Fault detection circuit, semiconductor device, and fault detection method

Abstract

The invention relates to a fault detection circuit, a semiconductor device and a fault detection method. A fault detection circuit is provided in a target circuit having a first circuit region for synchronous operation with a first clock signal, the fault detection circuit includes a first detection circuit for outputting a first detection result acquired by transitioning a voltage level in synchronization with a first clock signal, a second detection circuit for outputting a second detection result acquired by transitioning a voltage level in synchronization with the first clock signal, and a first comparison circuit for outputting a first comparison result by comparing the first detection result and the second detection result. Therefore, a fault can be accurately detected through the fault detection circuit.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] The disclosure of Japanese Patent Application No. 2023-159156 filed on September 22, 2023 (including specification, drawings and abstract) is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates to a fault detection circuit, a semiconductor device, and a fault detection method, for example, a fault detection circuit, a semiconductor device, and a fault detection method suitable for accurately detecting a fault. Background Art

[0004] The disclosed technologies are listed below.

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2023-073928

[0006] Patent Document 1 discloses a semiconductor device for reducing security risks due to fault injection attacks. Summary of the invention

[0007] In the semiconductor device disclosed in Patent Document 1, only measures are taken to reduce the security risk due to fault injection attacks, and there is a problem that a fault due to the fault injection attack cannot be detected. Other objects and novel features will become clear from the description of this specification and the accompanying drawings.

[0008] According to the present disclosure, a fault detection circuit is arranged in a target circuit, the target circuit having a first circuit area for operating in synchronization with a first clock signal, the fault detection circuit including a first detection circuit for outputting a first detection result obtained by transitioning a voltage level synchronously with the first clock signal, a second detection circuit for outputting a second detection result obtained by transitioning a voltage level synchronously with the first clock signal, and a first comparison circuit for outputting a first comparison result by comparing the first detection result and the second detection result.

[0009] According to a fault detection method disclosed herein, a fault detection circuit is provided in a target circuit, the target circuit having a first circuit region that operates synchronously with a first clock signal. The method includes: using the first detection circuit to output a first detection result obtained by transitioning a voltage level synchronously with the first clock signal, using the second detection circuit to output a second detection result obtained by transitioning a voltage level synchronously with the first clock signal, and using the first comparison circuit to output a first comparison result by comparing the first detection result with the second detection result.

[0010] The present disclosure can provide a fault detection circuit, a semiconductor device, and a fault detection method that can accurately detect a fault. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a block diagram showing a configuration example of a semiconductor device to which a failure detection circuit according to a first embodiment is applied;

[0012] Figure 2 It shows that the setting Figure 1 A diagram showing a first specific configuration example of a failure detection circuit in a semiconductor device shown;

[0013] Figure 3 It is shown Figure 2 A timing diagram of the operation of the fault detection circuit shown;

[0014] Figure 4 It shows that the setting Figure 1 A diagram showing a second specific configuration example of a failure detection circuit in a semiconductor device shown;

[0015] Figure 5 It is shown Figure 4 A timing diagram of the operation of the fault detection circuit shown;

[0016] Figure 6 It shows that the setting Figure 1 A diagram showing a third specific configuration example of a failure detection circuit in a semiconductor device shown in FIG.

[0017] Figure 7 It is shown Figure 6 A timing diagram of the operation of the fault detection circuit shown;

[0018] Figure 8 is a block diagram showing a configuration example of a semiconductor device to which a failure detection circuit according to a second embodiment is applied; and

[0019] Fig. 9 is a block diagram showing a configuration example of a semiconductor device to which a failure detection circuit according to a third embodiment is applied. DETAILED DESCRIPTION

[0020] Hereinafter, the embodiments will be described with reference to the accompanying drawings. Since the accompanying drawings are simplified, the technical scope of the embodiments should not be narrowly interpreted based on the description of the accompanying drawings. In addition, in the absence of redundant description, the same elements are represented by the same reference numerals.

[0021] In the following embodiments, when necessary for convenience, they will be described by dividing them into multiple parts or embodiments. However, unless otherwise specified, they are not interrelated, and one part or embodiment is a relationship of some or all modifications, examples of applications, detailed descriptions, supplementary instructions, etc. of another part or embodiment. In the following embodiments, the number of elements, etc. (including the number of elements, values, quantities, ranges, etc.) is not limited to a specific number, but may be not less than or equal to a specific number, unless the number is specifically indicated and is clearly limited to a specific number in principle.

