JP2011188115A - Semiconductor integrated circuit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a semiconductor integrated circuit that includes a monitoring circuit which prevents the occurrence of a common cause failure causing a loss of a monitoring function in the monitoring circuit which monitors the operation of a circuit to be monitored so as to output an alarm signal when there is a possibility that a failure occurs in the circuit to be monitored. <P>SOLUTION: The semiconductor integrated circuit has a circuit to be monitored in which at least one or more flip-flop circuits are present in a processing path and a monitoring circuit that includes a simulation circuit which has flip-flop circuits corresponding to the flip-flop circuits of the circuit to be monitored in a processing path so as to simulate an operation of the circuit to be monitored, and a comparator circuit which compares an output of the circuit to be monitored with an output of the simulation circuit so as to output an alarm signal on the basis of the comparison result. The flip-flop circuits corresponding to each other in the circuit to be monitored and the simulation circuit are operated at the same timing and controlled so as to output signals which are mutually inverted in logic to a corresponding succeeding circuit. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a semiconductor integrated circuit.

  In general, a semiconductor integrated circuit incorporates a monitoring circuit that detects an abnormal operation of a circuit (functional block) that realizes a certain function. The monitoring circuit includes a simulation circuit that simulates the operation of the monitored circuit (monitored circuit), and a comparison circuit that compares the operation of the monitored circuit with the operation of the simulation circuit and outputs a determination result of the presence or absence of a failure. ing.

  Incidentally, in recent years, an international standard IEC61508 that defines functional safety has been established, and various proposals have been made accordingly (for example, Patent Documents 1 and 2). However, the international standard IEC61508 requires that “the monitoring circuit and the monitored circuit have sufficient detection capability for common cause failures that cause the failure of the monitoring function at the same time”. Insufficient proposals to meet demand. As a straightforward example of a common cause failure, the failure operation that occurs in the simulated circuit and the failure operation that occurs in the monitored circuit are the same as when the simulation circuit is configured with a copy of the monitored circuit. Can be mentioned.

According to the international standard IEC61508, a β-factor is introduced to evaluate a common cause failure with respect to a probability λ _D of a random hardware failure that puts a monitored circuit in a dangerous state, and the probability of a dangerous common cause failure is expressed as λ _It is defined as _D β (IEC61508-6: 2000 Annex-D, Sec. D5), and a plurality of check items for determining β-factor values are described (IEC61508-6: 2000 Annex-D, Sec. D5). D6, Table D.1).

Each check item evaluates the degree of measures necessary to avoid the occurrence of a common cause failure from various viewpoints, and the evaluation result is indicated by a score corresponding to the degree of the measure. A high score is obtained for a high evaluation, and a low score for a low evaluation. In Table D.4 of the standard, β-factor values corresponding to the sum of the points are defined. The higher the sum, the smaller the β-factor value, and the probability of dangerous common cause failure λ _D β It is a mechanism that can be lowered.

In short, in order to meet the requirement of the international standard IEC61508 “the monitoring circuit and the monitored circuit have sufficient detection capability for the common cause failure that causes the failure of the monitoring function at the same time,” It is necessary to configure the monitoring circuit so that the β-factor value can be reduced and the probability of dangerous common cause failure λ _D β can be lowered.

JP 2008-258775 A JP 2003-248595 A

  The present invention has been made in view of the above, and causes a loss of the monitoring function when the operation of the monitored circuit is monitored and the alarm signal is output when there is a possibility of failure. An object of the present invention is to provide a semiconductor integrated circuit including a monitoring circuit in which common cause failures are unlikely to occur.

  According to one aspect of the present invention, there is provided a monitored circuit in which at least one flip-flop circuit is present in the processing path, and a flip-flop circuit corresponding to the flip-flop circuit of the monitored circuit in the processing path, A simulation circuit for simulating the operation of the monitored circuit, and a monitoring circuit having a comparison circuit for comparing the output of the monitored circuit with the output of the simulation circuit and outputting an alarm signal based on the comparison result. Each of the flip-flop circuits corresponding to each other in the monitoring circuit and the simulation circuit is controlled to operate at the same timing and to output signals whose logics are inverted to the corresponding subsequent circuits. A semiconductor integrated circuit is provided.

  According to the present invention, when the operation of the monitored circuit is monitored and there is a possibility of failure, when the alarm signal is output, the common cause failure that causes the loss of the monitoring function is unlikely to occur. The semiconductor integrated circuit having the circuit can be realized.

FIG. 1 is a block diagram showing the configuration of a monitoring circuit incorporated in the semiconductor integrated circuit according to the first embodiment of the present invention and the relationship with the monitored circuit. FIG. 2 is a diagram for explaining a control method (part 1) of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 3 is a diagram for explaining a control method (part 2) for two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 4 is a diagram for explaining a control method (No. 3) of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 5 is a diagram for explaining a control method (part 4) of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 6 is a diagram for explaining a control method (No. 5) of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 7 is a diagram for explaining a control method (No. 6) of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 8 is a diagram for explaining a control method (No. 1) of two selectors existing corresponding to the data supply paths to the two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. . FIG. 9 is a diagram for explaining a control method (No. 2) of two selectors existing corresponding to the data supply paths to the two corresponding flip-flop circuits in the monitored circuit and the simulation circuit shown in FIG. . FIG. 10 is a diagram illustrating an example in which the supply path of the clock signal and the control signal has a branch tree structure in the monitored circuit and the simulation circuit illustrated in FIG. FIG. 11 is a circuit diagram showing a specific configuration example of the monitored circuit and the monitoring circuit shown in FIG. 1 as the second embodiment of the present invention. FIG. 12 is a timing chart for explaining the operation when the monitored circuit and the simulation circuit of the monitoring circuit shown in FIG. 11 are 2-bit counters. FIG. 13 is a circuit diagram showing a basic configuration example of the monitored circuit (32-bit up counter) shown in FIG. FIG. 14 is a diagram showing a truth table of the half adder shown in FIG. FIG. 15 is a circuit diagram showing a basic configuration example (No. 1) of the simulation circuit (32-bit down counter) shown in FIG. FIG. 16 is a diagram showing a truth table of the half subtracter shown in FIG. FIG. 17 is a circuit diagram showing a basic configuration example (No. 2) of the simulation circuit (32-bit down counter) shown in FIG. FIG. 18 is a diagram showing a truth table of the negative logic half adder shown in FIG. FIG. 19 is a circuit diagram showing a configuration example of the coincidence detection circuit shown in FIG.

