Semiconductor device and fault detection method thereof

Abstract

Embodiments of the present invention relate to semiconductor devices and fault detection methods thereof. A semiconductor device includes an interrupt control circuit that receives multiple interrupt signals from a circuit block and outputs an interrupt request to a processor; and an interrupt monitoring circuit that corresponds to one of the interrupt signals and includes a setting circuit for setting a monitoring type and a first monitoring period and a second monitoring period. If the monitoring type indicates an asserted state of the interrupt signal, the interrupt monitoring circuit monitors the asserted state. If a first duration of a continuous asserted state exceeds a first monitoring period, the interrupt monitoring circuit detects the state as a fault. If the monitoring type indicates a negative state of the interrupt signal, the interrupt monitoring circuit monitors the negative state. If a second duration of a continuous negative state exceeds a second monitoring period, the interrupt monitoring circuit detects the state as a fault.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The disclosure of Japanese Patent Application No. 2017-227372 filed on November 28, 2017 including the specification, drawings and abstract is incorporated herein by reference in its entirety. Technical Field

[0003] The present invention relates to a semiconductor device and a fault detection method, for example, a semiconductor device and a fault detection method that monitor an interrupt signal. Background Art

[0004] Japanese Unexamined Patent Application Publication No. 2000-330798 discloses a controller technology for checking interrupt control of an interrupt signal from an input / output device to a processor. The interrupt controller in Japanese Unexamined Patent Application Publication No. 2000-330798 includes a register that stores a history of interrupt signals. After an interrupt using an interrupt signal, the interrupt controller checks the interrupt with reference to the contents of the register. Summary of the invention

[0005] However, in Japanese Unexamined Patent Application Publication No. 2000-330798, it is not assumed that the interrupt signal has various errors.

[0006] Other issues and new features will be clarified through the description and accompanying drawings of this specification.

[0007] According to an embodiment, a semiconductor device detects a failure by monitoring a duration of a specific state of an interrupt signal according to a monitoring type set for each interrupt signal.

[0008] According to this embodiment, a failure can be detected based on various errors of a plurality of interrupt signals. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a block diagram showing a configuration of a semiconductor device according to a first embodiment;

[0010] Figure 2 is a block diagram showing a configuration of an INTC monitor according to a first embodiment;

[0011] Figure 3 is a flowchart showing a process of monitoring an assertion period of an interrupt signal according to the first embodiment;

[0012] Figure 4 is a timing diagram when monitoring the assertion period of the interrupt signal according to the first embodiment;

[0013] Figure 5is a flowchart showing the process of monitoring the assertion period and negation period of the interrupt signal according to the first embodiment;

[0014] Figure 6 is a timing diagram when monitoring the assertion period and negation period of the interrupt signal according to the first embodiment;

[0015] Figure 7 is a block diagram showing a configuration of an INTC monitor according to a second embodiment;

[0016] Figure 8 is a block diagram showing a configuration of an INTC monitor according to a third embodiment;

[0017] Fig. 9 is a flowchart showing the process of monitoring the assertion period and negation period of the interrupt signal according to the third embodiment;

[0018] Fig.10 is a timing diagram when monitoring the assertion period and negation period of the interrupt signal according to the third embodiment;

[0019] Fig.11 is a block diagram showing the configuration of an INTC monitor and a frequency divider according to a fourth embodiment;

[0020] Fig.12 is a block diagram showing a configuration of a semiconductor device according to a fifth embodiment;

[0021] Fig.13 An example of a control register according to a fifth embodiment is shown;

[0022] Fig.14 is a diagram showing an example of a control flag confirmation register according to a fifth embodiment;

[0023] Fig.15 is a block diagram showing a configuration of a video processing device according to a sixth embodiment;

[0024] Fig.16 is a block diagram showing a configuration of a time-triggered system according to a seventh embodiment;

[0025] Fig.17 is a block diagram showing a configuration of an electronic controller in a time-triggered system according to a seventh embodiment;

[0026] Fig.18 is a block diagram showing a configuration of a speech processing unit according to an eighth embodiment; and

[0027] Fig.19 is a block diagram showing the configuration of a semiconductor device according to a ninth embodiment. DETAILED DESCRIPTION

[0028] For the purpose of explanation, the following description and drawings are optionally omitted and simplified. In addition, the elements of the functional blocks illustrated as various processes in the drawings may be configured with hardware including a central processing unit (CPU), a memory and other circuits, and software including a program loaded in the memory. Therefore, it will be appreciated by those skilled in the art that these functional blocks may be implemented in various forms, for example, only by hardware, only by software, or by a combination of hardware and software. There is no specific limitation on the form of the functional blocks. The same reference numerals in the drawings represent the same elements, and redundant explanations are optionally omitted.

[0029] The program can be provided to the computer while being stored using various non-transitory computer-readable media. Non-transitory computer-readable media include various actual recording media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., floppy disks, magnetic tapes, and hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (read-only memories), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (programmable ROMs), EPROMs (erasable PROMs), flash ROMs, or RAMs (random access memories)). The program can be provided to the computer by using various transient computer-readable media. Examples of transient computer-readable media include electrical signals, optical signals, and electromagnetic waves. Transient computer-readable media can supply programs to the computer via wired communication lines including wires and optical fibers or radio communication lines.

[0030] <First Embodiment>

[0031] Figure 11 is a block diagram showing a configuration of a semiconductor device 100 according to a first embodiment. The semiconductor device 100 includes processors 111 and 112, interrupt controllers (INTC) 121 and 122, an interrupt monitoring unit 130, and peripheral intellectual property rights (IPs) 141 to 144. The processor 111 is a control circuit that executes a predetermined interrupt in response to an interrupt request 181. The processor 112 is a control circuit that executes a predetermined interrupt in response to an interrupt request 182. Peripheral IPs 141 to 144 are circuit blocks that output interrupt signals 161 to 164, respectively. Peripheral IPs 141 and 143 are set at a relatively high functional safety level. Peripheral IPs 142 and 144 are set at a lower functional safety level than peripheral IPs 141 and 143. Therefore, the interrupt signals 161 and 163 output from peripheral IPs 141 and 143 are placed at a relatively high monitoring priority. In addition, the interrupt signals 162 and 164 output from the peripheral IPs 142 and 144 are placed at a relatively low monitoring priority. Therefore, in the example of the present embodiment, the interrupt signals 161 and 163 are monitored, and the interrupt signals 162 and 164 are not monitored. However, it is even possible to monitor the interrupt signals at a low monitoring priority. Further, it is even possible not to monitor the interrupt signals at a high monitoring priority. In other words, in the present embodiment, the signal to be monitored is not limited, as long as at least one of the interrupt signals 161 and 163 is monitored. The number of peripheral IPs and the number of interrupt signals are not limited. For example, hundreds of interrupt signals can be output from the peripheral IP. In addition, the ratio of the peripheral IP at a high functional safety level to the peripheral IP at a low functional safety level is not limited. Further, the semiconductor device 100 according to the present embodiment only requires at least one peripheral IP, which outputs the interrupt signal to be monitored. The number of processors and the number of INTCs are not limited in the present embodiment.

[0032] The INTC 121 is an interrupt control circuit that receives a plurality of interrupt signals and outputs an interrupt request 181 to the processor 111. In this configuration, the INTC 121 is coupled to signal lines for interrupt signals 161 to 164 from the corresponding peripheral IPs 141 to 144, and to a signal line for an interrupt signal 169 from the error control unit 150. The interrupt signals 161 and 163 are set as interrupt targets in the INTC 121. Therefore, in response to the interrupt signal 161 or 163, the INTC 121 outputs an interrupt request 181 to the processor 111. In other words, even when the interrupt signals 162, 164, and 169 that are not set as interrupt targets are received, the INTC 121 does not output an interrupt request.

[0033] INTC 122 is an interrupt control circuit that receives multiple interrupt signals and outputs an interrupt request 182 to the processor 112. In this configuration, INTC 122 is coupled to signal lines for interrupt signals 161 to 164 from corresponding peripheral IPs 141 to 144, and a signal line for an interrupt signal 169 from an error control unit 150. Interrupt signals 162, 164, and 169 are set as interrupt targets in INTC 122. Therefore, in response to interrupt signals 162, 164, or 169, INTC 122 outputs an interrupt request 182 to the processor. In other words, even when interrupt signals 161 and 163 that are not set as interrupt targets are received, INTC 122 will not output an interrupt request. Specifically, the internal settings of INTC 121 and INTC 122 can optionally change the combination of interrupt signals to interrupt targets in INTC 121 and INTC 122. INTC 121 is an example of a first interrupt control circuit, which will be discussed later. INTC 122 is an example of a second interrupt control circuit, which will be discussed later. The interrupt monitoring unit 130 includes INTC monitors 131 and 132 and an OR circuit 1301, and the INTC monitors 131 and 132 are interrupt monitoring circuits for corresponding interrupt signals. In this case, the INTC monitor 131 corresponds to the interrupt signal 161, and the INTC monitor 132 corresponds to the interrupt signal 163.

[0034] INTC monitor 131 monitors the state of interrupt signal 161. If an abnormality is detected, INTC monitor 131 outputs fault notification signal 171. INTC monitor 132 monitors the state of interrupt signal 163. If an abnormality is detected, INTC monitor 132 outputs fault notification signal 172. OR circuit 1301 outputs the result of the logical sum of fault notification signals 171 and 172 as fault notification signal 170. As already discussed in the present embodiment, at least one interrupt signal can be output as an interrupt target. Therefore, interrupt monitoring unit 130 may include at least one INTC monitor. In this case, OR circuit 1301 is not necessary. In the case of three or more interrupt signals to be monitored, INTC monitor can provide as many interrupt signals as possible for the corresponding interrupt signals.

[0035] refer to Figure 2 , the internal configuration of the INTC monitor 131 will be described below. Figure 2 1 is a block diagram showing the configuration of the INTC monitor 131 according to the first embodiment. The configuration of the INTC monitor 132 is the same as that of the INTC monitor 131, and thus illustration and description thereof are omitted.