[0022] In addition, in the following embodiments, constituent elements (including operating steps, etc.) are not necessarily essential unless they are specifically specified and they are considered to be obviously essential in principle. Similarly, in the following embodiments, when referring to the shape, positional relationship, etc. of components, etc., it is assumed that the shape, etc. are substantially similar to or similar to the shape, etc., unless they are specifically specified and they are considered to be obvious in principle. The same applies to the above-mentioned numbers, etc., including numbers, values, quantities, ranges, etc.

[0023] (First embodiment)

[0024] Figure 1 1 is a block diagram showing a configuration example of a semiconductor device 100 to which the failure detection circuit 1 according to the first embodiment is applied. The semiconductor device 100 is, for example, a system on chip (SoC) or a microcontroller unit (MCU).

[0025] Figure 1 The semiconductor device 100 shown includes a fault detection circuit 1 and a target circuit TG1 as a fault detection target of the fault detection circuit 1. The fault detection circuit 1 is provided in the target circuit TG1 and includes a first detection circuit 111 as a main circuit, a second detection circuit 112 as a checker, and a comparator 113.

[0026] The first detection circuit 111 detects the rising edge of the clock signal CLK1 used in the target circuit TG1, and outputs the detection result M1. For example, the first detection circuit 111 changes the voltage level of the detection result M1 from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1. When the moment when the reset signal RST1 is used in the target circuit TG1 becomes valid (for example, a high level), the first detection circuit 111 initializes the voltage level of the detection result M1 to a predetermined level (a high level or a low level).

[0027] The second detection circuit 112 detects the rising edge of the clock signal CLK1 used in the target circuit TG1, and outputs the detection result C1. For example, the second detection circuit 112 changes the voltage level of the detection result C1 from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1. When the moment when the reset signal RST1 is used in the target circuit TG1 becomes valid (for example, a high level), the second detection circuit 112 initializes the voltage level of the detection result C1 to a predetermined level (a high level or a low level).

[0028] The comparator 113 compares the detection result M1 of the first detection circuit 111 with the detection result C1 of the second detection circuit 112 in synchronization with the rising edge of the clock signal CLK1 .

[0029] In the present embodiment, the first detection circuit 111 and the second detection circuit 112 detect the rising edge of the clock signal CLK1, and the comparator 113 performs a comparison operation in synchronization with the rising edge of the clock signal CLK1. It will be described as an example, but not limited to this. The first detection circuit 111 and the second detection circuit 112 are configured to detect the falling edge of the clock signal CLK1, and the comparator 113 is configured to perform a comparison operation in synchronization with the falling edge of the clock signal CLK1.

[0030] For example, when no fault occurs in the target circuit TG1, the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 may be the same value. Therefore, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate the same value, the comparator 113 outputs the error signal ERR1 of an invalid state (e.g., a low level) to indicate that no fault occurs in the target circuit TG1.

[0031] In contrast, when a fault occurs in the target circuit TG1, the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 may be different. Therefore, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate different values, the comparator 113 outputs the error signal ERR1 of a valid state (e.g., a high level) to indicate that a fault has occurred in the target circuit TG1.

[0032] Here, the failure of the target circuit TG1 includes not only the failure naturally occurring in the target circuit TG1, but also the tampering of the data in the target circuit TG1 due to the attack from the outside, and the unexpected operation (change) of the power supply, electromagnetic wave and clock signal in the target circuit TG1 due to the attack from the outside.

[0033] When the error signal ERR1 is activated, the semiconductor device 100 shuts down or initializes the operation of the target circuit TG1 or the semiconductor device 100. Alternatively, when the error signal ERR1 is activated, the semiconductor device 100 may notify the outside that a failure has occurred in the target circuit TG1, or cause software to process by issuing an interrupt notification of a CPU (Central Processing Unit).

[0034] (First Specific Configuration Example and Operation of Failure Detection Circuit 1)

[0035] Figure 2 1 is a diagram showing a first specific configuration example of a failure detection circuit 1 provided in a semiconductor device 100 as a failure detection circuit 1a. Figure 2 In FIG. 1 , not only the fault detection circuit 1 a but also the semiconductor device 100 having the target circuit TG1 is shown. Figure 3 is a timing chart showing the operation of the failure detection circuit 1a.

