JPH07234801A - Logic circuit with error detecting function and fault tolerant system using the same - Google Patents

Abstract

PURPOSE:To provide a logic circuit with error detecting function which requires no special restriction and guarantees fail-safe performance. CONSTITUTION:The logic circuit consists of permuters 80-8n which superpose an orthogonal waveform generated by an orthogonal waveform generating circuit 100 on signals a0-an(10-1n) from a function block A, comparing circuits (30-3n) which compare the superposed signals a0'-an'(10'-1n') with signals b0-bn(20-2n) from a function block B, and an integrated circuit 5 which inputs output signals co-cn(40-4n) from the comparing circuits and outputs a signal 6 showing that the whole circuit including the function blocks A and B is normal only when signature waveforms characteristic to the respective signals appear. This constitution can guarantee the fail-safe performance even if a dummy signature due to a mixed touch is generated.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a self-check circuit and a method of constructing the same, and more particularly to a self-check comparison circuit suitable for a highly reliable system configuration.

[0002]

2. Description of the Related Art Advanced control is required to improve energy (fuel) efficiency, improve operability, improve riding comfort, improve safety and speed of transportation such as aircraft, trains and automobiles. Along with this, computerization of these control devices is progressing. For the safe operation of these transportation facilities, the reliability and fail-safety of the control device (no output on the dangerous side due to the occurrence of a failure) is strongly required.

In order to guarantee the reliability and fail-safety of the control device, it is possible to detect the failure occurrence of the control device,
That is, the self-checking property is important. In order to realize self-checking property, M-out-of-N code and two-wire logic (1-out-of-2 code, that is, M-out-of-
A method using a so-called redundant code in which a Hamming distance between codes is 2 or more is widely used. According to the above method, it is possible to completely detect a single fault. However, this is not limited to the case where multiple faults occur. When implementing a self-check circuit in an LSI, a phenomenon equivalent to the occurrence of multiple faults that spread to the entire chip May be indicated. Here, assuming that the probability that an erroneous output will coincide with the code point of the defined output code space O when a failure occurs is random in error,

[0004]

[Equation 1]

However, No: the number of code points of the output code space O Nu: the number of code points Therefore, how to increase Nu with respect to No is an issue for improving the detection rate.

There are the following two methods for realizing a self-checking circuit using the above redundant code.

(1) Method of constructing entire circuit with redundant code (2) Method of duplicating functional block section and comparing output of functional block section with self-checking comparison circuit configured with redundant code (1) The method of (1) has to be newly designed for self-checking, and there is a problem that it is difficult to optimize the operating speed of the circuit.

On the other hand, according to the method (2), since only the comparison circuit needs to be newly designed with the redundant logic, the existing processor, memory, etc. can be used for the functional block section, so that the development cost is greatly increased. In addition, the latest semiconductor technology can be utilized, and speedup can be easily achieved. The self-checking property of this method largely depends on the self-checking property of the comparator.

Therefore, in order to realize a self-checking comparator, the logic itself used in the comparison circuit is M-ou.
It has been proposed to use redundant codes such as t-of-N codes and two-wire logic. For example, in the literature (edited by Yoshihiro Toma: “Fault Tolerant System Theory”), IEICE
(1990)) and the RCCO (Redu) shown in Figure 2.5 (p.31).
ction Circuit for Checker Output)
By connecting to the tree structure as shown in (p.32),
A self-checking comparator can be realized.

In the case of the comparator, since the probability of occurrence of a failure in the circuit to be compared is small, it is rare that a mismatch occurs between the signals to be compared. Therefore, when a mismatch is detected, the path that should be activated is rarely activated, and when a failure occurs in the mode in which the output of this path is always fixed to mean "match". , There is a risk that the failure becomes latent. Therefore, in the case of the comparison circuit, in addition to the redundant code described above, not a binary level logic of 0 and 1 but a dynamic logic such as a frequency logic or an alternating inspection method in which the signal level changes in an alternating manner is used. Is used as a signal indicating that is normal (hereinafter referred to as a signature signal). One example is the RCCO shown in Figures 2.15 and 5.16 (p.42) of the above document.
Permuter (per
This is the method of prefixing muter). According to the above, an AC output can be obtained in a normal state, fluctuation of the threshold value of the semiconductor element and a fixed failure of 0,1 level (stack-at 0,1).
In the event of a failure due to a change in the DC characteristics of the device (such as a failure), an AC signal cannot be obtained, and errors are periodically injected to constantly check the operation of the error detection function. King property is significantly improved.