[0036] The INTC monitor 131 includes a timer counter 210, a control logic circuit 220, a control register 230, and a status register 240. The timer counter 210 measures the duration of the assertion state and the negation state of the interrupt signal 161 based on the clock signal CLK. The clock signal CLK can be a low-speed (kHz level) clock signal obtained by dividing the operating clock frequency. This is because the monitoring cycle is very long (milliseconds) relative to the operating clock frequency.

[0037] The control register 230 is an example of a setting circuit, which is used to set the monitoring cycle 231, the assertion flag 232 and the negation flag 233. The monitoring cycle 231 is a time as a threshold, which indicates that the duration of the assertion state and the negation state of the interrupt signal 161 is set within a normal range. The monitoring cycle 231 corresponds to a state in which the first monitoring cycle and the second monitoring cycle are common cycles. The assertion flag 232 is flag information indicating whether the INTC monitor 131 monitors the assertion state of the interrupt signal 161. The negation flag 233 is flag information indicating whether the INTC monitor 131 monitors the negation state of the interrupt signal 161. The assertion flag 232 and the negation flag 233 are examples of monitoring types, and the monitoring type indicates the monitoring state of the corresponding interrupt signal 161. Therefore, the assertion flag 232 and the negation flag 233 can be collectively represented as a piece of monitoring type information, and it can be controlled in response to the ON / OFF of the monitoring type information whether to monitor both the assertion state and the negation state of the interrupt signal 161.

[0038] The status register 240 is a holding circuit that holds an assertion cycle fault flag 241 and a negation cycle fault flag 242. In the assertion cycle fault flag 241, if the duration of the assertion state of the interrupt signal 161 exceeds the monitoring cycle 231, a value (e.g., 1) indicating the detection of a fault is set by the control logic circuit 220. In the negation cycle fault flag 242, if the duration of the negation state of the interrupt signal 161 exceeds the monitoring cycle 231, a value (e.g., 1) indicating the detection of a fault is set by the control logic circuit 220.

[0039] In the control register 230 and the status register 240, the setting value is read and written from the outside through the processor IO signal 1110 (for example, the processor 111 or 112). In other words, the processor 111 or 112 can set and refer to the setting value of the control register 230 and the status register 240. In addition, the assertion cycle fault flag 241 and the negation cycle fault flag 242 of the status register 240 are output as the fault notification signal 171.

[0040] When the assertion flag 232 or the negation flag 233 is set in the control register 230, the control logic circuit 220 starts monitoring the interrupt signal 161. The control logic circuit 220 detects changes in the assertion state and the negation state of the interrupt signal 161. Whenever the control logic circuit 220 detects a change in the interrupt signal 161, the control logic circuit 220 switches the monitoring of the assertion state and the negation state according to the settings of the assertion flag 232 and the negation flag 233.

[0041] Specifically, if the interrupt signal 161 is asserted when the monitoring type is set to the asserted state in the setting circuit (for example, 1 is set in the assertion flag 232 by the processor 111, etc.), the control logic circuit 220 starts to measure the first duration with the help of the timer counter 210. In addition, if the interrupt signal 161 is negated when the monitoring type is set to the negated state in the setting circuit (for example, 1 is set in the negation flag 233 by the processor 111, etc.), the control logic circuit 220 starts to measure the second duration with the help of the timer counter 210.

[0042] The control logic circuit 220 is an example of a control circuit that detects assertion and negation of the interrupt signal 161. If the start of assertion of the interrupt signal 161 is detected, the control logic circuit 220 clears the timer counter 210 and then compares the measured value of the timer counter 210 as the first duration with the monitoring period 231. If the first duration exceeds the monitoring period 231, the control logic circuit 220 detects the duration as a fault and sets a fault detection value (e.g., 1) in the assertion period fault flag 241 of the status register 240.

[0043] If the beginning of negation of the interrupt signal 161 is detected, the control logic circuit 220 clears the timer counter 210 and then compares the measured value of the timer counter 210 as the second duration with the monitoring period 231. If the second duration exceeds the monitoring period 231, the control logic circuit 220 detects the duration as a fault and sets a fault detection value (e.g., 1) in the negation period fault flag 242 of the status register 240.

[0044] from Figure 1The explanation continues. The error control unit 150 receives a notification of fault detection from the INTC monitors 131 and 132 as a fault notification signal 170, and outputs the notification of the detection as an interrupt signal 169. The error control unit 150 can select the INTC 121 and 122 and / or the external terminal 151 as the destination of the output. Therefore, if the error control unit 150 outputs a fault detection notification to the external terminal 151, a fault can be detected by, for example, an external monitor of the semiconductor device 100. Subsequently, various fault operations are performed according to the error information from the external terminal 151. For example, a power-on reset is performed on the semiconductor device 100.

[0045] The fault notification signal 170 indicates that a fault is detected by at least one of the INTC monitors. The fault notification signal 170 may include information for specifying the INTC monitor that has detected the fault, or an interrupt signal. Further, the fault notification signal 170 may include information for specifying whether the fault has been detected in an assertion cycle or in a negation cycle.

[0046] In this case, the error control unit 150 outputs the interrupt request 169 to both the INTCs 121 and 122. As described above, even if the INTC 121 receives the interrupt signal 169, the interrupt signal 169 will not be set as the interrupt target, and therefore will not be notified to the processor 111 as the interrupt request 181. In this configuration, the INTC 121 sets the interrupt signals 161 and 163 to be monitored as the interrupt target. If the interrupt signal 169 indicates a fault detection, a fault may occur in one of the peripheral IPs 141 and 143, which are blocks for the interrupt signals 161 and 163, the INTC 121, and the processor 111. This may not allow the interrupt to be correctly executed in the processor 111. Therefore, if the interrupt signals 161 and 163 are to be monitored, the interrupt signal 169 will not be set as the interrupt target in the INTC 121. If the INTC 122 receives the interrupt signal 169, the interrupt signal 169 is set as the interrupt target and is therefore notified to the processor 112 as an interrupt request 182. Therefore, in response to the interrupt request 182, the processor 112 refers to the status register 240 of the INTC monitors 131 and 132, specifies the interrupt signal indicating abnormal detection (or the peripheral IP from which the signal is output), and specifies whether the assertion cycle or the negation cycle has exceeded the monitoring cycle. In addition, the processor 112 writes the specified information to the DRAM (not shown). Subsequently, a fault operation is performed according to the specified information. For example, the software can be reset for the specified peripheral IP to recover from the fault. Error notification and recovery are merely exemplary.

[0047] In another error notification example, INTC monitors 131 and 132 can notify both INTCs 121 and 122 of fault detection and information for identifying the INTC monitor, interrupt signal, or peripheral IP from which the signal is output. In this case, INTCs 121 and 122 can each analyze the notification of fault detection to determine whether to notify the processor of an error. If it is determined that an error is to be notified from the INTC, the INTC can output an interrupt request to the processor. This can perform processing such as recovery in the correct processor.

[0048] Alternatively, the INTC monitors 131 and 132 may output a fault notification signal 171 or a fault notification signal 172 and information for identifying the INTC monitor, an interrupt signal, or a peripheral IP from which a signal is output, so that the error control unit 150 may specify the INTC monitor, the interrupt signal, or the peripheral IP from which a signal is output at the fault location based on the fault notification signal 170. In this case, the error control unit 150 may have, for example, a definition of an interrupt signal set for the INTCs 121 and 122. The error control unit 150 may output an interrupt signal to the INTC 121 or 122 based on the specified information and definition.

[0049] As has been discussed, in the present embodiment, two systems are provided for notifying interrupt signals. Specifically, in the first system, the interrupt signals 161 and 163 from the peripheral IPs 141 and 143 are notified to the INTC 121, and then the INTC 121 notifies the processor 111 of the interrupt request 181 in response to the interrupt signal 161 or 163. In the second system, the INTC 122 is notified of the interrupt signals 162 and 164 from the peripheral IPs 142 and 144 and the interrupt signal 169 from the error control unit 150, and then in response to the interrupt signal 162, 164 or 169, the INTC 122 notifies the processor 112 of the interrupt request 182.

[0050] If an abnormality is detected in the interrupt signal 161 or 163, there is a high probability of failure in the peripheral IP 141 or 143, INTC 121, processor 111, or related signal lines in the first system. Therefore, if an abnormality is detected in the interrupt signal 161 or 163 of the first system, the fault detection is notified to the second system without the abnormality, rather than the first system. This enables recovery thereafter.

[0051] Subsequently, only the monitoring of the assertion period will be discussed below as an anomaly detection of the interrupt signal. Figure 31 is a flow chart showing the process of monitoring the assertion period of the interrupt signal according to the first embodiment. In the following description, the process for monitoring the interrupt signal 161 on the INTC monitor 131 is discussed. In addition, in the following description, as will be discussed later Figure 4 As shown, the interrupt signal 161 is initially negated.

[0052] First, the processor 111 etc. sets a monitoring cycle of the interrupt signal 161 ( S101 ). Specifically, the processor 111 etc. sets a monitoring cycle 231 in the control register 230 of the INTC monitor 131 .

[0053] Then, the processor 111 etc. sets the assertion flag of the interrupt signal 161 (S102). Specifically, the processor 111 etc. sets 1 in the assertion flag 232 of the control register 230 of the INTC monitor 131. In addition, 0 is continuously set in the negation flag 233.

[0054] Then, the INTC monitor 131 stands by until the interrupt signal 161 is asserted (S103). Thereafter, the interrupt signal 161 is asserted (S104). At this time, the control logic circuit 220 of the INTC monitor 131 detects the assertion of the interrupt signal 161 and starts to measure the first duration by means of the timer counter 210. Then, the INTC monitor 131 monitors the assertion cycle of the interrupt signal 161 (S105). The control logic circuit 220 of the INTC monitor 131 determines whether the interrupt signal 161 has been negated (S106). If the control logic circuit 220 detects the beginning of the negation of the interrupt signal 161, the control logic circuit 220 clears the timer counter 210 (S107), and then returns to step S103.

