JP2009506406A - Computer system control apparatus and control method - Google Patents

Abstract

  The present invention relates to a control method and a control apparatus for a computer system including at least two same or similar functional units. According to the present invention, the functional unit is activated and / or deactivated depending on conditions that can be set in advance.

Description

Prior Art The manufacture of complex semiconductor devices such as microcontrollers (μc) or ASICs is prone to errors. In addition, since doping is a statistical process as the structure size continues to decrease, manufacturing errors are unavoidable over a long period of time. Moreover, it is clear that the likelihood of errors will increase in the future, regardless of much effort and progress. The yield, or the ratio between the number of properly working elements and the number of manufactured elements, is approximately 90% for a well-manufactured manufacturing process (i.e., already 10% is defective in this case), but still yields significantly lower values. It is sufficiently possible to make it. The mechanism that increases the yield, that is, directly reduces the cost. In addition, due to considerations for testing and manufacturing, there is an increasing demand for handling defective elements in the field.

  In order to be able to tolerate errors during operation in the manufacture of memory devices such as flash memory, RAM or ROM, the means already employed in part today is the use of error correcting codes (ECC). According to this means, not only data bits but also check bits are stored together. The check bits are configured such that if an error occurs in only one bit (or the known maximum number of bits), the error can be detected and corrected by auxiliary logic. As a result, even if an error exists, the entire component (or a corresponding partial component of one component) can give an appropriate result. While storing the check bits together is considerably more cumbersome, the auxiliary logic required does not incur a substantial extra cost.

  For example, errors in a semiconductor circuit in a computer system can also occur during operation of this circuit. In most cases, high capabilities cannot be guaranteed in the case of persistent errors in a systematic form. One minor exception is the ECC mechanism for memory. For transient errors in a processor, such as a CPU, recovery or reset measures are known. However, there is no known practical and low-cost concept for tolerating persistent errors for errors in execution units.

  The first object of the present invention is to improve the yield by making it possible to use functional units having errors in the manufacturing process of μC or semiconductor devices. The second problem of the present invention is to increase the capability of the component in operation. For this purpose, faulty execution units (eg cores, ALUs, processors) within a component can be identified, and “graceful degradation” or emergency action can be performed while a system using this component is in operation. We want to provide a means that can be done.

Advantages of the Invention Here we consider a semiconductor circuit, for example a microcomputer, comprising at least two identical or similar functional units. At the end of the manufacturing process, at the time of assembly, at the time of diagnosis or during the test phase during operation, the test program is used to identify possibly defective functional units. This can advantageously be done by means of a switching function and a comparison function, for example in a switching and comparison unit as shown. This unit compares the output signal of the functional unit with the output signal of at least one other functional unit and / or another reference value. Which functional unit is defective is stored in the storage element. These functional units are deactivated, for example by a functional and comparison unit or a cutting device. However, this element can be used and functions whether it is included in a defective functional unit.

  The present invention advantageously relates to a control method and a control device for a computer system comprising at least two identical or similar functional units. According to the present invention, the functional unit is activated and / or deactivated depending on conditions that can be set in advance.

  Advantageously, according to the method according to the invention, the activation and / or deactivation of the functional unit is for identifying at least one first step and / or defective functional unit for detecting errors in the computer system. Depending on the result of at least one second step.

  Advantageously according to the method according to the invention, the computer system comprises at least two identical or similar functional units, between at least two operating modes in at least two identical or similar units in the computer system. Switching is performed, the first operation mode corresponds to the comparison mode, and the second operation mode corresponds to the performance mode.

  Advantageously, according to the method according to the invention, an error in the output signal of the functional unit to be compared is detected during the comparison mode, this comparison mode corresponding to a first step for detecting an error in the computer system. .

  Advantageously, according to the method according to the invention, the selected functional unit of the computer system is switched to an operating mode, during which the identification of the defective functional unit is performed with the output signal of the functional unit and the reference value. This mode of operation corresponds to a second step for identifying defective functional units in a computer system.

  Advantageously, according to the method according to the invention, the reference value is stored in a storage device of the computer system and is read from the storage device for error detection when switching to the operating mode.

  Advantageously, according to the method according to the invention, switching between at least two operating modes takes place periodically or on demand during operation of the computer system.

  Advantageously, according to the method according to the invention, switching between at least two operating modes is performed for error detection and / or for identification of defective functional units.

  Advantageously, according to the method according to the invention, a configuration status and / or an error status is generated at least for the functional units of the computer system identified as defective.