[0011]

The above-mentioned prior art has a problem that it is easily affected by contact between wiring nets in a semiconductor device. When crosstalk occurs between wiring nets due to semiconductor device failure, migration of wiring material, insulation failure of the insulating layer, etc., the signature signal of other wiring nets (hereinafter I will call it a forgery signature). Normally, the fail-safe circuit indicates that it is normal by the signature signal, so it will be recognized as normal even though it is abnormal due to counterfeit signature due to touching, and the fail-safety of the circuit may be impaired. .

For this reason, in the prior art, the occurrence of cross-contact was prevented by adding a special design constraint to the wiring interval or the like. However, according to this method, it is necessary to form transistors and wirings on a semiconductor substrate based on restrictions that are completely different from those of general-purpose semiconductors, and thus it is not possible to enjoy the benefits of existing technology, design automation tools, etc. In many cases, there were a lot of manual work.

An object of the present invention is to provide a logic circuit with an error detection function that does not require special constraints and can guarantee fail-safety, and a fault tolerant system using the logic circuit.

[0014]

According to the present invention, a functional block for outputting a plurality of signals has at least a dual structure,
Comparing the output of these functional blocks,
In a logic circuit with an error detecting function for detecting an error based on a comparison result, a synthesizing unit is provided for superposing a unique waveform previously assigned to each output signal on the output signal of the one functional block, and the synthesizing is performed. It is characterized in that an error is detected by comparing the output from the means with the output from the other functional block.

That is, for example, assuming a semiconductor element, a signal waveform peculiar to each wiring net corresponding to each output signal is assigned as a signature, and is valid only when the signal waveform matches the signal waveform peculiar to the wiring net. It should be regarded as a signature.

Further, in order to distinguish between a legitimate signature and a counterfeit signature, it is desirable that the signatures unique to each wiring net have no correlation with each other. An orthogonal function is widely known as a function that has no correlation.

[0017]

[Equation 2]

The functions fi (x) and fj (x) are said to be orthogonal to each other. Known orthogonal functions include trigonometric functions having different periods, Walsh-Hadamal functions, and M series. Also, the Wavelet analysis, which analyzes the signal waveform in the time-frequency domain, has recently attracted attention in place of the conventional Fourier analysis, and the underlying Wavelet is also an orthogonal function. Although the trigonometric function and Wavelet are analog functions, they may be binarized in order to be applied to a digital circuit.

[0019]

According to the present invention, for example, assuming a semiconductor device, a signal waveform unique to each wiring net is assigned as a signature, and the signature is valid only when the signal waveform matches the signal waveform unique to the wiring net. Is considered.
As a result, even if a crosstalk occurs between wiring nets, migration of wiring material, insulation failure of the insulating layer, etc., and a signature signal is induced from another wiring net, a false signature is unique to the wiring net. Since it does not match the signal waveform, it can be distinguished from a valid signature. Therefore, it is possible to guarantee the fail-safe property without the need for a special wiring constraint or the like, which is indispensable for the complete detection of a failure in the conventional technique, for preventing the contact.

[0020]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows an embodiment of a comparator according to the present invention. An error for a test is injected into the signals a0 to an (10 to 1n) from the functional block A according to the orthogonal waveform (test pattern) generated by the orthogonal waveform generation circuit 100 by the permuter 80 to 8n, and an error is injected. The signals after injection are a0 'to an' (10 'to 1n'). The permuters 80 to 8n are exclusive OR (Exclude) as shown in the figure.
sive OR) has the function of artificially injecting errors for testing. Then, the signals 10 'to 1n' after error injection are compared with the signals b0 to b from the functional block B in the comparison circuits 30 to 3n.
bn (20 to 2n), the comparison results 40 to 4n are collected in the assembly circuit 5, and the comparison result 40 to 4n is collected in the assembly circuit 5.
Only when n indicates a normal signature, a signature signal indicating normal is output to the signature output 6.