[0036] like Figure 2 As shown, the fault detection circuit 1a includes a first detection circuit 111a, a second detection circuit 112a and a comparator 113a. The first detection circuit 111a, the second detection circuit 112a and the comparator 113a correspond to the first detection circuit 111, the second detection circuit 112 and the comparator 113 respectively.

[0037] The first detection circuit 111a includes a selector 1111, a flip-flop 1112, and an inverter 1113. The selector 1111 selects and outputs a signal with a value of "0" or an output of the inverter 1113 in response to the reset signal RST1. For example, when the reset signal RST1 is valid (e.g., high level), the selector 1111 selects and outputs a signal with a value of "0", and when the reset signal RST1 is invalid (e.g., low level), the selector 1111 selects and outputs the output of the inverter 1113. The flip-flop 1112 receives and outputs the output signal of the selector 1111 in synchronization with the rising edge of the clock signal CLK1. The inverter 1113 inverts and outputs the output of the flip-flop 1112. The output signal of the inverter 1113 is also used as a detection result M11, which is one of the detection results M1 of the first detection circuit 111a.

[0038] That is, after the detection result M11 is initialized to a high level by the reset signal RST1 , the first detection circuit 111 a becomes valid, and the voltage level of the detection result M11 changes from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1 .

[0039] The second detection circuit 112a includes a selector 1121, a flip-flop 1122, and an inverter 1123. The selector 1121 selects and outputs one of a signal having a value of "0" and an output of the inverter 1123 in response to the reset signal RST1. For example, when the reset signal RST1 is valid (e.g., a high level), the selector 1121 selects and outputs a signal having a value of "0", and when the reset signal RST1 is invalid (e.g., a low level), the selector 1121 selects and outputs the output of the inverter 1123. The flip-flop 1122 receives and outputs the output signal of the selector 1121 in synchronization with the rising edge of the clock signal CLK1. The inverter 1123 inverts and outputs the output of the flip-flop 1122. The output signal of the inverter 1123 is also used as a detection result C11, which is one of the detection results C1 of the second detection circuit 112a.

[0040] That is, after the detection result C11 is initialized to a high level by the reset signal RST1 , the second detection circuit 112 a is activated, and the voltage level of the detection result C11 changes from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1 .

[0041] The comparator 113a includes flip-flops 1131, 1132, 1135, and 1136, an exclusive OR circuit (hereinafter referred to as an XOR circuit) 1137, a logical AND circuit (hereinafter referred to as an AND circuit) 1140, and a holding circuit 1141. The flip-flop 1131 outputs the detection result C11 of the second detection circuit 112a acquired and outputted synchronously with the rising edge of the clock signal CLK1. The flip-flop 1132 outputs the output signal of the flip-flop 1131 acquired and outputted synchronously with the rising edge of the clock signal CLK1. The XOR circuit 1137 outputs the exclusive OR of the output of the flip-flop 1132 and the detection result M11 of the first detection circuit 111a. The flip-flop 1135 outputs the reset signal RST1 acquired and outputted synchronously with the rising edge of the clock signal CLK1. The flip-flop 1136 outputs the output signal of the flip-flop 1135 acquired and outputted synchronously with the rising edge of the clock signal CLK1. The AND circuit 1140 outputs a logical product of the output signal of the XOR circuit 1137 and the inverted signal of the output signal of the flip-flop 1136. The holding circuit 1141 holds the output signal of the AND circuit 1140 as the error signal ERR1.

[0042] For example, when the reset signal RST1 is valid (e.g., high level), the AND circuit 1140 outputs a low level signal, and when the reset signal RST1 is invalid (e.g., low level), the AND circuit 1140 outputs a voltage level signal corresponding to the detected M11, C11. Specifically, when the reset signal RST1 is invalid, when the detection results M11, C11 are consistent, the AND circuit 1140 outputs a low level signal, and when the detection results M11, C11 are inconsistent, the AND circuit 1140 outputs a high level signal. The holding circuit 1141 outputs the error signal ERR1 of the invalid state (e.g., low level) by being initialized, and the high level signal from the AND circuit 1140 is the output timing for switching the error signal ERR from the invalid state to the valid state (e.g., high level) (i.e., the detection results M11, C11 mismatch is the detection timing).

[0043] Here, if Figure 3 As shown, if the detection result C11 of the second detection circuit 112a does not correctly change from a low level to a high level due to an attack on the target circuit TG1 from the outside, the detection results M11 and C11 are inconsistent (time t11). At this time, the comparator circuit 113a outputs an error signal ERR1 of a valid state (high level) to indicate that a fault has occurred in the target circuit TG1 (time t11).

