JP2013242746A - Failure detection system and method, and semiconductor device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system that expands the range of failure detection for internal states of a processor so as to shorten time from the occurrence of a failure to the detection of the failure.SOLUTION: A failure detection system includes: JTAG-compliant first and second processors (101A and 101B); and a processor monitoring JTAG controller (105) that generates JTAG signals for monitoring the processors during normal operation and that commonly and parallelly inputs monitoring TDI-signals to the first and second processors (101A and 101B); and a TDO signal comparison circuit (103) that receives TDO signals that are parallelly output from the first and second processors (101A and 101B), compares them with each other and, if a mismatch is detected, brings a processor failure notification signal into an active state.

Description

  The present invention relates to a failure detection technique, and more particularly, to a failure detection system and method suitable for detecting a processor failure and a semiconductor device.

  In order to improve the functional safety of semiconductor devices such as processors or to ensure the required functional safety standards, failure of semiconductor devices such as processors can be quickly and rapidly increased during the operation of system products equipped with semiconductor devices such as processors. There is a demand for accurate detection. Here, functional safety refers to safety realized by the safety function operating correctly. Note that the functional safety standards for electrical / electronic / programmable electronic safety-related systems are standardized in, for example, IEC 61508 (IEC: International Electro-technical Commission). In IEC61508, the safety level (SIL: Safety Integrity Level) is defined in four stages. A safety-related system is an entity that performs a safety function. In addition, there is ISO26262 (ISO: International Organization for Standardization) as a safety standard for automobiles such as in-vehicle devices.

<Dual processor lockstep method>
As a configuration for realizing the fail-safe function, for example, a dual processor lockstep system is known. A dual processor lockstep system detects a failure by performing the same process on two processors and detecting the difference. FIG. 1 is a diagram for explaining a dual processor lockstep system (see, for example, FIG. 1 of Non-Patent Document 1). The dual processor is also called a dual core.

  Referring to FIG. 1, a processor # 0 (11A) mounted on a semiconductor device (semiconductor chip) 10 (SOC (System On Chip): a device in which necessary system functions are integrated on one chip). And processor # 1 (11B) have the same configuration, are driven by a common clock signal, and simultaneously execute the same program (instruction).

  The comparison circuit 13 receives the program processing result # 0 output from the processor # 0 to the processor # 0 bus signal 12A and the program processing result # 1 output from the processor # 1 to the processor # 1 bus signal 12B. Compare and detect match / mismatch. When the program processing results # 0 and # 1 do not match, the comparison circuit 13 determines that a processor failure has occurred, and outputs a processor failure notification signal (not shown) to the peripheral circuit control bus 14 or the semiconductor device 10, for example. The program processing result # 0 from the processor # 0 (11A) and the program processing result # 0 from the processor # 1 (11B) need to be input to the comparison circuit 13 and compared in synchronization with each other. For this reason, synchronization means (not shown) for synchronizing the processor # 0 and the processor # 1 is provided.

  As described above, a program corresponding to an application of a product or the like is simultaneously executed by the two processors # 0 (11A) and processor # 1 (11B), and a failure is detected by monitoring the processing results.

  Although not particularly limited, the processor # 0 (11A) and the processor # 1 (11B) are connected to a memory (not shown) such as a DRAM (Dynamic Random Access Memory) that stores and holds program instructions via the peripheral circuit control bus 14. Instruction is fetched from memory) and executed. Although not particularly limited, a configuration in which one of the dual processors of the processor # 0 (11A) and the processor # 1 (11B) is a control processor and the other is a monitoring processor is also used. In this case, for example, the program processing result of the processor corresponding to the control processor is output to a memory (not shown) or an input / output (IO) device (not shown) via the peripheral circuit control bus 14 or the like.

  In the dual processor lockstep method illustrated in FIG. 1, basically, only a failure within a range that can be discriminated from the signal output from the processor can be detected. For this reason, when a signal is not output from the processor, it is difficult to detect a failure (in some cases, the failure cannot be detected). This will be described below.

  FIG. 2 is a diagram for explaining the operation when the program for outputting the value of the general-purpose register # 0 from the processor # 0 and the processor # 1 to the processor # 1 bus signal and the processor # 1 bus signal in FIG. Figure). 2 shows a processor operation clock signal (system clock signal supplied to the processor) (not shown in FIG. 1), the value of general-purpose register # 0 of processor # 0, and general-purpose register # 1 of processor # 0. , The processor # 0 bus signal, the value of the general register # 0 of the processor # 1, the value of the general register # 1 of the processor # 1, the processor # 1 bus signal, and the processor # 0 bus by the comparison circuit 13 An example (reference diagram created by the present inventor) of the time transition of the comparison result of the signal and the processor # 1 bus signal is shown.

  In FIG. 2, a failure has occurred in the general-purpose register # 1 of the processor # 0 shown in FIG. 1 at the timing of (1) (circled number 1). Therefore, after timing (1), 0x0000_0003 is set in general-purpose register # 1 of processor # 0 instead of its expected value: 0x0000_0002 (32-bit data representing 0xHexadecimal). However, the value 0x0000_0008 of the general-purpose register # 0 of the processor # 0 is output to the processor # 0 bus signal.

  The value of the processor # 0 bus signal matches the value of the processor # 1 bus signal output from the processor # 1 operating normally (the value of the general-purpose register # 0 of the processor # 1).

  For this reason, the comparison circuit 13 cannot detect a failure of the processor # 0 (failure of the general-purpose register # 1) even though a failure has actually occurred in the general-purpose register # 1 of the processor # 0. .

<JTAG method>
JTAG (Joint Test Action Group), which standardizes inspection of semiconductor integrated circuits and substrates (boundary scan test), allows access to the inside of the processor, etc., based on its functions. For example, it operates on the processor incorporated in the system. It is also used for debugging software (programs). The software debugging function by JTAG is also called “JTAG-ICE” (ICE: In-Circuit Emulator) or “JTAG debugger”. In software debugging using JTAG, the inside of the processor core is accessed, and for example, breakpoint setting / cancellation, step execution, memory / register dumping, tracing, and the like are performed.

  A configuration example in the case where an internal signal such as a register in the processor is read using JTAG will be described. FIG. 3 shows an example of a JTAG connection configuration for software debugging of a system including a semiconductor device (SOC) having a dual processor configuration (see, for example, FIG. 2 of Non-Patent Document 1).

  In FIG. 3, processors 11′A and 11′B on a semiconductor device (chip) (SOC) 10 ′ are configured as a JTAG architecture compliant with IEEE (the Institute of Electrical and Electronics Engineers, Inc) Std 1149.1, In addition to logic (core logic) (not shown) for realizing the original function of the processor, a JTAG circuit (not shown) is provided.

In FIG. 3, the JTAG circuit implemented in the processors 11′A and 11′B is
・ Instruction register (IR (instruction register)),
Data register (DR) (BSR (Boundary Scan Register), BYPASS (1-bit bypass register), IDCODES (register holding device ID and revision number), other optional registers) ,
A decoder (decodes instructions in the instruction register);
A first multiplexer (MUX) (selects and outputs one of the data registers based on the output of the decoder);
A TAP controller (state machine having 16 types of states, state transitions by TMS and TCK, and controlling instruction registers, data registers, etc.);
Second multiplexer (MUX) (selects the instruction register or the output of the first MUX (multiplexer) based on the output of the TAP controller)
Is provided.

  A TAP (Test Access Port) (JTAG interface) includes the following signals (referred to as JTAG signals).

TCK (Test Clock): A test clock signal for performing the test operation and the boundary scan operation in synchronization (input terminal).
TMS (Test Mode Select): A signal that is decoded by the TAP controller and controls the test operation (input terminal).
TDI (Test Data Input): A signal for inputting instructions and data serially to the test logic (input terminal). TDI is captured in the register selected by the decoder in synchronization with the rising edge of TCK.
TDO (Test Data Output): A signal for serially outputting data from the test logic (output terminal). TDO is shifted out (read) from the register selected by the decoder in synchronization with the rising edge of TCK, and does not change until the falling edge of TCK. The TDO terminal is in a high impedance state except for the shift operation.
TRST (Test Reset): Optional signal. A signal used for asynchronous reset of the TAP controller (input terminal). In response to TRST Low, the TAP controller resets the state machine (Test-Logic-Reset).