  Hereinafter, a semiconductor integrated circuit according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to these embodiments.

(First embodiment)
FIG. 1 is a block diagram showing the configuration of a monitoring circuit incorporated in the semiconductor integrated circuit according to the first embodiment of the present invention and the relationship with the monitored circuit. 2 to 7 are diagrams for explaining a control method of two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 8 and FIG. 9 are diagrams for explaining a control method of two selectors existing corresponding to the data supply paths to the two flip-flop circuits corresponding to the monitored circuit and the simulation circuit shown in FIG. FIG. 10 is a diagram illustrating an example in which the supply path of the clock signal and the control signal has a branch tree structure in the monitored circuit and the simulation circuit illustrated in FIG.

  A monitored circuit 1 in FIG. 1 is a circuit (functional block) for realizing a certain function in a semiconductor integrated circuit (not shown). The monitoring circuit 2 includes a simulation circuit 3 and a comparison circuit 4. The simulation circuit 3 is a circuit that simulates the operation of the monitored circuit 1 based on the same data signal as the data signal input to the monitored circuit 1. The comparison circuit 4 compares the operations of the monitored circuit 1 and the simulation circuit 3 and outputs an alarm signal when the result indicates the possibility of failure. In FIG. 1, the output data signal of the monitored circuit 1 is output to the subsequent processing system. Instead, the output data signal of the simulation circuit 3 is used by the subsequent processing system. You can also.

  However, in this embodiment, the simulation circuit 3 is not a copy of the monitored circuit 1 but has a flip-flop circuit corresponding to a flip-flop circuit existing in a corresponding processing path of the monitored circuit 1, and the monitored circuit The combinational logic circuit is different from the combinational logic circuit constituting one corresponding processing path.

  In the monitored circuit 1 and the simulation circuit 3, the corresponding two flip-flop circuits operate at the same timing by the same clock signal supplied from the common clock supply line 5. On the other hand, two corresponding flip-flop circuits are supplied with a set signal and a reset signal from a common control signal line 6 as shown in FIG. 1A, and as shown in FIG. In some cases, a set signal or a reset signal is supplied from different control signal lines 7 and 8.

  Here, in order to facilitate understanding of the present invention, a part related to the present invention in the international standard IEC61508 defining functional safety will be described. In the plurality of check items for determining the β-factor value described in EC61508-6: 2000 Annex-D, Sec. D6, Table D.1 described above, (1) separability / separation property and ( 2) Checked for diversity / redundancy.

(1) In the separation / isolation, it is checked whether or not all signal wirings in the monitoring circuit and the monitored circuit are separated and isolated.
(2) In diversity / redundancy, (a) the monitoring circuit and the monitored circuit use different electrical technologies, for example, one is a configuration with a hard-wired circuit and the other is a configuration with a programmable electronic circuit (B) The monitoring circuit and the monitored circuit are designed by an engineer who has no communication at all, and different verifiers are performing at different times using different verification means, or (c) the monitoring circuit is Whether it has low diversity using the same technology diagnostic circuit or moderate diversity using different technology diagnostic circuits is checked. The reason why “different designers and different verification times” are required is to eliminate the possibility of common cause failures such as the possibility of the same design and the possibility of making the same verification error.

  Therefore, in the present embodiment, in order to satisfy (1) separability / isolation and (2) diversity / redundancy, two flip-flops corresponding to the monitored circuit 1 and the simulation circuit 3 are satisfied. The circuit is controlled, for example, as shown in FIGS. 2 to 7, and the two selectors existing corresponding to the data supply paths are controlled, for example, as shown in FIGS. (Supply signal, set signal) supply line has a branch tree structure as shown in FIG.

  First, a method for controlling two corresponding flip-flop circuits will be described with reference to FIGS. FIGS. 2 and 3 show control modes that are also used in the input / output interface unit, and FIGS. 4 to 7 show control modes in the internal circuit excluding the input / output interface unit. The two flip-flop circuits 10 (a, b) to 15 (a, b) operate at the same timing by the same clock signal CLK. The notations a and b in each of the two flip-flop circuits indicate that one is arranged on the monitored circuit 1 side and the other is arranged on the simulated circuit 3 side.

  The flip-flop circuits 10a and 10b in FIG. In this case, the same data signal DI is input from the preceding circuit corresponding to each data input terminal D. A subsequent circuit that receives the outputs of the flip-flop circuits 10a and 10b inputs the same reset signal R_n to each reset terminal R of the flip-flop circuits 10a and 10b and simultaneously sets the positive-phase output terminal Q to the bit “0”. After the reset, the output data signals in an inverted relationship with each other are captured.