Here, the signals a0'-an 'after error injection are given.
When any one of (10 'to 1n') is represented by ai ',

[0023]

[Mathematical formula-see original document] ai '= ai ^ pi (3) where i: signal number (i: 0 ... n) pi: orthogonal waveform generated by orthogonal waveform generation circuit 100 (test pattern) ^: exclusive It is an operator of exclusive OR. Furthermore, if any one of the comparison results c0 to cn (40 to 4n) is represented by ci,

[0024]

## EQU4 ## ci = ai '^ bi = ai ^ pi ^ bi (Equation 4) Here, when the functional blocks A and B are normal, since ai = bi, ai ^ bi = 0. Therefore,

[0025]

[Equation 5] ci = pi (Equation 5)

Since arbitrary pi (i: 1 ... n) are orthogonal to each other, ci and cj (i ≠ j) are also orthogonal. a
Assuming that i and pi are statistically independent, that is, orthogonal, then ai and ai 'are also orthogonal to each other, and bi and ai' are also orthogonal to each other. Therefore, there are correlations between these waveform groups that are not orthogonal, and are between ai and bi and between pi and ci.
Is in between. Therefore, in order to prevent the occurrence of the counterfeit signature due to the above-mentioned contact, between ai and bi and pi,
If the circuit layout is taken into consideration so as to be physically separated from each other during the period ci, it is possible to prevent the influence of the generation of the counterfeit signature due to the contact. An example of this circuit layout will be described later (FIG. 15).

According to the present embodiment described above, it is possible to provide a complete self-checking comparator without requiring special wiring restrictions.

In FIG. 2, the functional block A11
0, the functional block B111 is always valid signals a0 to an
(10 to 1n), b0 to bn (20 to 2n) are not necessarily output, and signals a0 to an (10 to 1n) and b0 to bn (20 to
2n) is often output together with a strobe signal indicating that it is effective. In such a case, as shown in FIG. 2, the strobe signals 130 and 131 are used to output the signals a0 to an.
When (10 to 1n) and b0 to bn (20 to 2n) are valid, they may be held by the latches 120 and 121. The type of signal used as a strobe signal for a circuit using a microprocessor differs depending on the microprocessor, and AS (Address Strob) is used for address signals and control signals.
e), BS (Bus Start), etc.
(Transfer Acknowledge), DTACK (Data Transfer Ac
Signals such as knowledge) can be used as strobe signals.

FIG. 3 shows the present invention as a reference (edited by Yoshihiro Toma: “Fault Tolerant System Theory”, IEICE (1)
990)) applied to the RCCO tree comparator. The signals a0 to an (10 to 1 from the functional block A
n) is a quadrature waveform generation circuit 1 with permuters 80 to 8n.
A signal 1 after injection of an error for a test according to a quadrature waveform (test pattern) generated by
It becomes 0'-1n 'and is input to the RCCO tree 3.
In the case of the RCCO tree, the signature output 6 also has a two-wire logic.

Inside the RCCO tree 3, the inputs and outputs of the RCCO are orthogonal to each other, as in the embodiment of FIG. 1, and it is possible to prevent the influence of the generation of a false signature due to contact.

In the following description of the embodiments, the description will be given based on the comparison circuit shown in FIG. 1. However, the comparison circuit using the RCCO tree can be similarly implemented unless otherwise specified.

FIG. 4 shows signals b0 to bn from the functional block B.
(20 to 2n) is also an embodiment in which error is injected by the permuters 90 to 9n by the orthogonal waveform generated by the orthogonal waveform generation circuit 100. According to the present embodiment, it is possible to prevent the stack fault at the input of the comparison circuit from becoming latent when bi has the same value for a long time. For example, when bi is an address signal and the program uses only the address of a specific area, the value of the upper bits of the address becomes a constant value for a long time.