  A signal serially input to the TDI terminal of the JTAG device passes through the data register or the shift register of the instruction register depending on the state of the TAP controller, and is output from the TDO terminal.

  As shown in FIG. 3, among TDI, TMS, TCK, and TRST for debugging from a PC (Personal Computer) 20, the TMS, TCK, and TRST signals for debugging are the TMS terminals and TCK of processors # 0 and # 1, respectively. Terminal and TRST terminal are respectively input in parallel.

  On the other hand, the debug TDI is serial chained (daisy chained). That is, the debug TDI signal from the PC 20 is serially input to the TDI terminal of the processor # 0, and the signal output serially from the TDO terminal of the processor # 0 is serially input to the TDI terminal of the processor # 1. A signal serially output from the TDO terminal of the processor # 1 is input to the PC 20 as a debug TDO signal. In this way, the TDI signal is connected in a serial chain so that the processor # 0 and the processor # 1 can be debugged individually. In FIG. 3, pull-up resistors connected to the debug TMS, TDI, TDO, and TRST are omitted for simplicity.

  4A and 4B are diagrams (reference diagrams created by the present inventor) for explaining the access when the JTAG instruction command is set and when the processor internal signal is read in FIG. 3, respectively. .

  As shown in FIG. 4A, a debugging TDI signal (command command) for the processor # 1 is serially input to the TDI terminal of the processor # 0, and then the debugging TDI signal is input to the TDI terminal of the processor # 0. (Instruction command) is input serially. In this case, the debugging TDI signal (instruction command) input to the TDI terminal of the processor # 0 serially in synchronization with TCK first passes through, for example, a 1-bit bypass register in the JTAG circuit in the processor # 0. (Bypassing the boundary scan register), serially output from the TDO terminal, serially input to the TDI terminal of the processor # 1 in synchronization with TCK, and set in the instruction register of the JTAG circuit in the processor # 1, for example The The debug TDI signal that is serially input to the TDI terminal of the processor # 0 in synchronization with TCK later is set in the instruction register of the JTAG circuit in the processor # 0.

  At the time of reading the internal signal of the processor, as shown in FIG. 4B, as a debug TDO signal, it synchronizes with the test clock TCK from the selected register (for example, the boundary scan register) of the JTAG circuit of the processor # 1. The serially shifted-out signal (processor # 1 internal signal) is output from the TDO terminal, and then serially synchronized with the test clock TCK from the selected register (for example, boundary scan register) of the JTAG circuit of processor # 0. Is output from the TDO terminal of the processor # 1 as a debug TDO signal. In this case, a signal (processor # 0 internal signal) that is serially shifted out to the TDO terminal in synchronization with TCK from the selected register (for example, the boundary scan register) of the JTAG circuit of processor # 0 is the processor # 1. The signal is input to the TDI terminal, and is serially output in synchronization with TCK from the TDO terminal of the processor # 1 via, for example, a 1-bit bypass register of the JTAG circuit in the processor # 1.

  Note that the processor # 1 internal signal in FIG. 4B sets an instruction command based on the debug TDI signal input to the processor # 1 in the instruction register of the JTAG circuit in the processor # 1 (11′B) (described later). Set the value of general-purpose register # 0 (not shown in FIG. 3) in the processor # 1 (11′B) in the boundary scan cell, and serially shift out from the TDO terminal. It has been done.

  Also, the processor # 0 internal signal in FIG. 4B sets the instruction command by the debug TDI signal input to the processor # 0 in the instruction register of the JTAG circuit in the processor # 0 (11′A), and The value of general-purpose register # 0 (not shown in FIG. 3) in # 0 (11′A) is set in the boundary scan cell, serially shifted out from the TDO terminal, and the processor # 1 (11′B) It is output via the TDI terminal, the JTAG circuit bypass register, and the TDO terminal.

  In the case of the configuration of FIG. 3, JTAG instruction commands cannot be written simultaneously (in parallel) to the processor # 0 and the processor # 1. Also, internal data cannot be read from the processor # 0 and the processor # 1 simultaneously (in parallel). As a result, the access time becomes longer.

  A configuration in which TDI signals are written in parallel to a plurality of devices is disclosed in Patent Document 1 and the like. In Patent Document 1, a TDI signal is connected in parallel to a TDI terminal of a plurality of devices in a configuration in which a scan path is formed so that a TDI signal passes through all of the plurality of devices in series. In Patent Document 1, a TDO terminal of each of a plurality of devices that input TDI signals in parallel is provided with a selector to which a plurality of inputs are connected, and a TDO signal selected by the selector is output.

JP 2001-343432 A

Harn Hua Ng "PPC405 Lockstep System on ML310", XAPP564 (v1.0.2) January 29, 2007, [Search March 22, 2012], Internet <URL: http://www.eetasia.com/ARTICLES/2004DEC/ A / 2004DEC09_PL_MPR_AN.PDF? SOURCES = DOWNLOAD>

  The analysis of related technologies is shown below.

  In the case of the configuration of FIG. 1, when the general-purpose register # 1 of the processor # 0 fails, if the influence of the failure is not output to the processor # 0 bus signal, the processor # 0 bus signal is compared with the processor # 1 bus signal. Even so, since they match, a failure in processor # 0 (failure in general register # 1) cannot be detected.

  In the case of the configuration shown in FIG. 3, the TDI signal is connected in a serial chain among a plurality of processors. For this reason, simultaneous writing of command commands to multiple processors and simultaneous reading of data cannot be performed. For example, in a system having n processors (n is a positive integer of 2 or more), the write time and read time of n processors are n times the write time and read time of one processor, respectively. Due to the increase in the reading time of the internal signal of the processor, the time required from the occurrence of a failure of the internal circuit of the processor to the detection of the failure may not satisfy a predetermined specification. Therefore, the configuration shown in FIG. 3 for software debugging using JTAG is not suitable for monitoring the processor, and cannot be applied to monitoring / diagnosis for improving functional safety or complying with required functional safety standards. .

  Therefore, the present invention has been developed to solve at least one of the above problems, and its purpose is to enable the expansion of the fault detection range of the internal state of the processor, and the time from the occurrence of the fault to the fault detection. It is an object of the present invention to provide a system, a method and an apparatus that can shorten the time.

According to the present invention, a plurality of JTAG (Joint Test Action Group) compliant processors having the same configuration and the same configuration,
A processor monitoring JTAG processor monitoring JTAG controller that generates a monitoring JTAG signal during normal operation;
With
Among the monitoring JTAG signals output from the processor monitoring JTAG controller, a monitoring test data input (TDI) signal is commonly and in parallel to a plurality of test data input (TDI) terminals of the plurality of processors. Supplied,
A test data output (TDO) signal output in parallel from a plurality of test data output (TDO) terminals of the plurality of processors is input in response to the input of the test data input (TDI) signal for monitoring. A failure detection system is provided that further includes a TDO signal comparison circuit that outputs a processor failure notification signal as an active state when these are compared and a mismatch is detected.

According to the present invention, among the monitoring JTAG signals output from the processor monitoring JTAG controller during normal operation of a system including a plurality of JTAG (Joint Test Action Group) processors having the same configuration. Supplying test data input (TDI) signals for monitoring to a plurality of test data input (TDI) terminals of the plurality of processors in common and in parallel;
The test data output (TDO) signals output in parallel from the plurality of test data output (TDO) terminals of the plurality of processors are compared in response to the input of the test data input (TDI) signal for monitoring. Then, a failure detection method for outputting a processor failure notification signal when a mismatch is detected is provided.

  According to the present invention, the failure detection range of the internal state of the processor can be expanded, and the time from failure occurrence to failure detection can be shortened.

