  generating signal S 2  will latch the value that circuit  1   10  generates at its output A in response to the value applied on its input at the latching edge of clock cycle i. The same value will be sampled by flip-flop  92  generating signal S 1  at the latching edge of cycle i+I of clock signal i+1. Thus the values sampled by the flip-flops  92 ,  93  generating signal S 1  and S 2  will be equal and we can compare them to detect failures having duration of any size without producing false alarms. Note that in this operating mode, it is not δ but T−δ that determines the duration of detectable faults, where T is the clock period. Indeed, the flip-flop  93  providing signal S 2  latches the value present at the output A of circuit  1   10  at a time d after the latching edge of cycle i of clock signal CK and the flip-flop  92  providing signal S 2  latches the value present at the output A of circuit  1   10  at the latching edge of cycle i+1 of clock signal CK, that is at a time the T after the latching edge of cycle i of clock signal CK. Thus, the two flip-flops latch signal A at times that differ by T−δ. Thus, any fault of duration less than T−δ can not affect both flip-flops, enabling detecting any fault of duration not exceeding T−δ. 
         [0140]    As a consequence, we can operate the circuit in two modes:
       In the first mode, δ will be shorter that the shortest paths of the circuit  1   10 . This mode detects all transient disturbances and circuit delay faults whose duration does not exceed δ.   In the second mode, δ will be larger that the largest paths of the circuit  1   10 . This mode detects all transient disturbances and circuit delay faults whose duration does not exceed T−δ.       
 
         [0143]    In the second mode, δ is larger than the largest delay of the circuit and the clock period T is even larger (T−δ should be positive). Thus, the clock period T exceeds the delays of the circuit by at least T−δ. Hence, T has to be larger than the strictly necessary time for accommodating the delays of the circuit. This means that by increasing T−δ to increase the duration of detectable faults, we reduce the circuit speed. Thus, mode  2  can be used to accommodate faults of any duration at the cost of circuit speed reduction. On the other hand, in the first operating mode, the clock period has not increased enabling circuit operation at the highest speed. However, the duration of detectable faults is bounded by the value of δ that cannot exceed the shortest delay of the circuit. 
         [0144]    Another use of the second mode concerns the detection of increasing circuit delays or clock skews induced by circuit aging. For doing so, the circuit will be operated by using a small value for T−δ. As far as the circuit delays do not exceed δ, flip-flops  92 ,  93  generating signal S 1  and S 2  will latch equal values. However, if due to aging the circuit delay exceeds δ, flip-flop  93  generating signal S 2  will latch an incorrect value and the comparator  95  will detect the delay increase induced by circuit aging. At this point the circuit still operates correctly, as signal S 1  provided to the next pipeline level is correct, but the timing margins between the clock period T and the circuit delays are reduced. Hence the activation of the comparator output indicates that the clock period T has to be increased. Detecting reduced timing margins for predicting circuit degradation due to aging is becoming important and has been proposed by other authors (S. Mitra and M. Agarwal, “Circuit Failure Prediction to Overcome Scaled CMOS Reliability Challenges,” International Test Conference, Santa Clara, Calif., October 2007). The scheme proposed here is unique in that it uses a new way for using the circuit of  FIG. 10A  following the above described second operating mode, which enables among others detecting timing margins reduction, as well as in that it enables using the same circuit adaptively to perform detection of faults of any duration or detection of reduced timing margins, according to the application requirements. 
         [0145]    It may be useful to design and produce a circuit that could be adapted to various environment and application constraints, including various environments and/or operating conditions inducing faults of various durations, various applications requiring detection of faults of various durations to achieve various levels of reliability or to detect increasing circuit delays induced by aging. Using the above two operating modes could enable achieving this goal. A preferred realization of the present invention taking advantage of these two operating modes consists in:
       Using a single clock signal CK for rating both flip-flops  92 ,  93 , generating signals S 1  and S 2 , and employing the first edge (say the rising edge) of signal CK to latch new values to the flip-flop  92  generating signal S 1 , and the second edge (say the falling edge) of signal CK to latch new values to the flip-flop  93  generating signal S 2 .   Selectively adapting the characteristics of the clock signal to implement the first operating mode by using a time interval separating the first and the second edge of signal CK shorter than the shortest delay of the circuit; or the second operating mode by using a a time interval separating the first and the second edge of signal CK larger than the largest delay of the circuit, further using in this mode a value for the clock period T such that the interval T−δ exceeds a selected value. This value can be the target duration of detectable faults, or the target margins between the clock period and the largest circuit delays.