Hardware control path redundancy for functional safety of peripherals

1 . A circuit comprising:

primary register circuitry configured to receive a first signal to write a first value to the primary register circuitry, the primary register circuitry including a primary register and a primary shadow register coupled to the primary register;

secondary register circuitry configured to receive a second signal to write a second value to the secondary register circuitry, the secondary register circuitry including a secondary register and a secondary shadow register coupled to the secondary register;

a counter configured to count a set amount of time from when the first signal is received;

a controller coupled to the counter, the controller configured to receive at least one of:

a third signal indicating whether the second signal was detected within the set amount of time, and

a fourth signal indicating whether the first value is the same as the second value;

a primary control register coupled to the controller and the primary shadow register; and

a redundant control register coupled to the primary control register and the primary shadow register.

2 . The circuit of claim 1 , wherein the counter is further configured to send a timeout signal to the controller when the second signal was not detected within the set amount of time.

3 . The circuit of claim 2 , wherein the controller is configured to assert a safety warning signal in response to receiving the timeout signal.

4 . The circuit of claim 1 , further comprising:

a comparator coupled to the primary and secondary register circuitry, the comparator configured to compare the first value in the primary register circuitry to the second value in the secondary register circuitry and output the fourth signal indicating whether the first value is the same as the second value.

5 . The circuit of claim 4 , wherein the controller is further configured to assert a safety warning in response to the fourth signal indicating that the first value is not the same as the second value.

6 . The circuit of claim 1 , wherein the set amount of time is based on a value configured during a boot-up process for the circuit and locked from modification while the circuit is running.

7 . The circuit of claim 1 , wherein:

the primary register is configured to receive the first signal; and

the secondary register is configured to receive the second signal.

8 . The circuit of claim 7 , wherein:

the primary control register is configured to store a first operational value; and

the redundant control register is configured to store a second operational value.

9 . The circuit of claim 8 , wherein, in response to receiving the fourth signal indicating that the first value is the same as the second value, the controller is configured to update the primary control register and the redundant control register with the first value.

10 . The circuit of claim 8 , further comprising:

a comparator coupled to the primary control register and to the redundant control register, the comparator configured to compare the first operational value to the second operational value.

11 . The circuit of claim 10 , wherein, in response to the comparison indicating that the first operational value is not the same as the second operational value, the comparator is further configured to output a fault indication signal.

12 . The circuit of claim 1 , wherein the circuit is embodied in a peripheral device comprising a safety disable register configured to disable redundancy functionality, wherein when the redundancy functionality is disabled, only the primary register circuitry is used for controlling the peripheral device.

13 . The circuit of claim 1 , wherein the first signal is received from a first processor, and the second signal is received from a second processor that is distinct from the first processor.

14 . The circuit of claim 1 , further comprising:

a multiplexer, wherein the set amount of time is selected from a plurality of timeout values via the multiplexer.

15 . The circuit of claim 1 , wherein the circuit is implemented in a system-on-a-chip.

16 . A method comprising:

detecting a first signal to write a first value;

writing the first value to primary register circuitry;

starting a timer in response to detecting the first signal;

determining whether a second signal to write a second value to secondary register circuitry is detected within a set amount of time as determined by the timer; and

based on whether the second signal was detected within the set amount of time, performing one of:

writing the second value to the secondary register circuitry when the second signal was detected within the set amount of time, and

when the second signal was not detected within the set amount of time, asserting a safety warning signal, incrementing a safety warning count in response to assertion of the safety warning signal, and comparing the incremented safety warning count to a safety warning threshold.

17 . The method of claim 16 , wherein after writing the second value to the secondary register circuitry, the method further comprises:

comparing the first value to the second value;

determining that the first value is the same as the second value; and

updating values in a primary control register and a second control register, respectively.

18 . The method of claim 16 , wherein after writing the second value to the secondary register circuitry, the method further comprises:

comparing the first value to the second value;

determining that the first value is not the same as the second value; and

asserting a safety warning signal.

19 . The method of claim 16 , further comprising:

issuing a safety fault event signal when the comparing indicates that the incremented safety warning count is greater than or equal to the safety warning threshold.

20 . The method of claim 16 , wherein, when the second signal was detected within the set amount of time, the method further comprising:

resetting the timer in response to detection of the second signal.