Semiconductor device and system using the same

Abstract

The present disclosure relates to a semiconductor device and a system using the same. The semiconductor device has a timer unit and a processing unit. The timer unit includes a binary counter and a first converter. The first converter converts a first count value output from the binary counter into a Gray code to output as first Gray code data. The processing unit includes a first synchronizer that captures the first Gray code data transmitted from the timer unit in synchronization with a system clock signal and outputs the captured first Gray code data as second Gray code data, and a failure detection unit that generates data for failure detection based on the first Gray code data transmitted from the timer unit, and compares a second count value based on the second Gray code data with a third count value based on the data for failure detection.

Description

TECHNICAL FIELD

[0001] The present application relates to a semiconductor device, and the present application can be appropriately applied to, for example, a semiconductor device having a general-purpose timer. BACKGROUND

[0002] In recent years, semiconductor devices for vehicles are required to enhance functional safety. In a system to which functional safety is applied, for example, when a component that constitutes the system fails, a safe state can be ensured by being designed to detect the failure and reduce the failure influence. A semiconductor device that supports functional safety requires a mechanism to diagnose whether a circuit is operating normally.

[0003] In addition, semiconductor devices for vehicles are becoming more and more complex. For example, a semiconductor device for a vehicle is equipped with a plurality of CPUs (Central Processing Units) to achieve high functionality. Some of the CPUs receive a common timer count value from a general-purpose timer. For example, each CPU executes an interrupt routine based on the timer count value.

[0004] The plurality of CPUs mounted on the semiconductor device for a vehicle operate at high speed and perform asynchronous operations with respect to each other, thereby improving the performance as a semiconductor device. Therefore, the general-purpose timer also operates asynchronously with each CPU, and the count value from the general-purpose timer is transmitted to the CPU asynchronously.

[0005] To achieve the asynchronous transmission from the general-purpose timer to the CPU, the general-purpose timer converts the timer count value from a binary code to a Gray code and outputs the Gray code. The Gray code is a code in which the Hamming distance is 1 when the count value is incremented by 1. By converting the timer count value to the Gray code, the CPU avoids capturing inactive data while the timer count value is changing.

[0006] From the viewpoint of functional safety, the connection between the general-purpose timer and the CPU that performs such asynchronous transmission also requires functional safety. That is, it is required to detect a failure in a path between the general-purpose timer and the CPU.

[0007] Various methods have been proposed to detect errors in data transmitted between devices.

[0008] The disclosed technology is listed below.

[0009] [Patent Literature 1] Japanese Unexamined Patent Application Publication No. 2010-211347

[0010] For example, Patent Literature 1 discloses an error detection technology using an error detection code. The information processing device of Patent Literature 1 generates an error detection code based on data output from a bus slave device such as a timer, and detects an error in the transmitted data based on the transmitted data and the generated error detection code. SUMMARY

[0011] However, if an error detection code is added to data of the timer count value converted into the Gray code for asynchronous transmission, the Hamming distance between adjacent codes increases. Thus, the CPU can capture inactive data while the timer count value is changing. That is, the CPU can fail to capture the correct timer count value. Therefore, it is difficult to apply the technology disclosed in Patent Literature 1 to path failure detection performed by asynchronous transmission from a general-purpose timer to a CPU.

[0012] Other objects and novel features will become apparent from the description and the accompanying drawings.

[0013] According to one embodiment, a semiconductor device has a timer unit and a processing unit. The timer unit includes a binary counter and a first converter. The first converter converts a first count value output from the binary counter into a Gray code to output as first Gray code data. The processing unit includes a first synchronizer and a failure detection unit. The first synchronizer captures the first Gray code data transmitted from the timer unit in synchronization with a system clock signal, and outputs the captured first Gray code data as second Gray code data. The failure detection unit generates data for failure detection based on the first Gray code data transmitted from the timer unit, and compares a second count value based on the second Gray code data with a third count value based on the data for failure detection.