  Advantageously, according to the method according to the invention, the deactivation of a functional unit is effected by storing information on the configuration status or error status of this functional unit in a storage device, this information being stored in the semiconductor system Can be read at initialization and / or during operation, and the stored information is processed to disable the use of units that are marked inactive.

  Advantageously, according to the method according to the invention, a configuration status and / or an error status is generated for all functional units that can be activated and / or deactivated in a computer system.

  Advantageously, according to the method according to the invention, information on the configuration status and / or error status of the functional units that can be activated and / or deactivated is stored in a storage device. Advantageously, according to the method according to the invention, the computer system includes at least two identical or similar functional units, at least one of the identical or similar functional units in the computer system complying with the standard. Is inactive.

  Advantageously, according to the method according to the invention, at least one piece of information relating to the configuration status of the deactivated functional unit is stored in the storage device. Advantageously, according to the method according to the invention, during or after the identification of a defective functional unit, the computer system is reconfigured by deactivating at least the functional unit identified as defective. Is called.

  Advantageously, according to the method according to the invention, when a functional unit is deactivated on the basis of an error, information relating to the configuration status and / or error status of this functional unit is written to the storage device.

  Advantageously, according to the method according to the invention, upon or after the identification of a defective functional unit, the computer system is reconfigured so that the functional unit identified as defective is deactivated, In this case, the functional unit which has been deactivated according to the standard but without any defects is activated.

  Advantageously, according to the method according to the invention, the first step for detecting an error corresponds to the prescribed operation of at least two identical or similar functional units in the computer system in the comparison mode.

  Advantageously, according to the method according to the invention, the second step for identifying defective functional units is the processing of the error detection routine in at least one functional unit and the result of this error detection routine and the reference value. Corresponds to the comparison process.

  Advantageously, according to the method according to the invention, the computer system is reconfigured before or during the execution of the above-mentioned steps for identifying defective functional units, and this reconfiguration leads to various functions. , Instructions, program segments or programs can be executed in the same or similar functional units.

  Advantageously, according to the method according to the invention, the reference value of the error detection routine described above is stored in the storage device together with this error detection routine.

  Advantageously, according to the method according to the invention, the computer system is reconfigured during or after the identification of the defective functional unit, with at least the functional unit identified as defective being inactive. Put into a state.

  Advantageously, according to the method according to the invention, when a functional unit is deactivated due to an error, the configuration status and error status of this functional unit are written to the storage device. Advantageously, according to the method according to the invention, at least part of the functions, instructions, program segments or programs defined for processing in the first operating mode before reconfiguration of the computer system as described above are stored in the computer system. Are processed in the second mode of operation.

  Advantageously, according to the method according to the invention, the first operating mode corresponds to a comparison mode and the second operating mode corresponds to a performance mode or an error mode with only active functional units.

  Advantageously, according to the method according to the invention, the deactivation of a functional unit is performed irreversibly by breaking the electrical connection to or between the functional units of the computer system.

  Advantageously, according to the method according to the invention, the disconnection of the electrical connection is achieved by an electrical action on at least part of the connection in the computer system described above.

  Advantageously, according to the method according to the invention, the activation and / or deactivation of the functional unit utilizes a device that is part of the computer system or is always connected to the computer system during operation of the computer system. Done.

  Advantageously, the invention relates to a control device for a computer system comprising at least two identical or similar functional units. This device is characterized in that means are provided which allow the functional units in the computer system to be activated and / or deactivated depending on previously settable conditions. Advantageously, according to the device according to the invention, means are provided which allow error detection and / or identification of defective functional units in a computer system.

  Advantageously, the device according to the invention is provided with a switching means, which enables switching between at least two operating modes of at least two identical or similar functional units in the computer system. The operation mode corresponds to the comparison mode, and the second operation mode corresponds to the performance mode.

  Advantageously, according to the device according to the invention, means are provided for switching selected functional units of the computer system to an operating mode, during which the defective functional unit is referred to the output signal of the functional unit and a reference. Can be identified by comparison with the value.

  Advantageously, the device according to the invention is provided with a comparison means by which the output signal of the functional unit is compared with the output signal or reference value of at least one other functional unit, resulting in a mismatch. Sometimes error information is generated.

  Advantageously, the device according to the invention is provided with storage means for storing a reference value for the output signal of the functional unit and means for supplying the reference value from this storage means to the comparison means.

  Advantageously, according to the apparatus according to the invention, means are provided for creating a configuration status and / or an error status for all functional units of the computer system that can be activated and / or deactivated. Advantageously, the device according to the invention is provided with means for storing data, at least one piece of information regarding the configuration status or error status of the functional units that can be activated and / or deactivated. Is stored.