It is a figure explaining the structure of the lock step of a dual processor. It is a figure for demonstrating the problem of the structure of FIG. It is a figure for demonstrating the structural example using JTAG. (A) and (B) are diagrams for explaining access at the time of setting a JTAG instruction command and reading a processor internal signal in FIG. It is a figure which shows an example of a structure of one Embodiment of this invention. It is a figure explaining the JTAG selector of FIG. (A), (B) is a figure explaining the access at the time of reading a processor internal signal at the time of the JTAG instruction command setting of this embodiment. It is a figure which shows the structural example of the JTAG controller for processor monitoring of FIG. FIG. 6 is a diagram illustrating a configuration example of a TDO signal comparison circuit in FIG. 5. It is a figure which shows the example of the command command set to a processor. It is a flowchart for demonstrating the processor monitoring process in one Embodiment of this invention. It is a time chart for demonstrating an example of the initial process of the JTAG controller for processor monitoring in one Embodiment of this invention. It is a time chart for demonstrating an example of the write operation of the JTAG instruction command of the processor monitoring JTAG controller in one Embodiment of this invention. It is a time chart for demonstrating an example of the reading operation | movement of the processor internal signal of the JTAG controller for a processor monitoring in one Embodiment of this invention. It is a time chart for demonstrating an example of operation | movement of the TDO signal comparison circuit in one Embodiment of this invention. 6 is a time chart for explaining an example of an operation when a failure occurs in the general-purpose register # 1 of the processor # 0 in the embodiment of the present invention. It is a figure for demonstrating the modification 1 to one Embodiment of this invention. It is a figure for demonstrating the modification 2 to one Embodiment of this invention. It is a figure for demonstrating the modification 3 to one Embodiment of this invention. It is a figure for demonstrating one form of this invention.

  An embodiment of the present invention will be described. According to one of several modes, as shown in FIG. 20, a semiconductor device (system) 100 includes, for example, first and second processors 101A including JTAG circuits compliant with IEEE Std. 1149.1, 101B and a JTAG controller 105 that generates a processor monitoring JTAG signal during normal operation. Among the monitoring JTAG signals from the JTAG controller 105, the TDI signal is supplied in common and in parallel to the TDI terminals of the first and second processors 101A and 101B (as shown in FIG. 3, in the daisy chain connection). Absent). Of the monitoring JTAG signal from the JTAG controller 105, TCK is supplied in common and in parallel to the TCK terminals of the first and second processors 101A and 101B. Similarly, TMS and TRST are supplied in common and in parallel to the TMS and TRST terminals of the first and second processors 101A and 101B.

  Furthermore, the semiconductor device (system) 100 inputs the TDO signals output in parallel from the TDO terminals of the first and second 101A and 101B in response to the input of the monitoring TDI signal, and compares them. When a mismatch is detected, a TDO signal comparison circuit 103 that outputs a processor failure notification signal as an active state is provided.

  The processor monitoring JTAG controller 105 reads out the state of each internal circuit from a plurality of internal circuits (general-purpose registers) included in each of the first and second processors 101A and 101B, and outputs the test data output of the processor. JTAG instruction commands (register read (for processor diagnosis)) to be output from the (TDO) terminal are sequentially generated and output as the test data input (TDI) signal, and when the reading of the state of the last internal circuit is completed The iterative process of returning to the internal circuit from which data was first read and reading the state again may be repeated during normal operation.

  By adopting such a configuration, for example, compared with the dual processor lockstep method illustrated in FIG. Further, in the present embodiment, the time for writing an instruction command and reading an internal signal is set as compared with the configuration illustrated in FIG.

  In this embodiment, when the system is started in the debug mode at the time of system development or the like, the processor monitoring JTAG controller 105 is not activated, and the debugging JTAG signal from the debugging device such as the PC is the first. , Supplied to the second processors 101A and 101B. Hereinafter, exemplary embodiments will be described with reference to the drawings.

<Embodiment 1>
FIG. 5 is a diagram showing an example in which the present invention is applied to a system (device) using JTAG.

  Referring to FIG. 5, a semiconductor device (SOC) 100 includes a processor monitoring JTAG controller 105 (same as 105 in FIG. 20) for controlling a JTAG circuit in the processor, and a debugging JTAG signal (debugging TDI, TMS, TRST, TCK) and a monitoring JTAG signal (monitoring JTDI, TMS, TRST, TCK) output from the processor monitoring JTAG controller 105, one set of two sets of JTAG signals is selected and the selected set is selected The JTAG selector 106 supplies the JTAG signal to the processor # 0 and the processor # 1.

  JTAG signals for debugging (TDI, TMS, TRST, TCK, TDO for debugging) are connected to a PC (not shown) or the like (see PC 200 in FIG. 6). The debugging JTAG signal is used for debugging the software of the processors 101A and 101B during system development.

  A debug instruction signal, which is a control signal input from an external terminal (pin) of the semiconductor device (SOC) 100 and supplied to the processor monitoring JTAG controller 105, is in an inactive state (non-debug mode, system Normal operation). At this time, the processor monitoring JTAG controller 105 generates TCK, TRST, TMS, and TDI for monitoring in order to read internal signals from the processor # 0 and the processor # 1.

  Depending on whether the debug instruction signal is in an active state (debug mode) or in an inactive state (non-debug mode), the JTAG selector 106 sets the debug JTAG signal or the JTAG signal for monitoring. Select a set.

  In the software debugging process during system development of an embedded system or the like, the semiconductor device 100 is activated with the debug instruction signal set to the active state (debug mode). In the debug mode, the JTAG selector 106 selects a JTAG signal set for debugging. In this case, the debugging TDI is connected in a daisy chain between the processors # 0 and # 1 having the JTAG circuit as in FIG. The debug TCK, the debug TMS, and the debug TRST are supplied in parallel to the processors # 0 and # 1, respectively. That is, the JTAG selector 106 inputs the debug TDI, supplies it serially to the TDI terminal of the processor # 0 as the TDI for the processor # 0, receives the serial output TDO # 0 from the TDO terminal of the processor # 0, The TDO # 0 is serially input to the TDI terminal of the processor # 1 as the TDI for the processor # 1, receives the serial output TDO # 1 from the TDO terminal of the processor # 1, and is serially output as a debugging TDO signal. The debug TMS, TCK, and TRST are supplied in parallel to the TMS, TCK, and TRST terminals of the processors # 0 and # 1, respectively.

  When system development by software debugging using JTAG or the like is completed, for example, when the system is normally operated as an actual product, the processor is monitored using a monitoring JTAG signal. That is, when starting in the normal mode, the debug instruction signal is set to the non-debug mode. The JTAG selector 106 selects the monitoring JTAG signal from the processor monitoring JTAG controller 105. Of the monitoring JTAG signals, the JTAG selector 106 supplies the monitoring TDI in parallel (simultaneously) to the processor # 0 and the TDI terminal of the processor # 1 as the TDI for the processor # 0 and the TDI for the processor # 1. The monitoring TCK, the monitoring TMS, and the monitoring TRST selected by the JTAG selector 106 are supplied in parallel (simultaneously) to the TCK terminal, the TMS terminal, and the TRST terminal of the processors # 0 and # 1.

  The TDO signals TDO # and TDO # 1 output simultaneously from the processors # 0 and # 1 are input to the TDO signal comparison circuit 103 and compared. Note that during normal operation (non-debug mode), TDO # 0 that is serially output from the TDO terminal from the processor # 0 is serially input to the JTAG selector 106, but is not selected by the JTAG selector 106 (selector). 106 selects the monitoring TDI from the processor monitoring JTAG controller 105 and outputs it to the processor 101B).

  The TDO signal comparison circuit 103 outputs a processor failure notification signal when there is a mismatch as a result of the comparison between TDO # and TDO # 1. The TDO signal comparison circuit 103 receives the monitoring TCK and the monitoring TRST from the processor monitoring JTAG controller 105.

  As described above, according to the present embodiment, the JTAG signal for monitoring is provided in the normal operation of the system product developed using the software debug function while having the software debug function used at the time of system development or the like. In addition, monitoring (diagnosis) for detecting a failure of the processor can be performed using a JTAG circuit in the processor. In other words, in the present embodiment, the JTAG circuit in the processor is used for two purposes: software debugging at the time of system development, and monitoring performed by an actual product after system development.

