DE102005037262A1 - Device and method for controlling a computer system - Google Patents

Abstract

Device and method for controlling a computer system with at least two identical or similar functional units, with functional units being activated and / or deactivated as a function of predeterminable conditions.

Description

The Production of complex semiconductor devices such as microcontrollers (μC) or also ASICs are prone to error. Since the doping with ever smaller structural sizes a statistical process is inevitable even in the long term, manufacturing errors. It even stands out that the error rate, despite great efforts and progress will increase in the future. Yield, i.e. The relationship the correct working components to the number of manufactured components for one mastered the manufacturing process at about 90% (that is, even here: 10% committee), but it is quite possible that much lower values occurrence. Mechanisms to increase the yield are therefore direct cost-cutting. Furthermore comes from testing and manufacturing considerations reinforced the requirement to handle bad components in the field can.

Around Error in the production of memory devices such as Flash, RAM or Tolerating ROM in operation is a mean that is already partially used today the use of an error correcting code (ECC). This will be about the Storage of data bits also check bits also stored with. The check bits are such that when adulterated only one bit (or a known maximum number of bits) of the error can be detected and corrected by an additional logic. This causes the entire component (or the corresponding subcomponent a component), even in the presence of errors, a correct Result delivers. The co-storage of the check bits requires a significant Additional expense while the necessary additional logic causes practically no large additional costs.

error in semiconductor circuits, especially in computer systems can also occur during operation of these circuits. In most cases it is not possible, high availability to ensure in systematic form even with permanent errors. One of the few exceptions are memory ECC mechanisms. For transient Errors in processors, especially CPUs, are recovery or reset actions known. For Errors in execution units but is not a realistic, cost-effective concept for tolerating known of permanent errors.

It is a first object of the invention, the yield in the manufacturing process from μC or To improve semiconductor devices, in particular the fact that also for Components with faulty functional units a use is possible. A second object of the invention is availability of building components in operation. These are intended to funds for disposal be made available, which make it possible faulty execution units (e.g., cores, ALU, processors) in a device to identify and the one "graceful degradation "or a run-flat in the operation of a system using this device, enable.

Advantages of invention

considered is a semiconductor circuit, for example, a μC, at least contains two identical or similar functional units. At the end of Production process, during assembly, during diagnosis or in Test phases during operation become potential through a test program identified faulty functional units. This can be advantageous by means of a switching and comparison function, for example shown be done in a switching and comparison unit, the output signals a functional unit with the output signals of at least one another functional unit and / or compared with other reference values. It is stored in a memory element, which functional units are faulty. These functional units are used, e.g. from the switchover and comparison unit or over a breaker disabled. The device is, although it contains faulty functional units, nevertheless usable and functioning.

Advantageous is a method for controlling a computer system with at least described two identical or similar functional units, wherein dependent of specifiable conditions activation and / or deactivation is made by functional units.

Advantageous a method is described, characterized in that a Activation and / or deactivation of functional units depending on the results of at least a first method step for Detection of a fault in the computer system and / or at least a second Method step for identifying a faulty functional unit he follows.

Advantageous a method is described, characterized in that the Computer system at least two identical or similar functional units contains and that between at least two modes of operation, the at least two identical or similar functional units of the computer system is switched and a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode.

Advantageous a method is described, characterized in that in the comparison mode errors in the output signals of the functional units to be compared be recognized and the comparison mode a first step to detect an error in the computer system corresponds to advantageous a method is described, characterized in that selected functional units of the Computer system are switched to an operating mode in which an identification of faulty functional units by a Comparison of the output signals of these functional units with reference values possible is and this mode of operation a second method step for Identification of a faulty functional unit in the computer system corresponds

Advantageous a method is described, characterized in that the Reference values stored in a memory device of the computer system and when switching to the operating mode for error identification be read from the memory device.

Advantageous a method is described, characterized in that a Switching between at least two modes of operation during operation the computer system cyclically or on request.

Advantageous a method is described, characterized in that the switching between at least two modes of operation for the purpose of recognizing Errors and / or the identification of faulty functional units he follows. Advantageously, a method is described, wherein for at least the functional units of the computer system identified as faulty a configuration status and / or error status is formed.