  Advantageously according to the device according to the invention, the means for storing data are non-volatile storage means.

  Advantageously, according to the device according to the invention, the configuration status and / or error status of the functional units stored in the storage device are read out and read out during initialization and / or operation of the computer system. Depending on the data and the error signal of the comparator, the activation and / or deactivation of the functional unit can be performed.

  Advantageously, according to the device according to the invention, the deactivation of the functional unit can be performed irreversibly.

  Advantageously according to the device according to the invention, means are provided for interrupting at least one electrical connection to or within the functional unit for irreversible deactivation of the functional unit. Yes.

  Advantageously, according to the device according to the invention, means are provided that allow the disconnection of the electrical connection to or in the functional unit by electrical action on at least a part of this connection.

  Advantageously according to the device according to the invention, the means for error detection, functional unit activation and / or deactivation are either part of the computer system or are always connected to the computer system.

  Other advantages and advantageous embodiments are indicated in the features described in the claims and in the following description.

  FIG. 1 shows a typical switching component with switching logic and processing logic.

  FIG. 2 shows the connection between the switching component and the storage element.

  FIG. 3 shows a basic method for increasing the yield using the memory element.

  FIG. 4 shows a special method for increasing the capability of graceful degradation and emergency action.

  FIG. 5 shows the connection between the switching component and the control component.

  FIG. 6 illustrates a basic method for increasing yield using a control component.

  FIG. 7 shows a possible structure of the memory element.

DESCRIPTION OF EMBODIMENTS In the following description, an execution unit may be referred to as a processor / core / CPU, an FPU (floating point unit), a DSP (digital signal processor), a coprocessor, or an ALU (arithmetic logic unit).

  First of all, FIG. 1 depicts the general case of a switching unit and a comparison unit, again for using more than two execution units. From the n execution units considered here, n signals N140 to N14n are supplied to the switching and comparison component N100. The switch and compare component N100 can generate up to n output signals N160-N16n from these input signals. In the simplest case, the “pure performance mode”, all signals N14i are the corresponding output signals N16i. In the opposite extreme case, i.e. "pure comparison mode", all the signals N140 to N14i are the only output signal of the output signal N16i.

  This figure illustrates how the various possible modes can be generated. For this reason, N100 includes the logic component of the switching logic N110. For the time being, the role of the switching logic is to determine which input side is not connected to any output side, i.e. which input side is ignored without the result being kept or inactive. It is. This function of the switching logic is often referred to below as the first function of the switching logic. Further, the switching logic N110 determines how many output signals are present and which of the input signals contributes to which of the output signals the input signal contributes. Here, at most one input signal can contribute to exactly one output signal. This function of the switching logic is often referred to below as the second function of the switching logic.

  In other words, in a mathematically different form, a function that associates one element of the set {N160 to N16n} with each element of the set {N140 to N14n} is defined by the switching logic without blocking signals. With blocking of individual input signals, switching logic generally defines a function that associates one element of set {N160-N16n} with each element of set {N140-N14n} (non-blocked signal). .

  In this case, the processing logic N120 determines for each of the output sides N16i how the input side contributes to this output signal. For purposes of illustrating various embodiments by way of example, it is assumed that the output side N160 is generated by signals N141-N14m without limiting generality. If m = 1, this simply corresponds to a signal through connection. If m = 2, the signals N141 and N142 are compared. This comparison can be performed synchronously or asynchronously, and this comparison can be performed on a bit-by-bit basis or only on the most significant bit, or it can be performed using tolerances. According to one advantageous embodiment, multiple execution units can be executed in a single lockstep operation (i.e. with the same instruction in the same clock). However, one fixed clock or phase shift is an equally advantageous solution. If m ≧ 3, there are more options.

  According to the first option, all signals can be compared, an error can be detected if there are at least two different values, and this error can be selectively signaled.

  According to the second option, m to k selections are made (k> m / 2). This can be achieved by using a comparison. Optionally, if one of the signals is identified as having a deviation, an error signal can be generated. If all three signals are different, various possible error signals can be formed.

  According to a third option, these values are fed into one algorithm. This algorithm can be, for example, the formation of an average value or median value, or the use of a fault tolerance algorithm (FTA). The FTA as described above is based on removing an extreme value of an input value and performing a kind of average value formation on the remaining value. This average value formation can be performed for all the remaining sets of values, or advantageously for a subset that can be easily formed in the hardware HW. In this case, it is not always necessary to actually compare the values. For average value formation, for example, only addition and division are required. For FTM, FTA, or median, partial sorting is required. Also in this case, if necessary, an error signal can be selectively transmitted when the extreme value is considerably large.