  In the example shown in FIG. 2, the subsequent circuit that receives the output of the flip-flop circuit 10a uses the data signal DO output from the positive phase output terminal Q of the flip-flop circuit 10a, and the subsequent circuit that receives the output of the flip-flop circuit 10b is The data signal DO_n output from the reverse phase output terminal Qn of the flip-flop circuit 10b is used. As a result, the corresponding two subsequent circuits perform the processing operation using the data signals that are in a relationship in which the logic is inverted. That is, two corresponding subsequent circuits are different combinational logic circuits.

  The flip-flop circuits 11a and 11b in FIG. In this case, the same data signal DI is inputted to each data input terminal D from the corresponding preceding circuit. The subsequent circuit receiving the outputs of the flip-flop circuits 11a and 11b inputs the same set signal S_n to the set terminals S of the flip-flop circuits 11a and 11b and simultaneously sets the positive phase output terminal Q to the bit “1”. The subsequent output data signals in an inverted relationship are taken in.

  In the example shown in FIG. 3, the subsequent circuit that receives the output of the flip-flop circuit 11a uses the data signal DO output from the positive phase output terminal Q of the flip-flop circuit 11a, and the subsequent circuit that receives the output of the flip-flop circuit 11b The data signal DO_n output from the reverse phase output terminal Qn of the flip-flop circuit 11b is used. As a result, the corresponding two subsequent circuits perform the processing operation using the data signals that are in a relationship in which the logic is inverted. That is, two corresponding subsequent circuits are different combinational logic circuits.

  The flip-flop circuit 12a in FIG. 4 has a reset terminal R, and the flip-flop circuit 12b has a set terminal S. In this case, the data signal DI having a relationship in which the logic is inverted from the corresponding preceding circuit is input to the data input terminal D of each of the flip-flop circuits 12a and 12b. A subsequent circuit that receives the output of the flip-flop circuit 12a uses the data signal DO output from the positive phase output terminal Q after the reset signal R_n is input to the reset terminal R. The subsequent circuit that receives the output of the flip-flop circuit 12b uses the data signal DO output from the positive-phase output terminal Q of the flip-flop circuit 12b after the reset signal R_n is input to the set terminal S.

  As a result, the corresponding two subsequent circuits perform the processing operation using the data signal DO that is in a logic-inverted relationship. That is, two corresponding subsequent circuits are different combinational logic circuits.

  The flip-flop circuit 13a of FIG. 5 has a set terminal S, and the flip-flop circuit 13b has a reset terminal R. In this case, each data input terminal D is supplied with a data signal DI having a logic-inverted relationship from the corresponding preceding circuit. A subsequent circuit that receives the output of the flip-flop circuit 13a uses the data signal DO output from the positive phase output terminal Q after the set signal S_n is input to the set terminal S. Further, the subsequent circuit receiving the output of the flip-flop circuit 13b uses the data signal DO output from the positive phase output terminal Q after the set signal S_n is input to the reset terminal R.

  As a result, the corresponding two subsequent circuits perform the processing operation using the data signal DO that is in a logic-inverted relationship. That is, two corresponding subsequent circuits are different combinational logic circuits.

  The flip-flop circuit 14a in FIG. 6 has a reset terminal R, and the flip-flop circuit 14b has a set terminal S. In this case, each data input terminal D is supplied with a data signal DI having a logic-inverted relationship from the corresponding preceding circuit. A subsequent circuit that receives the output of the flip-flop circuit 14a uses the data signal DO_n output from the reverse phase output terminal Qn after the reset signal R_n is input to the reset terminal R. The subsequent circuit that receives the output of the flip-flop circuit 14b uses the data signal DO_n output from the reverse phase output terminal Qn after the reset signal R_n is input to the set terminal S.

  As a result, the corresponding two subsequent circuits perform the processing operation using the data signal DO that is in a logic-inverted relationship. That is, two corresponding subsequent circuits are different combinational logic circuits.

  The flip-flop circuit 15a in FIG. 7 has a set terminal S, and the flip-flop circuit 15b has a reset terminal R. In this case, each data input terminal D is supplied with a data signal DI having a logic-inverted relationship from the corresponding preceding circuit. A subsequent circuit that receives the output of the flip-flop circuit 15a uses the data signal DO_n output from the negative phase output terminal Qn after the set signal S_n is input to the set terminal S. Further, the connection circuit that receives the output of the flip-flop circuit 15b uses the data signal DO_n output from the negative phase output terminal Qn.

  As a result, the corresponding two subsequent circuits perform the processing operation using the data signal DO that is in a logic-inverted relationship. That is, two corresponding subsequent circuits are different combinational logic circuits.

  Next, in FIG. 8 and FIG. 9, two selectors that exist corresponding to the data supply paths to the two corresponding flip-flop circuits in the monitored circuit and the simulation circuit have two inputs by one-bit control input. A case in which either one is selected and output is shown.

  The selectors 18a, 18b, 19a, and 19b of FIGS. 8 and 9 respectively select the input port a and the output port c when the 1-bit selection signal SEL input to the control port d is bit “0”. When the bit is “1”, the input port b and the output port c are connected.

  As shown in FIG. 8, in the monitored circuit and the simulated circuit, when the selectors 18a and 18b select one of the two data signals by the 1-bit selection signal SEL, the control ports of the selectors 18a and 18b A selection signal SEL is directly applied to d. The input data DataA and B are connected to the two input ports a and b of the selector 18a in this order, and the input data DataB and A are connected to the two input ports a and b of the selector 18b in reverse order.