Advantageous a method is described, characterized in that a Deactivation of a functional unit is done by providing information about the Configuration status or the error status of this functional unit be stored in a memory device such that these read out during initialization and / or operation of the semiconductor system can be and the stored information is processed so that a Use of units marked as disabled during operation not possible becomes.

Advantageous a method is described, characterized in that for all activatable and / or deactivatable functional units of the computer system a configuration status and / or an error status is formed.

Advantageous is a method described, characterized in that information about the configuration status and / or the error status of the activatable and / or deactivatable Function units are stored in a memory device. Advantageously, a method is described, characterized that the computer system at least two identical or similar Contains functional units and that at least one of the same or similar functional units disabled by default in the computer system is.

Advantageous a method is described, characterized in that at least an information about the configuration status of the deactivated functional unit in one Storage device is stored.

Advantageous a method is described, characterized in that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place in that at least the functional unit identified as faulty is deactivated.

Advantageous is a method described, characterized in that in the case deactivation of a functional unit due to an error information about the configuration status and / or an error status of this functional unit is written in a memory device.

Advantageous a method is described, characterized in that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place, whereby the as faulty disabled function unit is disabled and a default disabled, but not faulty functional unit is activated.

Advantageous a method is described, characterized in that the first method step for detecting a fault the intended operation the at least two identical or similar functional units of the computer system in a comparison mode.

Advantageous a method is described, characterized in that the second method step for identifying a faulty unit the execution of an error detection routine on at least one Function unit and a comparison of the results of the error detection routine corresponds to reference values.

Advantageously, a method is described, characterized in that prior to or to the implementation of the method step for identifying a faulty unit, a reconfiguration of the computer system is performed, the execution of different functions, commands, Program segments or programs on the same or similar functional units allows.

Advantageous a method is described, wherein the reference values of the error detection routines together stored with the error detection routines in a memory device are

Advantageous a method is described, characterized in that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place, wherein at least the functional unit identified as faulty is deactivated.

Advantageous is a method described, characterized in that in the case deactivation of a functional unit due to an error Configuration status and an error status of this functional unit be written in a memory device.

Advantageous a method is described, characterized in that at least some of the functions, commands, program segments or programs, the before a reconfiguration of the computer system for processing are determined in a first operating mode, after a reconfiguration of the Computer system are processed in a second mode of operation.

Advantageous a method is described, wherein the first operating mode a Comparison mode and the second operating mode a performance mode or a failure mode with only one active functional unit.

Advantageous a method is described, characterized in that the Deactivation of functional units irreversible by interrupting electrical Connections to or between functional units of the computer system he follows. Advantageously, a method is described, characterized that an interruption of electrical connections in the computer system by electrical action on at least part of the compounds is achieved ..

Advantageous a method is described, characterized in that a Activation and / or deactivation of functional units during the Operating the computer system and using devices takes place, which are part of the computer system or which constantly with connected to the computer system. A device is advantageous for controlling a computer system with at least two same or similar functional units described, characterized in that Agents are present that have an activation and / or deactivation of functional units of the computer system depending on specifiable conditions enable.

Advantageous is a device included, characterized in that means exist to error detection in the computer system and / or to allow identification of faulty functional units.

Advantageous is a device included, wherein the device switching means contains the one switching between at least two operating modes of at least two identical or similar functional units of the computer system allows and a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode.

Advantageous is a device included, characterized in that the Device contains means to selected Switch functional units of the computer system into an operating mode, in which an identification of faulty functional units by a comparison of the output signals of these functional units with Reference values possible is.

Advantageous is a device included, characterized in that the Device comparison means comprises to output signals from functional units with output signals of at least one further functional unit or compare with reference values and if there is a discrepancy an error information to create.

Advantageous is a device included, characterized in that the Device memory means, in which reference values for the output signals are stored by functional units and further comprises means reference values from the memory device of a comparison device supply.

Advantageous is a device included, characterized in that means There is a configuration status and / or an error status for all activatable and / or deactivatable functional units of the computer system to build. Advantageously, a device is included, characterized in that the device contains means for storing data in which at least one piece of information about the configuration status or the error status of the activatable and / or deactivatable functional units are stored.