  The various options described above for processing a plurality of signals to generate a single signal are referred to as comparison operations for short. Therefore, the role of the processing logic is to determine the detailed structure of the comparison operation for each output signal, that is, the detailed structure of the comparison operation for the corresponding input signal. Hereinafter, this is referred to as a second function of the processing logic. The identification of erroneous execution units that can generally occur in this way is hereinafter referred to as the first function of the processing logic.

  A combination of information of the switching logic N110 (that is, the above-described function) and information of the processing logic (that is, determination of a comparison operation for each output signal, that is, a function value) is mode information, and the mode is determined by this information. This information is naturally multi-valued in a general case, that is, it cannot be expressed by only one logical bit. Not all logically considered modes are significant in one defined implementation, but advantageously the number of modes allowed is limited. To emphasize, if there are only two execution units, there is only one comparison mode in the execution unit that can aggregate all the information into only one logical bit.

  In the general case, the characteristic of switching from the performance mode to the comparison mode is that execution units mapped to different output sides in the performance mode are mapped to the same output side in the comparison mode. This is advantageously realized as follows. That is, a subsystem of execution units is provided, in which all input signals N14i to be considered in this subsystem are each switched directly to the corresponding output signal N16i in the performance mode, while in the comparison mode Are all mapped to one output. Alternatively, such switching can be realized by changing the pairing. That is, as one embodiment according to the present invention, the performance mode and the comparison mode cannot be discussed in the general case, although the amount of mode allowed can be limited as it falls. However, switching from performance mode to comparison mode (and vice versa) can always be discussed.

  Next, how this type of switching and comparison component and some other factors can be used to increase the yield in the manufacturing process of semiconductor devices such as microcomputers under certain conditions State.

The basic idea is outlined below:
Devices, such as microcomputers, require more execution units than are needed during operation.

  Accordingly, during operation, even a few execution units than the total number of execution units that operate properly can be used. The assumption here is that units that are not operating properly have been identified and that they may not affect the entire system. By utilizing the switching unit and the comparison unit described above, the signal of the defective execution unit can be prevented from further propagating in the system via the switching logic N110.

  The processing logic N120 can compare the signals of different execution units. With proper comparison, defective execution units can be identified. This can be achieved by using a test program that sufficiently covers errors. If necessary, external identification means can be used together.

  This kind of test is performed at any point in time, for example at the end of the production line, at initialization or during assembly, and the result (ie a unique identification of the defective execution unit) is stored in non-volatile memory, By controlling the switching logic N110 so that the signal of the defective execution unit does not act, even if there is a defective execution unit, a microcomputer that can still use the execution unit that operates properly can be obtained. can get.

  Thus, the yield can be increased by the fault tolerance realized in the product. The reason is that as long as there are a sufficient number of execution units that still operate properly, elements with defects can be used. This depends on the application.

  This idea will be explained in detail here.

  The possible logical configurations for the switching unit and the comparison unit have already been described. In order to apply the present invention described here, although it is advantageous, the components are not necessarily provided as described above, and the above-described subcomponents such as switching logic and processing logic are not necessarily provided. It does not have to be.

  What is important with regard to the first function of the switching logic is that the output of components that may possibly be defective can be ignored in a suitable manner. This can be realized by shutting off their outputs with a switch, for example. Another possibility is to switch those signals to a standard “catcher” for signals with errors. Another possibility is to mark the output signal as invalid. Furthermore, as another possibility that can be used in addition or alternatively, the generation of this type of output signal can be prevented by deactivating the corresponding component itself. This can be realized by deactivating, stopping, shutting down the clock, or blocking the input signal. This has the advantage of minimizing power loss and thus optimizing service life, reliability and temperature load. In the following, all execution units whose output is ignored by some means can be referred to as being in a passive or inactive state.

  Important to the first function of the processing logic is firstly that the defective component can be identified. An advantageous possibility is to have all execution units execute the same program in parallel. However, this may not necessarily be realized by driving the execution unit in lockstep mode or with a fixed clock shift or phase shift.