[0014] According to one embodiment, a failure between a general-purpose timer and a processing unit in which asynchronous transmission is performed can be detected. Thus, the reliability of the semiconductor device can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 is a diagram illustrating an exemplary configuration of a semiconductor device according to a first embodiment;

[0016] Figure 2 is a diagram illustrating an example of a configuration of a general-purpose timer and a processing unit according to the first embodiment;

[0017] Figure 3 is a diagram illustrating an exemplary operation of a semiconductor device according to the first embodiment;

[0018] Figure 4 is a diagram illustrating another exemplary operation of a semiconductor device according to the first embodiment;

[0019] Figure 5 is a diagram illustrating a modified example of a configuration of a comparison circuit;

[0020] Figure 6is a diagram showing an exemplary configuration of a semiconductor device according to a second embodiment;

[0021] Figure 7 is a diagram showing an example of a configuration of a general-purpose timer and processing units according to the second embodiment;

[0022] Figure 8 is a diagram showing an exemplary operation of a semiconductor device according to the second embodiment; and

[0023] Figure 9 is a diagram for explaining another exemplary operation of a semiconductor device according to the second embodiment. DETAILED DESCRIPTION

[0024] Hereinafter, a semiconductor device according to one embodiment will be described in detail with reference to the accompanying drawings. In the specification and the drawings, the same or corresponding shapes of elements are denoted by the same reference numerals, and repetitive description thereof will be omitted. In the drawings, calibration can be omitted or simplified for convenience of description. In addition, at least some of the embodiments can be arbitrarily combined with each other.

[0025] First Embodiment

[0026] Figure 1 is a diagram showing an exemplary configuration of a semiconductor device 1 in the present embodiment. As shown in Figure 1 the semiconductor device 1 includes a general-purpose timer 10, processing units 100 to 120, and a fault management unit 130. The general-purpose timer 10, the processing units 100 to 120, and the fault management unit 130 are preferably configured as one semiconductor chip, but each or a part thereof can be different semiconductor chips constituting a semiconductor system.

[0027] The general-purpose timer 10 includes a counter 11. The counter 11 is an up counter. The general-purpose timer 10 asynchronously transmits an output of the counter 11 as a timer count value to the processing units 100 to 120.

[0028] The processing units 100 to 120 operate asynchronously with each other, and each performs data processing. Each of the processing units 100 to 120 receives the timer count value transmitted from the general-purpose timer 10. The processing units 100 to 120 use the received timer count value, for example, as a trace output for debugging function or a time stamp for interrupt processing and the like. In addition, each of the processing units 100 to 120 performs fault detection in a path from the general-purpose timer 10 to each of the processing units.

[0029] The failure management unit 130 receives the failure detection results of the processing units 100 to 120. Therefore, the failure detection results in the respective paths from the general-purpose timer 10 to the respective processing units are collected into the failure management unit to perform appropriate processing, such as interruption, reset, and the like, corresponding to the failure detection results.

[0030] Further, with reference to Figure 2 The general-purpose timer 10 and the processing unit 100 will be described. Figure 2 is a block diagram showing a detailed configuration example of the general-purpose timer 10 and the processing unit 100. Since Figure 1 The configuration example of the processing units 110 and 120 in the general-purpose timer 10 is the same as that of the processing unit 100, and thus the description thereof is omitted.

[0031] The general-purpose timer 10 includes a counter 11 in addition to the counter 11. The counter 11 is a binary counter, and outputs a count value that is counted in increments of binary codes. This count value is a timer count value of the general-purpose timer 10. The converter 12 converts data from binary codes to Gray codes. Therefore, data output from the counter 11 is converted from binary codes to Gray codes. The data converted to Gray codes by the converter 12 is output as Gray code data CNTVALUEG (also referred to as first Gray code data). The general-purpose timer 10 duplicates the Gray code data CNTVALUEG, and transmits them to the processing units 100 as Gray code data CNTVALUEG_m and Gray code data CNTVALUEG_c. The Gray code data CNTVALUEG_c is used for failure detection.

[0032] The processing unit 100 includes a synchronizer 101, a converter 102, a processing execution unit 103, and a failure detection unit 104, and receives the Gray code data CNTVALUEG_m and the Gray code data CNTVALUEG_c from the general-purpose timer 10.

[0033] The synchronizer 101 captures the received signal in synchronization with a system clock signal of the processing unit 100. That is, the synchronizer 101 captures the Gray code data CNTVALUEG_m in synchronization with the system clock signal of the processing unit 100, and outputs Gray code data CNTVALUEGS_m (also referred to as second Gray code data).

[0034] The converter 102 converts data from Gray codes to binary codes. The converter 102 converts the Gray code data CNTVALUEGS_m to binary codes, and outputs binary code data CNTVALUEB_m. Therefore, the timer count value of the Gray codes transmitted from the general-purpose timer 10 is converted to a timer count value of binary codes, and the binary code data CNTVALUEB_m is supplied as the timer count value to the processing execution unit 103.