[0044] (Second Specific Configuration Example and Operation of Failure Detection Circuit 1)

[0045] Figure 4 1 is a diagram showing a second specific configuration example of the failure detection circuit 1 provided in the semiconductor device 100 as the failure detection circuit 1b. Figure 4 In FIG. 1 , not only the fault detection circuit 1 b but also the semiconductor device 100 having the target circuit TG1 is shown. Figure 5 is a timing chart showing the operation of the failure detection circuit 1b.

[0046] like Figure 4 As shown, the fault detection circuit 1b includes a first detection circuit 111b, a second detection circuit 112b and a comparator 113b. The first detection circuit 111b, the second detection circuit 112b and the comparator 113b correspond to the first detection circuit 111, the second detection circuit 112 and the comparator 113 respectively.

[0047] The first detection circuit 111b includes a selector 1114, a flip-flop 1115, and an inverter 1116. The selector 1114 selects and outputs one of a signal having a value of "1" and an output of the inverter 1116 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1114 selects and outputs a signal having a value of "1", and when the reset signal RST1 is invalid, the selector 1114 selects and outputs the output of the inverter 1116. The flip-flop 1115 receives and outputs the output signal of the selector 1114 in synchronization with the rising edge of the clock signal CLK1. The inverter 1116 inverts and outputs the output of the flip-flop 1115. The output signal of the inverter 1116 is also used as a detection result M10, which is one of the detection results M1 of the first detection circuit 111b.

[0048] That is, after the detection result M10 is initialized to a low level by the reset signal RST1 , the first detection circuit 111 b becomes valid, and the voltage level of the detection result M10 changes from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1 .

[0049] The second detection circuit 112b includes a selector 1124, a flip-flop 1125, and an inverter 1126. The selector 1124 selects and outputs one of a signal having a value of "1" and an output of the inverter 1126 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1124 selects and outputs a signal having a value of "1", and when the reset signal RST1 is invalid, the selector 1124 selects and outputs the output of the inverter 1126. The flip-flop 1125 receives and outputs the output signal of the selector 1124 in synchronization with the rising edge of the clock signal CLK1. The inverter 1126 inverts and outputs the output of the flip-flop 1125. The output signal of the inverter 1126 is also used as a detection result C10, which is one of the detection results C1 of the second detection circuit 112b.

[0050] That is, the second detection circuit 112 b initializes the detection result C10 to a low level when the reset signal RST1 becomes valid, and then the voltage level of the detection result C10 changes from a low level to a high level, or from a high level to a low level in synchronization with the rising edge of the clock signal CLK1 .

[0051] The comparator circuit 113b includes flip-flops 1133, 1134, 1135, and 1136, an XOR circuit 1138, an AND circuit 1140, and a holding circuit 1141. The flip-flop 1133 outputs the detection result C10 of the second detection circuit 112b acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1134 outputs the output signal of the flip-flop 1133 acquired in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1138 outputs the exclusive OR of the output of the flip-flop 1134 and the detection result M10 of the first detection circuit 111b. The flip-flop 1135 outputs the reset signal RST1 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1136 outputs the output signal of the flip-flop 1135 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The AND circuit 1140 outputs the logical product of the output signal of the XOR circuit 1138 and the inverted signal of the output signal of the flip-flop 1136. The holding circuit 1141 holds the output signal of the AND circuit 1140 as the error signal ERR1.

[0052] For example, when the reset signal RST1 is valid (e.g., high level), the AND circuit 1140 outputs a low level signal, and when the reset signal RST1 is invalid (e.g., low level), the AND circuit 1140 outputs a voltage level signal corresponding to the detected M10, C10. Specifically, when the reset signal RST1 is invalid, when the detection results M10, C10 are consistent, the AND circuit 1140 outputs a low level signal, and when the detection results M10, C10 are inconsistent, the AND circuit 1140 outputs a high level signal. The holding circuit 1141 outputs the error signal ERR1 of the invalid state (e.g., low level) by being initialized, and the high level signal from the AND circuit 1140 is the output timing for switching the error signal ERR from the invalid state to the valid state (e.g., high level) (i.e., the detection results M10, C10 mismatch is the detection timing).

