Patent Description:
A number of interconnect buses have been proposed for various applications. One such interconnect bus is the Peripheral Component Interconnect Express, PCle, bus which represents a full duplex serial interface widely applied in computers, including servers, and mobile devices.

Systems using such an interconnect bus are increasingly in use in vehicles, for example in automotive applications, and many applications in vehicles require functional safety, i.e. to transmit data in such a way that errors occurring during data transmission are detected and dealt with appropriately. In this way, errors will not lead to dangerous conditions when driving the vehicles concerned. For example, there may be a need to deliver a system using a particular Automotive Safety Integrity Level, ASIL, such as ASIL-B or ASIL-D. These ASIL levels are defined in the international standard ISO <NUM>. Functional safety may also be required in other applications, not just in automotive.

In order to achieve functional safety data may be checked using cyclic redundancy checks, CRC. However, calculating such CRCs using software is slow and inefficient.

There is accordingly a need to address safety in interconnect connected systems.

<CIT> teaches a method of data integrity verification of safety relevant data using CRCs in a system with a "safety master" and a "safety slave" connected through a net. <CIT> teaches a safety device using a hardware CRC engine.

According to an aspect, there is provided a system comprising a first device, comprising: a first processor for running a first application; a first interface for transmitting and receiving data along a two-way communication channel, and a safety guard consisting of a hardware block between the processor and the interface; a second device comprising: a second processor for running a second application; a second interface connected to the second processor for transmitting and receiving data along the two-way communication channel with the first interface; wherein the system is arranged to send safety relevant data from the first application to the second application by: in the safety guard, adding safety information to the safety relevant data to create safety marked data; transmitting the safety marked data through the first interface and the two-way communication channel to the second interface; extracting the safety relevant data from the safety marked data and forwarding the extracted safety relevant data to the second application; retransmitting the safety marked data from the second interface back through the two-way communication channel to the first interface as loop back data; in the safety guard, checking the loop back data using the safety information in the loop back data, and if the checking indicates an error, transmitting an error notification signal to the first application and/or the second application.

By providing a safety guard system, functional safety may be enhanced without requiring all interconnected devices to be complex devices with advanced hardware for CRC calculation.

The inventors have realized that in many applications the full duplex bandwidth offered by the interconnect bus may not be used. In many cases, the data streams mostly from one device to another. It is therefore possible to use unused bandwidth, which may be considered spare bandwidth, to enhance safety.

In an alternative system, complex calculations would need to be carried out at both ends of the interface: the CRC must be calculated in the sending device and then checked in the receiving device. Such calculations may be viable in high-end microprocessors but in automotive applications it is very common that either the receiving or the sending device is not capable of such calculations.

In contrast to such an alternative system, embodiments of the invention provide a first device with a safety guard system which can communicate in a safety compliant way with a variety of devices, even devices without sufficient resource to carry out complex calculations.

Examples provide a device which is capable of a number of different modes of operation, including the mode of operation described above, to increase flexibility.

In another aspect of the invention, there is provided a safety device comprising.

In another aspect of the invention, there is provided a method of transmitting data between a first device and a second device along a two-way communications interface, wherein the first device has a first processor running a first application, a first interface for transmitting and receiving data and a safety guard between the first processor and the first interface, and the second device has a second processor running a second application, and a second interface for transmitting and receiving data, the method comprising sending safety relevant data from the first application to the second application by:.

Examples will now be described, purely by way of example, with reference to the accompanying drawings, in which:.

The accompanying drawings are schematic and not to scale. Like components may be referenced by the same reference number in different figures.

As shown in <FIG> an interconnected system is shown with a first device <NUM> and a second device <NUM> connected together by interface bus <NUM>. The interface bus <NUM> is a two-way communication channel <NUM> capable of transmitting in both directions, as illustrated with a first transmission channel <NUM> from the first device <NUM> to the second device <NUM> and a second transmission channel <NUM> from the second device <NUM> to the first device <NUM>. In the example the two-way communication channel <NUM> is a Peripheral Component Interconnect Express, PCle, bus but alternative and/or multiple buses may be used. In an alternative example case, monodirectional buses in each direction may together make up the two-way communication channel <NUM>.