[0035] The processing execution unit 103 executes processing such as an interrupt in accordance with the timer count value indicated by the binary code data CNTVALUEB_m.

[0036] The failure detection unit 104 includes a synchronizer 105, a converter 106, and a comparator 107.

[0037] The synchronizer 105 receives the Gray code data CNTVALUEG_c. The synchronizer 105 captures the Gray code data CNTVALUEG_c in synchronization with the system clock signal of the processing unit 100, and outputs the Gray code data CNTVALUEGS_c (also referred to as data for failure detection).

[0038] Similar to the converter 102, the converter 106 converts the Gray code data into binary code data. The converter 106 converts the Gray code data CNTVALUEGS_c into binary code data to output as the binary code data CNTVALUEB_c.

[0039] The comparator 107 compares the count value indicated by the binary code data CNTVALUEB_m (also referred to as a second count value) with the count value indicated by the binary code data CNTVALUEB_c (also referred to as a third count value), and outputs a failure detection signal FD in accordance with the comparison result. For example, if the count value indicated by the binary code data CNTVALUEB_m (second count value) coincides with the count value indicated by the binary code data CNTVALUEB_c (third count value), it is determined that no failure has occurred in the path from the general-purpose timer 10 to the processing unit 100.

[0040] Incidentally, the synchronizers 101 and 105 are affected by a delay due to clock wiring of the synchronizers 101 and 105. Therefore, there is a possibility that the timing at which the synchronizer 101 captures the Gray code data CNTVALUEG_m is different from the timing at which the synchronizer 105 captures the Gray code data CNTVALUEG_c. In addition, since the general-purpose timer 10 is asynchronous with the processing unit 100, the count values indicated by the synchronization data CNTVALUEGS_m and CNTVALUEGS_c can not coincide with each other. That is, if only it is determined whether the count value indicated by the binary code data CNTVALUEB_m matches the count value indicated by the binary code data CNTVALUEB_c, there is a possibility that a path failure is falsely determined to have occurred even if there is no path failure.

[0041] Thus, the comparator 107 determines not only whether the count value indicated by the binary code data CNTVALUEB_m matches the count value indicated by the binary code data CNTVALUEB_c, but also whether the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is less than or equal to a predetermined value. Specifically, the comparator 107 determines that there is no fault (no path fault) when the difference is equal to or less than "1", and determines that there is a fault when the difference is greater than "1".

[0042] Next, with reference to Figure 3 and 4 the operation of the asynchronous transfer of the timer count value from the general-purpose timer 10 to the processing unit 100 and the operation of the fault detection unit 104 will be described. Figure 3 and 4 An example is shown in which the timer count value output from the general-purpose timer 10 is incremented from "6" to "7". The predetermined value is set to "1", and the comparator 107 outputs the fault detection signal FD indicating that a fault has occurred when the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is greater than "1".

[0043] Figure 3 is a diagram showing the operation when there is no fault on the path between the processing unit 100 and the general-purpose timer 10. Further, in Figure 3 , a case is shown in which the synchronizer 101 captures data before the synchronizer 105.

[0044] Before time tl, "0101" indicating "6" is output as the Gray code data CNTVALUEG from the general-purpose timer 10. At this time, the Gray code data CNTVALUEG_m and CNTVALUEG_c that are "0101" are transferred to the processing unit 100. The Gray code data CNTVALUEG_m and CNTVALUEG_c are captured by the synchronizers 101 and 105 in synchronization with the system clock signal of the processing unit 100, and are converted to binary codes by the converters 102 and 106. The binary code data CNTVALUEB_m and CNTVALUEB_c converted by the converters 102 and 106 both become "0b0110". Thus, the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c becomes "0", and the comparator 107 outputs the fault detection signal FD of the inactive level indicating that there is no fault.

[0045] When the timer count value output from the general timer 10 is incremented from "6" to "7" at time tl, the Gray code data CNTVALUEG changes from "0101" to "0100". Therefore, the general timer 10 outputs the Gray code data CNTVALUEG_m and the Gray code data CNTVALUEG_c which become "0100".

[0046] At time t2, the synchronizer 101 captures the Gray code data CNTVALUEG_m. The captured Gray code data CNTVALUEG_m is converted into binary code by the converter 102, and "0b0111(7)" is output as the binary code data CNTVALUEB_m. However, at time t2, since the synchronizer 105 has not captured the Gray code data CNTVALUEG_c after the increment, the Gray code data CNTVALUEGS_c remains "0101" and the binary code data CNTVALUEB_c remains "0b0110(6)". Therefore, the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c becomes "1". Since the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is equal to or less than the predetermined value "1", the comparator 107 outputs the fault detection signal FD of the inactive level.