[0055] In step S106, if the control logic circuit 220 has not detected the beginning of negation of the interrupt signal 161, the control logic circuit 220 determines whether the timer counter 210 has overflowed (S108). Specifically, the control logic circuit 220 compares the measured value of the timer counter 210 (i.e., the first duration of continuous assertion of the interrupt signal 161) with the monitoring period 231. If it is determined that the first duration exceeds the monitoring period 231, the control logic circuit 220 detects a failure in the assertion cycle (S109). Specifically, the control logic circuit 220 sets 1 in the assertion cycle failure flag 241 of the status register 240. In step S108, if it is determined that the timer counter 210 has not overflowed, the process returns to step S105.

[0056] Figure 4 1 is a timing diagram when monitoring the assertion period of the interrupt signal according to the first embodiment. Figure 4, 5 milliseconds is set as the monitoring period 231, the assertion flag is set, and the negation flag 233 is not set. The first assertion period of the interrupt signal 161 is not longer than 3 milliseconds and therefore does not exceed the monitoring period 231, which indicates that the timer counter 210 is cleared. The second assertion period of the interrupt signal 161 exceeds 5 milliseconds, that is, the monitoring period 231, and therefore 1 is set in the assertion period fault flag 241. In the following, the fault detection is notified by the error control unit 150.

[0057] exist Figure 4 In the example, during the period when the assertion flag 232 is set (i.e., at the beginning of monitoring), only the assertion period of the interrupt signal is monitored and the interrupt signal is negated. In this case, as described above, the monitoring of the interrupt signal is placed on hold as in step S103 until Figure 3 In step S104, an interrupt signal is asserted.

[0058] This embodiment is also applicable to the case where only the assertion period of the interrupt signal is monitored and the interrupt signal is asserted during the setting of the assertion flag 232. In this case, immediately after the assertion flag 232 is set, the control logic circuit 220 of the INTC monitor 131 detects the assertion of the interrupt signal 161 and then starts measuring the first duration by means of the timer counter 210. Therefore, even in the case where the assertion flag 232 is set during the operation of the semiconductor device 100, monitoring can be started immediately so that a fault can be detected more quickly.

[0059] In addition, only the negation period of the interrupt signal can be monitored. In this case, the interrupt signal can be asserted or negated during the setting of the negation flag 233 (i.e., at the beginning of monitoring). If the interrupt signal is asserted during the setting of the negation flag 233, the monitoring of the interrupt signal is maintained until the interrupt signal is negated. If the interrupt signal is negated during the setting of the negation flag 233, then immediately after the setting of the negation flag 233, the control logic circuit 220 of the INTC monitor 131 detects the negation of the interrupt signal 161 and starts measuring the second duration of the timer counter 210. Therefore, even if the negation flag 233 is set during the operation of the semiconductor device 100, monitoring can be started immediately so that a fault can be detected more quickly.

[0060] Subsequently, the monitoring of assertion cycles and negation cycles will be discussed below as anomaly detection of interrupt signals. Figure 5 1 is a flow chart showing the process of monitoring the assertion cycle and negation cycle of the interrupt signal according to the first embodiment. Figure 6 As shown, the interrupt signal 161 is initially negated.

[0061] The processor 111 etc. sets a monitoring cycle of the interrupt signal 161 (S101). Then, the processor 111 etc. sets an assertion flag of the interrupt signal 161 (S102). Specifically, the processor 111 etc. sets 1 in the assertion flag 232 of the control register 230 of the INTC monitor 131.

[0062] Then, the processor 111 etc. sets the negation flag of the interrupt signal 161 ( S110 ). Specifically, the processor 111 etc. sets 1 in the negation flag 233 of the control register 230 of the INTC monitor 131 .

[0063] The INTC monitor 131 starts monitoring the interrupt signal 161 (S111) from when the assertion flag 232 and the negation flag 233 are set to 1. At this time, as described above, the interrupt signal 161 is negated, and thus the control logic circuit 220 of the INTC monitor 131 detects the negation of the interrupt signal 161 and starts measuring the second duration by means of the timer counter 210. In the following description, the INTC monitor 131 will be mainly discussed.

[0064] The control logic circuit 220 of the INTC monitor 131 determines whether the interrupt signal 161 has been asserted (S112). If the control logic circuit 220 does not detect the start of asserting the interrupt signal 161, the control logic circuit 220 determines whether the timer counter 210 has overflowed (S114). Specifically, the control logic circuit 220 compares the measured value of the timer counter 210 (that is, the second duration during which the interrupt signal 161 is continuously negated) with the monitoring cycle 231. If it is determined that the second duration exceeds the monitoring cycle 231, the control logic circuit 220 detects a fault in the negation cycle (S115). Specifically, the control logic circuit 220 sets 1 in the negation cycle fault flag 242 of the status register 240. In step S114, if it is determined that the timer counter 210 has not overflowed, the process returns to step S111.

[0065] If the control logic circuit 220 detects the start of assertion of the interrupt signal 161 in step S112 , the control logic circuit 220 clears the timer counter 210 ( S113 ) and then starts measuring the first duration by means of the timer counter 210 .

[0066] Then, the INTC monitor 131 monitors the assertion period of the interrupt signal 161 (S105). The control logic circuit 220 of the INTC monitor 131 determines whether the interrupt signal 161 has been negated (S106). If the control logic circuit 220 detects the beginning of the negation of the interrupt signal 161, the control logic circuit 220 clears the timer counter 210 (S107) and then returns to step S111.

[0067] If the control logic circuit 220 does not detect the beginning of the negation of the interrupt signal 161 in step S106, the process is as follows Figure 3 The same is done in .

[0068] Figure 6 1 is a timing diagram showing monitoring of assertion periods and negation periods of an interrupt signal according to the first embodiment. Figure 6 , 5 milliseconds are set as the monitoring period 231, the assertion flag is set, and then the negation flag 233 is set. Then, immediately after the setting of the negation flag 233, the measurement of the negation period is started and the interrupt signal is asserted in the monitoring period 231. The assertion period also indicates negation within the monitoring period 231. Thereafter, the second negation period of the interrupt signal 161 exceeds 5 milliseconds, that is, the monitoring period 231, and thus 1 is set in the negation period fault flag 242. In the following, the fault detection is notified by the error control unit 150.

[0069] exist Figure 6 , during the setting of the assertion flag 232 and the negation flag 233 (i.e., at the start of monitoring), both the assertion period and the negation period of the interrupt signal are monitored and the interrupt signal is negated. The present embodiment is also applicable to the case where both the assertion period and the negation period of the interrupt signal are monitored during the setting of the assertion flag 232 and the negation flag 233, and the interrupt signal is asserted. In this case, immediately after the assertion flag 232 is set and before the negation flag 233 is set, the control logic circuit 220 of the INTC monitor 131 detects the assertion of the interrupt signal 161, and then starts to measure the first duration with the aid of the timer counter 210. Therefore, even in the case where the assertion flag 232 and the negation flag 233 are set during the operation of the semiconductor device 100, monitoring can be started immediately so that a fault can be detected more quickly.

[0070] If the assertion cycle or negation cycle of the interrupt signal exceeds a predetermined monitoring cycle, it can be determined that a fault has occurred in a series of systems, which include a peripheral IP from which the interrupt signal is output, an interrupt control circuit to which the interrupt signal is output, and a processor. Further, in the present embodiment, a control register 230 and a timer counter 210 are provided for each interrupt signal, so that the correct monitoring cycle is set in view of the characteristics of each interrupt signal. For example, in the case of signal processing for television and video, real-time data needs to be processed at 30fps. For example, in the case of an interrupt signal that is always asserted for each frame, a time equal to at least one frame is set to the monitoring cycle 231 of the control register 230, so that an abnormality is immediately detected in the interrupt control.

[0071] According to this embodiment, an INTC monitor can be provided for each interrupt signal, and a monitoring type and a monitoring cycle can be set for each interrupt signal. Therefore, a fault can be detected based on various errors of a plurality of interrupt signals.

[0072] The present embodiment can also be expressed as follows: the semiconductor device 100 includes a first processor 111, circuit blocks (peripheral IPs 141 and 143), a first interrupt control circuit (INTC 121), and at least one interrupt monitoring circuit (INTC monitor 131 or 132).

[0073] In this configuration, the first processor 111 executes a predetermined interrupt in response to an interrupt request. The circuit blocks output interrupt signals 161 to 163 respectively. The first interrupt control circuit receives multiple interrupt signals from the circuit blocks and outputs an interrupt request 181 to the first processor 111. At least one of the interrupt monitoring circuits corresponds to at least one of the interrupt signals 161 and 163, and includes a setting circuit (control register 230) for setting a monitoring type (assertion flag 232 and negation flag 233) indicating the monitoring state of the corresponding interrupt signal, and a first monitoring cycle and a second monitoring cycle (monitoring cycle 231). If the monitoring type indicates the assertion state of the interrupt signal, the interrupt monitoring circuit monitors the assertion state. If the first duration of the continuous assertion of the interrupt signal exceeds the first monitoring cycle, the interrupt monitoring circuit detects the state as a fault. If the monitoring type indicates the negation state of the interrupt signal, the interrupt monitoring circuit monitors the negation state. If the second duration of the continuous negation of the interrupt signal exceeds the second monitoring cycle, the interrupt monitoring circuit detects the state as a fault. This makes it possible to specifically set the monitoring type and monitoring period for each interrupt signal, so that various errors occurring in response to the interrupt signal can be detected as faults.

[0074] When the monitoring type is set for the setting circuit of the interrupt monitoring circuit, it is expected that the interrupt monitoring circuit starts monitoring the interrupt signal. In addition, whenever a change in the state of the interrupt signal is detected, it is expected that the interrupt monitoring circuit switches the monitoring of the asserted state and the negated state. Therefore, a fault can be detected in the correct monitoring cycle according to the state of the interrupt signal.