Advantageous is a device included, wherein the means for storage non-volatile data Storage means are.

Advantageous is a device included, characterized in that means present during initialization and / or operation of the Computer system stored in a memory device configuration state and / or error states of the functional units read out and dependent on the read-out data and an error signal of the comparator can perform an activation and / or deactivation of functional units.

Advantageous is a device included, wherein means are present, the deactivation of functional units can irreversibly perform. Advantageous is a device that contains means that are for the irreversible deactivation of functional units at least an electrical connection to this or in these functional units interrupts.

Advantageous is a device that contains means that are an interruption of electrical connections to or in functional units by electrical action on at least a part of these compounds can work. Advantageous is a device included, characterized in that the Means for error detection, activation and / or deactivation of functional units are part of the computer system or constantly using connected to the computer system.

Further Advantages and advantageous embodiments will be apparent from the features the claims as well as the description.

characters

1 describes a general switching component with a switching logic and processing logic

2 describes the connection of the switching component with a memory element

3 describes a principal method for increasing yield using a storage element

4 describes a principle method for increasing availability, graceful degradation and emergency operation.

5 describes the connection of the switching component with an influencing component

6 describes a principal method for increasing the yield using an influencing component

7 describes the structure of a possible memory element

description the embodiments

A execution unit can below both a processor / core / CPU, as well as an FPU (Floating Point Unit), a DSP (Digital Signal Processor), a Coprocessor or an ALU (Arithmetic logical Unit) denote.

In 1 First, a general case of the switching and comparison unit, is also shown for the use of more than two execution units. Of the n execution units to be considered, n signals N140,..., N14n go to the switching and comparison component N100. This can generate up to n output signals N160, ..., N16n from these input signals. In the simplest case, the "pure performance mode", all signals N14i are directed to the corresponding output signals N16i In the opposite limit case, the "pure comparison mode", all signals N140, ..., N14n are directed to only one of the output signals N16i.

At this figure leaves Explain how the various conceivable modes can arise. To N100 contains the logical component of a switching logic N110. It is first Task of the switching logic to determine which inputs to none Output are switched, i. which inputs are ignored without Consequences remain or are inactive. This function of the switching logic is often referred to below as the first function of the switching logic. Furthermore, switching logic N110 determines how many output signals it will ever have and which of the input signals to which of the output signals contribute. In this case, an input signal at most to exactly one output signal contribute. This function of the switching logic will be often in the following Also referred to as the second function of the switching logic.

In formulated differently mathematical form is thus without blocking of Signals through the switching logic defines a function that everyone Element of the set {N140, ..., N14n} an element of the set {N160, ..., N16n}. With the blocking of individual input signals is more generally defined by the switching logic a function that each element of a specified subset of {N140, ..., N14n} (the unlocked signals) an element of the set {N160, ..., N16n}.

The processing logic N120 then determines to each of the outputs N16i how the inputs contribute to that output signal. Around By way of example, to describe the various possible variations, it is assumed without loss of generality that the output N160 is generated by the signals N141, ..., N14m. If m = 1, this simply means that the signal is switched through, if m = 2 then the signals N141, N142 are compared. This comparison can be performed synchronously or asynchronously, it can be performed bitwise or only on significant bits or even with a tolerance band. A preferred possibility is that execution units run in lockstep mode (ie same instructions at the same clock rate). A fixed clock or phase offset is also an advantageous solution.

If m> = 3 there are several Options.

A first option is to compare all the signals and if present at least two different values to detect an error, which one can signal optional.

A second option consists in making a k out of m selection (k> m / 2). This can be through Use of comparators can be realized. Optionally, a Error signal generated when one of the signals detected as deviant becomes. One maybe different error signal can be generated if all three signals are different.

A third possibility is to apply these values to an algorithm. This For example, the formation of an average, a median, or the use of a Fault Tolerant Algorithm (FTA). Such an FTA is based on omitting extreme values of the input values delete and make a kind of averaging over the remaining values. This averaging can over the total amount of the remaining values, or preferably over one be made in HW easily formed subset. In this Case it is not always necessary to actually set the values to compare. For example, averaging only adds up and divide, FTM, FTA or median require a partial Sorting. If necessary, can also be here at sufficiently large extreme values optionally an error signal can be output.