  In FIG. 5, the processor synchronization circuit 104 connected to the processor # 0 bus signal 102A and the processor # 1 bus signal 102B is sent from the processor # 0 and the processor # 1 to the processor # 0 bus signal 102A and the processor # 1 bus, respectively. The program processing result output to the signal 102B is synchronized, and one is output to the peripheral circuit control bus 114. The peripheral circuit control bus 114 is basically the same as the peripheral circuit control bus of FIG.

<JTAG selector>
FIG. 6 is a diagram for explaining the configuration of the JTAG selector 106 in the configuration shown in FIG. Referring to FIG. 6, the JTAG selector 106 is a selector 107, 108, 109, 110, 111 that selects the first input when the debug instruction signal is inactive, and the second input when the debug instruction signal is active. It has.

  The first and second inputs of the selector 107 are connected to the monitoring TDI from the processor monitoring JTAG controller 105 and the debugging TDI from the PC 200, respectively, and the output is connected to the TDI terminal of the processor # 0.

  The first and second inputs of the selector 108 are connected to the monitoring TDI from the processor monitoring JTAG controller 105 and the TDO terminal of the processor # 0, respectively, and the output is connected to the TDI terminal of the processor # 1.

  The first and second inputs of the selector 109 are connected to the monitoring TMS from the processor monitoring JTAG controller 105 and the debugging TMS from the PC 200, respectively, and the outputs are connected to the TMS terminals of the processors # 0 and # 1. Yes.

  The first and second inputs of the selector 110 are connected to the monitoring TCK from the processor monitoring JTAG controller 105 and the debugging TCK from the PC 200, respectively, and the outputs are connected to the TCK terminals of the processors # 0 and # 1. Yes.

  The first and second inputs of the selector 111 are connected to the monitoring TRST from the processor monitoring JTAG controller 105 and the debugging TRST from the PC 200, respectively, and the outputs are connected to the TRST terminals of the processors # 0 and # 1. Yes.

  The TDO terminals of the processors # 0 and # 1 are input to the TDO signal comparison circuit 103. The TDO terminal of the processor # 1 is output to the PC 200 as a debug TDO signal.

  When the monitoring JTAG signal is selected, the debug instruction signal is set to an inactive state, the selectors 107 and 108 both select the first input, and the monitoring TDI from the processor monitoring JTAG controller 105 is set to the processor #. 0 is supplied in parallel to the TDI terminal of processor # 1 and the TDI terminal of processor # 1.

  When the debug JTAG signal is selected, the debug instruction signal is set to the active state, and both the selectors 107 and 108 select the second input. The selector 107 supplies the debugging TDI from the processor monitoring JTAG controller 105 to the TDI terminal of the processor # 0, and the selector 108 supplies the output signal from the TDO terminal of the processor # 0 to the TDI terminal of the processor # 1. . A TDO signal (debug TDO) from the processor # 1 is output to an external PC or the like as a debug TDO.

  According to the present embodiment, during normal operation, the monitoring TDI is supplied in parallel (simultaneously) to the TDI terminals of the processor # 0 and the processor # 1, and TDO # output in parallel from the processor # 0 and the processor # 1. 0 and TDO # 1 are compared by the TDO signal comparison circuit 103.

<Instruction command setting / processor internal signal read / access>
7A and 7B are diagrams illustrating an example of access to the JTAG signal according to the present embodiment. FIG. 7A illustrates an instruction command when an instruction command is set, and FIG. 7B illustrates a processor internal signal read time. In this embodiment, the instruction command and the processor internal signal are serially input and output in parallel from the TDO terminal for the processors # 0 and # 1, respectively.

  FIG. 4 (A) and FIG. 4 (B), the access time (the time required to set instruction commands to the processors # 0 and # 1, and the read time of the internal signals of the processors # 0 and # 1), As is clear from the comparison with the access times of FIGS. 7A and 7B, the access times of FIGS. 7A and 7B are as shown in FIGS. 4A and 4B, respectively. It is about half the access time of B).

  As described above, according to the present embodiment, the processor monitoring JTAG controller 105 and the JTAG selector 106 are provided, and the processor # 0 starts during normal operation of the system other than the debug mode (in the processor monitoring mode). And the internal signal from the processor # 1 can be simultaneously output to the TDO signal comparison circuit 103 on TDO # 0 and TDO # 1, respectively.

  In the present embodiment, during normal operation, the processor # 0 and the processor # 1 simultaneously execute the same instruction (program) fetched from a main memory (not shown). Therefore, when two processors are operating normally, the same value (bit signal) is serially output from TDO # 0 of processor # 0 and TDO # 1 of processor # 1.

  If the TDO signal comparison circuit 103 that compares the values of TDO # 0 of processor # 0 and TDO # 1 of processor # 1 detects a mismatch between the corresponding serial bit signals of TDO # 0 and TDO # 1, the processor fails The signal is output outside the semiconductor device.

  According to this embodiment having such a configuration, a JTAG instruction (command) for sequentially outputting the values of the TDO # 0 of the processor # 0 and the general-purpose ranger of the processor # 1 from the TDO terminal is set with reference to FIG. It is possible to detect the described failure (failure that does not affect the output of the processor bus such as failure of the general-purpose register 0 of the processor # 0). As described above, the dual processor lockstep method illustrated in FIG. 1 cannot detect this type of failure.

<Processor monitoring JTAG controller>
FIG. 8 is a diagram illustrating an example of the configuration of the processor monitoring JTAG controller 105 illustrated in FIGS. 5 and 6. As shown in FIG. 8, the processor monitoring JTAG controller 105 includes a debug mode determination circuit 121, an initialization control counter 122, a JTAG signal control counter 123, an instruction command counter 124, a clock gate (ClockGate) 125, and a TMS. A control circuit 126 and a TDI control circuit 127 are provided.

  The debug mode determination circuit 121 checks the state of the debug instruction signal when the system is reset, for example, and activates the processor monitoring JTAG controller 105 when the debug instruction signal is in an inactive state (non-debug mode, normal operation). Therefore, the monitoring start instruction signal is activated (for example, High) and output to the initialization control counter 122. Although not particularly limited, the monitoring start instruction signal is composed of a one-shot pulse (High pulse) having a pulse width of one cycle of the clock signal (Clock).

The initialization control counter 122
・ Reset release timing of monitoring TRST,
-The clock supply timing (clock enable signal) of the monitoring TCK, and
Control the control start instruction signal of the JTAG signal control counter 123.

The JTAG signal control counter 123
-TMS control circuit 126,
-TDI control circuit 127, and
Control the count-up instruction signal of the command command counter 124.

  The JTAG signal control counter 123 receives the activation of the control start instruction signal output from the initialization control counter 122, starts the clock signal count operation, and inputs the count value to the TMS control circuit 126 and the TDI control circuit 127. . The JTAG signal control counter 123 generates a count up instruction signal and supplies it to the command command counter 124.

  The instruction command counter 124 generates JTAG instruction commands to be output to the processor # 0 and the processor # 1. The command command counter 124 receives the count up instruction signal from the JTAG signal control counter 123 and increments the count value by one. The count value of the command command counter 124 is input to the TDI control circuit 127.

  The TMS control circuit 126 generates a monitoring TMS signal based on the count value of the JTAG signal control counter 123.

  The TDI control circuit 127 generates a monitoring TDI signal based on the count value of the JTAG signal control counter 123 and the count value of the command command counter 124 and outputs it serially. The monitoring TDI signal (command command) from the TDI control circuit 127 is set in the command register of the JTAG circuit of the processors # 0 and # 1.

<TDO signal comparison circuit>
FIG. 9 is a diagram illustrating an example of the configuration of the TDO signal comparison circuit 103 illustrated in FIGS. 5 and 6. Referring to FIG. 9, the TDO signal comparison circuit 103 includes an exclusive OR circuit 131, a selector 132, a flip-flop 133 with a reset function, and a high fixing circuit (Clamp H) 134.

  The exclusive OR circuit 131 calculates the exclusive OR of the TDO # 0 that is the output signal of the processor # 0 and the TDO # 1 that is the output signal of the processor # 1 and detects a match / mismatch. . The exclusive OR circuit 131 outputs High when coincident (when TDO # 0 = TDO # 1), Low when coincident (when TDO # 0 ≠ TDO # 1).