[0075] If the interrupt signal is asserted when the monitoring type is set to the asserted state in the setting circuit, the interrupt monitoring circuit is expected to start monitoring the first duration. Further, if the interrupt signal is negated when the monitoring type is set to the negated state in the setting circuit, the interrupt monitoring circuit is expected to start measuring the second duration. This can start monitoring immediately according to the setting of the monitoring type, thereby quickly detecting a fault.

[0076] It is desirable that the semiconductor device further includes a second processor 112, an error control unit 150 that outputs a notification of the detection as an interrupt signal 169, and a second interrupt control circuit (INTC 122) that receives the interrupt signal 169 from the error control unit 150 and outputs a signal as an interrupt request 182 to the processor 112. Therefore, if a fault is detected from the interrupt signal, the fault can be notified by a system that does not have a fault among the systems including the INTC (for notifying the interrupt request) and the processor. This can accurately analyze the cause of the fault.

[0077] The interrupt monitoring circuit also includes: a timer counter 210, which measures the first duration and the second duration based on the operating clock; and a control circuit (control logic circuit 220) that detects the assertion and negation of the interrupt signal. If the assertion is detected, the control circuit is expected to clear the timer counter 210, and then compare the measured value of the timer counter 210 with the first monitoring period as the first duration. If the negation is detected, the control circuit is expected to clear the timer counter 210, and then compare the measured value of the timer counter 210 with the second monitoring period as the second duration. Therefore, the durations of assertion and negation are alternately measured so that the fault is correctly detected.

[0078] In this case, the interrupt signal includes a first interrupt signal 161 and a second interrupt signal 163. Desirably, the semiconductor device further includes a first interrupt monitoring circuit (INTC monitor 131) corresponding to the first interrupt signal 161 and a second interrupt monitoring circuit (INTC monitor 132) corresponding to the second interrupt signal 163. Therefore, a fault can be correctly detected for each of the interrupt signals.

[0079] Furthermore, if a fault is detected by monitoring the first interrupt signal, the first interrupt monitoring circuit outputs a first fault notification signal 171, and if a fault is detected by monitoring the second interrupt signal, the second interrupt monitoring circuit outputs a second fault notification signal 172. Preferably, the semiconductor device further includes an OR circuit 1301 that outputs a logical sum of the first notification signal 171 and the second fault notification signal 172 as a third fault notification signal 170. Therefore, the interrupt signals can be monitored together to detect a fault.

[0080] Furthermore, the semiconductor device includes M interrupt monitoring circuits (M is a positive integer), where M is less than the sum of the interrupt signals. M interrupt monitoring circuits are provided for the corresponding M signals in the interrupt signals. Therefore, faults can be preferentially detected from some of the interrupt signals, thereby achieving flexible monitoring.

[0081] In addition, the circuit block includes M first circuit blocks and a second circuit block having a lower functional safety level than the first circuit block. M interrupt monitoring circuits are provided for corresponding interrupt signals output from the M first circuit blocks. Therefore, only important interrupt signals considering functional safety are monitored, thereby suppressing the circuit size.

[0082] <Second Embodiment>

[0083] The second embodiment is a modification of the first embodiment. In the second embodiment, the control register in the INTC monitor has an area for storing a reset flag. The reset flag is a value set by the user to optionally reset the timer counter value. In the second embodiment, the configuration other than the INTC monitor is the same as that of the first embodiment, so its illustration and description are omitted.

[0084] Figure 7 1 is a block diagram showing the configuration of the INTC monitor 131a according to the second embodiment. Figure 2 Differently, the INTC monitor 131a also includes a reset flag 234 in the control register 230. For example, the processor 111 etc. sets the reset flag 234 of the control register 230 to 1 through the processor IO signal 1110 at a desired time. When 1 is set in the reset flag 234, the INTC monitor 131a clears the measured value of the timer counter 210.

[0085] For example, if multiple interrupts occur simultaneously, but the priority of one of the interrupt signals is lower than the priority of another interrupt signal, a delay longer than the initially set monitoring period is required. In this case, the delay of the interrupt signal is not a fault, but it can be detected as a fault in actual operation. In this case, a reset flag is set for the INTC monitor that monitors the interrupt signal, so that the timer counter 210 is temporarily cleared and the counting is restarted. Therefore, the detection of the fault from the interrupt signal can be maintained.

[0086] <Third Embodiment>

[0087] The third embodiment is a modification of the first embodiment or the second embodiment. In the third embodiment, the monitoring period of the INTC monitor can be set separately for assertion and negation. In the third embodiment, the configuration other than the INTC monitor is the same as that of the first embodiment, so its illustration and description are omitted. The third embodiment can be applied to the second embodiment.

[0088] Figure 8 is a block diagram showing the configuration of the INTC monitor 131b according to the third embodiment. Figure 2 Differently, the INTC monitor 131 b is configured so that the monitoring period 231 in the control register 230 is divided into an assertion monitoring period 2311 and a negation monitoring period 2312. The assertion monitoring period 2311 is an example of a first monitoring period, and the negation monitoring period 2312 is an example of a second monitoring period. The assertion monitoring period 2311 may be the same period as the negation monitoring period 2312, or a period different from the negation monitoring period 2312.

[0089] Fig. 9 1 is a flow chart showing the process of monitoring the assertion cycle and negation cycle of the interrupt signal according to the third embodiment. Fig.10 As shown, the interrupt signal 161 is negated at the beginning. Figure 5 The same processing as in the explanation.

[0090] First, in step S101a, the processor 111 etc. individually sets the assertion monitoring period and negation monitoring period of the interrupt signal 161. Specifically, the processor 111 etc. sets the assertion monitoring period 2311 and negation monitoring period 2312 in the control register 230 of the INTC monitor 131b.

[0091] Then, in step S112, if the control logic circuit 220 does not detect the start of assertion of the interrupt signal 161, the control logic circuit 220 determines whether the timer counter 210 has overflowed compared with the negative monitoring period 2312 (S114a). Specifically, the control logic circuit 220 compares the second duration and the negative monitoring period 2312. If it is determined that the second duration exceeds the negative monitoring period 2312, the control logic circuit 220 detects a fault in the negative period (S115). In step S114a, if it is determined that the timer counter 210 has not overflowed, the process returns to step S111.

[0092] In step S106, if the control logic circuit 220 does not detect the beginning of negation of the interrupt signal 161, the control logic circuit 220 determines whether the timer counter 210 has overflowed compared with the assertion monitoring period 2311 (S108a). Specifically, the control logic circuit 220 compares the first duration and the assertion monitoring period 2311. If it is determined that the first duration exceeds the assertion monitoring period 2311, the control logic circuit 220 detects a failure in the assertion period (S109). In step S108a, if it is determined that the timer counter 210 has not overflowed, the process returns to step S105.

[0093] Fig.10 is a timing diagram showing the assertion period and negation period of the monitoring interrupt signal according to the third embodiment. Fig.10 , 3 milliseconds are set as the assertion monitoring cycle 2311, 7 milliseconds are set as the negation monitoring cycle 2312, the assertion flag 232 is set, and then the negation flag 233 is set. Even in the case where the negation cycle is 6 milliseconds, the negation cycle is shorter than the negation monitoring cycle 2312, so no fault is detected. The assertion cycle is 3 milliseconds, which is longer than the assertion monitoring cycle 2311, and therefore 1 is set in the assertion cycle fault flag 241. Hereinafter, fault detection is notified by the error control unit 150.

[0094] Therefore, the present embodiment can also be expressed as follows: the processor or the like sets the monitoring type and the first monitoring cycle and the second monitoring cycle in the setting circuit. The interrupt monitoring circuit starts to monitor the interrupt signal according to the setting of the monitoring type. If the monitoring type indicates the asserted state of the interrupt signal, the interrupt monitoring circuit monitors the asserted state and compares the first duration of the continuous asserted state with the first monitoring cycle. If the first duration exceeds the first monitoring cycle, the interrupt monitoring circuit detects the state as a fault. If the monitoring type indicates the negative state of the interrupt signal, the interrupt monitoring circuit monitors the negative state. If the second duration of the continuous negative state exceeds the second monitoring cycle, the interrupt monitoring circuit detects the state as a fault. In this way, the monitoring cycle is set respectively for the assertion cycle and the negation cycle of the interrupt signal. This can flexibly set the monitoring cycle according to the type of the interrupt signal, so as to correctly detect the fault.

[0095] <Fourth Embodiment>

[0096] The fourth embodiment is a modification of the first embodiment to the third embodiment. In the first embodiment to the third embodiment, it is assumed that a frequency divider (not shown) is coupled to multiple INTC monitors. Therefore, a common cycle is used for the clock signal. However, some interrupt signals require a long monitoring cycle, while other interrupt signals only require a relatively short monitoring cycle. Therefore, the common cycle may constrain the monitoring cycle. In the fourth embodiment, the cycle of the clock signal varies between the INTC monitors.

[0097] Specifically, the semiconductor device according to the fourth embodiment includes at least two interrupt monitoring circuits provided for at least two interrupt signals in a plurality of interrupt signals, and a plurality of frequency dividers that divide the frequency with different frequency division ratios relative to the operating clock. At least two interrupt monitoring circuits operate the operating clock supplied from at least some of the frequency dividers. This can change the operating clock between the interrupt monitoring circuits, thereby flexibly adjusting the monitoring cycle. It is expected that the semiconductor device according to the fourth embodiment also includes a selection circuit that selects the destination of the operating clock supplied from the frequency divider from at least two interrupt monitoring circuits. Therefore, the monitoring cycle can be finely adjusted by a combination of the monitoring cycle and the frequency division ratio.

