Single-CPU
The simplest architecture with faultRobust technology
is a single-CPU asymmetric solution, where a standard
CPU-based microcontroller is complemented by a set of
supervisors such as the fRCPU, some
instances of the fRMEM e.g. for system
sram and tightly-coupled memories, a set of fRBUS
for internal interconnects and a set of fRPERI
to cover the peripherals.
The choice of which peripheral should be covered is
driven by the SRS and FMEA. This solution keeps the
gate-count costs for the diagnostic below 30% of the
protected logic; it has a very low beta factor and it
can be configured to achieve the level of robustness
required either for a SIL2 or a SIL3 system.

Dual-CPU
faultRobust is also suitable for multiprocessors architectures
and it can be used to implement or complement lock-step
or mutual redundant solutions. The two CPUs share an
fRCPU that includes two CPU checking
units. The System Control Unit acts like the comparator
of a dual-core approach, while the CPU Checking Units
guarantee enough clues for the System Control Unit to
determine which of the two CPUs is faulty in case of
a mismatch, thus increasing the diagnostic capability
of the system, keeping a very low beta factor thanks
to the diversity of the diagnostic logic, allowing higher
availability and a better fault-degradation path with
respect to state-of-the-art dual core architectures.

Multi-IC
At system level, the combined use of fRIPs
and fRNET allows the construction of
hierchical robust systems: each MCU or sensor is made
more robust using fRIPs while safety-relevant
information is exchanged through an off-chip implementation
of fRNET.
 |