  The selector 132 inputs the output of the flip-flop 133 and the High potential of the High fixing circuit 134 to the first and second inputs, uses the output of the exclusive OR circuit 131 as the selection control signal, and the selection control signal is Low. When (when TDO # 0 = TDO # 1), the first input (output of the flip-flop 133) is selected and the selected signal is supplied to the data terminal of the flip-flop 133. The selector 132 selects the second input (High fixed potential) and supplies it to the data terminal of the flip-flop 133 when the selection control signal is High (when TDO # 0 ≠ TDO # 1).

  The flip-flop (D-FF) 133 receives the output of the selector 132 at the data terminal D, samples the signal at the data terminal D in response to the rising edge of the monitoring TCK, and outputs it to the output terminal Q. Consists of. The output signal of the output terminal Q of the flip-flop (D-FF) 133 is output as a processor failure communication signal (when it is High, there is a failure).

  When the exclusive OR circuit 131 detects a mismatch (output is High), the selector 132 selects the High fixed potential of the second input, and the flip-flop 133 outputs in synchronization with the rising edge of the monitoring TCK. Terminal Q (processor failure notification signal) is activated (High).

  Once the processor failure notification signal is set to the active state (High), the flip-flop 133 is held in the active state (High) until the flip-flop 133 is reset by the reset signal Reset. That is, once a mismatch (TDO # 0 ≠ TDO # 1) is detected by the exclusive OR circuit 131, a match (TDO # 0 = TDO # 1) is detected by the exclusive OR circuit 131 thereafter. Even if it continues to be detected, the processor failure notification signal is kept High. More specifically, when the coincidence is detected by the exclusive OR circuit 131, the selector 132 selects the output signal (High) of the output terminal Q of the flip-flop 133 which is the first input, and the data of the flip-flop 133 is selected. Feedback input to the terminal D and sampled in response to the monitoring TCK by the flip-flop 133, but since the previous sample value of the output terminal Q of the flip-flop 133 is High, the flip-flop 133 samples High. As a result, the processor failure notification signal is maintained high. Then, when the reset signal Reset is activated, the processor failure notification signal is set to Low.

  In the state where the exclusive OR circuit 131 has never detected a mismatch, the output signal of the exclusive OR circuit 131 is Low, so that the output signal of the flip-flop 133 is flip-flops via the selector 132. Is fed back to the data terminal D of the group 133 and sampled in response to the rising edge of the monitoring TCK. Since the output terminal Q of the flip-flop 133 is reset to Low at the time of initialization or the like, the processor failure notification signal is maintained Low.

  The TDO signal comparison circuit 103 operates in synchronization with the monitoring TCK output from the processor monitoring JTAG controller 105. For this reason, it operates only in the normal mode in which the processor monitoring JTAG controller 105 is activated (the operation starts with the supply of the monitoring TCK from the clock gate circuit 125 of the processor monitoring JTAG controller 105 in FIG. 8).

  In the debug mode, the TDO signal comparison circuit 103 does not operate. In this case, the flip-flop 133 is reset by a reset signal Reset when resetting at initialization or the like, and its output terminal Q (processor failure notification signal) is set to Low, and no monitoring TCK is supplied. The signal is kept low. The handling of the processor failure notification signal in the debug mode has been described above in the range of the circuit configuration in FIG. 9, but it may be configured to be fixed to the processor failure notification signal Low in the debug mode by any method other than the above. Of course.

  A procedure for detecting a failure in an internal circuit of the processors 101A and 101B in this embodiment (reading a general-purpose register not shown in FIG. 5) will be described. As a premise, the processor # 0 and the processor # 1 execute the same processing in the normal mode.

<Example of command>
As shown in FIG. 10, 0b000000 to 0b011111 (where 0b represents a binary display) as a value of an instruction register (6 bits) of a JTAG circuit (not shown) in the processors 101A and 101B (FIGS. 5 and 6) Is assigned a command for monitoring the processor (reading (diagnosis) of general-purpose registers # 0 to # 31 in the processor. Read (diagnosis) is a value of the general-purpose register and a boundary scan register. Jb instruction commands for reading out from the TDO terminal via 0.0b100000 to 0b111100 are assigned to debugging instruction commands, 0b111101, 0b111110, and 0b111111 are SAMPLE / PRELOAD, EXTEST, and BYPASS, respectively. The day Shift register represents the data registers of the JTAG circuit in the processor.

  EXTEST, SAMPLE / PRELOAD, and BYPASS are essential instructions. EXTEST outputs a bit string provided by the user from each terminal, and tests a physical connection outside the device (stops normal operation and enters a test mode).

  SAMPLE / PRELOAD can test data fetch from a pin of a device in normal operation and output a specified pattern to the device pin. BYPASS can bypass the device by placing a 1-bit bypass register between TDI and TDO and transfer it to the selected device in synchronization with TCK. In SAMPLE / PRELOAD and BYPASS, the device continues to operate normally.

  The read (diagnostic) commands of the general purpose registers # 0 to # 31 of the instruction command in FIG. 10 are the processor T0 (101A) and the processor # 1 (101B) as the monitoring TDI signal (serial bit signal) of the monitoring JTAG signal. ) And set in the instruction register of the JTAG circuit in the processor # 0 (101A) and the processor # 1 (101B). When starting in the normal mode, the TDI control circuit 127 (see FIG. 8) of the processor monitoring JTAG controller 105 counts the count value of the JTAG signal control counter 123 (see FIG. 8) and the command command counter 124 (see FIG. 8). Based on the value, a TDI signal for monitoring is generated, and 6-bit signals: 0b000000, 0b000001,... Reading the values of # 0 to # 31 as TDO # 0 and TDO # 1 is repeated until the system stops, for example. In FIG. 11, the number of general-purpose registers of processor # 0 (101A) and processor # 1 (101B) is 32, but the configuration is not limited to this.

<Fault detection procedure>
FIG. 11 is a flowchart (flowchart) for explaining the procedure for detecting an internal failure of the processor in the present embodiment. When the system is activated (step S1), the processor monitoring JTAG controller 105 determines whether the normal mode activation or the debug mode activation is performed based on the value of the debug instruction signal (step S2).

  When the debug instruction signal is in an inactive state (non-debug mode, that is, a normal mode), the processor monitoring JTAG controller 105 activates the monitoring start instruction signal and performs initial processing for processor monitoring (step S3).

  If the debug instruction signal is in the active state (debug mode) in step S2, the processor monitoring JTAG controller 105 does not perform the monitoring process (step S6).

  In the normal mode, the processor monitoring JTAG controller 105 writes a JTAG instruction command (for example, general-purpose register # 0 read instruction) in parallel to the processor # 0 and the processor # 1 from the monitoring TDI (step S4). ).

  Next, the process of reading the values of the general register # 0 of the processor # 0 and the processor # 1 from the TDO terminal is performed in parallel (step S5). TDO # 0 and TDO # 1 output from the TDO terminals of the processor # 0 and the processor # 1 are input to the TDO signal comparison circuit 103 and compared.

  Next, the processor monitoring JTAG controller 105 writes JTAG instruction commands to the processor # 0 and the processor # 1 in parallel in order to read the value of the general-purpose register # 1 of the processor # 0 and the processor # 1 (step S4). ), Reading processing (TDO # 0, TDO # 1) from the TDO terminal of the values of the general-purpose register # 1 of the processor # 0 and the processor # 1 is performed in parallel (step S5).

  Thereafter, the processes of steps S4 and S5 are sequentially performed from general register # 2 to general register # 31 (the number of general registers of processor # 0 and processor # 1 is 32). In step S5, TDO # 0 and TDO # 1 read in parallel from the TDO terminals of the processor # 0 and the processor # 1 are compared by the TDO signal comparison circuit, and a match / mismatch is determined.