[0098] Fig.111 is a block diagram showing a configuration of an INTC monitor and a frequency divider according to a fourth embodiment. In this configuration, three interrupt monitoring circuits are used for INTC monitors 131 to 133. For example, the frequency division ratio is set so that the frequency divider 191 outputs a clock signal at 100 Hz, the frequency divider 192 outputs a clock signal at 1 KHz, and the frequency divider 193 outputs a clock signal at 10 KHz. In this configuration, at least two interrupt monitoring circuits are required. In addition, in this configuration, at least two frequency dividers are required. Further, in this configuration, the frequency division ratio is not limited. The selection logic 190 is an example of a selection circuit that can optionally select a combination of couplings between the frequency dividers 191 to 193 and the INTC monitors 131 to 133 based on a signal SEL regarding a combination of the frequency divider and the INTC monitor. Therefore, for example, the processor 111, etc. selects a combination of the frequency divider and the INTC monitor through the selection logic 190 in response to the signal SEL, thereby coupling the frequency divider and the INTC monitor in any combination. Therefore, by setting the division ratio of the frequency divider, setting the monitoring period of the INTC monitor, and specifying the combination in the selection logic 190, the monitoring period can be adjusted more finely.

[0099] <Fifth Embodiment>

[0100] The fifth embodiment is a modification of the first to fourth embodiments.

[0101] Means for detecting faults to ensure functional safety include, for example, a scan test for selecting defective chips during manufacturing and a power-on self-test (POST) performed at startup after the semiconductor device is assembled into a user system. In particular, POST is always performed before the semiconductor device is actually used. If a large circuit is to be checked in a semiconductor device and the test time is therefore expected to increase, some measures can be taken to shorten the test time. For example, POST can be performed on circuit blocks (hierarchies), which are groups of circuits classified by function. However, POST cannot be performed for signals that cross hierarchies. Disadvantageously, this may reduce the fault detection rate for signals that cross hierarchies.

[0102] Therefore, according to the first embodiment, a fault can be detected on a portion that cannot be detected by POST during operation of the semiconductor device. Specifically, the INTC monitor according to the first embodiment monitors an interrupt signal from the peripheral IP to the INTC. If the peripheral IP and the INTC are provided at different levels, the interrupt signal can be a signal that crosses the level. Therefore, the monitoring of the interrupt signal by the INTC monitor can detect a fault that cannot be detected by POST.

[0103] Furthermore, in view of functional safety, during the operation of the semiconductor device, for each predetermined cycle, it is necessary to check whether the interrupt signal is correctly monitored and set. At this time, the values ​​of the assertion flag and the negation flag of the control register in the INTC monitor are read, and the read values ​​are compared with the predetermined expected values, thereby checking whether the interrupt signal is correctly monitored and set.

[0104] Recent semiconductor devices include, for example, hundreds of interrupt signals. The INTC monitor and control register according to the first embodiment are provided for each interrupt signal, so that reading the values ​​of the assertion flag and the negation flag requires a considerable processing time. However, as described above, it is necessary to read the value of the flag within a predetermined cycle, and it is necessary to check a large number of setting values ​​of the functional safety circuit other than the INTC monitor. Therefore, a short processing time is more desirable.

[0105] Therefore, in the fifth embodiment, the address is defined so as to collectively refer to the values ​​of the assertion flag and the negation flag in the control register provided for each interrupt signal. Specifically, for the assertion flag and the negation flag, continuous reference addresses are allocated between the control registers. For example, reference address 1 is allocated to the assertion flag of the first control register, reference address 2 after reference address 1 is allocated to the negation flag of the first control register, reference address 3 after reference address 2 is allocated to the assertion flag of the second control register, and reference address 4 after reference address 3 is allocated to the negation flag of the second control register. As an access request from the processor to the interrupt monitoring unit, reference address 1 indicates the starting address, and reference address 4 indicates the size. In this case, in response to the access request, the values ​​of reference addresses 1 to 4 are read. In other words, only a single access request enables the assertion flag and the negation flag of the first control register and the second control register to be read. Reference addresses are allocated to handle virtual registers obtained only by assertion flags and negation flags from at least two control registers in the control register, from a processor outside the interrupt monitoring unit, etc. For example, a virtual register can be implemented by allocating a continuous reference address set in a semiconductor device so as to collectively refer to the INTC monitor of the trigger that holds the assertion flag and the negation flag among the triggers that constitute the control register. In this case, the number of virtual registers is less than the number of control registers. Therefore, during the setting of the assertion flag and the negation flag, the processor, etc. respectively make a setting request to the first address for accessing the corresponding control register. When the setting of the assertion flag and the negation flag is confirmed, the processor, etc. makes a reference request to the second address (reference address) for accessing the virtual register. As described above, the number of virtual registers is less than the total number of control registers (the number of interrupt signals to be monitored), thereby shortening the reading time of all values ​​of the assertion flag and the negation flag.

[0106] Fig.12 3 is a block diagram showing the configuration of a semiconductor device 300 according to a fifth embodiment. The semiconductor device 300 includes a level 310, a level 320, a level 330, a level 340, and a level 350. Level 310 is a circuit block (hereinafter referred to as a "circuit level"), which includes a plurality of CPU cores 311 to 31i (i is an integer not less than 2). Level 320 is a circuit level, which includes a plurality of CPU cores 321 to 32j (j is an integer not less than 2). Level 330 is a circuit level, which includes INTCs 121 and 122, an interrupt monitoring unit 360, peripheral IPs 141 and 142, and an error control unit 150. Level 340 is a circuit level, which includes peripheral IPs 143 and 144. Level 350 is a circuit level, which includes peripheral IPs 145 and 146. The number of levels 310 and 320 including CPU cores may be three or more. The number and kind of peripheral IPs included in the levels 330, 340, and 350 are not limited. Furthermore, in addition to the levels 340 and 350, a circuit level including peripheral IPs may be provided.

[0107] In this configuration, interrupt signals 161, 163, and 165 are set as interrupt targets in the INTC 121. In the INTC 122, interrupt signals 162, 164, 166, and 169 are set as interrupt targets.

[0108] The interrupt monitoring unit 360 includes INTC monitors 3000, 3001, ..., and 300n (n is an integer not less than 2), an OR circuit 361, and a register access control circuit 362. The INTC monitor 3000 corresponds to the interrupt signal 161, the INTC monitor 3001 corresponds to the interrupt signal 163, and the INTC monitor 300n corresponds to the interrupt signal 165. The OR circuit 361 outputs the result of the logical sum of the fault notification signals from the INTC monitors 3000 to 300n as the fault notification signal 170.

[0109] In the semiconductor device 300, a first address is defined for accessing a control register provided in the INTC monitors 3000 to 300n. In other words, the first address is an address suitable for accessing each of the control registers. Further, in the semiconductor device 300, a second address is defined for accessing an assertion flag and a negation flag indicating a monitoring type in the control register. The second address is a reference address, which is defined to read an assertion flag and a negation flag at a continuous address, which are stored separately for each of the interrupt signals.

[0110] The register access control circuit 362 controls access for reading or writing at a specified address in response to an access request from, for example, a CPU core in the hierarchy 310 or 320. The register access control circuit 362 can be implemented by, for example, a decoder that converts the accessed address into a physical address. For example, the CPU core specifies a first address for the register access control circuit 362, and transmits a write request for setting the value of the assertion flag and the negation flag. In this case, the register access control circuit 362 sets the value specified by the write request in the storage area of ​​the assertion flag and the negation flag of the control register specified by the first address. In addition, the CPU core specifies a second address and a read size for the register access control circuit 362, and transmits a read request for the assertion flag and the negation flag. In this case, the register access control circuit 362 reads data of the address at the read size at most from the assertion flag of the control register specified by the second address. At this time, at the second address, continuous addresses are allocated to the storage area of ​​the assertion flag and the negation flag among the control registers, so that only the assertion flag and the negation flag are read in response to the read request.

[0111] Fig.13 An example of a control register according to the fifth embodiment is shown. In this configuration, 320 interrupt signals are to be monitored, the assertion flag is set with 1 bit, the negation flag is set with 1 bit, and 32 bits of the register can be read at a time from the processor 111, etc. Therefore, 320 INTC monitors 3000 to 3319 are provided, and 320 control registers 0_4000 to 319_4319 are provided. In each of the control registers, the assertion flag and the negation flag are each set with 1 bit. The storage location and storage size of the assertion flag, the negation flag, the assertion monitoring period, and the negation monitoring period are not limited to Fig.13 .

[0112] Fig.13 The concept of registers recognized from the processor 111 and the like in the access at the first address is shown. Specifically, for example, consecutive first addresses are assigned to a 32-bit flip-flop of a negative monitoring cycle from the assertion flag 0 to the control register 0_4000. Thereafter, consecutive first addresses are also assigned to a 32-bit flip-flop of a negative monitoring cycle from the assertion flag 1 to the control register 1_4001, and a negative monitoring cycle from the assertion flag 319 to the control register 319_4319. Continuous addresses are not required between control registers.

[0113] Therefore, in order to specify the first address from the processor 111 so as to read the assertion flag and the negation flag in each of the control registers, 320 reads need to be performed. Therefore, in order to confirm the monitoring setting of the interrupt signal, 320 reads need to be performed. In the present embodiment, as discussed below, the reading is performed on the virtual register.

[0114] Fig.14 An example of the virtual register 363 according to the fifth embodiment is shown. Fig.14 1 shows the concept of registers recognized from the processor 111 or the like in access at the second address. Figure 4 In the example of, virtual register 363 can be expressed by 20 control flag confirmation registers 0_36200 to 19_36219. In control flag confirmation register 0_36200, a reference to the trigger of assertion flag 0 and negation flag 0 of control register 0_4000 is set. Similarly, a reference to the trigger is set for assertion flag 1 and negation flag 1 of control register 1_4001, ..., and assertion flag 15 and negation flag 15 of control register 15_4015. In other words, it can be assumed that control flag confirmation register 0_36200 jointly maintains the setting value of assertion flag and negation flag among control registers 0_4000 to 15_4015. Therefore, for example, access to control flag confirmation register 0_36200 is access to assertion flag and negation flag among control registers 0_4000 to 15_4015. Furthermore, for example, consecutive second addresses are assigned to the 32-bit flip-flops from the assertion flag 0 to the negation flag 15 of the control flag confirmation register 0_36200. Thereafter, consecutive second addresses are also assigned to the 32-bit flip-flops from the assertion flag 16 to the negation flag 31 of the control flag confirmation register 1_36201 and from the assertion flag 304 to the negation flag 319 of the control flag confirmation register 19_36219. Continuous addresses are not required between control registers.