[0053] Here, if Figure 5 As shown, if the detection result C10 of the second detection circuit 112b is not correctly changed from a low level to a high level due to an attack from outside the target circuit TG1, the detection results M10 and C10 are inconsistent (time t21). At this time, the comparator circuit 113b outputs an error signal ERR1 of a valid state (high level), which indicates that a fault has occurred in the target circuit TG1 (time t21).

[0054] (Third Specific Configuration Example and Operation of Failure Detection Circuit 1)

[0055] Figure 61 is a diagram showing a third specific configuration example of the failure detection circuit 1 provided in the semiconductor device 100 as the failure detection circuit 1c. Figure 6 In FIG. 1 , not only the fault detection circuit 1 c but also the semiconductor device 100 having the target circuit TG1 is shown. Figure 7 is a timing chart showing the operation of the failure detection circuit 1c.

[0056] like Figure 6 As shown, the fault detection circuit 1c includes a first detection circuit 111c, a second detection circuit 112c and a comparator 113c. The first detection circuit 111c, the second detection circuit 112c and the comparator 113c correspond to the first detection circuit 111, the second detection circuit 112 and the comparator 113 respectively.

[0057] The first detection circuit 111c includes selectors 1111 and 1114, flip-flops 1112 and 1115, and inverters 1113 and 1116. The selector 1111 selects and outputs one of a signal having a value of "0" and an output of the inverter 1113 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1111 selects and outputs a signal having a value of "0", and when the reset signal RST1 is invalid, the selector 1111 selects and outputs the output of the inverter 1113. The flip-flop 1112 receives and outputs the output signal of the selector 1111 in synchronization with the rising edge of the clock signal CLK1. The inverter 1113 inverts and outputs the output of the flip-flop 1112. The output signal of the inverter 1113 is also used as a detection result M11, which is one of the detection results M1 of the first detection circuit 111c. The selector 1114 selects and outputs one of a signal having a value of "1" and an output of the inverter 1116 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1114 selects and outputs a signal having a value of "1", and when the reset signal RST1 is invalid, the selector 1114 selects and outputs the output of the inverter 1116. The flip-flop 1115 receives and outputs the output signal of the selector 1114 in synchronization with the rising edge of the clock signal CLK1. The inverter 1116 inverts and outputs the output of the flip-flop 1115. The output signal of the inverter 1116 is also used as a detection result M10, which is one of the detection results M1 of the first detection circuit 111b.

[0058] That is, the first detection circuit 111c initializes the detection result M11 to a high level and the detection result M10 to a low level by the reset signal RST1 becoming valid, and then causes the voltage levels of the detection results M11 and M10 to change. It changes from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK1. Under normal circumstances, among the detected M11 and M10, if one indicates a high level, the other indicates a low level.

[0059] The second detection circuit 112c includes selectors 1121 and 1124, flip-flops 1122 and 1125, and inverters 1123 and 1126. The selector 1121 selects and outputs one of a signal having a value of "0" and an output of the inverter 1123 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1121 selects and outputs a signal having a value of "0", and when the reset signal RST1 is invalid, the selector 1121 selects and outputs the output of the inverter 1123. The flip-flop 1122 receives and outputs the output signal of the selector 1121 in synchronization with the rising edge of the clock signal CLK1. The inverter 1123 inverts and outputs the output of the flip-flop 1122. The output signal of the inverter 1123 is also used as a detection result C11, which is one of the detection results C1 of the second detection circuit 112c. The selector 1124 selects and outputs one of a signal having a value of "1" and an output of the inverter 1126 in response to the reset signal RST1. For example, when the reset signal RST1 is valid, the selector 1124 selects and outputs a signal having a value of "1", and when the reset signal RST1 is invalid, the selector 1124 selects and outputs the output of the inverter 1126. The flip-flop 1125 receives and outputs the output signal of the selector 1124 in synchronization with the rising edge of the clock signal CLK1. The inverter 1126 inverts and outputs the output of the flip-flop 1125. The output signal of the inverter 1126 is also used as a detection result C10, which is one of the detection results C1 of the second detection circuit 112b.

[0060] That is, the second detection circuit 112c becomes effective through the reset signal RST1, initializes the detection result C11 to a high level, initializes the detection result C10 to a low level, and then changes the voltage levels of the detection results C11 and C10 from high to high. In synchronization with the rising edge of the clock signal CLK1, the level changes to a low level or changes from a low level to a high level. Under normal circumstances, among the detected C11 and C10, if one indicates a high level, the other indicates a low level.