  In this way, an appropriate comparison can identify defective components that may be present via majority decision. As an option, the results of this program can be further compared in the product test, initialization test or production line end point test with the known results by external units (watchdog, other microcomputers, test equipment, ASIC) can do. This is particularly advantageous when there are only two execution units. This is because in such a case, if a difference occurs between the two execution units, the third information is required to identify the execution unit having a defect. In addition to the above comparison operations, such comparisons are realized by performing comparisons only in pairs or on subsets until a unique identification of an execution unit with possibly existing defects becomes possible. be able to. Accordingly, processing logic needs to identify the defective component as a result of this first function.

  It is necessary to configure the test program so that the defects act with the highest possible probability. To develop such a program, for example, you can use a defect model (for example, stuck-at-Modell), run a piece of application code, or run a full instruction test. Can do. In the case of a production line end point test, it can correspond to a current test program limited to execution units. However, this can be combined with the currently common production line end point test, or only components that have already been determined by the first production line end point test can be tested by this program. The last mentioned method has the advantage that, in particular, additional process steps are carried out only for components that otherwise belong to defective products. Each component obtained by such a final “relief step” directly increases the yield of the manufacturing process.

  After the defective unit is identified by the first function of the processing logic, the information needs to be stored. When the method according to the present invention is applied to a manufacturing process to increase yield, it is advantageous to use a non-volatile memory element. In that case, which execution unit is inactive is stored there.

  FIG. 2 shows the function of this storage element. The elements N510, N520, N54i, N56i of the switching and comparison unit N500 in FIG. 2 have the same functions as the elements N110, N120, N14i, N16i of the switching and comparison unit N100 in FIG. Further, a storage element N530 is depicted here. Processing logic N520 sends information about the execution unit identified as defective to storage element N530. The switching logic N510 is accessible to this storage element and implements the first function of the switching logic so that the element represented as inactive by N530 is actually inactive.

  Of course, the storage element can be provided in the switching and comparison unit, but it may also be provided externally or even external to the component. For example, when assembling a microcomputer, it is conceivable to provide an external element in the control device or in the PC, because this makes it possible to apply a larger test while using peripheral devices. .

  FIG. 3 shows the basic idea regarding a method for increasing the yield during manufacturing. In the first step N600 (identification step), the defective execution unit is identified. For identification, the first function of the processing logic N520 is used, that is, a test program is used. In the second step N610 (storage step), defect information is stored. Corresponding information is passed from the processing logic N520 to the storage element N530. In the third step N620 (configuration), the switching logic N510 uses the information from N530 to apply the first function of the switching logic and outputs the execution unit according to the requested active and passive states. Configure. It should be emphasized here that although this can optionally be done by SW, according to one advantageous embodiment, the configuration is also not affected here by SW control.

  The main factor regarding the inactive state is the defect. However, according to one advantageous embodiment, another reason may hold. For example, an execution unit can be marked as inactive in the storage element described above even for a component that is completely free of defects.

  For example, if the test is performed during operation (eg, during the initialization phase or during normal operation) as well as the production line end point, errors that occur during operation rather than during manufacture can be detected. As shown in FIG. 1, the second function of the switching logic (function to connect the active execution units to each other during operation) and the second function of the processing logic (compare the signals switched to the output side). Through the function to be performed), it is possible to easily detect errors during operation and identify defective execution units.

  If a non-defective execution unit is marked inactive, a unit that is identified as defective when an error occurs during operation can be replaced with a non-defective but inactive unit. It is advantageous for this purpose to store in storage element N530 information whether the execution unit is simply inactive or whether it also has a defect. Advantageously, when inactive, the information that a given execution unit is defective can be changed.

  FIG. 7 shows a structure that can basically be realized with respect to the storage element O100 (corresponding to N530). This includes a first storage area O110, which is advantageously provided with memory locations O120 to O12n depending on the number of execution units. Advantageously, each memory location is implemented with at least one bit. The number or address of the memory location O12i is uniquely associated with the execution unit number or identifier. One bit of O120 is set to 0, for example, which indicates that the corresponding execution unit is active. If this is set to 1, the corresponding execution unit is inactive. This information can be tied to fault tolerance or other information in memory locations O120-O12n, but the basic information content for this application is always kept the same.

  As an option, a second storage area O140 is additionally provided, which is preferably provided with memory locations O130 to O13n depending on the number of execution units. Advantageously, each memory location is implemented with at least one bit. The number or address of the memory location O13i is uniquely associated with the execution unit number or identifier. One bit of O130 is set to 0, which, for example, indicates that the corresponding execution unit is not defective. If this is set to 1, it indicates that the corresponding execution unit is defective. This information can be tied to fault tolerance or combined with other information in memory locations O130-O13n, but the basic information content for this application is always kept the same. Alternatively, this storage area is not writable or writable only in special circumstances or only in a special way, and in this way an execution unit once marked as defective Is guaranteed not to be mistakenly labeled as non-defective.