[0047] At time t3, after the timer count value is incremented to "7", the synchronizer 105 captures the Gray code data CNTVALUEG_c. The synchronizer 105 outputs the Gray code data CNTVALUEGS_c which becomes "0100". The Gray code data CNTVALUEGS_c is converted into binary code by the converter 106, and "0b0111(7)" is output as the binary code data CNTVALUEB_c. Therefore, the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c becomes "0", and the comparator 107 outputs the fault detection signal FD of the inactive level.

[0048] As described above, since the timer count values are incremented one by one, even if the timing at which the synchronizer 101 captures the Gray code data CNTVALUEG_m deviates from the timing at which the synchronizer 105 captures the Gray code data CNTVALUEG_c, the difference is always equal to or less than "1". Therefore, even if a delay due to clock wiring causes a deviation between the timing at which the synchronizer 101 captures the Gray code data CNTVALUEG_m and the timing at which the synchronizer 105 captures the Gray code data CNTVALUEG_c, a path fault can be detected correctly.

[0049] Next, reference will be made to Figure 4The operation in the case where a path failure occurs between the processing unit 100 and the general-purpose timer 10 will be described. In Figure 4 In the case where a stuck-at-1 failure occurs at the second bit of data in the path from the general-purpose timer 10 to the synchronizer 101, the operation will be shown.

[0050] Before time tll, it is assumed that the Gray code data CNTVALUEG "0101" indicating the timer count value "6" is output from the general-purpose timer 10. In the path from the general-purpose timer 10 to the synchronizer 101, the Gray code data CNTVALUEGS_m output by the synchronizer 101 becomes "0111" because a stuck-at-1 failure occurs at the second bit of data. The Gray code data CNTVALUEGS_m is converted into binary code, and "0b0101 (5)" is output as binary code data CNTVALUEB_m to the comparator 107. On the other hand, because there is no failure in the path from the general-purpose timer 10 to the synchronizer 105, the synchronizer 105 correctly captures the Gray code data CNTVALUEG_c output from the general-purpose timer 10. That is, the binary code data CNTVALUEB_c becomes "0b0110 (6)". Therefore, the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is "1", that is, less than or equal to the predetermined value. Therefore, the failure detection signal FD indicates the inactive level. That is, at this time, no failure is detected.

[0051] Because the general-purpose timer 10 and the processing unit 100 are asynchronous, the timing at which the timer count value of the general-purpose timer 10 changes is not defined. Therefore, even if the processing execution unit 103 receives the binary code data CNTVALUEB_m captured via the stuck-at-failure path, the operation of the processing execution unit 103 does not become problematic in the case of the stuck-at-failure shown in Figure 4 In the case of the stuck-at-failure shown in FIG. 11, this case is the same as the case where the timer count value is not incremented, and therefore the operation of the processing execution unit 103 does not become problematic.

[0052] Next, at time tll, when the timer count value output from the general-purpose timer 10 is incremented from "6" to "7", the Gray code data CNTVALUEG changes from "0101" to "0100".

[0053] At time t12, the synchronizers 101 and 105 capture the Gray code data CNTVALUEG_m and CNTVALUEG_c, respectively. In the path from the general purpose timer 10 to the synchronizer 101, since the stuck-at-1 fault occurs at the second bit of the data, the synchronizer 101 outputs "0110" as the Gray code data CNTVALUEGS_m. On the other hand, since no fault occurs in the path from the general purpose timer 10 to the synchronizer 105, the synchronizer 105 outputs "0100" as the Gray code data CNTVALUEGS_c. The Gray code data CNTVALUEGS_m and CNTVALUEGS_c are converted into binary codes by the converters 102 and 106, respectively. The converter 102 outputs the binary code "0b0100 (4)" corresponding to the Gray code "0110" as the binary code data CNTVALUEB_m. The converter 106 outputs the binary code "0b0111 (7)" corresponding to the Gray code "0100" as the binary code data CNTVALUEB_c. Thus, the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is "3", i.e., greater than the predetermined value. Therefore, the fault detection signal FD output from the comparator 107 becomes the active level indicating that a fault occurs.

[0054] As described above, the fault detection signal FD is generated when the timer count value indicated by the binary code data CNTVALUEB_m supplied to the processing execution unit 103 changes from "5" to "4". In other words, a fault is detected at the timing at which the timer count value that should be incremented decreases from "5" to "4".