[0061] The comparator circuit 113c includes flip-flops 1131-1136, XOR circuits 1137 and 1138, a logic summation circuit (hereinafter referred to as an OR circuit) 1139, an AND circuit 1140, and a holding circuit 1141. The flip-flop 1131 outputs a detection result C11 of the second detection circuit 112c acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1132 outputs an output signal of the flip-flop 1131 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1137 outputs an exclusive OR of the output of the flip-flop 1132 and the detection result M11 of the first detection circuit 111c. The flip-flop 1133 outputs a detection result C10 of the second detection circuit 112c acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1134 outputs an output signal of the flip-flop 1133 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1138 outputs an exclusive OR of the output of the flip-flop 1134 and the detection result M10 of the first detection circuit 111c. The OR circuit 1139 outputs a logical OR of the output signal of the XOR circuit 1137 and the output signal of the XOR circuit 1138. The flip-flop 1135 outputs a reset signal RST1 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1136 outputs an output signal of the flip-flop 1135 acquired and outputted in synchronization with the rising edge of the clock signal CLK1. The AND circuit 1140 outputs a logical product of the output signal of the OR circuit 1139 and the inverted signal of the output signal of the flip-flop 1136. The holding circuit 1141 holds the output signal of the AND circuit 1140 as the error signal ERR1.

[0062] For example, when the reset signal RST1 is valid (e.g., high level), the AND circuit 1140 outputs a low level signal, and when the reset signal RST1 is invalid (e.g., low level), the AND circuit 1140 outputs a voltage level signal corresponding to the detection results M11, C11 and the detection results M10, C10. Specifically, when the reset signal RST1 is invalid, when the detection results M11, C11 are consistent, and when the detection results M10, C11 are consistent, the AND circuit 1140 outputs a low level signal, and when the detection results M11, C11 are mismatched, or when the detection results M10, C10 are mismatched, the AND circuit 1140 outputs a high level signal. The holding circuit 1141 outputs the error signal ERR1 in an invalid state (e.g., a low level) by being initialized, and the high-level signal from the AND circuit 1140 is the output timing for switching the error signal ERR from the invalid state to the valid state (e.g., a high level) (i.e., the detection results M11, C11 mismatch, or the detection results M10, C10 mismatch is the detection timing).

[0063] Here, if Figure 7As shown, for example, even if the detection results M11, C11 and M10 are correctly transformed due to an attack on the target circuit TG1 from the outside, if the detection result C10 is not correctly transformed, the detection results M10 and C10 will not match (time t31). At this time, the comparator circuit 113c outputs the error signal ERR1 of the valid state (high level), which indicates that a fault has occurred in the target circuit TG1 (time t31). That is, the fault detection circuit 1c can detect the fault of the target circuit TG1 with better accuracy than the fault detection circuits 1a and 1b.

[0064] As described above, the fault detection circuit 1 according to the present embodiment can always detect faults of the target circuit TG1 with good accuracy, such as tampering of data in the target circuit TG1 due to an attack from the outside, and unexpected operations (changes) of the power supply, electromagnetic waves, and clock signals in the target circuit TG1 due to an attack from the outside.

[0065] (Second embodiment)

[0066] Figure 8 1 is a block diagram showing a configuration example of a semiconductor device 100 to which a fault detection circuit 2 is applied according to a second embodiment. The fault detection circuit 2 has a first detection circuit 111, a second detection circuit 112, and a comparator 113, and further has a first detection circuit 121, a second detection circuit 122, and a comparator 123. The first detection circuit 121, the second detection circuit 122, and the comparator 123 have the same configurations as the first detection circuit 111, the second detection circuit 112, and the comparator 113, respectively.

[0067] The first detection circuit 111, the second detection circuit 112 and the comparator 113 constitute a partial fault detection circuit 11 for detecting a fault in a circuit area A1 that operates synchronously with the clock signal CLK1 of the target circuit TG1. The first detection circuit 121, the second detection circuit 122 and the comparator 123 constitute a partial fault detection circuit 12 for detecting a fault in a circuit area A2 that operates synchronously with the clock signal CLK2 of the target circuit TG1.