  By using inactive but defect-free execution units, cold redundancy, which provides the above methods for defect-free elements, is added to increase availability and reliability. Can be used.

  Another possibility to apply the present invention is to realize a Graceful-Degradation Mode and a Limp-home Mode.

  A precondition in this case is that a defect has been found during operation via the second function described above in the processing logic. FIG. 4 shows a method that is advantageously used in that case. First, a defect is found in step N700 (error detection). This can be done, for example, by using a test program. However, when the system is in comparison mode, for example, if this can be set via the second function of processing logic and switching logic, this type of error detection can also be performed during normal operation, ie the application software Functions as a test program. This is advantageous for two reasons: in this case no dedicated test program is required, while all defects of the execution unit acting as a whole are found in this way.

  In step N705, it is checked whether the faulty execution unit can already be identified by the current configuration of the switching logic and processing logic. If this is the case, steps N710 (configuration for error detection) and N720 (identification step) have already been completed, and the process proceeds to step N730. This is the case, for example, when an error occurs in a subsystem where the signals from the three execution units are compared. If the result of the check (in step N705) is not applicable (for example, if an error is detected in a subsystem consisting of two execution units running in comparison mode), error identification is possible first in step N710 Is selected. The simplest way to do this is, for example: In other words, “suspect candidates” (that is, all execution units involved in the subsystem that caused the error) are combined with a sufficiently large number of other execution units so as to become one output signal by the switching logic N510. In this case, it is advantageous to use again the SW part that presented the error as a test program, but a dedicated test program may be used. In this case, step N720 can be executed by the first function of the processing logic, and a defective execution unit can be identified. However, alternatively, other identification methods may be selected. For example, accept one of the suspect candidates and combine it with other execution units without defects. If no errors are identified, other execution units will be defective. If an error is identified, it can be estimated that it is an error in the execution unit. The latter method does not provide the same identification certainty, but it can be used more easily during the execution of the movement, i.e. a currently critical driving operation controlled by a component, for example in an automobile, is being carried out. This is advantageous in some cases. After identifying the defective execution unit, both steps N730 (storage step, corresponding to N610) and N740 (configuration, corresponding to N620) are executed.

  It should be emphasized here that in this last step a number of advantageous possibilities are obtained by the method according to the invention. If there are enough execution units that are not defective but inactive, a fully functioning system can be formed again as described above.

  In the case where there are too few defect-free execution units for normal operation, the existing software can be executed as normal for existing execution units. This is advantageous when the system is described with a pre-propagation time in the normal case. In this case, perhaps enough performance can be provided to guarantee operation even if the number of execution units is reduced. This can be supported in particular by avoiding operating conditions that are highly concentrated in performance (for example, high engine speeds in automobile engines).

  If the number of execution units without defects for normal operation is too small, only a subset of the applications can be executed alternatively.

  In the case where the number of execution units without defects is too small for normal operation, the third possibility is to run the application in another mode. For example, the strong comparison mode can be stopped and a relatively weak comparison mode or performance mode can be applied. In this case, relatively weak error detection or fault tolerance occurs for subsequent operations, but in some cases this is acceptable. This is because it is only necessary to maintain this state for a limited time. According to the invention, this option can be realized very easily. This is because only the components and methods shown here can be used. Of course, combinations of these embodiments are also conceivable.

  A fundamentally different possibility of using the idea of the method according to the invention is that the storage element is deactivated to ensure that a potentially defective execution unit is irreversibly deactivated. It is to use other means without using. This can be done by controlling the line of elements (eg, separating or connecting).

  Various options include: dedicated line antifuse (which can be used during operation, maintenance, assembly or manufacturing), mechanical processing of the line (soldering, cutting), laser, electron beam, X Burning with a line beam or special electrical signal, and chemical action on the line.

  This requires a control component instead of a storage element. FIG. 5 illustrates the function of this control component. The elements N810, N820, N84i, N86i of the switching and comparison unit N800 in FIG. 5 have the same functions as the elements N110, N120, N14i, N16i of the switching and comparison unit N100 in FIG. Furthermore, a control component N830 is depicted here. Processing logic N820 sends information about the execution unit identified as defective to control component N830. This has means for controlling the lines or functional groups in the element so that the execution unit is deactivated, for example as described above. Although N830 can be a component in a device, controller, or system, N830 may be a machine in a manufacturing process or an operator of such a machine. These components can also be used for maintenance. As an option, corresponding information can also be sent to the switching logic, whereby the switching logic performs the first function, effectively deactivating the element represented as inactive by N830.