  When the parallel read processing from the TDO terminal of the general-purpose register # 31 of the processor # 0 and the processor # 1 is completed, the processing returns to the parallel read processing from the TDO terminal of the general-purpose register # 0 of the processor # 0 and the processor # 1 again. Reading of the values of the general-purpose registers # 0 to # 31 is repeated until the operation stops.

  The general-purpose register failure detection process of the processor is performed by the TDO signal comparison circuit 103 in the loop of steps S4 and S5 in FIG. 11 until the system is stopped after the completion of the initial process of the processor monitoring. 1 is performed by comparing TDO # 0 output from 1 and TDO # 1.

<Processor monitoring JTAG controller: Initial operation>
FIG. 12 is a timing chart showing an example of the initial operation of the processor monitoring JTAG controller 105. FIG. 12 illustrates an example of operations from the activation determination process in the normal mode (step S2 in FIG. 11) to the processor monitoring initial process (S3 in FIG. 11). FIG. 12 shows a clock signal (Clock), a reset signal Reset, a debug instruction signal, a monitoring start control signal, a count value of the initialization control counter 123, a monitoring TRST, a clock in the processor monitoring JTAG controller 105 shown in FIG. The time transition of the enable, the monitoring TCK, the control start signal, and the count value of the JTAG control counter 123 is illustrated. In FIG. 12, the count value controlling each operation timing is merely an example, and it is needless to say that the count value is not limited to this configuration. The initial operation of the processor monitoring JTAG controller 105 will be described below with reference to FIGS.

  When the system is started, after a power-on reset is performed, a system reset signal Reset (low and reset state) supplied to the processor monitoring JTAG controller 105 is set to a reset release state (High: inactive state).

  The debug mode determination circuit 121 of the processor monitoring JTAG controller 105 detects a rising edge of the system reset signal Reset from Low to High, and detects a change from the reset state to the release state. The debug mode determination circuit 121 confirms the state (value) of the debug instruction signal at the rising edge of the system reset signal Reset. When the debug instruction signal is in the non-debug mode (Low, normal mode), the monitor start instruction signal is For example, an active state (High) is output for one clock cycle (one cycle period of the clock signal Clock) (timing (1) in FIG. 12).

  In response to the falling edge of the High pulse of the monitoring start instruction signal from the debug mode determination circuit 121, the count value of the initialization control counter 122 is cleared to “0”. The monitoring TRST is set to reset release (High) when the count value of the initialization control counter 122 is “0”. The monitoring TRST can be switched to a reset state (Low: active state) only by a system reset.

  The initialization control counter 122 counts up in response to the high pulse (rising edge) of the clock signal Clock, and when the count value becomes “7” (timing (4) in FIG. 12), thereafter, the high pulse of the clock signal Clock. Is input, the initialization control counter 122 holds the value “7”.

  When the value of the initialization control counter 122 changes from “0” to “1” in response to the rise of the clock signal Clock (timing (2) in FIG. 12), the monitoring TRST is reset from the reset state (Low). State (High). The monitoring TRST is supplied to the processor # 0 (101A), the processor # 1 (101B), and the TDO signal comparison circuit 103.

  Next, when the count value of the initialization control counter 122 changes from “4” to “5” in response to the rise of the clock signal Clock (timing (3) in FIG. 12), the initialization control counter 122 receives the clock enable signal. The inactive state (Low) is switched to the active state (High).

  When the clock enable signal is switched from the inactive state (Low) to the active state (High), the clock gate 125 changes from the off (blocked) state to the on state, passes the clock signal Clock, and outputs it as the monitoring TCK. The monitoring TCK from the processor monitoring JTAG controller 105 is commonly supplied to the processors # 0 and # 1.

  When the count value of the initialization control counter 122 changes from “6” to “7” in response to the rising edge of the clock signal Clock (timing (4) in FIG. 12), the initialization control counter 122 generates a control start instruction signal, For example, the clock signal Clock is supplied to the JTAG signal control counter 123 as an active state (High) for one clock cycle period.

  In response to the High pulse of the control start instruction signal, the count value of the JTAG signal control counter 123 is cleared to “0”. The JTAG signal control counter 123 counts up from the clock signal Clock after the High pulse of the control start instruction signal falls to Low. Although not particularly limited, in the example of FIG. 12, the JTAG signal control counter 123 is configured by a 6-bit counter.

<Processor monitoring JTAG controller: Instruction register write operation>
FIG. 13 is a time chart for explaining the detailed operation of the writing process of the JTAG instruction command to the processors # 0 and # 1 (S4 in FIG. 11). FIG. 13 shows the monitoring TCK in the processor monitoring JTAG controller 105 shown in FIG. 8, the count value of the JTAG control counter 123, the monitoring TMS, the count value of the instruction command counter 124, the monitoring TDI, the processor # 0, the processor An example of the time transition of the state of the internal TAP controller (not shown in FIGS. 5, 6, etc.) of # 1 is illustrated. A write operation to the instruction register will be described with reference to FIGS.

  The JTAG instruction command write processing to the processor # 0 and the processor # 1 is performed when the count value (8 bits) of the JTAG signal control counter 123 in the processor monitoring JTAG controller 105 is “0x00 to 0x0C”. And the TAP controller state of the JTAG circuit inside processor # 1 is Run-Test / Idle, Select-DR, Select-IR, Capture-IR, Shift-IR, Exit-IR, Update-IR As described above, the TMS control circuit 126 in FIG. 8 controls the monitoring TMS signal. Hereinafter, the 16 states of the TAP controller will be outlined.

  When the TAP controller is in a stable Test-Logic-Reset state, the test logic is reset and the normal logic function of the device is performed.

  Run-Test / Idle is a state in which the test logic can be run or idle.

  In the Select-DR and Select-IR (Select DR scan, Select IR scan) states, no special function is executed. The TAP controller exits this state at the next TCK. This state makes it possible to select whether to scan the data register or the instruction register.

  In the Capture-DR (capture DR) state, the selected data register captures data specified by the current instruction. The capture operation is performed at the rising edge of TCK.

  When entering the Shift-DR state, the selected data register is placed in the scan path between TDI and TDO. At the first falling edge of TCK, TDO goes from the high impedance state to the active state, and TDO outputs the logic level of the least significant bit of the selected data register. In the Shift-DR state, data is serially shifted through the selected data register every TCK.

  The Exit1-DR and Exit2-DR (exit 1DR, exit 2DR) states are temporary states for ending the scan of the data register. It is also possible to return from Exit1-DR and Exit2-DR to Shift-DR. At the first falling edge of TCK after entering Exit1-DR and Exit2-DR, TDO becomes a high impedance state.

  In the Pause-DR (pause DR) state, no special function is performed, and the data register scan operation is suspended and resumed.

  The Update-DR (Update DR) state is the TCK falling edge after entry into the Update DR state if the current instruction requires the selected data register to be updated with the current data. Updates are made.

  In the Capture-IR state, the instruction register captures the current state value at the rising edge of TCK.

  When entering the Shift-IR state, the instruction register is placed in the scan path between TDI and TDO. At the first falling edge of TCK, TDO goes from the high impedance state to the active state, and TDO outputs the logic level of the least significant bit of the instruction register. In the Shift-IR state, data (6-bit instruction command) is serially shifted in the instruction register (6 bits) every TCK.

  The Exit1-IR and Exit2-IR (exit 1IR, exit 2IR) states are temporary states that terminate the scan of the instruction register. It is also possible to return from Exit1-IR and Exit2-IR to Shift-IR. At the first falling edge of TCK after entering Exit1-IR and Exit2-IR, TDO becomes a high impedance state.

  No special function is performed in the Pause-IR state. The TAP controller can stay in this state indefinitely. Suspend and resume the scan operation of the instruction register.

  The Update-IR state updates the instruction register. The update is performed at the falling edge of TCK after entry into the update IR state.

  In FIG. 13, the TDI control circuit 127 counts the count value of the instruction command counter 124 at the timing ((1) to (6)) when the JTAG state inside the processor # 0 and the processor # 1 becomes “Shift-DR”. (JTAG instruction command) is converted from parallel to serial, and a serial bit signal is output as a monitoring TDI signal.