These various options mentioned processing of multiple signals into one signal will be for brevity referred to as comparison operations.

The The task of the processing logic is therefore to determine the exact shape of the Comparison operation for every output signal - and with it also for the associated Input signals - specify. This is hereafter referred to as the second function of the processing logic designated. The usually possible identification of faulty execution units is hereafter referred to as the first function of the processing logic designated.

The Combination of the information of the switching logic N110 (i.e. Function) and the processing logic (i.e., the determination of the comparison operation per output, i. per function value) is the mode information and this sets the mode. This information is in general Case of course multivalent, i.e. not just about a logical bit can be displayed. Not all theoretically conceivable Modes are useful in a given implementation, preferably restrict the number of allowed modes. To emphasize is that in the case of only two execution units, where there is only one comparison mode, all the information is on only one logical bit can be condensed.

A Switching from a performance to a comparison mode is in General case characterized in that execution units, the be displayed on different outputs in the performance mode, be displayed in the comparison mode on the same output out. Preferably, this is realized by being a subsystem of execution units where, in the performance mode, all input signals N14i, the in the subsystem are switched directly to corresponding output signals N16i be while they are all mapped to one output in comparison mode. Alternatively, such switching can also be realized thereby be changed that pairings become. It is represented by that in the general case can not speak of the performance mode and the comparison mode, although in a given aspect of the invention, the amount restrict the allowed modes so can that be the case. But you can always switch from one to another from the performance to the compare mode (and vice versa).

in the The following describes how to use such a changeover and comparison component and some other elements under certain Conditions the yield in the manufacturing process of semiconductor devices, e.g. .mu.C increase can.

The Basic idea is roughly outlined the following: On the device, for example a μC, are more execution units, as needed in operation.

Thus, you can work with less than the full number of correctly working execution units in operation. requirement is, that incorrectly operating units are identified and can not affect the overall system.

The Use of a switching and comparison unit described above allows it, about the Switching logic N110 the signals of faulty execution units at the other To prevent dissemination in the system.

The Processing logic N120 enabled it, signals of different execution units to compare. By a suitable comparison one can erroneous execution units identify. This is possible, if one uses a sufficiently error-covering test program. If necessary, one can also use external means of identification deploy.

Thereby, that such a test at any time, e.g. at the end of the band, at initialization time or during assembly, the Result (i.e., uniquely identifying the failed execution units) in a preferably non-volatile Memory stores and that this result the switching logic N110 influenced such that the signals of faulty execution units without Impact receives one μC, its correctly working execution units can still be used even if erroneous execution units available.

By the fault tolerance thus realized in the product can be the yield increase, since so also faulty components can be used, so long the number of still working execution units large enough is. This depends on the application.

These Idea is now detailed.

A possible Logical shape of the switching and comparison unit is described above. It Although it is advantageous for the application of the invention described herein but not necessary that the component exists as such and that the named sub-components are switching and processing logic exist.

critical for the First function of the switching logic is that outputs are potentially faulty Components in a suitable form can be ignored. This can be done by these outputs, for example, by switches, interrupted become. Another possibility is it, the outputs on a standard "catcher" for faulty To switch signals. Another possibility is the output signals as invalid to mark. Yet another way, beyond that or alternatively, it is the occurrence of such output signals prevent by disabling the appropriate component itself becomes. This in turn can be achieved by disabling the component, a pause, a clock interruption or an interruption of the Input signals can be realized. This also has the advantage that The power loss minimizes and thus life, reliability and temperature load is optimized. The following are all Execution units, whose output can be ignored by any means passive or inactive.

critical for the First function of the processing logic is first that a faulty component can be identified. A preferred option is to run all execution units in parallel execute the same program allow. Preferably but not necessarily this can be realized thereby be that execution units in a lockstep mode or with a fixed clock or phase offset operate. Through a suitable comparison can thus over a Majority decision a potentially present defective component be identified. Optionally in addition to a production, initialization or tape test the results of this program with the previously known results an external unit (watchdog, other μC, tester, ASIC) are compared. This is particularly advantageous if only two execution units be present, since in this case when a difference between both execution units a third piece of information identifying the erroneous execution unit necessary is. Such a comparison can be made via the comparison operations described above Be also realized in such a way that he only in pairs or carried out on subsets becomes, until such time as a clear identification potentially faulty Execution units is possible. The processing logic must therefore be the result of this first function identify the faulty components.

