Microcontroller

Patent metadata

Field	Value
Publication number	US-10650143-B2
Application number	US-201815964273-A
Country	US
Kind code	B2
Filing date	Apr 27, 2018
Priority date	Apr 27, 2017
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

A microcontroller with a built-in self-healing function. A programmable memory stores a normal control routine. A processing unit is arranged to execute the normal control routine in order to provide output data on the output line. A danger signal input line which is connected to a logic unit and dedicated to communicating a danger signal to the logic unit. Processor and logic unit state lines are provided between the processing unit and the logic unit for communicating processor state data from the processing unit to the logic unit and communicating logic unit state data from the logic unit to the processing unit. An interrupt line between the logic unit and the processing unit is dedicated to communicating an interrupt signal from the logic unit to the processing unit.

First claim

The invention claimed is:

1. A microcontroller comprising:
a programmable memory storing a normal control routine;
an output line;
a processing unit arranged to execute the normal control routine to provide output data on the output line;
a logic unit;
a danger signal input line connected to the logic unit and dedicated to communicating a danger signal to the logic unit;
one or more processor state lines between the processing unit and the logic unit for communicating processor state data from the processing unit to the logic unit;
one or more logic unit state lines between the logic unit and the processing unit for communicating logic unit state data from the logic unit to the processing unit;
an interrupt line between the logic unit and the processing unit dedicated to communicating an interrupt signal from the logic unit to the processing unit; and
a read-only-memory storing a danger interrupt service routine,
wherein the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to receipt of the danger signal on the danger signal input line;
the processing unit is arranged to always respond to the receipt of the interrupt signal from the logic unit on the interrupt line by interrupting the normal control routine, or any other routine executing on the processing unit, and executing the danger interrupt service routine stored in the read-only memory,
wherein the danger interrupt service routine accesses the one or more logic unit state lines to determine and apply corrective action; the logic unit is arranged to store processor state data from the one or more processor state lines to provide stored state data, the stored state data being associated with the normal control routine executing on the processing unit; the logic unit is arranged to learn a correlation between the receipt of the danger signal on the danger signal input line and a subset of the stored state data; and having learnt the correlation, the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to the receipt of the subset of the stored state data on the one or more processor state lines;
wherein the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to the receipt of the subset of the stored state data on the one or more processor state lines, pre-empting the receipt of another instance of the danger signal, and
wherein the logic unit is arranged to learn a correlation between the receipt of multiple instances of the danger signal on the danger signal input line and the subset of the stored state data.

2. The microcontroller of claim 1 , wherein the programmable memory, the processing unit, the logic unit and the read-only-memory are on a single chip of semiconductor material.

3. The microcontroller of claim 1 , wherein the logic unit comprises a logic unit memory; and the stored state data is stored in the logic unit memory.

4. The microcontroller of claim 1 , wherein the logic unit is separate from the processing unit so that the processing unit cannot change any aspect of the operation of the logic unit.

5. The microcontroller of claim 1 , wherein the programmable memory is a flash memory.

6. The microcontroller of claim 1 , wherein the output line is an input/output line.

7. The microcontroller of claim 1 , wherein the danger interrupt service routine accesses the stored state data via the one or more logic unit state to determine the corrective action.

8. A microcontroller comprising:
a programmable memory storing a normal control routine;
an output line;
a processing unit arranged to execute the normal control routine to provide output data on the output line;
a logic unit;
a danger signal input line connected to the logic unit and dedicated to communicating a danger signal to the logic unit;
one or more processor state lines between the processing unit and the logic unit for communicating processor state data from the processing unit to the logic unit;
one or more logic unit state lines between the logic unit and the processing unit for communicating logic unit state data from the logic unit to the processing unit;
an interrupt line between the logic unit and the processing unit dedicated to communicating an interrupt signal from the logic unit to the processing unit; and
a read-only-memory storing a danger interrupt service routine,
wherein the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to receipt of the danger signal on the danger signal input line;
the processing unit is arranged to always respond to the receipt of the interrupt signal from the logic unit on the interrupt line by interrupting the normal control routine, or any other routine executing on the processing unit, and executing the danger interrupt service routine stored in the read-only memory,
wherein the danger interrupt service routine accesses the one or more logic unit state lines to determine and apply corrective action; the logic unit is arranged to store processor state data from the one or more processor state lines to provide stored state data, the stored state data being associated with the normal control routine executing on the processing unit; the logic unit is arranged to learn a correlation between the receipt of the danger signal on the danger signal input line and a subset of the stored state data; and having learnt the correlation, the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to the receipt of the subset of the stored state data on the one or more processor state lines; and
wherein the logic unit comprises an OR-gate which is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to receipt of the danger signal on the danger signal input line or in response to the receipt of the subset of the stored state data on the processor state line(s).

9. A microcontroller comprising:
a programmable memory storing a normal control routine;
an output line;
a processing unit arranged to execute the normal control routine to provide output data on the output line;
a logic unit;
a danger signal input line connected to the logic unit and dedicated to communicating a danger signal to the logic unit;
one or more processor state lines between the processing unit and the logic unit for communicating processor state data from the processing unit to the logic unit;
one or more logic unit state lines between the logic unit and the processing unit for communicating logic unit state data from the logic unit to the processing unit;
an interrupt line between the logic unit and the processing unit dedicated to communicating an interrupt signal from the logic unit to the processing unit; and
a read-only-memory storing a danger interrupt service routine,
wherein the logic unit is arranged to communicate the interrupt signal to the processing unit via the interrupt line in response to receipt of the danger signal on the danger signal input line;
the processing unit is arranged to always respond to the receipt of the interrupt signal from the logic unit on the interrupt line by interrupting the normal control routine, or any other routine executing on the processing unit, and executing the danger interrupt service routine stored in the read-only memory,
wherein the danger interrupt service routine accesses the one or more logic unit state lines to determine and apply corrective action; the logic unit is arranged to store processor state data from the one or more processor state lines to

Assignees

• Airbus Group Ltd
• Airbus Operations Ltd

Inventors

• French Richard
• Degeler Viktoriya
• Jones Kevin

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/86

  Secure or tamper-resistant housings · CPC title

• G06F11/004 Primary

  Error avoidance (G06F11/07 and subgroups take precedence) · CPC title

• G06F11/3024

  where the computing system component is a central processing unit [CPU] · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title