[0055] According to the first embodiment, it is possible to detect a path fault between the general purpose timer 10 and the processing unit 100 by copying the Gray code data CNTVALUEG from the general purpose timer 10 and comparing the Gray code data copied by the processing unit 100 after synchronization. Since the general purpose timer 10 and the processing unit 100 operate asynchronously, even if no fault occurs in the path from the general purpose timer 10 to the processing unit 100, the count values indicated by the Gray code data CNTVALUEGS_m and CNTVALUEGS_c captured by the synchronizers 101 and 105 can deviate by "1". Therefore, when the difference between the count values indicated by the Gray code data CNTVALUEGS_m and CNTVALUEGS_c is greater than "1", the comparator circuit 107 determines that a fault occurs, thereby avoiding a false determination. Thus, it is possible to improve the reliability of the semiconductor device 1.

[0056] Modified example of comparator

[0057] Figure 5is a block diagram showing a modification example of the comparator 107. The comparator 107a, which is a modification example of the comparator 107, includes subtractors 107_1 and 107_3, determination circuits 107_2 and 107_4, and an OR circuit 107_5.

[0058] The subtractors 107_1 and 107_3 subtract the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c. Here, the minuend and the subtrahend of the subtractors 107_1 and 107_3 are interchanged. That is, the subtractor 107_1 subtracts the binary code data CNTVALUEB_c from the binary code data CNTVALUEB_m, and the subtractor 107_3 subtracts the binary code data CNTVALUEB_m from the binary code data CNTVALUEB_c.

[0059] The determination circuits 107_2 and 107_4 respectively receive the difference between the count values of the subtractors 107_1 and 107_3, and respectively determine whether the corresponding difference between the count values is equal to or less than a predetermined value. When the corresponding difference between the count values is greater than the predetermined value, the determination circuits 107_2 and 107_4 respectively output “1” as a determination result.

[0060] The OR circuit 107_5 outputs the failure detection signal FD based on the determination results of the determination circuits 107_2 and 107_4. The OR circuit 107_5 outputs the failure detection signal FD, which is activated when at least one of the determination results of the determination circuits 107_2 and 107_4 indicates “1”.

[0061] As described above, in the present modification example, two subtractors are provided in which the minuend and the subtrahend are interchanged with each other, and a failure is detected from the results of the subtractors. Therefore, even if any one of the synchronizers 101 and 105 first captures data, a failure can be correctly detected. For example, if only one subtractor is used, the difference between the count values can be a negative value. If the difference between the count values indicating the negative value is equal to or less than the predetermined value, a failure can not be detected even if a path failure occurs. However, as in the present modification example, when a subtractor in which the minuend and the subtrahend are interchanged is further provided, the result of one subtraction circuit shows a negative value, and the result of the other subtraction circuit shows a positive value. Therefore, if either one of the differences between the count values as the results of the subtractors is greater than the predetermined value, a failure can be detected. In other words, the comparator 107 according to the present modification example determines whether the absolute value of the difference between the count values indicated by the binary code data CNTVALUEB_m and CNTVALUEB_c is equal to or less than a predetermined value, and outputs the failure detection signal FD based on the determination result. Therefore, the reliability of the semiconductor device 1 can be further improved.

[0062] As Figure 5 shown, the comparator 107a can further include a mode setting circuit 107_6. In this case, the mode setting circuit 107_6 can set a predetermined value to the determination circuits 107_2 and 107_4 according to a mode setting signal MODE supplied from the outside.

[0063] Second Embodiment

[0064] Next, a second embodiment will be described. In the second embodiment, a semiconductor device la according to another form of the semiconductor device 1 according to the first embodiment will be described. Figure 6 is a block diagram showing a configuration example of the semiconductor device la according to the second embodiment, Figure 7 is a block diagram showing a detailed configuration example of the general-purpose timer 10a and the processing units 100a according to the second embodiment. As Figure 6 shown, the semiconductor device la is different from the semiconductor device 1 described in the first embodiment in that the semiconductor device la has the general-purpose timer 10a instead of the general-purpose timer 10 and the processing units 100a to 120a instead of the processing units 100 to 120. Figure 1 In the second embodiment, the failure management unit 130 of the semiconductor device la can be the same as that shown in Figure 1 , and thus the description thereof will be omitted here.

[0065] As Figure 6 shown, the general-purpose timer 10a is different from the general-purpose timer of the first embodiment in that the output of the counter 11 (the output of the general-purpose timer) is not duplicated.