[0115] Therefore, the slave processor 111 specifies the second address to read the asserted flag and the negated flag in each of the control flag confirmation registers, thereby suppressing the number of reads to 20. Therefore, the reading of the control flag confirmation registers can be performed in a shorter time than the reading of the control registers.

[0116] According to the above description, the present embodiment can also be expressed as follows: the semiconductor device includes at least two interrupt monitoring circuits, which are provided for at least two interrupt signals in the interrupt signal. For the semiconductor device, the reference address is used to collectively refer to the monitoring type set for the corresponding setting circuit provided in the at least two interrupt monitoring circuits. In addition, the semiconductor device also includes an access control circuit (register access control circuit 362), which reads the monitoring type from the setting circuit in response to an access request for the reference address, and collectively sends the read monitoring type to the source of the access request. Therefore, without separately referring to the control register provided for the corresponding interrupt signal, access is made using a reference address that can collectively access the flag through the access control circuit, thereby shortening the confirmation time of the monitoring setting.

[0117] Another aspect of the present embodiment is discussed below. First, a method for detecting a fault will be discussed for a semiconductor device 300 including circuit levels 310 to 350, each of which has a plurality of circuits. The circuit includes a processor (CPU cores 311 to 31i and 321 to 32i), a circuit block (peripheral IPs 141 to 146), an interrupt control circuit (INTC 121), and at least one interrupt monitoring circuit (INTC monitor 3000). In this configuration, the processor executes a predetermined interrupt in response to an interrupt request. The circuit blocks output interrupt signals 161 to 166, respectively. The interrupt control circuit receives a plurality of interrupt signals from the circuit blocks and outputs an interrupt request 181 to one of the processors. An interrupt monitoring circuit is provided for corresponding interrupt signals 161, 163, and 165, and each interrupt monitoring circuit includes a setting circuit for setting a monitoring type and a first monitoring cycle and a second monitoring cycle, the monitoring type indicating a monitoring state of the corresponding interrupt signal. With this configuration, when the semiconductor device 300 is started, a predetermined operation check test is performed on each circuit level in the circuit hierarchy. In the absence of an abnormality in the operation check test, the semiconductor device is activated normally. In normal operation, the interrupt signal from the second circuit level to the first circuit level is monitored by some interrupt monitoring circuits in the interrupt monitoring circuit. In this configuration, the first circuit level includes an interrupt control circuit and an interrupt monitoring circuit. The second circuit level is a circuit level other than the first circuit level. If the monitoring type indicates the asserted state of the interrupt signal in the interrupt monitoring circuit, and the first duration of the continuous asserted state exceeds the first monitoring cycle, the interrupt monitoring circuit detects the state as a fault. If the monitoring type indicates the negative state of the interrupt signal, and the second duration of the continuous negative state exceeds the second monitoring cycle, the interrupt monitoring circuit detects the state as a fault. Signals across levels are monitored to detect faults that cannot be detected in the operation check test performed when starting in the same level, thereby improving the fault detection rate.

[0118] During normal operation, some of the processors can read the monitoring type from the setting circuit of the interrupt monitoring circuit and compare the monitoring type with a predetermined expected value. Therefore, during the operation of the semiconductor device, it is possible to periodically and quickly check whether the interrupt signal is correctly monitored. In addition, the INTC monitor provided for functional safety can safely perform the correct monitoring function.

[0119] The first circuit level also includes at least two interrupt monitoring circuits, which are provided for at least two of the interrupt signals, respectively. For the semiconductor device 300, the reference address is used to collectively reference the monitoring type set for the corresponding setting circuits provided in the at least two interrupt monitoring circuits. During normal operation of the semiconductor device 300, it is expected that the monitoring type is read from the setting circuit in response to an access request for the reference address from the first processor of the processors, and the read monitoring type is collectively sent to the first processor. Therefore, without individually referring to the control register provided for each interrupt signal, access is made using a reference address that can collectively access the flag by accessing the control circuit, thereby shortening the confirmation time of the monitoring setting.

[0120] <Sixth Embodiment>

[0121] The sixth embodiment is a modification of the first to fifth embodiments. Specifically, the application of the semiconductor device to a video processing apparatus will be discussed below. Fig.15 4 is a block diagram showing a configuration of a video processing device 420 according to a sixth embodiment. The video processing device 420 receives an input of video data from a camera module 410 and outputs display data to a display device 430. The camera module 410 inputs captured video data as an image to the video processing device 420. Specifically, when the power is turned on, the camera module 410 starts to input image data 441. Whenever image data of one frame is input, the camera module 410 outputs an interrupt signal 442 to the video processing device 420.

[0122] The video processing device 420 includes an image input unit 421, an INTC monitor 422, an INTC 423, a CPU 424, a RAM 425, a digital signal processor (DSP) 426, an image output unit 427, and a bus 428. The RAM 425 is a storage device for storing image data. The image input unit 421 receives image data 441 input from the camera module 410 and stores the image data in the RAM 425 through the bus 428. When the start of the video input (one frame of image data input) from the camera module 410 is detected, the image input unit 421 outputs an interrupt signal 443 indicating the start of the video input to the CPU 424 to the INTC monitor 422 and the INTC 423. In response to the interrupt signal 443 indicating the start of the video input, the INTC 423 outputs an interrupt request 444 indicating the start of the video input to the CPU 424. In response to the interrupt request 444 indicating the start of the video input, the CPU 424 sets the monitoring type on the INTC monitor 422 through the processor IO signal 1110. The monitoring type can be set by the image input unit 421. The monitoring type is not always set at the input of the image data of one frame. When the camera module 410 is powered on, the monitoring type can be set. The image input unit 421 can be a peripheral IP. Specifically, when the interrupt signal 442 from the camera module 410 is detected, the image input unit 421 outputs an interrupt signal 443 to the INTC monitor 422 and the INTC 423.

[0123] INTC 423 outputs an interrupt request 444 to CPU 424 in response to interrupt signal 443. In response to interrupt request 444, CPU 424 performs operation according to a predetermined program. Specifically, CPU 424 reads image data of one frame from RAM 425 through bus 428, and notifies DSP 426 of the data. For example, DSP 426 compresses the notified image data according to a predetermined algorithm. The compressed data can be stored in RAM 425. Image output unit 427 outputs the compressed data as display data to display device 430, and displays the data on the screen.

[0124] In the INTC monitor 422, a period is set as a monitoring period (negation monitoring period 2312) according to processing of one frame of a video image. The INTC monitor 422 monitors the interrupt signal 443. If the negation period exceeds the negation monitoring period 2312, the INTC monitor 422 detects the state as a fault and outputs a fault notification signal 445. In this case, even after a processing time equal to one frame has passed, the interrupt signal 443 is not asserted, and thus a fault may exist in, for example, the camera module 410.

[0125] Furthermore, when the assertion period exceeds the predetermined assertion monitoring period 2311, the INTC monitor 422 detects the state as a fault and outputs a fault notification signal 445. In this case, after the interrupt signal 443 is asserted once, some processing of image data of one frame is not completed, and the interrupt signal 443 is not negated. Therefore, the fault may exist in, for example, the INTC 423 or the CPU 424.

[0126] Therefore, in the setting circuit according to the sixth embodiment, the monitoring type is set at the beginning of the video input from the camera module, and the cycle is set as the monitoring cycle according to the processing of one frame of the video image. Therefore, a fault can be correctly detected in the image processing.

[0127] More specifically, the interrupt monitoring circuit corresponds to an interrupt signal output for each frame of an image captured from the camera module through one of the circuit blocks, a monitoring type is set in a setting circuit provided in the interrupt monitoring circuit at the start of a video input from the camera module, and a monitoring period set in the setting circuit is a period corresponding to processing of one frame of the captured image.

[0128] <Seventh Embodiment>

[0129] The seventh embodiment is a modification of the first to fifth embodiments. Specifically, the semiconductor device is applied to a terminal in a communication system in which frames are transmitted and received between terminals through a transmission path. In the following example, the communication system is applied to a time-triggered system in which frame data is transmitted and received between electronic controllers according to a predetermined schedule, which are controllers for onboard equipment or production lines.

[0130] Fig.16 7 is a block diagram showing the configuration of a time trigger system 7000 according to a seventh embodiment. The time trigger system 7000 includes a plurality of electronic controllers 710, 720, and 730 coupled to a network bus 700. The electronic controller 710 includes a timer schedule 711 and a local timer 712, and has a function of transmitting and receiving frame data (not shown). The electronic controllers 720 and 730 have the same configuration and function.

[0131] In the timer schedules 711, 721, and 731, the timing for transmitting and receiving frame data between the electronic controllers 710 to 730 is defined using a common time axis. The electronic controllers 710 to 730 each determine the processing timing defined in the schedule according to a local timer, and transmit and receive frame data. For example, the electronic controller 710 determines the transmission time of the frame data arriving at the electronic controller 710 according to the local timer 712, which is defined in the timer schedule 711. The electronic controller 710 transmits the frame data at the transmission time. Therefore, the local timers 712, 722, and 732 need to be synchronized with each other. The local timers can be synchronized with each other according to the prior art.

[0132] Fig.17 7 is a block diagram showing the configuration of the electronic controller 710 provided in the time trigger system 7000 according to the seventh embodiment. The configurations of the electronic controllers 720 and 730 are the same as that of the electronic controller 710, and thus illustration and description thereof are omitted.