FIG. 5 shows an embodiment in which the functional blocks A and B are provided with orthogonal waveform generating circuits 100 and 101 separately and independently. According to this embodiment, the quadrature waveform generation circuits 100, 10
Since 1 is duplicated, the orthogonal waveform generation circuits 100, 1
01 Either fault can be detected and reported. Further, according to this embodiment, the independence of the two systems can be utilized in the layout as described later with reference to FIG.

FIG. 6 shows an embodiment in which a pulse-on waveform is used in a time slot specific to each wiring net as an orthogonal waveform. According to the present embodiment, the output patterns p0 to pn of the quadrature waveform generation circuit 100 and the functional blocks A110 and B1.
Comparison results when both 11 are normal c0 to cn (40
4n) is as shown in FIG.

FIG. 7 shows an embodiment of the quadrature waveform generating circuit 100 for generating the pattern shown in FIG. At power-on reset of the system, the RESET signal becomes active, the flip-flop 1001 is preset (1 is set as an initial value), and the flip-flop 1001 is reset.
2-100m is reset (0 is set as an initial value)
To be done. That is, the flip-flop strings 1001 to 10
A value of 1, 0, 0, 0, 0, ... 0 is set in 0m.
After the power-on reset, the patterns of 1, 0, 0, 0, 0, ... 0 are sequentially shifted according to the CLK (clock) signal to generate the pattern of FIG. Flip flop 1
If 001 to 100 m are made redundant, and if the majority of redundant flip-flop outputs is taken for each stage, a soft error of the flip-flop due to noise, radiation, etc., or a temporary error called single event upset ( Transient fault) can be prevented and reliability can be further improved. Needless to say, the orthogonal waveform generation circuit 100 can also be used in the RCCO tree 3 of FIG.

FIG. 8 shows an assembly circuit 5 suitable for the pattern of FIG.
It is an example of. According to the pattern of FIG. 6, since the simple OR (logical sum) shown in FIG. 8 has different waveforms, it is possible to know the occurrence of a failure. Even if a contact occurs between the wiring nets at this time, there is no other wiring net that uses the legitimate signatures of p2 and c2, and therefore the legitimate signature erroneously appears in the signature output 6. No forged signature is output. Therefore, even if a counterfeit signature occurs due to contact, it is possible to guarantee the fail-safety.

FIG. 11 shows an embodiment in which an excess pulse detection function is added to the pulse dropout detection function of the assembly circuit of FIG. Here, the excess pulse means the signals c0 to cn (40 to 4n).
This is a phenomenon in which one of the signals is turned on at the same time.
Any one of c0 to cn (40 to 4n) as shown in FIG.
When two signals are turned on, OR (logical sum) 50, E
The OR (exclusive OR) 51 together produces a signature output as shown in FIG. Here, as shown in FIG.
When the pulses are turned on at the same time for 2 and cn,
As shown in (1), the pulse of the signature output 61 is omitted, and the waveform becomes different from the legal signature, so that the occurrence of a failure can be known.

FIG. 13 shows an embodiment of the assembly circuit 5 in which the pulse arrival order is further taken into consideration. If the signature pulses of the comparison result normally arrive in the order of c0, c1, c2, ... Cn, the signature output 6 is inverted in level every time the signature pulse of cn arrives, as shown in FIG. However, if any one of the signature pulses c0, c1, c2, ... Cn is missed, the signature output 6 will not be inverted or the period will be remarkably lengthened. According to this embodiment, the cycle of the signature output 6 changes remarkably due to the failure, so that the failure can be easily detected.