  FIG. 6 illustrates the basic idea of a method for increasing the yield using the control component N830. In the first step N900 (identification step), the defective execution unit is identified. For identification, the first function of the processing logic N820 is used, that is, a test program is used. In a second step N910, defect information is sent from processing logic N820 to control component N830. In a third step N920, the control component N830 uses this information and uses means available to this component to control the line or functional group in the element so that the defective component is inactive. In an alternative fourth step N930, the switching logic N810 uses information to apply the first function of the switching logic and configures the output of the execution unit according to the required active and passive states. I do. Of course, this type of control component can also be used during operation. Since the effect on the system is exactly the same, all the advantages gained when using storage elements can be applied here as well. In this case, it is advantageous if the control component is provided as a HW component in the system.

  In addition to the execution units mentioned in the description of the embodiments, the advantageous method and apparatus according to the invention can be applied to other components in a semiconductor circuit, for example analog / digital converters, timer elements, interrupt controllers, communications. It can also be applied to a controller or a control unit.

  In the following, all such components of a semiconductor circuit are summarized in terms of functional units.

  According to one further advantageous embodiment, the invention described so far is used together with ECC protection for other storage elements. In this case, the result is a highly available component that allows both memory and execution units to be configured for fault tolerance, thus maximizing yield and optimal availability during operation. Can also be guaranteed.

Diagram showing a typical switching component with switching logic and processing logic Diagram showing connection between switching component and storage element The figure which shows the basic method for the yield rise which utilizes the memory element Illustration showing a special way to increase graceful degradation and emergency action capabilities Diagram showing connection between switching component and control component Diagram showing basic method for increasing yield using control component Diagram showing the structure of a possible storage element

Claims (42)