The first device <NUM> may be for example a microprocessor, a microcontroller or other chip with the capability of executing programmed instructions. A processor core <NUM> is provided which is capable of running an application <NUM>. Those skilled in the art will appreciate that the first device <NUM> will also contain registers, memory access and a large number of components that support the running of the application <NUM> on the processor core <NUM> but which are known and will not be described further.

The first device <NUM> also contains an interface <NUM> for connection to the two-way communication channel <NUM> for controlling communication along the bus <NUM>. The interface <NUM> may be divided into layers, including a physical layer <NUM> for delivering the physical packets onto the bus <NUM> and taking the incoming packets, and then passing the packets to a data link layer <NUM> from which the packets get passed to an upper layer <NUM>, for example a transactional layer, from which the packets get transferred into and out of the interface <NUM> towards the processor core <NUM>.

In addition to the above components the first device <NUM> also contains a safety guard <NUM> which is connected between the interface <NUM> on the one hand and the processor <NUM> and the application <NUM> running on the processor <NUM> on the other hand. The safety guard <NUM> is connected to the interface <NUM> by a first bidirectional interconnect <NUM> and to the processor <NUM> by a second bidirectional interconnect <NUM>. Such interconnects <NUM>, <NUM> may be, for example, an serial peripheral interconnect, SPI.

The safety guard <NUM> is a separate hardware block to the processor core <NUM> and to the interface <NUM>.

In this example the second device <NUM> is a device which does not have a safety guard <NUM>. The second device <NUM> may be for example a microprocessor, a microcontroller or other chip with the capability of executing programmed instructions, such as a power management integrated circuit, PMIC, system on chip SOC, or other device.

A second processor core <NUM> is provided which is capable of running an application <NUM>. Those skilled in the art will appreciate that the second device <NUM> will also contain registers, memory access and a large number of components that support the running of the application <NUM> on the processor core <NUM> but which are known and will not be described further.

The second device <NUM> also contains a second interface <NUM> for connection to the two-way communication channel <NUM> for controlling communication along the bus <NUM>. The second interface <NUM> may be divided into layers, including a physical layer <NUM> for delivering the physical packets onto the bus <NUM> and taking the incoming packets, and then passing the packets to a data link layer <NUM> from which the packets get passed to an upper layer <NUM>, for example a transactional layer, from which the packets get transferred into and out of the second interface <NUM> to the processor core <NUM>.

The second device <NUM> does not contain a safety guard <NUM> and may accordingly be a standard component. The safety relevant data <NUM> may pass directly between second interface <NUM> and second processor core <NUM> along a third bidirectional interconnect <NUM>.

Those skilled in the art will realize that although the first, second and third bidirectional interconnects <NUM>, <NUM>, <NUM> may be shown as single interconnects, each of the interconnects <NUM>, <NUM>, <NUM> may in reality be formed of a plurality of interconnects with bridges or links between the interconnects. Some components of the first and second bidirectional interconnects <NUM>, <NUM> may be shared.

The operation of the system will now be described, purely by way of example.

Consider the case that safety relevant data <NUM> needs to be transmitted from the first application <NUM> in the first device <NUM> to the second application <NUM> in the second device <NUM>.

The safety relevant data <NUM> is first transmitted through second bidirectional interface <NUM> to the safety guard <NUM>, which contains a safety unit <NUM> which adds safety information <NUM> to the safety relevant data <NUM> to create safety marked data <NUM>. How this is done will be described in more detail below.

The safety marked data <NUM> is then transmitted through first bidirectional interface <NUM> to interface <NUM> which transmits the safety marked data <NUM> through the two-way communication channel <NUM> to the second interface <NUM> in the second device <NUM>.