  As a result, different data signals are output from the corresponding selectors 18a and 18b in response to the selection signal SEL having the same contents, so that the two subsequent circuits process different data signals. In other words, two corresponding subsequent circuits are different combinational logic circuits.

  Further, as shown in FIG. 9, in the corresponding selectors 19a and 19b in the monitored circuit and the simulation circuit, the input data connected to the two input ports a and b selected by the 1-bit selection signal are both The selection signal SEL is directly applied to the control port d of the selector 19a in the order of Data A and B, and the selection signal SEL is applied to the control port d of the selector 19b with the logic inverted by the inverter circuit 20.

  As a result, different data signals are output from the corresponding selectors 19a and 19b in response to the selection signal SEL whose logic is inverted, so that the two subsequent circuits process different data signals. In other words, two corresponding subsequent circuits are different combinational logic circuits.

  Next, FIG. 10A shows an example of a branch tree structure of a clock signal supply path, and FIG. 10B shows an example of a branch tree structure of a reset signal supply path. Although an example of a branch tree structure of the set signal supply path is not shown, it has the same form.

  In FIG. 10A, when the clock signal CLK output from the clock generation circuit 24 is supplied to the monitored circuit 1 and the monitoring circuit 2, two branches are made from the vicinity of the output terminal of the route buffer 26 that receives the clock signal CLK. A branch clock tree 28 connected to the monitored circuit 1 via the buffer 27 and a branch clock tree 31 connected to the monitoring circuit 2 via the buffers 29 and 30 are formed. In consideration of timing adjustment, the branch clock tree 31 is provided with two buffers 29 and 30.

  Further, in FIG. 10B, when the reset signal Reset_n output from the reset signal generation circuit 34 is supplied to the monitored circuit 1 and the monitoring circuit 2, from a position near the output terminal of the route buffer 36 that receives the reset signal Reset_n. A branch / reset signal / tree 38 connected to the monitored circuit 1 via the buffer 37 and a branch / reset signal / tree 41 connected to the monitoring circuit 2 via the buffers 39 and 40 are formed. To do. In consideration of timing adjustment, the branch / reset signal / tree 41 includes two buffers 29 and 30.

  Here, the reason why the branch position is set in the vicinity of the output terminals of the route buffers 26 and 36 is to make the occurrence area of the common cause failure as small as possible. The branch tree structure illustrated in FIG. 10 is branched through a root buffer to ensure “separation / isolation”, and a clock signal and a reset signal supplied to the monitored circuit 1 and the monitoring circuit 2. It is intended as an effective measure against common cause failure where set signals fail simultaneously. Therefore, if the distance between the output terminal of the route buffer and the branch position is long, the effect of the countermeasure is diminished. Therefore, in an actual design, it is desirable to designate the branch position as close as possible to the output terminal of the route buffer. .

  In this way, in the monitored circuit 1 and the monitoring circuit 2, the same data signal or the data signal in which the logic is inverted is input to the corresponding two flip-flop circuits operating at the same timing. The two flip-flop circuits are controlled using a reset signal or a set signal, and output signals whose logics are inverted are used in the subsequent circuits.

  Further, in the selectors that exist corresponding to the respective data supply paths to the corresponding two flip-flop circuits, the connection relations of the data input ports are made different, or the logics of the selection signals applied to each other are inverted. Different data signals are supplied to subsequent circuits.

  Further, the clock signal, reset signal, and set signal supply paths used in common in the monitored circuit 1 and the monitoring circuit 2 have a branch tree structure and are supplied separately.

  As a result, in the monitored circuit 1 and the monitoring circuit 2, each subsequent circuit that receives the output of the flip-flop circuit is a different combinational logic circuit. Similarly, each subsequent circuit that receives the output of the selector also becomes a different combinational logic circuit. Accordingly, the number of circuits and nodes performing the same operation is very small.

  As a result, a short circuit failure (bridge failure) occurring in one combinational logic circuit, a short circuit failure between signals input to the comparison circuit 4 (bridge failure), and the influence of one combinational logic circuit on the value of the other combinational logic circuit (Coupling between signals, glitch, crosstalk, etc.) appears as illegal data taken into the flip-flop circuit in the interface part of the output circuit, so that the comparison circuit 4 can detect a failure with high probability. it can.

  After the RTL design or C language design is optimized in the logic synthesis tool, as long as the above-described relationship with respect to the corresponding two flip-flop circuits and the corresponding two selectors is maintained, the corresponding two subsequent circuits are mutually connected. Since the combinational logic circuits are different, the object of the present invention can be achieved.

  Therefore, in this embodiment, when there is a short circuit or interference between the signal in the monitoring circuit and the signal in the monitored circuit, and the two signals move in the same way, the monitoring circuit and the monitored circuit Since the circuit operates differently from each other, the comparison circuit can detect the failure. Accordingly, in response to the check item “diversity / redundancy” in the international standard IEC61508, “the monitoring circuit and the monitored circuit are different from each other in logic circuit and are essentially separated and isolated in terms of design”. So you can get high evaluation. In addition, since the supply path of the clock signal and control signal (reset signal, set signal) has a branch tree structure, higher evaluation can be obtained.

  In this embodiment, the monitoring circuit and the monitored circuit do not use different electrical techniques, but the monitoring circuit simulation circuit and the monitored circuit are different from each other because they operate differently. Design and verification methods are required, and operating frequency margins and electrical characteristics are also different. As a result, the “diversity / redundancy” check item in the international standard IEC61508 can be highly evaluated as having achieved medium diversity in general.