FIG. 15 is a layout example of the present invention. Signals a0 to an (10 to 10 from the functional block A110)
1n) is latched by the latch 120 by the strobe signal 130, the exclusive waveform is taken by the orthogonal waveform of the orthogonal waveform generation circuit 100 and the permuters 80-8n, and a0'-an '.
(10 'to 1n'). Similarly, functional block B
The signals b0 to bn (20 to 2n) from 111 are latched by the strobe signal 131 by the latch 121, the exclusive OR of the orthogonal waveform of the orthogonal waveform generation circuit 101 and the permuters 90 to 9n, and b0 'to bn' ( 20 'to 2n'). The signals a0 'to an' (1 generated as described above
0'to 1n ') and b0' to bn '(20' to 2n ') are compared by the comparison circuits 40 to 4n, and the comparison results c0 to cn (40 to
4n), which is the signature output 6 in the assembly circuit 5.
The process up to this point is as described in the above embodiment.

Here, the comparison circuits 40 to 4n and the assembly circuit 5
Area 0 (200), functional block A110, latch 12
0, quadrature waveform generation circuit 100, permuter 80-8n
Area 1 (201), functional block B111, latch 1
21, orthogonal waveform generation circuit 101, permuters 90-9
n is divided into two areas, area 2 (202). When these circuits are formed as individual chips, the region 0 (200), the region 1 (201), and the region 2 (202) are formed as separate chips. Further, when these circuits are put in the same chip, the area 0 (200), the area 1 (20
If the distance between 1) and the area 2 (202) is increased or the power supply ground is separated, it is possible to prevent the spread of the failure. According to the layout of the present embodiment described above, signals having correlation, that is, between ai and bi and between pi and ci can be geometrically, physically, or electrically isolated from each other. It is possible to prevent the influence of the occurrence of the counterfeit signature due to.

In designing a high-performance LSI, a rough layout (floor plan) generally relies on heuristics such as human experience and intuition, and generally details are automatically routed based on a certain algorithm. Is efficient. Therefore, most of the existing automatic wiring tools have a function of automatically inputting detailed wiring by inputting a rough layout (floor plan) by a person. Therefore, the method according to the present embodiment has good compatibility (compatibility) with the functions of the existing automatic wiring tools, and the functions of these automatic wiring tools can be utilized to the maximum extent.

According to the present embodiment described above, the functional block according to the usual logic design is simply logically or optically copied to form the area 0 (200 including the comparison circuits 40 to 4n and the integrated circuit 5). In addition to the self-check, the reliability can be improved and the development cost can be significantly reduced.

FIG. 16 shows an embodiment of a self-checking computer using the present invention. Each of the functional blocks A110 and B111 has an MPU (Micro-Processing U).
Computer components such as nit), WDT (Watch Dig Timer), and INTC (interrupt controller) are connected to the internal buses 212 and 213. Further, each functional block is connected to external buses 206 and 207 via interfaces 204 and 205. The comparator according to the present invention compares the signals of the internal buses 212 and 213 with the signals in which the signatures are superposed by the permuters 80 to 8n and 90 to 9n according to the pattern generated by the orthogonal waveform generation circuits 100 and 101, thereby functional block A11.
0, B111 normal / abnormal is determined. Internal bus 21
If the signals of 2 and 213 match, the comparator (region 0
(200)) outputs the signature signal to the signature output 6. Further, as shown in FIG. 16, the functional block A110 is (region 1 (201)), the functional block B111 is (region 2 (202)), and the region 0 (200) of the comparator is arranged between regions according to the layout shown in FIG. A single-chip self-checking microcomputer can be realized by arranging them on a single chip after keeping the distance between them and separating the power supply ground. For simplicity, in the figure,
The latches 120 and 121 are omitted.

External bus 2 in addition to internal buses 212 and 213
If 06 and 207 are checked by the comparator (area 0 (200)), the operation of the entire LSI including the operation of the interfaces 204 and 205 can be further monitored.

According to the present embodiment, the MP with a normal design
U (Micro-Processing Unit), WDT (Watch Dig Time
r), INTC (interrupt controller) and other functional blocks of a microcomputer, which are composed of microcomputer components, are simply logically or optically (at the mask pattern level) duplicated, and the comparison circuit 40 ~ 4n, area 0 composed of integrated circuit 5
A self-checking microcomputer can be easily realized by combining with (200),
A highly reliable self-checking circuit can be realized with less development man-hours and costs.