  At the timing when the output of the JTAG instruction command to the monitoring TDI is completed ((7) in FIG. 13), the instruction command counter 124 (FIG. 8) increments the count value by 1 (the count value is 0b000001), and then Prepare the JTAG command to be output.

  When the count value of the instruction command counter 124 is 0b011111 (general register # 31 read instruction: see FIG. 10), the next instruction command counter 124 is 0b000000 (general register # 0 rising instruction: see FIG. 10). Set to

<Processor monitoring JTAG controller: General register read operation>
Next, the detailed operation of the process of reading the value of the general-purpose register from processor # 0 and processor # 1 (step S5 in FIG. 11) will be described. FIG. 14 is a time chart illustrating an example of a process for reading the value of the general-purpose register from the processors # 0 and # 1. 14 shows the monitoring TCK in the processor monitoring JTAG controller 105 in FIG. 8, the count value of the JTAG signal control counter 123, the monitoring TMS, the TDO signal TDO # 0 of the processor # 0 in FIGS. 5 and 6, the processor A time transition of the TDO signal TDO # 1 of # 1, the JTAG state inside the processor # 0 and the JTAG state inside the processor # 1 of FIGS. 5 and 6 is schematically shown. The general-purpose register read operation will be described with reference to FIGS.

  The process of reading the value of the general-purpose register (32-bit width) from the processor # 0 and the processor # 1 is performed when the count value of the JTAG signal control counter 123 is between 0x0D to 0x30, and the TAP controllers of the processor # 0 and the processor # 1 The TMS control circuit 126 generates a monitoring TMS signal so that the state of “Run-Test / Idle” becomes “Update-DR”.

  At the timing when the internal JTAG state of the processor # 0 and the processor # 1 becomes “Shift-DR” ((1) to (6) in FIG. 14), the TDO # 0 of the processor # 0 and the TDO of the processor # 1 From # 1, the value of the general-purpose register is serially output simultaneously.

  When the count value becomes “0x30”, the JTAG signal control counter 123 clears the count value to “0x00” (auto clear). Therefore, “JTAG instruction command write processing to processor # 0 and processor # 1” and “reading of general register values from processor # 0 and processor # 1” are repeated during system operation.

  The TDO signal comparison circuit 103 is synchronized with the monitoring TCK output from the processor monitoring JTAG controller 105 and always outputs from the processor # 0 and the TDO # 0 output from the processor # 1 during startup in the normal mode of the system. The TDO # 1 to be compared is compared.

<Operation example of TDO signal comparison circuit>
FIG. 15 is a timing chart showing an example of the operation of the TDO signal comparison circuit 103. FIG. 15 illustrates time transitions of the monitoring CLK, TDO # 0, TDO # 1, and processor failure detection signal in the TDO signal comparison circuit 103 of FIG. The comparison operation (failure detection operation) will be described with reference to FIGS. The value of general-purpose register # 0 (32 bits) is output from processor # 0 and processor # 1 simultaneously from TDO # 0 and TDO # 1 (in order of LSB (Least Significant Bit) to MSB (Most Significant Bit)). doing.

  The flip-flop 133 of the TDO signal comparison circuit 103 that detects the difference between the values of TDO # 0 and TDO # 1 at the timing of outputting the second bit of the general-purpose register # 0 causes the rising edge of the monitoring TCK. In response to the edge, the processor failure notification signal is output from the inactive state (Low) to the active state (High), and thereafter, the processor failure notification signal is maintained at High.

<Example of failure detection operation>

  FIG. 16 is a timing chart for explaining an operation example of failure detection according to the present embodiment described with reference to FIGS. FIG. 16 shows a clock signal (Clock), a monitoring TCK, a general-purpose register # 0 for processor # 0, a general-purpose register # 1 for processor # 0, a processor # 0 bus signal, an output signal TDO # 0 for processor # 0, a processor # 1 general-purpose register # 0, processor # 1 general-purpose register # 1, processor # 1 bus signal, processor # 1 output signal TDO # 1, comparison result of processor # 0 bus signal and processor # 1 bus signal, TDO The comparison results are illustrated. In the example shown in FIG. 16, at timing (1) on general register # 1 of processor # 0, a failure has occurred in the 0th bit of general register # 1 of processor # 0.

  In FIG. 16, when the processing of processor # 0 and processor # 1 outputs the value of general-purpose register # 0 to the processor bus at timing (1), the output value of the processor # 0 bus signal is the faulty general-purpose register. Not affected by # 1. For this reason, it matches the output value of the processor # 1 bus signal operating normally (“comparison result of processor # 0 bus signal and processor # 1 bus signal” is “match”).

  The values of the general purpose registers # 1 are output from the TDOs of the processor # 0 and the processor # 1, and the TDO signal comparison circuit 103 compares TDO # 0 and TDO # 1.

  In the timing (2) of FIG. 16, when a failure has occurred in the 0th bit of the general register # 1 of the processor # 0, the comparison result of TDO # 0 and TDO # 1 becomes inconsistent, and the TDO signal comparison circuit 103 sets the processor failure notification signal to the active state (High). That is, it is possible to detect a failure of the general-purpose register of the processor at an early stage as compared with the lock step method of the dual processor.

<Effect>
The effect of this embodiment is demonstrated below.

  As shown in FIG. 16, during normal operation of the system, internal signals are simultaneously read from the processors # 0 and # 1 and compared by the comparison circuit so that the processor failure n can be detected. It is possible to detect a processor failure before it is affected by an internal processor failure.

  Compared with the lock step method of the dual processor, the time from failure occurrence to failure detection can be shortened. As a result, the time required to shift the entire system to a highly safe state can be shortened, so that the safety of the system is increased.

  The processor monitoring JTAG controller 105 generates a general-purpose register read command (for diagnosis) as a JTAG command using an internal counter circuit or the like, and determines which general-purpose register read signal of the processor is monitored. I can figure it out. For this reason, it is possible to identify a general-purpose register that has failed, and to improve the accuracy of failure detection.

  The dual processor lockstep method of FIG. 1 can only detect that the processor has failed. According to this embodiment, it is also possible to specify at which bit of which general-purpose register of the processor the failure has occurred. For this reason, it is possible to shorten the time for troubleshooting in actual machine evaluation.

  By the way, generally, when the monitoring function is improved, the performance of the system may be degraded, or the normal function may need to be stopped. However, according to the present embodiment, there is no need to stop system performance degradation or normal functions for the following reasons.

  The processor monitoring JTAG controller 105 includes a hardware circuit, and autonomously monitors JTAG signals (TDI (JTAG instruction command)) based on a control signal (system reset signal Reset, debug instruction signal) and a clock signal Clock. TCK, TMS, TRST) are generated, and software control is unnecessary. For this reason, it is possible to detect a processor failure without degrading the software processing performance during normal operation of the system.

  Since the internal signal of the processor is read using the TDO signal of the JTAG circuit, it is possible to detect the failure of the processor while avoiding the influence on the normal function of the system.

<Modification 1>
As shown in FIG. 17, the processor failure notification signal output from the TDO signal comparison circuit 103 to the outside may be input as an interrupt signal for the processors # 0 and # 1. The processor # 0 and the processor # 1 that have received the active interrupt signal (active processor failure notification signal) execute interrupt processing (ISR: Interrupt Service Routine) corresponding to the interrupt. As the interrupt process, a predetermined fail-safe function is executed. Alternatively, for example, one processor in which a failure of the general-purpose register is detected may be stopped, and the program may be executed only by the other processor.

<Modification 2>
In the embodiment and the first modification, the processor failure notification signal from the TDO signal comparison circuit 103 is output to the outside of the semiconductor device. However, in the second modification, as illustrated in FIG. A processor failure notification signal is transmitted to the peripheral circuit 140.

  The peripheral circuit 140 that has received the active processor failure notification signal may, for example, implement a fail-safe function that forcibly stops processing and shifts to a highly safe state.

  The modified examples of FIGS. 17 and 18 can shorten the time from the occurrence of a failure to the transition to a safe state of the system, as compared to the dual processor lockstep method.