[0133] The electronic controller 710 includes a communication controller 740, an INTC monitor 750, an INTC 760, a CPU 770, and a RAM 780. The communication controller 740 is an example of a peripheral IP. The communication controller 740 includes a timer schedule 711, a local timer 712, a control unit 713, and a buffer 714. In the timer schedule 711, the timing of transmitting and receiving frame data in at least the electronic controller 710 is defined using a time axis shared with the timer schedules 712 and 731. The local timer 712 is synchronized with the local timers 722 and 732. The control unit 713 controls the processing of the communication controller 740. For example, the control unit 713 performs time synchronization of the local timer 712, and transmits and receives data. In response to the time synchronization of the local timer 712, the control unit 713 sets a monitoring type for the INTC monitor 750. The monitoring type can be set by the CPU 770. In addition, the control unit 713 sets a time corresponding to a time interval of transmission and reception of the electronic controller 710 as a monitoring period in the INTC monitor 750. The time interval is defined in the timer schedule 711. For example, if the transmission and reception of the electronic controller 710 are defined at the same time interval in the timer schedule 711, the monitoring period is fixed. If the transmission and reception of the electronic controller 710 are defined at different intervals in the timer schedule 711, the monitoring period of the INTC monitor 750 is updated each time. The control unit 713 determines whether the time indicated by the local timer 712 has reached the time defined in the timer schedule 711. If the time of the local timer 712 has reached the time defined in the timer schedule 711, the control unit 713 outputs an interrupt signal 791 to the INTC monitor 750 and the INTC 760. The buffer 714 is a storage area that holds data received from the electronic controllers 720 and 730 through the network buses 700 and 730 and holds data to be transmitted to the electronic controller 720.

[0134] INTC 760 outputs an interrupt request 792 to CPU 770 in response to interrupt signal 791. In response to interrupt request 792, CPU 770 performs operations according to a predetermined program. CPU 770 reads data received in buffer 714 and stores the data in RAM 780. In addition, CPU 770 reads transmission data from RAM 780 and stores the data in buffer 714. Additionally, CPU 770 performs processing on the transmitted and received data.

[0135] In the INTC monitor 750, a period is set as a monitoring period (a negation monitoring period 2312) according to the timing of generating the interrupt signal 791 output based on the local timer 712. The INTC monitor 750 monitors the interrupt signal 791. If the negation period exceeds the negation monitoring period 2312, the INTC monitor 750 detects the state as a fault and outputs a fault notification signal 793. In this case, if the local timer 712 is normal, the interrupt signal 791 is always asserted in the predetermined monitoring period. Therefore, if the interrupt signal 791 is not asserted in the negation monitoring period 2312 and the negation period exceeds the negation monitoring period 2312, a fault may exist in, for example, the local timer 712.

[0136] Furthermore, when the assertion cycle exceeds the predetermined assertion monitoring cycle 2311, the INTC monitor 750 detects the state as a fault and outputs a fault notification signal 793. In this case, if the INTC 760 and the CPU 770 are normal, the interrupt signal 791 is always negated within the predetermined assertion monitoring cycle 2311. Therefore, if the interrupt signal 791 is not asserted in the negated monitoring cycle 2311 and the assertion cycle exceeds the assertion monitoring cycle 2311, a fault may exist in, for example, the INTC 760 or the CPU 770, a wire may be cut between the INTC 760 and the CPU 770, or a fault on the time trigger system 7000 may be caused by delayed processing of the CPU 770.

[0137] Therefore, in the setting circuit according to the seventh embodiment, the detection type is set when the timer provided in one of the circuit blocks is synchronized with the external device in time, and the cycle is set as the monitoring cycle according to the timing of generating the interrupt signal output based on the timer. Therefore, the fault can be correctly detected in the time trigger system.

[0138] More specifically, the interrupt monitoring circuit corresponds to an interrupt signal output according to a predetermined schedule of a timer provided in one of the circuit blocks, and when the timer is synchronized in time with an external device, a monitoring type is set in a setting circuit provided in the interrupt monitoring circuit, and a monitoring period set in the setting circuit is a period corresponding to a timing of generating an interrupt signal within the predetermined schedule.

[0139] <Eighth Embodiment>

[0140] The eighth embodiment is a modification of the first to fifth embodiments. Specifically, the application of the semiconductor device to a voice data processing unit will be discussed below. Fig.188 is a block diagram showing a configuration of a speech processing unit 800 according to the eighth embodiment. The speech processing unit 800 includes a speech data sampling module 810, an INTC monitor 820, an INTC 830, and a CPU 840.

[0141] The voice data sampling module 810 usually samples the voice data at 8KHz (125μs intervals). The voice data sampling module 810 performs various signal processing using a voice frame of 160 samples (20 milliseconds). Therefore, the voice data sampling module 810 outputs an interrupt signal 851 to the INTC monitor 820 and the INTC 830 using the sampling period of the voice data (i.e., at 125μs intervals). The voice data sampling module 810 is an example of a peripheral IP. In addition, when the input of the voice data starts, the voice data sampling module 810 sets the monitoring type on the INTC monitor 820. The monitoring type can be set by the CPU 840.

[0142] The INTC 830 outputs an interrupt request 852 to the CPU 840 in response to the interrupt signal 851. The CPU 840 performs a software process 853 on the voice data sampling module 810 in response to the interrupt request 852.

[0143] In the INTC monitor 820, the period is set as the monitoring period (negative monitoring period 2312) according to the processing of one frame of voice data. The INTC monitor 820 monitors the interrupt signal 851. If the negative period exceeds the negative monitoring period 2312, the INTC monitor 820 detects the state as a fault and outputs a fault notification signal 854. If the voice data sampling module 810 operates normally, the interrupt signal 851 is always asserted at intervals of 125 μs. Therefore, if the interrupt signal 851 is not asserted in the negative monitoring period 2312 and the negative period exceeds the negative monitoring period 2312, the fault may exist in, for example, the voice data sampling module 810.

[0144] Furthermore, when the assertion cycle exceeds the predetermined assertion monitoring cycle 2311, the INTC monitor 820 detects the state as a fault and outputs a fault notification signal 854. This is because, as long as the INT 830 and the CPU 840 operate normally, the software process 853 from the CPU 840 is executed and the interrupt signal 851 is negated in the assertion monitoring cycle 2311. Therefore, in this case, the fault may exist in, for example, the INTC 830 or the CPU 840.

[0145] Therefore, in the setting circuit according to the eighth embodiment, the monitoring type is set at the beginning of the input from the voice data sampling module, and the cycle is set as the monitoring cycle according to the processing of one frame of voice data. Therefore, a fault can be correctly detected in the side tone processing, etc.

[0146] In other words, the interrupt monitoring circuit corresponds to the interrupt signal output from the voice data sampling module in the circuit block; when voice data is input from the sampling module, the monitoring type is set in the setting circuit provided in the interrupt monitoring circuit; and the monitoring period set in the setting circuit is a period corresponding to the processing of one frame of voice data.

[0147] <Ninth Embodiment>

[0148] The ninth embodiment is a modification of the first embodiment. Fig.19 1 is a block diagram showing a configuration of a semiconductor device 100a according to a ninth embodiment. The semiconductor device 100a includes a processor 111, an INTC 121, an interrupt monitoring unit 130a, and peripheral IPs 141 and 142. In this configuration, the interrupt monitoring unit 130a includes an INTC monitor 131. The INTC monitor 131 monitors the state of an interrupt signal 161. If an abnormality is detected, the INTC monitor 131 outputs a fault notification signal 171 to an external terminal 152. With this configuration, a fault can be detected by, for example, an external monitor of the semiconductor device 100a. Other configurations are similar to those of the first embodiment.

[0149] Specifically, according to this embodiment, an INTC monitor may be provided for at least one interrupt signal, and a monitoring type and a monitoring cycle may be set for the interrupt signal. Therefore, a fault may be detected based on various errors occurring in relation to the interrupt signal.

[0150] The invention made by the present inventors has been specifically described based on the foregoing embodiments. Obviously, the present invention is not limited to these embodiments, and various changes can be made within the scope of the present invention.

Claims

1. A semiconductor device, comprising: a first processor, executing a predetermined interrupt in response to a first interrupt request; A plurality of circuit blocks, each circuit block outputting an interrupt signal; a first interrupt control circuit, receiving the interrupt signal from the circuit block and outputting the first interrupt request to the first processor; as well as at least one interrupt monitoring circuit, corresponding to at least one of the interrupt signals, and comprising a setting circuit, the setting circuit being used to set a monitoring type and a first monitoring period and a second monitoring period, the monitoring type indicating whether to monitor only the asserted state of the corresponding interrupt signal, only the negative state of the corresponding interrupt signal, or both the asserted state and the negative state of the corresponding interrupt signal, wherein if the set monitoring type indicates that at least the asserted state of the interrupt signal is to be monitored, the interrupt monitoring circuit monitors the asserted state, and if a first duration of a continuous asserted state exceeds a first monitoring period, the interrupt monitoring circuit detects the state as a fault, and If the set monitoring type indicates that at least the negative state of the interrupt signal is to be monitored, the interrupt monitoring circuit monitors the negative state, and if a second duration of continuous negative states exceeds a second monitoring period, the interrupt monitoring circuit detects the state as a fault.

2. The semiconductor device according to claim 1, wherein when the setting circuit for the interrupt monitoring circuit sets the monitoring type, the interrupt monitoring circuit starts to monitor the interrupt signal, and Wherein each time a change in the state of the interrupt signal is detected, the interrupt monitoring circuit switches monitoring of the asserted state and the negated state.

3. The semiconductor device according to claim 2, wherein when the monitoring type is set to the asserted state in the setting circuit, if the interrupt signal is asserted, the interrupt monitoring circuit starts monitoring the first duration, and Wherein when the monitoring type is set to the negated state in the setting circuit, if the interrupt signal is negated, the interrupt monitoring circuit starts measuring the second duration.