As described above, according to the first embodiment, it is possible to incorporate separability and diversity from the design stage, so that the β-factor value can be reduced. As a result, the probability of dangerous common cause failure λ it is possible to reduce the _D beta. In this way, it is possible to realize a monitoring circuit having a circuit structure in which common cause failures that cause failures simultaneously in both the monitoring circuit and the monitored circuit are unlikely to occur.

(Second Embodiment)
In the second embodiment, a configuration example of a monitored circuit and a monitoring circuit when the functional block to be monitored in the semiconductor integrated circuit is a counter (for example, a 32-bit counter) is shown.
As described in the first embodiment, in the present invention, the abnormal operation of a certain functional block in the semiconductor integrated circuit is configured by combining the monitored circuit and the simulated circuit in the monitoring circuit into different combinational logic circuits. To detect. Therefore, when monitoring the abnormal operation of the 32-bit counter, one of the monitored circuit and the simulation circuit is configured as a 32-bit up counter, and the other is configured as a 32-bit down counter.

  FIG. 11 is a circuit diagram showing a specific configuration example of the monitored circuit and the monitoring circuit shown in FIG. 1 as the second embodiment of the present invention. The function block 50 is a monitored circuit, the function block 51 is a simulation circuit in the monitoring circuit, and the coincidence detection circuit 52 is a comparison circuit in the monitoring circuit. In the second embodiment, the monitored circuit 50 is a 32-bit up counter, and the simulation circuit 51 is a 32-bit down counter. FIG. 11 shows a configuration for counting one bit in the 32-bit counter and accompanying circuit elements. The coincidence detection circuit 52 is configured as shown in FIG. 19, for example.

  In other words, in FIG. 11, the monitored circuit 50 includes a flip-flop circuit 55 that stores a counter value and a half adder 56 that adds “+1” to the counter value. Three selectors 57 to 59 are arranged between them, and an inverter circuit 60 and an AND circuit 61 are provided as elements for performing a logical operation on the control signal. Each of the selectors 57 to 59 selects and outputs one of the two inputs by a 1-bit (binary level signal) control input.

  The simulation circuit 51 includes a flip-flop circuit 65 that stores a counter value and a half subtractor 66 that performs “−1” on the counter value. Three selectors 67 to 69 are arranged between them, and an inverter circuit 70, an OR circuit 71, and inverter circuits 72 and 73 are provided as elements for performing a logical operation on the control signal. Each of the selectors 67 to 69 selects and outputs one of the two inputs according to a 1-bit (binary level signal) control input.

  The connection relationship of each element of the monitored circuit 50 is shown. In the flip-flop circuit 55, the clock signal CLK is input to the clock terminal, the reset signal Reset_n is input to the reset terminal R, and the output of the selector 57 is input to the data input terminal D. The positive phase output terminal Q of the flip-flop circuit 55 is connected to the input port a of the selector 59 and the input port b of the selector 59 via the half adder 56. The parallel output data of the 32 flip-flop circuits 55 is output to the subsequent circuit as the counter value cnt0 [31: 0] and also input to the coincidence detection circuit 52.

  The selector 59 connects the input port b and the output port c when the output of the AND circuit 61 input to the control port d is at a high level, and the input port a and the output when the output of the AND circuit 61 is at a low level. Connect to port c. The AND circuit 61 receives the operation instruction signal run and the count enable signal cnten0. That is, the selector 59 selects the output of the half adder 56 when the operation instruction signal run and the count enable signal cnten0 are both at a high level, and selects the output of the flip-flop circuit 55 in other cases. Output to the selector 58.

  In the selector 58, the preset data predata [31: 0] is input to the input port a, and the output of the selector 59 is input to the input port b. The selector 58 connects the input port b and the output port c when the output of the inverter circuit 60 input to the control port d is at a high level, and the input port a and the output when the output of the inverter circuit 60 is at a low level. Connect to port c. A preset control signal prewrite 0 is input to the inverter circuit 60. That is, the selector 58 selects the output of the selector 59 when the preset control signal prewrite0 is at a low level, and selects the preset data predata [31: 0] when the preset control signal prewrite0 is at a high level, and outputs it to the selector 57.

  In the selector 57, the bit “0” (32h “0000 — 0000”) is input to the input port a from the outside, and the output of the selector 58 is input to the input port b. The selector 57 connects the input port b and the output port c when the operation instruction signal run input to the control port d is at a high level, and outputs the input port a and output when the operation instruction signal run is at a low level. Connect to port c. That is, the selector 57 selects the output of the selector 58 when the operation instruction signal run is at a high level, selects the bit “0” when it is at a low level, and outputs it to the flip-flop circuit 55.

  Next, the connection relationship of each element of the simulation circuit 51 is shown. In the flip-flop circuit 65, the clock signal CLK is input to the clock terminal, the reset signal Reset_n is input to the set terminal S, and the output of the selector 67 is input to the data input terminal D. The positive phase output terminal Q of the flip-flop circuit 65 is connected to the input port a of the selector 69 and the input port b of the selector 69 via the half subtractor 66. The parallel output data of the 32 flip-flop circuits 55 is input to the coincidence detection circuit 52 as the counter value cnt1 [31: 0].