[0066] The processing units 100a to 120a are different from the processing units 100 to 120 described in the first embodiment in that the processing units 100a to 120a receive the counter output which is not duplicated. The configuration and operation of the processing units 100a to 120a will be described later.

[0067] The general-purpose timer 10a and the processing units 100a will be described with reference to Figure 7 Since the processing units 110a and 120a have the same configuration as the processing unit 100a, the description thereof will be omitted.

[0068] As described above, the output of the general-purpose timer 10a is not duplicated. The other configurations and operations are the same as those of the general-purpose timer 10 described in the first embodiment, and thus the description thereof will be omitted. Figure 2

[0069] The processing unit 100a is different from the processing unit 100 described in the first embodiment in that the processing unit 100a receives the counter output which is not duplicated. Figure 2 ​The processing unit 100 described in the first embodiment differs in that the processing unit 100a includes a buffer 201 and a failure detection unit 202 instead of the failure detection unit 104. The other components are the same as those described in the first embodiment Figure 2 The processing unit 100 shown is the same, so the same components are denoted by the same reference numerals, and the description thereof is omitted.

[0070] The buffer 201 receives and holds the binary code data CNTVALUEB in response to the system clock signal. Then, the buffer 201 outputs the held binary code data CNTVALUEB as binary code data CNTVALUEB_n in response to a subsequent system clock signal. That is, the buffer 201 delays the binary code data CNTVALUEB output from the converter 102 by one cycle, and supplies the delayed binary code data to the processing execution unit 103.

[0071] The processing execution unit 103 receives the binary code data CNTVALUEB_n output from the buffer 201, and executes processing such as an interrupt in accordance with the timer count value indicated by the binary code data CNTVALUEB_n.

[0072] The failure detection unit 202 includes a comparator 203. The comparator 203 compares the count value indicated by the binary code data CNTVALUEB_n output from the converter 102 with the count value indicated by the binary code data CNTVALUEB_n output from the buffer 201, and outputs a failure detection signal FD in accordance with the comparison result. That is, the output of the converter 102 is used as data for failure detection. More specifically, the comparator 203 acquires the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB_n, and outputs the failure detection signal FD based on the difference.

[0073] The binary code data CNTVALUEB-n is data of a period before the binary code data CNTVALUEB. The general purpose timer 10a outputs a timer count value that is incremented one by one. Therefore, if there is no failure in the path between the general purpose timer 10a and the processing unit 100a, the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n becomes "0" or "1". Therefore, when the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n is "0" or "1", the comparator 203 outputs the failure detection signal FD of an inactive level, and in other cases, outputs the failure detection signal FD of an active level indicating that there is a failure. In other words, the comparator 203 determines whether the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n falls within the range of "0" to "1", and outputs the failure detection signal FD based on the determination result.

[0074] Reference Signs List Figure 8 and 9 The operation of the asynchronous transmission of the timer count value from the general purpose timer 10a to the processing unit 100a and the operation of the failure detection unit 202 will be described.

[0075] Figure 8 is a diagram for explaining the action when there is no failure in the path between the general purpose timer 10a and the processing unit 100a.

[0076] Before the time t21, the general purpose timer 10a outputs "0111" indicating "5" as the Gray code data CNTVALUEG, and the synchronizer 101 captures the Gray code data CNTVALUEG in response to the system clock signal and outputs the captured Gray code data as the Gray code data CNTVALUEG_m "0111" to the converter 102. The converter 102 converts the Gray code data CNTVALUEG-m into binary code, and outputs "0b0101" as the binary code data CNTVALUEB. In Figure 8 Before the time t21 shown in the figure, the Gray code data CNTVALUEG is held at "0111 (5)", the count value indicated by the binary code data CNTVALUEB-n output from the buffer 201 based on the binary code data of the previous period matches the count value indicated by the binary code data CNTVALUEB output from the converter 102. Therefore, the difference becomes "0", and the failure detection signal FD indicating no failure is output from the comparator circuit 203.

[0077] At time t21, the timer count value output from the general-purpose timer 10a is incremented from "5" to "6", and the Gray code data CNTVALUEG changes from "0111" to "0101".

[0078] At time t22, the synchronizer 101 captures the Gray code data CNTVALUEG and outputs "0101" as the Gray code data CNTVALUEG-m. The converter 102 converts the Gray code data CNTVALUEG-m into binary code and outputs "0b0110 (6)" as the binary code data CNTVALUEB. The buffer 201 outputs "0b0101 (5)" as the binary code data CNTVALUEB_n, which is the binary code data CNTVALUEB of the previous cycle. At time t22, the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n becomes "1". Therefore, the comparator 203 outputs the fault detection signal FD indicating that there is no fault.