The test program must be designed in such a way that an error is most likely to have an effect. To develop such a program, for example, an error model (eg, stuck-at model) may be used, a portion of the application code may be run, or a complete command test. In the case of the tape test, this may correspond to a test program today, which is limited to the execution units. But you can also link this with a common today band test and test only those components with this program, which have already failed by the first band end test. This last procedure has the particular advantage that only components are subjected to an additional process step, which otherwise belong to the committee. Every component that passes through the the last "rescue step" was won, directly increases the yield of the manufacturing process.

After this the first function of the processing logic is the faulty units has identified, this information must be stored. When applying the method according to the invention to the manufacturing process to increase the yield is preferably a non-volatile memory element is used. This then stores which execution units are inactive.

In 2 the function of this memory element is shown. The elements N510, N520, N54i, N56i of the switchover and comparison unit N500 in 2 have the same functions as the elements N110, N120, N14i, N16i of the switching and comparison unit N100 in FIG 1 , In addition, a memory element N530 is shown. The processing logic N520 sends the information about the execution units identified as faulty to the memory element N530. This can be accessed by the N510 switching logic and the first function of the switching logic so that the elements marked as inactive by N530 actually become inactive.

The Storage element can of course within the switching and comparison unit, but it can also outside lie, even outside the Component. For example, when mounting a μC in one control unit or a pc an external element conceivable, since then possibly used a more extensive test using the peripherals can be.

The basic process idea for increasing the yield in production is in 3 described. In a first step N600 (identification step), an identification of faulty execution units takes place. The identification uses the first function of the processing logic N520 and thus the test program. In the second step N610 (storage step), the error information is stored. The corresponding information is given by the processing logic N520 to the memory element N530. In the third step N620 (configuration), the switching logic N510 uses the information from N530 and uses the first function of the switching logic to configure the outputs of the execution units according to the required activity and passivity. It should be emphasized that although this can optionally be done by SW, in a preferred application the configuration is not exercised by SW control here.

Of the Main reason for inactivity is faultiness. However, in a preferred extension also other reasons valid be. For example, it is possible that even for completely error-free components in this memory element execution units marked as inactive.

In particular, if the test is not only at the end of the tape, but during operation (for example, in an initialization phase or even during normal operation), it is possible that errors that do not occur during production but in operation, are detected. Via the second function of the switching logic (to link the active execution units together in operation) and the second function of the processing logic (to make a comparison for the signals switched to an output) as in the description of FIG 1 is shown, it is easily possible to detect errors during operation and to identify faulty execution units.

If error-free execution units are marked as inactive, so it is possible when a Error in operation against unit identified as faulty to exchange a faultless but inactive unit. Preferably For this purpose, information is stored in memory element N530 as to whether the execution unit only inactive or if it is still faulty. It is advantageous not possible during operation, that the information that a given execution unit is faulty changed becomes.

In 7 is a principle possible structure of a memory element O100 (equivalent to N530) described. It contains a first memory area O110, in which there are memory locations O120,..., O12n, preferably corresponding to the number of execution units. Each memory location is preferably realized via at least one bit. The number or address of the memory location O12i is uniquely linked to the number or identification of an execution unit. For example, a bit in O120 that is set to 0 indicates that the associated execution unit is active. If set to 1, the associated execution unit should be inactive. This information can be fault tolerant or linked to other information in the memory locations O120, ..., O12n, the basic information content, based on this application remains the same.

Optionally, there is additionally a second memory area O140, in which there are memory locations O130,..., O13n, preferably corresponding to the number of execution units. Each memory location is preferably realized via at least one bit. The number or address of the memory location O13i is uniquely linked to the number or identification of an execution unit. For example, a bit in O130 that is set to 0 indicates that the associated execution unit is healthy. If it is set to 1, it means that the associated execution unit is faulty. This information can be fault tolerant or linked to other information in the memory locations O130, ..., O13n, the basic information content, based on this application remains the same. Optionally, this memory area can not be described or only under special circumstances or in a special way, so that it is ensured that an execution unit once marked as defective is not erroneously marked as error-free.