In a method for controlling a computer system comprising at least two same or similar functional units,
A method characterized in that the functional unit is activated and / or deactivated depending on pre-settable conditions. The method of claim 1, wherein
Activation and / or deactivation of a functional unit is a result of at least one first step for detecting an error in the computer system and / or at least one second step for identifying a defective functional unit. Depending on the method. The method of claim 1, wherein
The computer system includes at least two identical or similar functional units,
Switching between at least two operating modes in at least two identical or similar units in the computer system, wherein the first operating mode corresponds to the comparison mode and the second operating mode corresponds to the performance mode. Feature method. The method according to claim 2 or 3,
An error in an output signal of a functional unit to be compared is detected during the comparison mode, the comparison mode corresponding to a first step for detecting an error in the computer system. The method according to any one of claims 1 to 4, wherein
The selected functional unit of the computer system is switched to an operating mode, during which the defective functional unit is identified by comparing the output signal of the functional unit with a reference value,
The method of operation, wherein the mode of operation corresponds to a second step for identifying defective functional units in a computer system. The method of claim 5, wherein
The reference value is stored in a storage device of a computer system, and is read from the storage device for error detection when switching to an operation mode. The method according to claim 3 or claim 5, wherein
Switching between at least two operating modes is performed periodically or on demand during operation of the computer system. The method of claim 7, wherein
A method characterized in that switching between at least two operating modes is performed for error detection and / or for identification of defective functional units. A method according to any one of claims 1 to 8,
A method wherein a configuration status and / or an error status is formed for at least functional units of a computer system identified as defective. The method of claim 9, wherein
Deactivation of a functional unit is performed by storing information about the configuration status or error status of the functional unit in a storage device, which can be read during initialization and / or operation of the semiconductor system. A method characterized in that the stored information is processed to disable the use of a unit represented as inactive during operation. The method according to any one of claims 1 to 10, wherein:
A method wherein a configuration status and / or an error status is formed for all functional units of the computer system that can be activated and / or deactivated. The method of claim 11 wherein:
A method, characterized in that information on the configuration status and / or error status of functional units that can be activated and / or deactivated is stored in a storage device. The method of claim 1, wherein
The computer system includes at least two identical or similar functional units;
A method wherein at least one of the same or similar functional units in the computer system is inactive according to a standard. 14. The method of claim 13, wherein
A method characterized in that at least one piece of information relating to the configuration status of a deactivated functional unit is stored in a storage device. The method of claim 14, wherein
A method wherein the computer system is reconfigured at or after identifying a defective functional unit by deactivating at least the functional unit identified as defective. The method of claim 15, wherein
A method, wherein when a functional unit is deactivated based on an error, information regarding the configuration status and / or error status of the functional unit is written to a storage device. The method of claim 15, wherein
During or after identification of the defective functional unit, the computer system is reconfigured and the functional unit identified as defective is deactivated and deactivated according to the standard A method characterized in that a functional unit not accompanied is activated. The method of claim 3, wherein
Method according to claim 1, wherein the first step for detecting an error corresponds to a prescribed operation of at least two identical or similar functional units in a computer system in a comparison mode. The method of claim 18, wherein:
The second step for identifying a defective functional unit corresponds to a process of an error detection routine in at least one functional unit and a process of comparing the result of the error detection routine with a reference value. how to. The method of claim 19, wherein
Before or during execution of the steps for identifying defective functional units, the computer system is reconfigured so that the various functions, instructions, program segments or programs are the same or similar. A method characterized in that it can be executed in any functional unit. The method of claim 19, wherein
A reference value for the error detection routine is stored in a storage device together with the error detection routine. The method of claim 19, wherein
A method characterized in that upon or after identification of a defective functional unit, the computer system is reconfigured so that at least the functional unit identified as defective is deactivated. The method of claim 22, wherein
A method wherein when a functional unit is deactivated based on an error, the configuration status and error status of the functional unit are written to a storage device. The method of claim 22, wherein
At least a portion of a function, instruction, program segment or program defined for processing in a first mode of operation prior to reconfiguration of the computer system is stored in the second mode of operation after reconfiguration of the computer system. A method characterized in that it is processed. 25. The method of claim 24, wherein
The first operating mode corresponds to a comparison mode, and the second operating mode corresponds to a performance mode or an error mode with only active functional units. 23. The method of claim 15 or claim 22, wherein
A deactivation of a functional unit is performed irreversibly by breaking an electrical connection to or between the functional units of the computer system. The method of claim 26.
The method of claim 1, wherein disconnecting an electrical connection in a computer system is accomplished by electrical action on at least a portion of the connection. 28. A method according to any one of claims 1 to 27.
Functional unit activation and / or deactivation is performed during operation of the computer system using a device that is part of the computer system or is always connected to the computer system. . In a control device of a computer system comprising at least two same or similar functional units,
A method, characterized in that means are provided for enabling the activation and / or deactivation of a functional unit in a computer system depending on previously settable conditions. 30. The apparatus of claim 29.
Apparatus provided with means for enabling error detection and / or identification of defective functional units in the computer system. The apparatus of claim 30, wherein
Switching means is provided, which enables switching between at least two operation modes of at least two same or similar functional units in the computer system, the first operation mode corresponding to the comparison mode, The operation mode of 2 corresponds to the performance mode. The apparatus of claim 30, wherein
Means are provided for switching the selected functional unit of the computer system to an operation mode, and a defective functional unit can be identified during the operation mode by comparing the output signal of the functional unit with a reference value. A device characterized by. The apparatus of claim 32.
Comparing means is provided for comparing the output signal of the functional unit with the output signal or reference value of at least one other functional unit and generating error information when a mismatch occurs. Features device. 34. The apparatus of claim 33.
An apparatus comprising: storage means for storing a reference value for the output signal of the functional unit; and means for supplying the reference value from the storage means to the comparison means. 35. Apparatus according to any one of claims 29 to 34.
Apparatus for providing a configuration status and / or error status for all functional units of the computer system that can be activated and / or deactivated. 36. Apparatus according to any one of claims 29 to 35.
Means for storing data are provided, wherein said means stores at least one piece of information regarding the configuration status or error status of a functional unit that can be activated and / or deactivated . The apparatus of claim 36.
The apparatus for storing data is a non-volatile storage means. 38. The apparatus of any one of claims 29 to 37.
Reads the configuration status and / or error status stored in the storage means at initialization and / or during computer system operation, and activates the functional unit depending on the read data and the error signal of the comparison means Means provided for enabling and / or deactivation. 39. Apparatus according to any one of claims 29 to 38.
Means provided with means capable of irreversibly executing the deactivation of the functional unit. 40. The apparatus of claim 39.
A device characterized in that means are provided for interrupting at least one electrical connection to or within the functional unit for irreversible deactivation of the functional unit. 41. The method of claim 40, wherein
A device is provided, characterized in that a means can be provided for the disconnection of the electrical connection to or in the functional unit by electrical action on at least a part of the connection. 42. The apparatus according to any one of claims 29 to 41, wherein:
An apparatus characterized in that the means for error detection, functional unit activation and / or deactivation are part of or always connected to the computer system.

Images