[0068] Basically, the configuration and operation of the partial fault detection circuit 111, the second detection circuit 112, and the comparator 113 in the first detection circuit 111 are described above. However, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate the same value, the comparator 113 outputs the error signal ERR1 indicating an invalid state (e.g., low level) in synchronization with the clock signal CLK1 of the target circuit TG1, indicating that no fault has occurred in the circuit area A1. In addition, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate different values, the comparator 113 outputs the error signal ERR1 indicating a valid state (e.g., high level) in synchronization with the clock signal CLK1 of the target circuit TG1, indicating that a fault has occurred in the circuit area A1.

[0069] In the present embodiment, the first detection circuit 111 and the second detection circuit 112 detect the rising edge of the clock signal CLK1, and the comparator 113 performs a comparison operation in synchronization with the rising edge of the clock signal CLK1. It will be described as an example, but not limited to this. The first detection circuit 111 and the second detection circuit 112 are configured to detect the falling edge of the clock signal CLK1, and the comparator 113 is configured to perform a comparison operation in synchronization with the falling edge of the clock signal CLK1.

[0070] Then, the first detection circuit 121 includes a partial failure detection circuit 12 , a second detection circuit 122 , and a comparator 123 .

[0071] The first detection circuit 121 detects the rising edge of the clock signal CLK2 used in the target circuit TG1, and outputs the detection result M2. For example, the first detection circuit 121 changes the voltage level of the detection result M2 from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK2. When the moment when the reset signal RST2 is used in the target circuit TG1 becomes valid (for example, a high level), the first detection circuit 121 initializes the voltage level of the detection result M2 to a predetermined level (a high level or a low level).

[0072] The second detection circuit 122 detects the rising edge of the clock signal CLK2 used in the target circuit TG1, and outputs the detection result C2. For example, the second detection circuit 122 changes the voltage level of the detection result C2 from a high level to a low level, or from a low level to a high level in synchronization with the rising edge of the clock signal CLK2. When the moment when the reset signal RST2 is used in the target circuit TG1 becomes valid (for example, a high level), the second detection circuit 122 initializes the voltage level of the detection result C2 to a predetermined level (a high level or a low level).

[0073] The comparator 123 compares the detection result M2 of the first detection circuit 121 with the detection result C2 of the second detection circuit 122 in synchronization with the rising edge of the clock signal CLK2.

[0074] In the present embodiment, the first detection circuit 121 and the second detection circuit 122 detect the rising edge of the clock signal CLK2, and the comparator 123 performs a comparison operation in synchronization with the rising edge of the clock signal CLK2. It will be described as an example, but not limited to this. The first detection circuit 121 and the second detection circuit 122 are configured to detect the falling edge of the clock signal CLK2, and the comparator 123 is configured to perform a comparison operation in synchronization with the falling edge of the clock signal CLK2.

[0075] For example, if no fault occurs in the circuit area A2 operating in synchronization with the clock signal CLK2 of the target circuit TG1, the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 may be the same value. Therefore, when the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 indicate the same value, the comparator 123 outputs the error signal ERR2 of an invalid state (e.g., a low level) to indicate that no fault occurs in the circuit area A2 of the target circuit TG1.

[0076] In contrast, when a fault occurs in the circuit region A2 of the target circuit TG1, the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 may be different. Therefore, when the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 indicate different values, the comparator 123 outputs the error signal ERR2 of a valid state (e.g., a high level) to indicate that a fault has occurred in the circuit region A2 of the target circuit TG1.

[0077] Therefore, in the fault detection circuit 2 according to the present embodiment, faults of a plurality of circuit areas operating in synchronization with different clock signals of the target circuit TG1 can be detected individually. This helps to identify the cause of the fault.

[0078] In the present embodiment, the fault detection circuit 2 has been described as an example of a case having two partial fault detection circuits 11, 12, but is not limited thereto. The fault detection circuit 2 may include three or more partial fault detection circuits provided in three or more circuit areas respectively operating in synchronization with different clock signals.

[0079] (Third Embodiment)

[0080] Fig. 93 is a block diagram showing a configuration example of a semiconductor device 100 to which a failure detection circuit 3 is applied according to the third embodiment. The failure detection circuit 3 has the same circuit configuration as that of the failure detection circuit 2.

[0081] Here, in the fault detection circuit 3, the partial fault detection circuit 11 is provided in the circuit area B1 driven by the power supply voltage VDD1, and the partial fault detection circuit 12 is provided in the circuit area B2 driven by the power supply voltage VDD2. That is, the partial fault detection circuit 11 detects a fault of the circuit area B1 driven by the power supply voltage VDD1 of the target circuit TG1, and the partial fault detection circuit 12 detects a fault of the circuit area B2 driven by the power supply voltage VDD2 of the target circuit TG1.