By the use of inactive but error-free execution units, it is possible to cold redundancy that this method offers for error-free components, for availability and increase reliability.

A another possibility Using the invention is Graceful Degradation and Limp home To enable modes.

The premise here is that an error has been discovered during operation via the above-mentioned second function of the processing logic. A then preferably used method is in 4 described. First, an error is detected in step N700 (error detection). This can be done, for example, by using a test program. However, if the system is in a comparison mode, such as can be set via the second functions of the processing logic and the switching logic, such a fault detection is also possible in normal operation, ie the application software acts as a test program. This is particularly advantageous for two reasons: on the one hand, you do not need a dedicated test program, on the other hand, all errors of the execution units that have any effect are discovered in this way. In step N705 it is checked whether a faulty execution unit can already be identified by the existing configuration of switching and processing logic. If so, then steps N710 (error detection configuration) and N720 (identification step) have already been completed, and it goes directly to step N730. This is the case, for example, when the error occurs in a subsystem in which the signals from 3 execution units are compared. If this is not the case (in step N705) (for example, if an error is detected in a subsystem of two execution units that are running in a compare mode), a configuration that allows error identification must first be selected in step N710. This is most easily done, for example, by combining the "suspected candidates" (ie, all execution units involved in the subsystem that generated an error) with a sufficient number of other execution units together by the switching logic N510 for an output signal the SW part that revealed the error is reused as a test program, but a dedicated test program can also be used The first function of the processing logic then allows step N720 to be performed and the failed execution unit to be identified Alternatively, another method of identification may be chosen: for example, one of the suspected candidates is taken and coupled to another error-free execution unit. If no error is identified, another execution unit is faulty eser execution unit to be closed. Although the latter method does not offer the same security of identification, but it can be used more easily during operation, would be advantageous if, for example, in a motor vehicle just runs a critical driving maneuver, which is influenced by the device.

After this completed the identification of the faulty execution unit is, the two steps N730 run (storage step, corresponds to N610) and N740 (confguration, equivalent to N620).

To emphasize that it is in this last step by the inventive method now several advantageous options gives.

If There are enough error-free but inactive execution units can, as described above, a fully functional system again produce.

If There are too few error-free execution units for the Normal operation, you can use the existing software as well as it is based on the existing execution units expire. This is especially beneficial when the system normally specified with runtime reserves. Then it is probably that too, a reduced amount of execution units sufficient performance available to ensure operation. This is particularly supportable at the system level that particularly high performance operating conditions (e.g., high speeds in the Engine of a motor vehicle) are avoided.

If There are too few error-free execution units for the Normal operation, you can alternatively only a subset of the application expire.

If there are too few error-free execution units for normal operation, you can run the application in other modes in a third possibility. For example, you can do without a strong comparison mode and only a weaker comparison mode or per use formatting mode. In this case, although only a weaker error detection or fault tolerance is given for the following operation, but this is tolerable under certain circumstances, since this condition may only be maintained for a limited time. This option is particularly easy to implement with this invention, since only the components and methods set out here have to be used. Of course, combinations of these variants are also conceivable.

A in principle different possibility, The idea of this invention is to apply to the memory element to dispense with and use other means to potentially defective execution units disable it so that it reliably and irreversibly disabled are. This can be done by influencing (for example, separation or Connection) of lines in the device done.

Different options are:
Use of dedicated line antifuses (this can be used in operation, maintenance, assembly, or manufacturing), mechanical treatment (soldering, disconnecting), laser, electron, X-ray, or special electrical Signals and chemical influence on the lines.

Instead of the memory element to an influencing component is necessary. In 5 the function of this influencing component is shown. The elements N810, N820, N84i, N86i of the N800 switching and comparison unit in 5 have the same functions as the elements N110, N120, N14i, N16i of the switching and comparison unit N100 in FIG 1 , In addition, an influencing component N830 is shown. The processing logic N820 sends the information about the execution units identified as faulty to the influencing component N830. This has means, as enumerated above, to influence lines or functional groups in the component so that execution units are deactivated. N830 may be a component within the device, controller, or system, but N830 may also be a machine in the manufacturing process or a human operator of such a machine. It is also possible that this component is used in maintenance. Optionally, the corresponding information can still be given to the switching logic so that it performs the first function in such a way that the elements marked as inactive by N830 actually become inactive.