FIG. 17 shows an embodiment of a fault tolerant computer system using a self-checking computer. Self-checking computer 20
External bus 206 (207), 206 'from 3,203'
The signal output to (207 ') is selected by the output selection circuit 210 and becomes the final output 211. Output selection circuit 2
10 is controlled by the switching control signal 209 generated by the switching control circuit 208 based on the signature outputs 6 and 6 '. That is, the output of the self-checking computer which is considered normal is selected based on the signature outputs 6, 6'from the self-checking computer 203, 203 '.

FIG. 18 is a diagram for explaining the configuration of the switching control circuit 208. Signature monitoring circuit 21
2 and 213 monitor the signature outputs 6 and 6 ′, and when the signature outputs 6 and 6 ′ are normal, the monitoring results 214 and 2
A signal indicating "normal" is output to 15 and a signal indicating "abnormal" is output to the monitoring results 214 and 215 when the signature outputs 6 and 6'are abnormal. In decision logic 216,
Only when the signature output 6 is abnormal and the signature output 6'is normal, the switching control signal 209 indicates "external bus 20".
6 '(207') is selected to output a signal meaning "select external bus 206 (207)".
It outputs a signal of meaning. In the drawing, for simplification, the signal indicating “normal” of the monitoring results 214 and 215 is at the normal binary H level, the signal indicating “abnormal” is at the L level, and the switching control signal 209 “external bus” is used. 206 '(2
A signal meaning "to select 07 ')" is shown at H level, and a signal meaning "to select external bus 206 (207)" is shown at L level. However, these signals are not limited to the binary logic, but the redundancy control such as the two-wire logic, the frequency logic, and the unique signature for each net provided in the present invention can be used to improve the reliability of the switching control circuit 208. , The reliability of the entire system can be further improved.

Continuing signature monitoring circuit 212, 2
Description will be added to the thirteenth embodiment. When the signature output 6 has a periodic waveform as shown in FIG. 9, the signature monitoring circuits 212 and 213 can be realized by monitoring the arrival of pulses at regular intervals with a counter. If the signature output 6 is a more complicated waveform, it is correlated with the reference (template) waveform. If the correlation is 1.0, it is judged as normal, and if it is less than 1.0. If it is determined that is abnormal, the signature monitoring circuits 212 and 213 can be realized.

According to this embodiment described above, it is possible to construct a hot standby type fault tolerant system in which the self-checking computer 203 is the main system and the self-checking computer 203 'is the sub-system (standby system). Moreover, the error detection method provided by the present invention with less omission of detection can provide a system more reliable than the conventional one.

Further, the self-checking computer provided by the present invention can be applied to a fault tolerant system having various configurations other than the system configuration described above. For example, the present invention can be applied to Japanese Patent Application No. 63-266055 (hereinafter referred to as an already applied patent), which has already been filed by the inventors. Subsystem 1 of FIG. 5 of the already filed patent
-1 to 1-N are replaced with the self-checking computer 203 provided by the present invention, and output 3-1
Applicable by replacing .about.3-N with the external bus 208 (207) of the present invention and replacing the mutual diagnosis results 4-1 and 4-N of the previously filed patent with the signature output 6 of the present invention.

FIG. 19 shows an embodiment of the self-checking comparator according to the present invention. Here, the comparison circuits 40 to 4n,
The integrated circuit 5 is in the area 0 (200), the latch 120, the quadrature waveform generation circuit 100, and the permuters 80 to 8n are in the area 1 (2).
01), the latch 121, the quadrature waveform generation circuit 101, and the permuters 90 to 9n are divided into two regions, that is, a region 2 (202), and a region 0 (200) and a region 1 (20
1) and the region 2 (202) are spaced from each other or the power supply ground is separated to prevent the propagation of a fault, and these circuits are housed in the same chip to form a comparator 217. The comparator 217 is connected to the external functional block A110 and the external functional block B111, and compares the outputs thereof. According to the present embodiment, similar signals to those in the embodiment shown in FIG.
That is, since ai and bi and pi and ci can be geometrically, physically, or electrically isolated from each other, it is possible to prevent the influence of the generation of the counterfeit signature due to the contact, and to compare the self-checking with each other. Can be realized.