[0079] At time t23, the binary code data CNTVALUEB (0b0110 (6)) with one cycle delay after the output from the buffer 201 is incremented is output as the binary code data CNTVALUEB-n. Therefore, at time t23, the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n becomes "0". Therefore, the comparator 203 outputs the fault detection signal FD indicating that there is no fault.

[0080] When the count value output from the general-purpose timer 10a is incremented from "6" to "7", it operates in the same manner as described above.

[0081] As described above, the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n is at most "1". Therefore, the path fault can be appropriately determined based on the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB-n.

[0082] Next, with reference to Figure 9 the operation in the case where there is a path fault between the general-purpose timer 10a and the processing unit 100a will be described. In Figure 9 , the operation when a stuck-at-1 fault occurs at the second bit of data in the path from the general-purpose timer 10a to the processing unit 100a is shown.

[0083] Before time t31, the Gray code data CNTVALUEG (0111) indicating the timer count "5" is output from the general timer 10a. In the path from the general timer 10a to the processing unit 100a, a stuck-at-1 fault occurs at the second bit of the data, and the Gray code data CNTVALUEG-m output by the synchronizer 101 is "0111". Therefore, the count value indicated by the Gray code data CNTVALUEB output from the converter 102 coincides with the count value indicated by the Gray code data CNTVALUEB-n output from the buffer 201, and the difference becomes "0". Therefore, no fault is detected at this time.

[0084] At time t31, the general timer 10a increments the timer count value from "5" to "6", and outputs the Gray code data CNTVALUEG as "0101 (6)". At time t32, the synchronizer 101 captures the Gray code data CNTVALUEG output from the general timer 10a. However, since there is a fault in the path from the general timer 10a to the processing unit 100a, the data CNTVALUEG-m captured by the synchronizer 101 becomes "0111". The converter 102 converts the Gray code data CNTVALUEG-m as "0111" into binary code, and outputs "0b0101 (5)" as the binary code data CNTVALUEB. At time t32, the comparator 203 compares the binary code data CNTVALUEB_n ("0b0101") indicating the count value "5" before the increment count output from the buffer 201, with the binary code data CNTVALUEB ("0b0101 (5)") as the conversion result into binary code. In this case, the difference between the count value indicated by the Gray code data CNTVALUEB and the count value indicated by the Gray code data CNTVALUEB-n becomes "0", and it is determined that there is no fault even at this time point.

[0085] At time t33, although the buffer 201 outputs the binary code data CNTVALUEB_n corresponding to the timer count value after the increment count, the difference between the count value indicated by the Gray code data CNTVALUEB and the count value indicated by the Gray code data CNTVALUEB-n is "0" at this time. Therefore, it is determined that there is no fault.

[0086] At time t34, the general-purpose timer 10a increments the timer count value from "6" to "7" and outputs the Gray code data CNTVALUEG of "0100(7)". At time t35, the synchronizer 101 captures the Gray code data CNTVALUEG output from the general-purpose timer 10a. However, since there is a failure in the path from the general-purpose timer 10a to the processing unit 100a, the data CNTVALUEG-m captured by the synchronizer 101 becomes "0110". The converter 102 converts the Gray code data CNTVALUEG-m into binary code and outputs "0b0100(4)" as the binary code data CNTVALUEB. At this time, the output of the buffer 201 is the binary code data of the previous cycle ("0b0101(5)"). Therefore, the difference between the count value indicated by the binary code data CNTVALUEB and the count value indicated by the binary code data CNTVALUEB_n becomes "-1". Therefore, the failure detection signal FD indicating that there is a failure is output from the comparator 203.

[0087] Therefore, when it is determined that the timer count value supplied to the processing execution unit 103, which should have been incremented, is decreased, the failure detection signal FD is output.

[0088] According to the second embodiment, it is possible to determine whether the timer count value supplied to the processing execution unit 103 is changed correctly by providing the buffer 201 to the processing unit 100a and comparing the binary code data CNTVALUEB_n acquired as the binary code data of the previous cycle via the buffer 201 with the binary code data CNTVALUEB output from the converter 102. Therefore, it is possible to detect a failure in the path from the general-purpose timer 10a to the processing unit 100a and to improve the reliability of the semiconductor device la.