A data handling application <NUM>, then takes the safety marked data <NUM>, extracts the original safety relevant data <NUM> from the safety marked data <NUM> by stripping the safety information <NUM> and forwards the extracted safety relevant data <NUM> to the second application <NUM>. The data handling application <NUM> also retransmits the safety marked data <NUM> including the safety information <NUM> back through the second interface <NUM> and the two way communication channel <NUM> to the first interface <NUM> as loop back data <NUM>. In the example the data handling application <NUM> runs on the same core <NUM> as the second application <NUM> but in alternative embodiments the data handling application may run on a different core or be implemented in hardware.

The first interface <NUM> then passes the loop back data <NUM> to the safety guard <NUM>. The safety unit <NUM> checks the loop back data <NUM> using the safety information <NUM> in the loop back data <NUM>, and if the checking indicates an error, transmits an error notification signal to the first application <NUM> and the second application <NUM>.

In the example of <FIG>, a separate notification channel <NUM>, separate from the two-way communication channel <NUM> is provided between the first device <NUM> and the second device <NUM> for transmitting the error notification signal from the safety guard <NUM> to the second device <NUM>. This allows for communication in case there is an ongoing problem with communication along the two-way communication channel <NUM>. In other examples, the error notification signal may be transmitted along the two-way communication channel <NUM>.

Note that the data-handling application <NUM> and the second device <NUM> do not need to carry out complex calculations relating to the safety information <NUM> and so the second device <NUM> may be a lower power or simpler device than the first device <NUM>. Thus, the system may deliver improved safety using the first device <NUM> with the hardware safety guard <NUM> without the need for complex or expensive hardware in the second device <NUM>.

The safety information <NUM> will now be described in more detail.

In an example, the safety unit <NUM> creates a header including check data as the safety information <NUM> and adds this header to the safety relevant data <NUM> to create the safety marked data <NUM>. In other examples, the safety information <NUM> is not added as header but elsewhere.

In particular, the safety unit <NUM> may calculate cyclic redundancy check, CRC; data as the safety information <NUM>. The calculation of a CRC from data is known and will not be described further.

In a particular example, with reference to <FIG>, the first device <NUM> is arranged to transmit the safety relevant data <NUM> by first splitting the safety relevant data <NUM> into a plurality of unprotected frames <NUM>, each frame having a respective sequence number A.

The safety unit <NUM> then processes each unprotected frame <NUM> by calculating a CRC <NUM> corresponding to the unprotected frame <NUM>, appending the CRC <NUM> and the sequence number A to the unprotected frame <NUM> to form a protected frame. Each protected frame is then passed in sequence to the first interface <NUM>.

Alternatively, the sequence number A can first be added to the unprotected frame <NUM> and then the CRC <NUM> calculated based on both the unprotected frame <NUM> and the sequence number. In this way, also the sequence number is checked and controlled by the CRC <NUM>.

Referring to <FIG>, the same first device <NUM> may also operate with an alternative second device <NUM> which in this example is arranged to transmit data from the second application <NUM> running in second device <NUM> to the first application <NUM> running in the first device <NUM>. In this example, the second device <NUM> is a device with sufficient processing capability in processor <NUM> or in additional processor capacity to calculate safety information <NUM> with sufficient speed.

In this alternative operation mode safety relevant data <NUM> from the second application <NUM> is passed to the data-handling application <NUM> which unlike safety guard <NUM> is not a dedicated hardware unit but an application <NUM> running on processor <NUM>. The data-handling application <NUM> adds safety information <NUM> to the safety relevant data <NUM> to create safety marked data <NUM>.

This data is then passed to second interface <NUM> which transmits the safety marked data <NUM> through the two-way communication channel <NUM> to the first interface <NUM>. The safety relevant data <NUM> is passed to safety guard <NUM> which extracts the safety information <NUM> from the received safety marked data <NUM>. The safety information <NUM> is checked and if the safety information <NUM> indicates that the safety relevant data <NUM> has been safely received, the safety relevant data <NUM> is extracted from the safety marked data <NUM> and forwarded to the first application <NUM>.