[0052]

According to the present invention, it is possible to provide a new method capable of guaranteeing the fail-safe property even if a counterfeit signature is generated due to contact. Therefore, according to the present invention, it is possible to take advantage of existing semiconductor technology, design automation tools, etc. without requiring special constraints in realizing a fail-safe logic circuit, and to significantly reduce both development cost and time. Can be expected.

[Brief description of drawings]

FIG. 1 shows a basic embodiment of the present invention.

FIG. 2 is an embodiment corresponding to functional blocks.

FIG. 3 is an example using an RCCO tree.

FIG. 4 is an embodiment in which a quadrature waveform is added to an output from a functional block B.

FIG. 5 is an embodiment in which the orthogonal waveform generation circuit is duplicated.

FIG. 6 shows an example of an orthogonal function waveform.

FIG. 7 shows an embodiment of a quadrature waveform generation circuit.

FIG. 8 shows an example of an integrated circuit.

FIG. 9 shows an example of an orthogonal function waveform and a signature output.

FIG. 10 shows an example of an orthogonal function waveform and a signature output at the time of failure.

FIG. 11 is an example of an integrated circuit.

FIG. 12 is an example of an orthogonal function waveform and a signature output at the time of a failure.

FIG. 13 shows an example of an integrated circuit.

FIG. 14 is an example of an orthogonal function waveform and a signature output.

FIG. 15 is a circuit layout according to the present invention.

FIG. 16 is a block diagram of a self-checking computer according to the present invention.

FIG. 17 is a configuration diagram of a fault tolerant computer system using a self-checking computer.

FIG. 18 is a configuration diagram of the inside of a switching control circuit.

FIG. 19 is a self-checking comparator.

[Explanation of symbols]

10 to 1n ... Signals a0 to an, 20 from the functional block A
~ 2n ... Signals b0 to bn from functional block B, 3 ... RC
CO, 30 to 3n ... Comparison circuit, 40 to 4n ... Comparison result c
0-cn, 5 ... Assembly circuit, 6 ... Output signal, 80-8n, 9
0-9n-Permuter, 100, 101 ... Orthogonal waveform generation circuit, 110 ... Functional block A, 111 ... Functional block B, 120, 121 ... Latch, 203, 203 '... Self-checking computer.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor, Tashiro, Ishi, 7-1, Omika-cho, Hitachi-shi, Ibaraki Hitachi Ltd. Hitachi Research Laboratory (72) Inventor Keisuke Togitsu, 7-chome, Omika-cho, Hitachi-shi, Ibaraki No. 1 in Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Hiroshi Sato No. 1-1, Omika-cho, Hitachi, Hitachi, Ibaraki (72) In Hitachi Research Laboratory, Hitachi, Ltd. (72) Makoto Nomi Katsuta, Ibaraki Prefecture 1070 Ichige Hitachi Ltd. Mito Plant (72) Inventor Shinya Otsuji 7-1-1 Omika-cho, Hitachi-shi, Ibaraki Hitachi Ltd. Hitachi Research Laboratory

Claims (13)