[0089] Although one processing execution unit 103 is provided in the processing unit 100 or 100a in the first or second embodiment, a plurality of processing execution units 103 can be provided and the timer count value from the general-purpose timer 10 can be commonly supplied to the plurality of processing execution units 130. For example, each of the processing units 100 to 120 or 100a to 120a can be a CPU cluster having a plurality of CPUs and the timer count value can be commonly provided to the plurality of CPU clusters.

[0090] Although the invention made by the present inventors has been specifically described based on the embodiments, the present invention is not limited to the above-described embodiments, and needless to say, various modifications can be made without departing from the gist thereof.

Claims

1. A semiconductor device, comprising: The timer unit has: Binary counter; and A first converter is configured to convert a first count value output from the binary counter into Gray code to be output as first Gray code data. as well as The processing unit has: A first synchronizer is configured to capture the first Gray code data transmitted from the timer unit in sync with the system clock signal, and output it as second Gray code data. and The fault detection unit includes a second synchronizer configured to capture first Gray code data transmitted from the timer unit synchronously with the system clock signal to output third Gray code data. The fault detection unit is configured to i) compare a second count value based on the second Gray code data with a third count value based on the third Gray code data, and ii) output a fault detection signal indicating that a fault has been detected based on the comparison result. The first synchronizer receives the first Gray code data through a first path, and The second synchronizer receives the first Gray code data via a second path different from the first path.

2. The semiconductor device according to claim 1, The fault detection unit determines whether the difference between the second count value and the third count value is equal to or less than a predetermined value.

3. The semiconductor device according to claim 2, When the difference is greater than the predetermined value, the fault detection unit outputs a fault detection signal.

4. The semiconductor device according to claim 1, The fault detection unit determines whether the absolute value of the difference between the second count value and the third count value is equal to or less than a predetermined value, and outputs a fault detection signal when the absolute value of the difference is greater than the predetermined value.

5. The semiconductor device according to claim 1, wherein The fault detection unit determines whether the difference between the second count value and the third count value is within a predetermined range.

6. The semiconductor device according to claim 5, When the difference is outside the predetermined value range, the fault detection unit outputs a fault detection signal.

7. The semiconductor device according to claim 1, The processing unit further includes a second converter, which converts the second Gray code data into second binary code data, and The fault detection unit includes: The third converter converts the third Gray code data into third binary code data, and The comparator compares the count value based on the second binary code data with the count value based on the third binary code data.

8. The semiconductor device according to claim 1, further comprising: The processing execution unit receives the second count value.

9. The semiconductor device according to claim 1, The timer unit and the processing unit operate asynchronously to each other.

10. A semiconductor device, comprising: The timer unit has: Binary counter; and A first converter is configured to convert a first count value output from the binary counter into Gray code to be output as first Gray code data. as well as The processing unit has: A first synchronizer is configured to capture the first Gray code data transmitted from the timer unit in sync with the system clock signal, and output it as second Gray code data. A buffer, coupled to the first synchronizer, is configured to capture second count data based on the second Gray code data and output the captured second count data as third count data in response to the next system clock signal; as well as The fault detection unit is configured to i) compare the second count value data with the third count value data, and ii) output a fault detection signal indicating that a fault has been detected based on the comparison result.

11. A semiconductor system, comprising: The timer unit has a binary counter and a first converter, the first converter converting a first count value output from the binary counter into Gray code for output as first Gray code data; as well as Multiple processing units receive the first Gray code data from the timer unit. Each of the plurality of processing units includes: A first synchronizer, synchronized with the system clock signal, captures the first Gray code data transmitted from the timer unit to output the second Gray code data; as well as The fault detection unit includes a second synchronizer configured to capture first Gray code data transmitted from the timer unit in sync with the system clock signal to output third Gray code data. The fault detection unit compares a second count value based on the second Gray code data with a third count value based on the third Gray code data, and outputs a fault detection signal indicating that a fault has been detected based on the detection result. The first synchronizer receives the first Gray code data through a first path, and The second synchronizer receives the first Gray code data via a second path different from the first path.

12. The semiconductor system of claim 11, further comprising: The fault management unit is notified of the fault detection signal of each fault detection unit of the plurality of processing units.

13. The semiconductor system according to claim 11, The plurality of processing units operate asynchronously with each other.

14. The semiconductor system according to claim 11, Each of the plurality of processing units includes a plurality of processing execution units, and the second count value is collectively supplied to the plurality of processing execution units.

Images