<Modification 3>
As shown in FIG. 19, a processor failure notification signal from the TDO signal comparison circuit 103 may be input to the processor monitoring JTAG controller 105. The processor monitoring JTAG controller 105 that has received the processor failure notification signal in the active state
The general-purpose register number where the failure occurred, from the value of the command command counter 124 (FIG. 8),
A bit number where a failure has occurred is detected from the count value of the JTAG signal control counter 123 (FIG. 8), and is output to the outside of the semiconductor device as a processor failure occurrence point notification signal. By adopting such a configuration, the accuracy of identifying the location where the processor has failed becomes higher than that of the dual processor lockstep method.

  Alternatively, failure detection may be performed at locations other than the general purpose registers of the processor. Since the internal signal of the processor is read using the JTAG circuit, the user reads the signal at a desired location other than the general-purpose register (a circuit that can set and read the signal by boundary scan) by assigning an instruction command. It becomes possible.

  In the above embodiment, for simplicity of explanation, the number of processors is two, but the number of processors may be three or more. Even when three or more processors are used, as in the case of two processors, when the processor is monitored, the JTAG signal is connected in parallel to all the processors so that the TDO signal of each processor can be simultaneously converted into the same processor internal signal. Can be output. By comparing the TDO signal of the processor with the TDO signal comparison circuit, it becomes possible to detect a failure of the processor.

  In the embodiment of FIG. 5 and the like, an example in which the present invention is implemented on the same chip of a semiconductor device (SOC) having a dual processor is shown. However, the present invention is applied to a substrate on which a dual processor is mounted. Of course, is applicable.

  It should be noted that the disclosures of the above-mentioned patent documents and non-patent documents are incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept. Various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) can be combined or selected within the scope of the claims of the present invention. . That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

10, 10 ', 100 Semiconductor device (SOC)
11A, 11B, 11′A, 11′B, 101A, 101B Processor 12A, 102A Processor # 0 bus signal 12B, 102B Processor # 1 bus signal 13 Comparison circuit 14, 114 Peripheral circuit control bus 20, 200 PC
103 TDO signal comparison circuit 104 processor synchronization circuit 105 JTAG controller for processor monitoring 106 JTAG selectors 107 to 111 selector 121 debug mode determination circuit 122 initialization control counter 123 JTAG signal control counter 124 instruction command counter 125 clock gate 126 TMS control circuit 127 TDI Control circuit 131 Exclusive OR circuit (Exclusive OR)
132 selector 133 flip-flop (D-type flip-flop)
134 High Fixed Circuit (Clump H)
140 Peripheral circuit

Claims (10)

A plurality of processors conforming to JTAG (Joint Test Action Group) and having the same configuration,
A processor monitoring JTAG processor monitoring JTAG controller that generates a monitoring JTAG signal during normal operation;
With
Among the monitoring JTAG signals output from the processor monitoring JTAG controller, a monitoring test data input (TDI) signal is commonly and in parallel to a plurality of test data input (TDI) terminals of the plurality of processors. Supplied,
A test data output (TDO) signal output in parallel from a plurality of test data output (TDO) terminals of the plurality of processors is input in response to the input of the test data input (TDI) signal for monitoring. A failure detection system, further comprising a TDO signal comparison circuit that outputs a processor failure notification signal as an active state when these are compared and a mismatch is detected.   The processor monitoring JTAG controller sequentially generates a JTAG instruction command for reading a state of each internal circuit and outputting it from a test data output (TDO) terminal of the processor to a plurality of internal circuits included in the processor. The test data input (TDI) signal for monitoring is output, and when the reading of the last internal circuit is completed, the iterative process of returning to the first reading internal circuit and reading again is repeated. The failure detection system according to claim 1. The processor monitoring JTAG controller
A debug mode determination circuit for checking a state of an input debug instruction signal at the time of system startup, determining that the debug instruction signal is in an inactive state, starting in a normal mode, and activating a monitoring start instruction signal; ,
Activated in response to the activation of the monitoring start instruction signal, counts the input clock signal, and releases the reset of the monitoring test reset (TRST) signal when the count value reaches a predetermined value. Timing control, activation of a clock enable signal that permits supply of a test clock (TCK) signal for monitoring, and an initialization control counter that activates a control start instruction signal;
When the activated control start instruction signal is output from the initialization control counter, the subsequent clock signal is counted, and a count-up instruction signal is generated according to a predetermined count value determined in advance. A counter,
An instruction command counter that performs a count-up operation in response to the count-up instruction signal output from the JTAG signal control counter and outputs a count value as a JTAG instruction command;
A TMS control circuit that generates a test mode set select (TMS) signal for monitoring based on the count value of the JTAG signal control counter;
A TDI control circuit that generates the test data input (TDI) signal for monitoring based on the count value of the JTAG signal control counter and the count value of the command command counter;
A clock gate circuit that outputs the clock signal as the monitoring test clock (TCK) signal when the clock enable signal from the initialization control counter is activated;
The failure detection system according to claim 2, further comprising: The TDO signal comparison circuit
A detection circuit for detecting a match / mismatch of a plurality of test data output (TDO) signals output in parallel from a plurality of test data output (TDO) terminals of the plurality of processors;
A holding circuit having an output signal as the processor failure notification signal;
A detection result in the detection circuit is input as a selection control signal, and a fixed logical value corresponding to an active state of the output signal of the holding circuit or the processor failure notification signal according to a match or mismatch of the detection results A selector for selecting and outputting,
With
The holding circuit samples the output signal of the selector in response to a monitoring test clock (TCK) signal output from the processor monitoring JTAG controller, and outputs a sampled value;
The selector selects the fixed logical value when the detection circuit detects a mismatch, and thereafter, the processor failure notification signal held and output by the holding circuit maintains an active state. The failure detection system according to any one of 1 to 3.   When the system is started in the debug mode, the processor monitoring JTAG controller is not activated, the monitoring JTAG signal is not output, and the debugging JTAG signal from the debugging device is supplied to the processor. The failure detection system according to any one of claims 1 to 4. A JTAG selector for switching the monitoring JTAG signal or the debugging JTAG signal based on the value of the debugging instruction signal;
When the debug instruction signal is inactive
The JTAG selector
The test data input (TDI) signal, test clock (TCK) signal, test mode select (TMS) signal, and test reset (TRST) signal of the monitoring JTAG signal from the processor monitoring JTAG controller, respectively. Supply in common and in parallel,
When the debug instruction signal is active,
The JTAG selector
A test clock (TCK) signal, a test mode select (TMS) signal, and a test reset (TRST) signal among the debugging JTAG signals from the debugging device are supplied in common and in parallel to the plurality of processors. The test data input (TDI) signal is chain-connected between the plurality of processors, and the test data output (TDO) signals of the plurality of processors are sequentially output from the test data output (TDO) terminal of the last stage processor. The failure detection system according to claim 5, wherein the failure detection system is transmitted to the debugging device as a test data output (TDO) signal for debugging. Regarding the processor failure notification signal from the TDO signal comparison circuit,
Output to outside the system,
Supplying an interrupt signal to the plurality of processors;
Input to peripheral circuit
Input to the processor monitoring JTAG controller;
The fault detection system according to claim 1, wherein at least one of the following is performed.   A semiconductor device comprising the failure detection system according to claim 1. The monitoring test data among the monitoring JTAG signals output from the processor monitoring JTAG controller during normal operation of a system having a plurality of processors compliant with JTAG (Joint Test Action Group) and having the same configuration. Supplying an input (TDI) signal to a plurality of test data input (TDI) terminals of the plurality of processors in common and in parallel;
The test data output (TDO) signals output in parallel from the plurality of test data output (TDO) terminals of the plurality of processors are compared in response to the input of the test data input (TDI) signal for monitoring. And a processor failure notification signal is output when a mismatch is detected. During normal operation, the processor monitoring JTAG controller reads out the state of each internal circuit from a plurality of internal circuits included in the processor and outputs it from the test data output (TDO) terminal of the processor. Are sequentially generated and output as the test data input (TDI) signal for monitoring,
10. The fault detection method according to claim 9, wherein when the reading of the last internal circuit is completed, the iterative process of returning to the first internal circuit from which reading was performed and repeating the reading is repeated.

Images