In contrast, if the safety information <NUM> indicates that the safety relevant data <NUM> has not been safely received, the safety guard <NUM> transmits an error notification signal to the first application <NUM> and/or the second application <NUM> in a similar manner to the notification described above with reference to <FIG>, except that in this case the error notification signal relates to data transfer from the second device <NUM> to the first device <NUM> instead of from the first device <NUM> to the second device <NUM>.

Referring to <FIG>, the same first device <NUM> may also operate with a further alternative second device <NUM> which in this example is arranged to transmit data from the second device <NUM> to the first device <NUM>. In this example, unlike in the example described above with respect to <FIG>, the second device <NUM> does not have sufficient processing power to rapidly calculate safety information <NUM>.

In this case safety relevant data <NUM> is taken from the second application <NUM> and passed to the first application <NUM> in a second alternative operation mode by first transmitting the safety relevant data <NUM> through the second interface <NUM> and the two-way communication channel <NUM> to the first interface <NUM>.

The safety relevant data <NUM> is then passed to the safety guard <NUM> which forwards the safety relevant data <NUM> to the first application. The safety guard <NUM> also retransmits the safety relevant data <NUM> by passing the safety relevant data <NUM> to the first interface <NUM> as a second loop back data <NUM>.

The first interface <NUM> then transmits the second loop back data <NUM> through the two-way communications channel <NUM> to the second interface <NUM>.

The data-handling application <NUM> then checks whether the second looped back data <NUM> differs from the safety relevant data <NUM> originally transmitted, and if the looped back data <NUM> differs, transmits an error notification signal to the first application <NUM> and/or the second application <NUM>.

Thus, a hardware first device <NUM> is provided which may communicate in a variety of different ways with a variety of different second devices <NUM>, <NUM>, <NUM> depending on the need or application. The provision of the hardware safety guard <NUM> in the first device <NUM> with the functionality described above allows the second device <NUM>, <NUM>, <NUM> to be simpler than first device <NUM> and the second device <NUM>, <NUM>, <NUM> can be run with low-power consumption.

The invention has been described above with reference to examples, but those skilled in the art will realize that the details in the examples may be modified, combined together in different ways or adapted.

In particular, the first <NUM> and second devices <NUM>, <NUM>, <NUM> may be any form of device with sufficient computing power in hardware and/or software to carry out the method. The various functions can be implemented in a variety of ways, for example using hard wired circuitry, logic circuitry, a processor executing firmware stored in the processor or in a separate memory, or a processor executing code stored or delivered from an external memory, or a device, or combinations thereof.

The devices may be implemented in any convenient semiconductor technology at any suitable scale.

Claim 1:
A system comprising
a first device (<NUM>), comprising:
a first processor (<NUM>) for running a first application;
a first interface (<NUM>) for transmitting and receiving data along a two-way communication channel (<NUM>), and
a safety guard (<NUM>) consisting of a hardware block between the first processor and the first interface;
a second device (<NUM>) comprising:
a second processor (<NUM>) for running a second application;
a second interface (<NUM>) connected to the second processor for transmitting and receiving data along the two-way communication channel (<NUM>) with the first interface (<NUM>);
wherein the system is arranged to send safety relevant data (<NUM>) from the first application to the second application by:
in the safety guard (<NUM>), adding safety information to the safety relevant data (<NUM>) to create safety marked data (<NUM>);
transmitting the safety marked data (<NUM>) through the first interface and the two-way communication channel to the second interface;
extracting the safety relevant data (<NUM>) from the safety marked data and forwarding the extracted safety relevant data to the second application;
retransmitting the safety marked data (<NUM>) including the safety information (<NUM>) from the second interface back through the two-way communication channel to the first interface as loop back data;
in the safety guard (<NUM>), checking the loop back data using the safety information in the loop back data, and if the checking indicates an error, transmitting an error notification signal to the first application and/or the second application.