The basic process idea for the yield increase using the influencing component N830, is in 6 described. In a first step N900 (identification step) an identification of faulty execution units takes place. The identification uses the first function of the processing logic N820 and thus the test program. In the second step N910, the error information is given by the processing logic N820 to the influencing component N830. In the third step N920, the influencing component N830 uses this information in order to use the means at its disposal to influence the lines or functional groups in the component in such a way that the faulty components are inactive. In the optional fourth step N930, the switching logic N810 uses the information and uses the first function of the switching logic to configure the outputs of the execution units according to the required activity and passivity.

Of course you can Such an influencing component can also be used during operation. All the benefits of using a storage element are also applicable here, since the impact on the system is the same is. But then it is advantageous if the influencing component exists as a hardware component in the system.

Except on in the description of the embodiments mentioned Execution units can be the advantageous methods and devices also on other components a semiconductor circuit such as e.g. Analog / digital converters, timer modules, Interrupt controller, communication controller or control units be applied. The following is the totality of these components a semiconductor circuit under the term functional units summarized.

In a further preferred embodiment The invention described herein is combined with ECC protection for others Memory elements used. In this case, a highly available component is created, where both memory and execution units are designed to be fault tolerant are and thus make it possible both to maximize yield and optimal availability to ensure during operation.

Claims (42)