  The selector 69 connects the input port b and the output port c when the output of the OR circuit 71 input to the control port d is at a high level, and the input port a and the output when the output of the OR circuit 71 is at a low level. Connect to port c. The OR circuit 71 receives an inverted operation instruction signal run_n obtained by inverting the logic of the operation instruction signal run by the inverter circuit 72, and an inverted count enable signal cnten0_n obtained by inverting the logic of the count enable signal cnten0 by the inverter circuit 73. The That is, the selector 69 selects the output of the flip-flop circuit 65 when both the operation instruction signal run and the count enable signal cnten0 are not at the high level, and selects the output of the half subtractor 66 in the other cases. Output to.

  In the selector 68, the output of the selector 69 is input to the input port a, and the preset data predata [31: 0] is input to the input port b. The selector 68 connects the input port b and the output port c when the output of the inverter circuit 70 input to the control port d is at a high level, and connects the input port a and the output port c when the output is at a low level. . The inverter circuit 70 receives the preset control signal prewrite1. That is, the selector 68 selects the output of the selector 69 when the preset control signal prewrite1 is at a high level, selects the preset data predata [31: 0] when the preset control signal prewrite1 is at a low level, and outputs it to the selector 67.

  In the selector 67, the output of the selector 68 is input to the input port a, and the bit “1” (32h “FFFF_FFFF”) is input to the input port b from the outside. The selector 67 connects the input port b and the output port c when the inversion operation instruction signal run_n input to the control port d is at a high level, and connects the input port a and the output port c when it is at a low level. . That is, the selector 57 selects the output of the selector 68 when the operation instruction signal run is at a high level, selects the bit “1” when the operation instruction signal run is at a low level, and outputs it to the flip-flop circuit 65. To do.

  In the above configuration, the monitored circuit 50 has the flip-flop circuit 55 at the rising edge of the clock signal CLK after the positive phase output terminal Q is reset to the bit “0” in the period when the reset signal Reset_n is at the low level. By capturing the output of the selector 57, the output of the half adder 56 is input. Then, the counter value is incremented by 1 at the positive phase output terminal Q of the flip-flop circuit 55.

  That is, when the operation instruction signal run is at a low level, the bit “0” is output from the selector 57 and is taken into the flip-flop circuit 55 at the rising edge of the clock signal CLK. When the operation instruction signal run is at a high level and the count enable signal cnten0 is also at a high level, the selector 59 selects the output of the half adder 56, so that the preset control signal prewrite0 is at a low level. The 32-bit counter value counted up by 1 is taken into the flip-flop circuit 55 at the rising edge of the clock signal CLK.

  The count enable signal cnten0 is a pulse signal whose pulse width is one cycle of the clock signal CLK, and is generated in synchronization with the clock signal CLK. Therefore, by changing the frequency of pulse generation of the count enable signal cnten0, that is, the frequency, it is possible to perform a count-up operation at a frequency slower than that of the clock signal CLK.

  When the preset control signal prewrite0 becomes high level in the operation process where the operation instruction signal run is at high level, the selector 58 selects the preset data predata [31: 0]. At this time, the preset data predata [31: 0] output from the selector 57 is taken into the flip-flop circuit 55 at the rising edge of the clock signal CLK.

  Next, in the simulation circuit 51, the flip-flop circuit 65 causes the selector 67 to start at the rising edge of the clock signal CLK after the positive-phase output terminal Q is set to the bit “1” during the period in which the reset signal Reset_n is at a low level. By taking the output, the output of the half subtractor 66 is input. Then, the counter value is counted down by 1 in the flip-flop circuit 65.

  That is, when the operation instruction signal run is at a low level, the bit “1” is output from the selector 67 and is taken into the flip-flop circuit 65 at the rising edge of the clock signal CLK. When the operation instruction signal run is at a high level and the count enable signal cnten0 is also at a high level, the selector 69 selects the output of the half subtractor 66, so that the preset control signal prewrite1 is at a high level. The 32-bit counter value counted down by 1 is taken into the flip-flop circuit 65 at the rising edge of the clock signal CLK.

  Similar to the monitored circuit 50, the frequency of pulse generation of the count enable signal cnten0, that is, the frequency can be changed to enable the countdown operation at a frequency slower than the clock signal CLK.

  If the preset control signal prewrite1 becomes low level during the operation process in which the operation instruction signal run is at high level, the selector 68 selects the preset data predata [31: 0]. At this time, the preset data predata [31: 0] output from the selector 67 is taken into the flip-flop circuit 65 at the rising edge of the clock signal CLK.

  Next, the operation when the monitored circuit and the simulation circuit in FIG. 11 are 2-bit counters will be described with reference to FIG. FIG. 12 is a timing chart for explaining the operation when the monitored circuit and the simulation circuit of the monitoring circuit shown in FIG. 11 are 2-bit counters. In FIG. 12, for easy understanding, the frequency of the count enable signal cnten0 is set to 1/3 of the clock signal CLK.

  In FIG. 12, since the monitored circuit 50 is an up counter, the counter value is incremented by “+1” while the count enable signal cnten0 is at a high level. Then, immediately before the count enable signal cnten0 falls, the counter value is taken into the flip-flop circuit 55 at the rise of the clock signal CLK. Since it is a 2-bit up-counter, it is incremented from the value “0x0” and repeatedly counted up to the value “0x3”.

  On the other hand, the simulation circuit 51 sets the counter value at the rising edge of the clock signal CLK immediately before the inverted count enable signal cnten0_n rises during the period when the inverted count enable signal cnten0_n is at a low level. Is a 2-bit down counter that is fetched by the flip-flop circuit 65, and therefore it is decremented from the value “0x3” and repeatedly counted up to the value “0x0”.

