# US 12,761,997 B2 · Method and apparatus for performing a fault recovery based on an application dependent fault reaction time

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,761,997 B2
- Document ID: US12761997B2
- Status: Granted
- Kind: B2
- Application number: 18/499,802
- Filed: 2023-11-01
- Published: 2025-03-13
- Granted: 2026-10-13
- Earliest claimed: 2023-09-12
- Assignees: NXP B.V.
- Applicants: NXP B.V.
- Inventors: Hemant Nautiyal; Marcus Mueller; Sandeep Kumar Arya; David Baca
- Web page: https://patentgrep.com/patent/US12761997B2

## CPC

- G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A fault reaction handling time interval (FRTI) for a reaction to the fault is determined based on a domain identifier (DID) indicative of an application associated with a fault. A first reaction to recover from the fault is signaled and then a determination is made whether a safe state is reached after the FRTI. Based on the safe state not being reached, a second FRTI is determined for a second escalated reaction, the second FRTI also being based on the DID. Typically, the second reaction results in less system availability so by defining the FRTI based on the DID sufficient time is allowed for reaching a safe state before the reaction is escalated.

## Claims

### Claim 1

A method performed by a fault collection and control system (FCCS) of a system on a chip (SoC), the method comprising:
receiving a domain identifier (DID) indicative of an application which caused a fault in a fault source of the SoC, the application executed by an application core of the SoC, the DID received from a DID circuit of the FCCS;
determining, by a timer circuit of the FCCS, a fault reaction handling time interval (FRTI) for a reaction to the fault, the FRTI being based on the DID, wherein the DID is provided to a multiplexer which receives from a mapping multiplexer selected by a mapping control circuit a plurality of FRTI corresponding to different DID, the plurality of FRTI associated with the reaction, and which outputs to a timer of the timer circuit the FRTI based on the provided DID;
providing, by a reaction system of the FCCS, a reaction signal associated with the fault;
determining, by the FCCS, whether a safe state of the fault source is reached based on the reaction signal after the timer indicates the FRTI has passed; and
providing an indication to a controller of the FCCS whether the safe state is reached based on the determination;
wherein the FRTI is a first FRTI and the reaction is a first reaction; wherein determining whether the safe state is reached comprises determining whether the safe state is reached after the first FRTI; wherein providing the indication comprises based on the safe state not being reached after the first FRTI, causing by the mapping control circuit the multiplexer to receive another plurality of FRTI corresponding to the different DID, the other plurality of FRTI associated with a second reaction; selecting by the multiplexer a second FRTI from a plurality of FRTI associated with the second reaction based on the provided DID and which outputs to the timer the second FRTI of the DID; signaling a second reaction associated with the fault recovery different from the first reaction and determining whether the fault is recovered after a timeout of the second FRTI is indicated by the timer of the timer circuit, wherein the first FRTI and the second FRTI are configured to reduce a time that the fault source reaches the safe state after the fault increasing functionality of the fault source after the fault compared to when the first FRTI and second FRTI do not change for different reactions; and
wherein the second reaction is more severe than the first reaction.

### Claim 2 (depends on 1)

The method of claim 1, wherein determining the first FRTI comprises selecting based on the DID the first FRTI from a lookup table which comprise a plurality of FRTI.

### Claim 3 (depends on 1)

The method of claim 1, wherein receiving the DID comprises determining that the DID is not provided by the fault source and receiving a preconfigured DID of a DID circuit based on a port to which the DID circuit is coupled, the port coupled to a fault channel of the fault source.

### Claim 4 (depends on 1)

The method of claim 1, wherein the first reaction is a software reset and the second reaction is a hardware reset of the application core.

### Claim 5 (depends on 1)

The method of claim 1, wherein determining the first FRTI comprises determining a respective FRTI from a plurality of FRTI in a look up table for each DID of a plurality of DID; and selecting from the determined FRTI and the respective DID, the first FRTI for the DID.