[Claims] 1. In a logic circuit with an error detection function for comparing outputs of at least duplicated functional blocks and detecting an error, one or both outputs of the duplicated functional blocks are provided for each block. A logic circuit with an error detecting function, characterized in that a synthesizing means for superposing a unique waveform assigned in advance is provided, and an error is detected based on an output from the synthesizing means. 2. The waveform synthesizing means according to claim 1, wherein the synthesizing means generates a unique waveform pre-allocated for each of the functional blocks, the generated unique waveform and an output from the functional block. A logic circuit with an error detecting function, comprising a logic operation means for calculating the exclusive OR of 3. A logic circuit with an error detection function, wherein at least a function block for outputting a plurality of signals is at least duplicated, a comparison means for comparing outputs of these function blocks is provided, and an error is detected based on a comparison result. , Combining the output signal of the one functional block with a unique waveform assigned in advance for each output signal, and comparing the output from the combining unit with the output from the other functional block A logic circuit with an error detection function that detects an error by doing so. 4. The synthesizing means according to claim 3, wherein the synthesizing means includes a waveform generating means for generating a unique waveform previously assigned to each output signal, a generated unique waveform and the one functional block. A logic circuit with an error detection function, comprising a logic operation means for calculating an exclusive OR with each output signal. 5. A logic circuit with an error detecting function according to claim 3, wherein the unique waveforms previously assigned to the respective output signals are mutually uncorrelated waveforms. 6. The logic circuit with an error detecting function according to claim 3, wherein the unique waveforms assigned in advance to the respective output signals are waveforms orthogonal to each other. 7. A logic circuit with an error detection function, comprising at least a dual structure of functional blocks for outputting a plurality of signals, comprising comparison means for comparing the outputs of these functional blocks, and detecting an error based on the comparison result. A first synthesizing unit that superimposes a unique waveform previously assigned to each output signal on the output signal of the one functional block, and an output signal of the other functional block for each output signal in advance. Error detection for detecting an error by providing a second synthesizing means for superimposing the unique waveform assigned to the first synthesizing means, and comparing the output from the first synthesizing means with the output from the second synthesizing means. Functional logic circuit. 8. A method for detecting an error by comparing output signals between functional blocks which output a plurality of signals configured in a duplicated manner, wherein each output of one of the functional blocks configured in a duplicated manner. A unique waveform previously assigned to each output signal is superimposed on the signal, and the other output signal of the duplicated functional block and each output signal on which the unique waveform is superimposed are combined. An error detection method characterized by comparing and detecting an error. 9. The exclusive OR according to claim 8, wherein each output signal of one of the duplicated functional blocks and a unique waveform previously assigned to each output signal are exclusive ORed. An error detection method, characterized in that the characteristic waveform is superimposed. 10. A method for detecting an error by comparing output signals between functional blocks that output a plurality of signals configured in a duplicated manner, wherein each output of one of the functional blocks configured in a duplicated manner. A unique waveform previously assigned to each output signal is superimposed on the signal, and the other output signal of the duplicated functional block and each output signal on which the unique waveform is superimposed are combined. An error detecting method, characterized in that, as a result of the comparison, when a waveform other than the previously assigned unique waveform is obtained as a result of the comparison, it is determined to be an error. 11. A method for detecting an error by comparing output signals between functional blocks that output a plurality of signals configured in a duplicated manner, each output of one of the functional blocks configured in a duplicated manner. A unique waveform previously assigned to each output signal is superimposed on the signal, and the other output signal of the duplicated functional block and each output signal on which the unique waveform is superimposed are combined. As a result of the comparison, if the pre-allocated unique waveform is not obtained,
An error detection method characterized by determining that it is an error. 12. A first circuit comprising at least a CPU, an interrupt controller and a timer, which generates a plurality of output signals, a second circuit having the same function as the first circuit, and the first circuit. And a logic circuit with an error detection function having a comparison circuit for comparing output signals from the second circuit with each other, in the first and second circuits, with respect to each of the plurality of output signals previously assigned to each output signal. With an error detection function, characterized in that first and second synthesis circuits for superposing the generated unique waveforms are respectively provided, and the first circuit, the second circuit and the comparison circuit are respectively arranged on different chips. Logic circuit. 13. A synthesizing means for arranging at least a duplication structure of a functional block for outputting a plurality of signals, and superimposing a unique waveform previously assigned to each output signal on the output signal of one of the functional blocks. First and second computers for detecting an error by comparing the output from the synthesizing means with the output from the other functional block;
A switching control circuit for selecting one of the outputs of the first and second computers and outputting the output to the outside, wherein the switching control circuit detects an error output from the first and second computers. A fault tolerant system characterized by selecting one of the computer outputs based on a signal.