  Next, the overall configuration of the 32-bit up counter (monitored circuit 50) and the 32-bit down counter (simulation circuit 51) will be briefly described. FIG. 13 is a circuit diagram showing a basic configuration example of a monitored circuit (32-bit up counter). FIGS. 15 and 17 are circuit diagrams showing basic configuration examples (No. 1) and (No. 2) of the simulation circuit (32-bit down counter). FIG. 15 includes positive values and FIG. 17 includes negative logic. Has been. In FIG. 13, the selectors 57 to 59, the inverter circuit 60, and the AND circuit 61 in the monitored circuit 50 in FIG. 15 and 17, the selectors 67 to 69, the inverter circuit 70, the OR circuit 71, and the inverter circuits 72 and 73 in the simulation circuit 51 of FIG. 11 are not shown.

  FIG. 13 shows the flip-flop circuit 55 and the half adder 56 shown in FIG. 11. Each circuit has a one-to-one correspondence and is composed of 32 pieces. The flip-flop circuits 55_0 to 55_31 are reset at the same timing by the reset signal Reset_n, and operate at the same timing by the clock signal CLK. Each of the half adders 56_0 to 56_31 includes two inverter circuits 80 and 81, three AND circuits 82, 83, and 84, and an OR circuit 85.

  In terms of the relationship between the flip-flop circuit 55_0 and the half adder 56_0, in the half adder 56_0, an external carry input (fixed value “1”) is directly input to one input terminal of the AND circuits 82 and 84. , And input to one input terminal of the AND circuit 83 via the inverter circuit 81. The data sent to the positive phase output terminal Q of the flip-flop circuit 55_0 is directly input to the other input terminal of the AND circuits 83 and 84 and input to the other input terminal of the AND circuit 82 via the inverter circuit 80. Is done. The outputs of the AND circuits 82 and 83 become the output S0 of the half adder 56_0 through the OR circuit 85, and are input to the data input terminal D of the flip-flop circuit 55_0. An output C1 of the AND circuit 84 is a carry output, and becomes a carry input of the next half adder 56_1. Similarly, at each stage, the carry output of the preceding stage becomes the carry input of the subsequent stage, and the counter value added to the positive phase output terminal Q of the corresponding flip-flop circuit is output.

  Each of the half adders 56_0 to 56_31 performs an operation according to the truth table shown in FIG. In FIG. 14, A is an input from a corresponding flip-flop circuit, Cn is a carry input, S is an addition output, and Cn + 1 is a carry output.

  Next, FIG. 15 shows the flip-flop circuit 65 and the half subtractor 66 shown in FIG. 11. Each circuit has a one-to-one correspondence and is composed of 32 pieces. The flip-flop circuits 65_0 to 65_31 are set at the same timing by the reset signal Reset_n, and operate at the same timing by the clock signal CLK. The half subtractors 66_0 to 66_31 include two inverter circuits 90 and 91, two AND circuits 92 and 93, and an OR circuit 94, respectively.

  Speaking of the relationship between the flip-flop circuit 65_0 and the half subtractor 66_0, in the half subtractor 66_0, an external borrow input (fixed value “1”) is connected to one input terminal of the AND circuit 92 via the inverter circuit 90. And input directly to one input terminal of the AND circuit 93. Further, data sent from the flip-flop circuit 65_0 to the positive phase output terminal Q is directly input to the other input terminal of the AND circuit 92 and input to the other input terminal of the AND circuit 93 via the inverter circuit 91. . The outputs of the AND circuits 92 and 93 become the output D0 of the half subtractor 66_0 through the OR circuit 94 and are input to the data input terminal D of the flip-flop circuit 65_0. The output B1 of the AND circuit 93 is a borrow output, which is a borrow input of the next half subtractor 66_1. Similarly, at each stage, the borrow output of the previous stage becomes the borrow input of the subsequent stage, and the counter value subtracted to the positive phase output terminal Q of the corresponding flip-flop circuit is output.

  Each of the half subtractors 66_0 to 66_31 performs an operation according to the truth table shown in FIG. In FIG. 16, A is an input from a corresponding flip-flop circuit, Bn is a borrow input, D is a subtraction output, and Bn + 1 is a borrow output.

Next, FIG. 17 shows a case where the half subtractor 66 in the simulation circuit of FIG. 11 is configured by a negative logic half adder. The negative logic half adders 98_0 to 98_31 in FIG. 17 are obtained by configuring the half adders 56_0 to 56_31 in FIG. 13 with negative logic.
Speaking of the relationship between the flip-flop circuit 65_0 and the negative logic half adder 98_0, the negative logic half adder 98_0 receives a negative logic carry (fixed value “0”) from the outside, and the negative logic output S0_n is flip-flops. Is input to the data input terminal D of the circuit 65_0. The data sent to the positive phase output terminal Q of the flip-flop circuit 65_0 is inputted to the negative logic half adder 98_0. The negative logic carry output C1_n generated by the negative logic half adder 98_0 is the negative logic carry input of the next stage negative logic half adder 98_1. Similarly, in each stage, the negative logic carry output of the previous stage becomes the negative logic carry input of the subsequent stage, and the counter value subtracted to the positive phase output terminal Q of the corresponding flip-flop circuit is output.

  Each of the negative logic half adders 98_0 to 98_31 performs an operation according to the truth table shown in FIG. In FIG. 18, A is an input from a corresponding flip-flop circuit. Cn is a carry input, S is an addition output, and Cn + 1 is a carry output. The carry input Cn, addition output S, and carry output Cn + 1 shown in FIG. 14 are logically inverted.