Method for controlling a computer system having at least two identical or similar functional units, characterized in that an activation and / or deactivation of functional units is performed depending on predefinable conditions. A method according to claim 1, characterized in that an activation and / or deactivation of functional units in dependence of the results of at least a first method step for detecting an error in Rechnersys tem and / or at least a second method step for identifying a faulty functional unit takes place. Method according to claim 1, characterized in that that the computer system at least two identical or similar Contains functional units and that between at least two operating modes of the at least two same or similar functional units of the computer system switched and a first mode of operation a comparison mode and a second operating mode corresponds to a performance mode. Method according to Claims 2 and 3, characterized that in the comparison mode, errors in the output signals to be compared Function units are detected and the comparison mode one first method step for detecting an error in the computer system corresponds to Method according to one of the preceding claims, characterized marked that selected Functional units of the computer system are switched to an operating mode, in which an identification of faulty functional units by a comparison of the output signals of these functional units with Reference values is possible and this mode of operation a second method step for identification corresponds to a faulty functional unit in the computer system Method according to claim 5, characterized in that that the reference values in a memory device of the computer system are stored and when switching to the operating mode for error identification be read from the memory device. A method according to claim 3 or claim 5, characterized characterized in that a switching between at least two operating modes during the Operation of the computer system cyclic or on request. Method according to claim 7, characterized in that that is the switching between at least two modes of operation for the purpose the detection of errors and / or the identification of faulty functional units he follows. Method according to one of the preceding claims, characterized marked that for at least the functional units identified as faulty the computer system, a configuration status and / or error status is formed. Method according to claim 9, characterized that a deactivation of a functional unit takes place thereby, that information about the configuration status or the error status of this functional unit be stored in a memory device such that these during initialization and / or operation of the semiconductor system can be read out and the stored information is processed so that a Do not use the units marked as disabled during operation allows becomes. Method according to one of the preceding claims, characterized marked that for all activatable and / or deactivatable functional units of Computer system, a configuration status and / or an error status is formed. Method according to claim 11, characterized in that that information about the configuration status and / or the error status of the activatable and / or deactivatable functional units in a memory device get saved. Method according to claim 1, characterized in that that the computer system at least two identical or similar Contains functional units and that at least one of the same or similar functional units disabled by default in the computer system is. Method according to claim 13, characterized in that that at least information about the configuration status the disabled functional unit in a memory device is stored. Method according to claim 14, characterized in that that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place in that at least the functional unit identified as faulty is deactivated. Method according to claim 15, characterized in that that in the case of deactivation of a functional unit due an error about information the configuration status and / or an error status of this functional unit is written in a memory device. Method according to claim 15, characterized in that that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place, whereby the as faulty disabled function unit is disabled and a default disabled, but not faulty functional unit is activated. A method according to claim 3, characterized in that the first method step for detecting a fault to the normal operation of the at least two identical or similar Function units of the computer system in a comparison mode corresponds. Method according to claim 18, characterized that the second method step for identifying a faulty Unit of execution of an error detection routine on at least one Function unit and a comparison of the results of the error detection routine corresponds to reference values. Method according to claim 19, characterized that before or to the implementation of the Method step for identifying a faulty unit a reconfiguration of the computer system is made, which the execution different functions, commands, program segments or programs on the same or similar functional units allows. Method according to claim 19, characterized that the reference values of the error detection routines together with the error detection routines stored in a memory device are Method according to claim 19, characterized that at or after the identification of a faulty functional unit a reconfiguration of the computer system takes place, wherein at least the functional unit identified as faulty is deactivated. Method according to claim 22, characterized in that that in the case of deactivation of a functional unit due of an error, a configuration status and an error status of this Function unit are written in a memory device. Method according to claim 22, characterized in that that at least part of the functions, commands, program segments or programs that are prior to a reconfiguration of the computer system for Processing are determined in a first mode of operation, after a Reconfiguration of the computer system in a second operating mode be processed. Method according to Claim 24, characterized that the first operating mode is a comparison mode and the second Operating mode in a performance mode or a failure mode with only corresponds to an active functional unit. A method according to claim 15 or claim 22, characterized characterized in that the deactivation of functional units irreversible by interrupting electrical connections to or between functional units the computer system takes place. Method according to claim 26, characterized in that that an interruption of electrical connections in the computer system by electrical action on at least part of the compounds is achieved .. Method according to one of the preceding claims, characterized characterized in that an activation and / or deactivation of Functional units during the operation of the computer system and using devices takes place, which are part of the computer system or which constantly with connected to the computer system. Device for controlling a computer system with at least two identical or similar functional units, characterized in that means are present, the activation and / or Deactivation of functional units of the computer system depending on allow for specifiable conditions. Device according to claim 29, characterized in that that means are available to error detection in the computer system and / or an identification of faulty functional units to enable. Device according to claim 30, characterized in that in that the device contains switching means which allow switching between at least two modes of operation of the at least two same or similar Function units of the computer system allows and a first mode of operation a comparison mode and a second mode of operation a performance mode equivalent. Device according to claim 30, characterized in that that the device contains means to selected Switch functional units of the computer system into an operating mode, in which an identification of faulty functional units by a comparison of the output signals of these functional units with Reference values is possible. Device according to claim 32, characterized in that in that the device comprises comparison means for output signals of functional units with output signals of at least one further functional unit or compare with reference values and if there is a discrepancy an error information to create. Apparatus according to claim 33, characterized in that the device comprises memory means in which reference values for the output signals of functional units are stored and further comprises means for obtaining reference values from the memory means of a comparison means supply. Device according to one of the preceding claims, characterized characterized in that means are present for a configuration status and / or an error status for all activatable and / or deactivatable functional units of Computer system to form. Device according to one of the preceding claims, characterized characterized in that the device comprises means for storing Contains data, in which at least one information about the configuration status or the error status of the activatable and / or deactivatable Function units are stored. Device according to Claim 36, characterized that the means for storing data non-volatile storage means are. Device according to one of the preceding claims, characterized characterized in that means are present at initialization and / or during operation of the computer system in a memory device stored configuration status and / or error status of the functional units read and dependent from the read-out data and an error signal from the comparator can perform an activation and / or deactivation of functional units. Device according to one of the preceding claims, characterized characterized in that means are present which deactivate of functional units can irreversibly perform. Device according to claim 39, characterized in that that there are agents available for irreversible deactivation of functional units at least one electrical connection this or in these functional units interrupts. Device according to claim 40, characterized in that that means are present which interrupt electrical Connections to or in functional units by electrical action can act on at least a part of these compounds. Device according to one of the preceding claims, characterized characterized in that the means for error detection, for activation and / or deactivation of functional units part of the computer system are or constantly connected to the computer system.