### Claim 6 (depends on 1)

The method of claim 1, wherein the fault source is one of the application, the application core, a resource, execution environment, or the system on a chip and the safe state is a safe operation the application, application core, resource, execution environment, or system on a chip (SoC).

### Claim 7

A fault collection and control system (FCCS) of an SoC, the FCCS comprising:
a reaction system;
a controller;
a domain identifier (DID) circuit arranged to output a domain identifier (DID) indicative of an application which caused a fault in a fault source of the SoC, the application executed by an application core of an SoC;
a timer circuit arranged to determine based on the DID a fault reaction handling time interval (FRTI) for a reaction to the fault, wherein the DID is provided to a multiplexer which receives from a mapping multiplexer selected by a mapping control circuit a plurality of FRTI corresponding to different DID, the plurality of FRTI associated with the reaction, and which outputs to a timer of the timer circuit the FRTI based on the provided DID;
the controller arranged to indicate to the reaction system a reaction associated with the fault; and
the reaction system arranged to provide a reaction signal associated with the fault recovery;
determine whether the fault is recovered based on the reaction signal and after an FRTI timeout is indicated by a timer of the timer circuit; and provide an indication of whether a safe state is reached based on the determination;
wherein the FRTI is a first FRTI and the reaction is a first reaction; wherein the reaction system arranged to determine whether the fault is recovered or safe state is reached comprises the reaction system arranged to determine whether the safe state is reached or the fault recovered after the FRTI timeout; and wherein the reaction system arranged to provide an indication of a result of the fault recovery comprises the reaction system arranged to based on the safe state not being reached, signal a second reaction associated with the fault recovery different from the first reaction;
wherein the timer circuit is further arranged to cause by the mapping control circuit the multiplexer to receive another plurality of FRTI corresponding to the different DID, the other plurality of FRTI associated with a second reaction; select by the multiplexer based on the provided DID a second FRTI from a plurality of FRTIs associated with the second reaction and output to the timer the second FRTI of the DID;
wherein the reaction system arranged to determine whether the fault is recovered or safe state is reached further comprises the reaction system arranged to determine whether the safe state is reached or the fault recovered after a timeout of the second FRTI, wherein the first FRTI and the second FRTI are configured to reduce a time that the fault source reaches the safe state after the fault increasing functionality of the fault source after the fault compared to when the first FRTI and second FRTI do not change for different reactions; and
wherein the second reaction is more severe than the first reaction.

### Claim 8 (depends on 7)

The FCCS of claim 7, wherein the DID circuit is arranged to determine that the DID is not provided by a fault source and the timer circuit is arranged to receive a preconfigured DID of the DID circuit based on a port to which the DID circuit is coupled, the port coupled to a fault channel of the fault source.

### Claim 9 (depends on 7)

The FCCS of claim 7, wherein the timer circuit arranged to determine the first FRTI comprises the timer circuit arranged to select based on the DID the first FRTI from a lookup table which comprise a plurality of FRTIs.

### Claim 10 (depends on 7)

The FCCS of claim 7, wherein the first reaction is a software reset and the second reaction is a hardware reset of the application core.

### Claim 11 (depends on 7)

The FCCS of claim 7, wherein the timer circuit arranged to determine the first FRTI comprises the timer circuit arranged to determine a respective FRTI from a plurality of FRTIs in a look up table for each DID of a plurality of DID; and select from the determined FRTI and respective DID, the first FRTI for the DID.

### Claim 12 (depends on 7)

The FCCS of claim 7, wherein the fault source is one of the application, the application core, a resource, execution environment, or the system on a chip and the safe state is a safe operation the application, application core, resource, execution environment, or system on a chip (SoC).

### Claim 13 (depends on 7)

The FCCS of claim 7, wherein the FCCS comprises a plurality of DID circuits and each DID circuit is coupled to a respective port of the FCCS which provides a respective DID for a respective fault source and stores a preconfigured DID for the respective port.

### Claim 14 (depends on 7)

The FCCS of claim 7, wherein the FRTI for one DID is different for another DID.