  FIG. 19 is a circuit diagram showing a configuration example of the coincidence detection circuit shown in FIG. The coincidence detection circuit 52 includes exclusive OR circuits 99_0 to 99_31 and a NAND circuit 100. Each of the exclusive OR circuits 99_0 to 99_31 includes a 32-bit counter value cnt0 [31: 0] output from the monitored circuit 50 and a 32-bit counter value cnt1 [31: 0] output from the simulation circuit 51. 2 bits corresponding to are input. When all the outputs of the 32 exclusive OR circuits 99_0 to 99_31 are at a high level (bit “1”), the NAND circuit 100 notifies the outside that there is no failure by setting the output (alarm signal Alarm) to a low level. In other cases, the output (alarm signal Alarm) is set to a high level to notify the outside of the occurrence of the failure.

  That is, the match detection circuit 52 compares the counter value cnt0 [31: 0] output from the monitored circuit 50 with the counter value cnt1 [31: 0] output from the simulation circuit 51 for each corresponding bit. If there is no failure and all do not match, the alarm signal Alarm is at a low level, and if there is a failure and even one bit matches, the alarm signal Alarm is at a high level.

  In FIG. 11, the counter value cnt0 [31: 0] is output to the subsequent circuit. Instead, the 32-bit counter value cnt1 [31: 0] output from the simulation circuit 51 is output to the subsequent circuit. In the case of the configuration, it goes without saying that the logic must be matched in the subsequent circuit.

  As described above, according to the second embodiment, the abnormal operation of the 32-bit counter in the semiconductor integrated circuit is configured such that one of the monitored circuit and the simulated circuit is configured as a 32-bit up counter, and the other is Therefore, the abnormal operation of the 32-bit counter can be monitored in such a way that a common cause failure that causes both the monitoring circuit and the monitored circuit at the same time is unlikely to occur.

  At that time, the monitored circuit and the simulated circuit use two different preset control signals, and the flip-flop circuit in the monitored circuit and the flip-flop circuit in the simulated circuit set preset data independently. Can do. In this case, the preset data is set in the monitored circuit and the simulation circuit by inverting the logics of the two preset control signals, so that the monitored logic circuit and the simulation circuit operate different combinational logic circuits. It does not detract from the spirit of the present invention.

  Although not shown, in the combinational logic circuit of the monitored circuit and the simulated circuit, one is composed of a logic circuit that does not include a NAND (negative logical product) circuit and includes a NOR (negative logical sum) circuit, and the other is NOR (negative logical sum). ) Even if it is configured with a logic circuit including a NAND (Negative AND) circuit without including a circuit, the same effect can be obtained from the viewpoint of diversity by configuring one with positive logic and the other with negative logic. This is because a NAND (Negative AND) circuit and a NOR (Negative OR) circuit constitute a complete system, so that, for example, any NAND (Negative AND) circuit can be used without using a NOR circuit. This is because a different circuit configuration can be realized while having the same function.

  1 circuit to be monitored, 2 monitoring circuit, 3 comparison circuit, 10a, 10b, 11a, 11b, 12a, 12b, 13a, 13b, 14a, 14b, 15a, 15b flip-flop circuit, 18a, 18b, 19a, 19b selector, 50 Monitored circuit (32-bit up counter), 51 simulation circuit (32-bit down counter), 55, 65 flip-flop circuit, 56 half adder, 57-59, 67-69 selector, 66 half subtractor.

Claims (6)

A monitored circuit having at least one flip-flop circuit in the processing path;
The processing path has a flip-flop circuit corresponding to the flip-flop circuit of the monitored circuit, a simulation circuit that simulates the operation of the monitored circuit, and the output of the monitored circuit and the output of the simulation circuit are compared And a monitoring circuit having a comparison circuit that outputs an alarm signal based on the comparison result,
The flip-flop circuits corresponding to each other in the monitored circuit and the simulation circuit are controlled to operate at the same timing and to output signals having their logics inverted to the corresponding subsequent circuits, respectively. A semiconductor integrated circuit.   The flip-flop circuits in the monitored circuit and the simulation circuit receive the same input signal, the same reset signal, or the same set signal, and the positive phase output of one flip-flop circuit and the other flip-flop circuit 2. The semiconductor integrated circuit according to claim 1, wherein a reverse phase output of the circuit is used in each of the subsequent circuits corresponding thereto.   The flip-flop circuits in the monitored circuit and the simulation circuit each receive a signal whose logic is inverted, one flip-flop circuit receives a reset signal at a reset terminal, and the other flip-flop circuit is a set terminal 2. The semiconductor integrated circuit according to claim 1, wherein a reset signal is input to each of the first and second positive-phase outputs, and each of the succeeding circuits is used.   The flip-flop circuits in the monitored circuit and the simulation circuit each receive a signal whose logic is inverted, one flip-flop circuit receives a reset signal at a reset terminal, and the other flip-flop circuit is a set terminal 2. The semiconductor integrated circuit according to claim 1, wherein a reset signal is input to each of the first and second reverse-phase outputs, and each of the succeeding circuits is used.   2. The semiconductor integrated circuit according to claim 1, wherein one of the monitored circuit and the simulation circuit is configured by positive logic and the other is configured by negative logic.   2. The monitored circuit and the simulation circuit are each configured by a logic circuit that does not include a negative logical sum circuit, and the other is configured by a logical circuit that does not include a negative logical product circuit. The semiconductor integrated circuit as described.

Images