4. The semiconductor device according to claim 2, wherein in the setting circuit, the monitoring type is set at the beginning of the video input from the camera module, and the cycle is set to the first monitoring cycle and the second monitoring cycle according to the processing of one frame of the video image.

5. A semiconductor device according to claim 2, wherein in the setting circuit, the monitoring type is set when a timer provided in one of the circuit blocks is synchronized in time with an external device, and the cycle is set to the first monitoring cycle and the second monitoring cycle according to the timing of generating the interrupt signal output based on the timer.

6. The semiconductor device according to claim 2, wherein in the setting circuit, the monitoring type is set at the beginning of the input from the sampling module of the voice data, and the period is set to the first monitoring period and the second monitoring period according to the processing of one frame of the voice data.

7. The semiconductor device according to claim 1, further comprising: a second processor, the second processor executing a predetermined interrupt in response to a second interrupt request; an error control unit that receives a notification of a fault detection and outputs said notification of the detection as an interrupt signal; as well as The second interrupt control circuit receives the interrupt signal from the error control unit and outputs the second interrupt request to the second processor.

8. The semiconductor device according to claim 1, The interrupt monitoring circuit further comprises: a timer counter to measure the first duration and the second duration based on an operating clock; as well as a control circuit that detects assertion and negation of the interrupt signal, wherein if the assertion is detected, the control circuit clears the timer counter and then compares the measured value of the timer counter with the first monitoring period as the first duration, and Wherein if the negation is detected, the control circuit clears the timer counter and then compares the measured value of the timer counter as the second duration with the second monitoring period.

9. The semiconductor device according to claim 1, The interrupt signal includes a first interrupt signal and a second interrupt signal, and The semiconductor device comprises: a first interrupt monitoring circuit, corresponding to the first interrupt signal; as well as The second interrupt monitoring circuit corresponds to the second interrupt signal.

10. The semiconductor device according to claim 9, wherein if the fault is detected by monitoring the first interrupt signal, the first interrupt monitoring circuit outputs a first fault notification signal, wherein if the fault is detected by monitoring the second interrupt signal, the second interrupt monitoring circuit outputs a second fault notification signal, and The semiconductor device further includes an OR circuit that outputs a logical sum of the first failure notification signal and the second failure notification signal as a third failure notification signal.

11. The semiconductor device according to claim 1, The semiconductor device comprises at least two interrupt monitoring circuits, wherein the at least two interrupt monitoring circuits are provided for at least two interrupt signals among the interrupt signals, respectively. wherein in the semiconductor device, a reference address is set to commonly refer to the monitoring types set in the setting circuits respectively provided in the at least two interrupt monitoring circuits, and The semiconductor device further includes an access control circuit that reads the monitoring type from the setting circuit in response to an access request for the reference address and commonly sends the read monitoring type to a source of the access request.

12. The semiconductor device according to claim 1, wherein the semiconductor device comprises M interrupt monitoring circuits, wherein M is an integer less than the total number of the interrupt signals, and The M interrupt monitoring circuits are provided for corresponding M of the interrupt signals.

13. The semiconductor device according to claim 12, wherein the circuit blocks include M first circuit blocks and second circuit blocks having a lower functional safety level than the first circuit blocks; and The M interrupt monitoring circuits are provided for corresponding interrupt signals output from the M first circuit blocks.

14. The semiconductor device according to claim 1, further comprising: at least two interrupt monitoring circuits, provided for at least two of the interrupt signals respectively; as well as Multiple frequency dividers divide the frequency at different division ratios relative to the operating clock. wherein the at least two interrupt monitoring circuits are activated by the operation clock supplied from at least some of the frequency dividers. 15 . The semiconductor device according to claim 14 , further comprising a selection circuit that selects a destination of the operation clock supplied from the frequency divider from among the at least two interruption monitoring circuits.

16. A method for detecting a fault of a semiconductor device, the semiconductor device comprising: A first processor executes a predetermined interrupt in response to an interrupt request; A plurality of circuit blocks, each circuit block outputting an interrupt signal; a first interrupt control circuit, receiving the interrupt signal from the circuit block and outputting the interrupt request to the first processor; and at least one interrupt monitoring circuit, corresponding to at least one of the interrupt signals and comprising a setting circuit, the setting circuit being used to set a monitoring type, and a first monitoring period and a second monitoring period, the monitoring type indicating whether to monitor only the asserted state of the corresponding interrupt signal, only the negative state of the corresponding interrupt signal, or both the asserted state and the negative state of the corresponding interrupt signal, the method comprising: Under the control of the interrupt monitoring circuit, Setting the monitoring type, the first monitoring period and the second monitoring period in the setting circuit; According to the setting of the monitoring type, start monitoring the interrupt signal; If the set monitoring type indicates that at least the asserted state of the interrupt signal is to be monitored, monitoring the asserted state; comparing a first duration of the continuously asserted state to a first monitoring period to detect a fault if the first duration exceeds the first monitoring period; If the set monitoring type indicates that at least the negated state of the interrupt signal is to be monitored, monitoring the negated state; and A fault is detected if a second duration of the continuous negative state exceeds a second monitoring period.

17. A fault detection method for a semiconductor device, the semiconductor device having a first circuit level and a second circuit level, the first circuit level comprising: A plurality of processors execute predetermined interrupts in response to the interrupt request; A plurality of circuit blocks, each circuit block outputting an interrupt signal; an interrupt control circuit that receives the interrupt signal from the circuit block and outputs the interrupt request to one of the processors; and at least one interrupt monitoring circuit, corresponding to at least one of the interrupt signals and comprising a setting circuit, the setting circuit being used to set a monitoring type, and a first monitoring period and a second monitoring period, the monitoring type indicating whether to monitor only the asserted state of the corresponding interrupt signal, only the negative state of the corresponding interrupt signal, or both the asserted state and the negative state of the corresponding interrupt signal, the method comprising: performing a predetermined operation check test on each of the first circuit level and the second circuit level when the semiconductor device is started; in the case where there is no abnormality in the operation check test, normally activating the semiconductor device; In normal operation, the interrupt signal from the second circuit level to the first circuit level is monitored by the interrupt monitoring circuit; Under the control of the interrupt monitoring circuit, If the set monitoring type indicates that at least the asserted state of the interrupt signal is to be monitored, and a first duration of a continuous asserted state exceeds the first monitoring period, detecting the state as a fault; and If the set monitoring type indicates that at least the negative state of the interrupt signal is to be monitored, and a second duration of consecutive negative states exceeds the second monitoring period, the state is detected as a fault.

18. The semiconductor device failure detection method according to claim 17, further comprising: In the normal operation, the monitoring type is read from the setting circuit provided in the interrupt monitoring circuit by some of the processors to compare the monitoring type with a predetermined expected value.

19. The semiconductor device failure detection method according to claim 17, wherein the first circuit level comprises at least two interrupt monitoring circuits, the at least two interrupt monitoring circuits being provided for at least two of the interrupt signals respectively, and The method further comprises: setting a reference address in the semiconductor device, the reference address being set to commonly refer to the monitoring types set in the setting circuits respectively provided in the at least two interrupt monitoring circuits; as well as In the normal operation, in response to an access request for the reference address from a first processor among the processors, the monitoring type is read from the setting circuit to collectively send the read monitoring type to the first processor.

20. A semiconductor device comprising: A first processor performs an interrupt operation in response to an interrupt request; A plurality of circuit blocks, each circuit block outputting an interrupt signal; a first interrupt control circuit, receiving the interrupt signal from the circuit block and sending the interrupt request to the first processor; as well as a first interrupt monitoring circuit, receiving an associated one of the interrupt signals, wherein when the assertion period of the associated interrupt signal among the interrupt signals exceeds a first monitoring period, the first interrupt monitoring circuit detects a first fault, wherein the first interrupt monitoring circuit detects a second fault when a negation period of the associated interrupt signal in the interrupt signals exceeds a second monitoring period, When at least one of the first fault and the second fault is detected, the first interrupt monitoring circuit outputs a fault notification signal.

21. The semiconductor device according to claim 20, Wherein the first interrupt monitoring circuit comprises a setting circuit, wherein the setting circuit includes monitoring type information indicating whether to monitor only the assertion period of the associated interrupt signal among the interrupt signals, whether to monitor only the negation period of the associated interrupt signal among the interrupt signals, or to monitor both the assertion period and the negation period, The first interrupt monitoring circuit starts monitoring the assertion period and the negation period of the associated interrupt signal in the interrupt signals in response to the monitoring type information to detect the first fault and the second fault.

22. The semiconductor device according to claim 20, wherein the fault notification signal includes information for specifying which of the first fault and the second fault has been detected.

23. The semiconductor device according to claim 21, The first processor sets the monitoring type information.

24. A method for detecting a fault of a semiconductor device, the semiconductor device comprising: A first processor performs an interrupt operation in response to an interrupt request; A plurality of circuit blocks, each circuit block outputting an interrupt signal; and a first interrupt control circuit, receiving the interrupt signal from the circuit block, and sending the interrupt request to the first processor based on the interrupt signal, the method comprising: measuring an assertion period of a first interrupt signal output from a first circuit block among the plurality of circuit blocks, comparing the measured assertion period of the first interrupt signal with a first monitoring period to detect a first fault, measuring a negation period of the first interrupt signal, comparing the measured negation period of the first interrupt signal with a second monitoring period to detect a second fault, and When at least one of the first fault and the second fault is detected, a fault notification signal is generated.

25. The fault detection method according to claim 24, further comprising: In response to the monitoring type information indicating monitoring of the assertion period, starting to monitor the assertion period of the first interrupt signal, and In response to the monitoring type information indicating monitoring of the negation period, starting monitoring of the negation period of the first interrupt signal, The monitoring type information is set by the first processor.

26. The fault detection method according to claim 24, wherein the fault notification signal includes information for specifying which of the first fault and the second fault has been detected.

27. The fault detection method according to claim 25, The monitoring type information is set by the first processor.

Images