[0082] Therefore, in the fault detection circuit 3 according to the present embodiment, faults of a plurality of circuit areas driven by different power supply voltages of the target circuit TG1 can be detected individually. This helps to identify the cause of the fault.

[0083] In the present embodiment, the fault detection circuit 3 has been described as an example of a case having two partial fault detection circuits 11, 12, but is not limited thereto. The fault detection circuit 3 may include three or more partial fault detection circuits provided in three or more circuit areas driven by different power supply voltages.

[0084] Although the inventors' invention has been specifically described based on the embodiment, the present invention is not limited to the embodiment that has been described, and it goes without saying that various modifications can be made without departing from the gist thereof.

[0085] Furthermore, some or all of the processing of the fault detection circuit may be implemented by causing the CPU to execute a computer program.

[0086] The above-mentioned program includes a set of instructions (or software codes), which are used to make the computer perform one or more of the functions described in the embodiment when read into the computer. The program can be stored on a non-transient computer-readable medium or on a tangible storage medium. As an example and not limitation, a computer-readable medium or a tangible storage medium includes: RAM (random access memory), ROM (read-only memory), flash memory, SSD (solid state drive) or other storage technology, CD-ROM, DVD (digital versatile disk), Blu-ray (registered trademark) disk or other optical disk storage, cassette, tape, disk storage or other magnetic storage device. The program can be transmitted on a transient computer-readable medium or a communication medium. As an example and not limitation, a transient computer-readable medium or a communication medium includes electrical, optical, acoustic or other forms of propagation signals.

Claims

1. A fault detection circuit is provided in a target circuit, the target circuit having a first circuit region operating in synchronization with a first clock signal, the fault detection circuit comprising: a first detection circuit configured to output a first detection result obtained by changing a voltage level synchronously with the first clock signal, a second detection circuit configured to output a second detection result obtained by transitioning the voltage level in synchronization with the first clock signal, and The first comparison circuit is used to output a first comparison result by comparing the first detection result with the second detection result.

2. The fault detection circuit according to claim 1, When the first detection result and the second detection result match, the first comparison circuit outputs the first comparison result indicating that no fault has occurred in the first circuit area, When the first detection result and the second detection result mismatch, the first comparison circuit outputs the first comparison result indicating that a failure has occurred in the first circuit area.

3. The fault detection circuit according to claim 1, wherein the first detection circuit outputs a third detection result obtained by converting a voltage level into the first detection result in synchronization with the first clock signal, wherein the second detection circuit outputs a fourth detection result obtained by converting the voltage level into the second detection result in synchronization with the first clock signal, The first comparison circuit compares the first detection result with the second detection result, further compares the third detection result with the fourth detection result, and outputs the first comparison result.

4. The fault detection circuit according to claim 3, When the first detection result and the second detection result match, and when the third detection result and the fourth detection result match, the first comparison circuit outputs a first comparison result indicating that no failure has occurred in the first circuit area, When the first detection result and the second detection result mismatch, or when the third detection result and the fourth detection result mismatch, the first comparison circuit outputs a first comparison result indicating that a failure has occurred in the first circuit area.

5. The fault detection circuit according to claim 1, The first detection circuit also includes: a first selector for selecting and outputting a first initial value as one of 0 and 1 or the first detection result based on a first reset signal; a first flip-flop, configured to capture and output an output signal of the first selector in synchronization with the first clock signal; as well as a first inverter, configured to invert the output signal of the first trigger and output the first detection result; The second detection circuit also includes: a second selector, configured to select and output the first initial value or the first detection result based on the first reset signal; a second flip-flop for capturing and outputting an output signal of the second selector in synchronization with the first clock signal; and The second inverter is used to invert the output signal of the second trigger and output the second detection result.

6. The fault detection circuit according to claim 3, The first detection circuit also includes: a first selector for selecting and outputting a first initial value as one of 0 and 1 or the first detection result based on a first reset signal; a first flip-flop, configured to capture and output an output signal of the first selector in synchronization with the first clock signal; as well as a first inverter, configured to invert the output signal of the first trigger and output the first detection result; The second detection circuit also includes: a second selector, configured to select and output the first initial value or the first detection result based on the first reset signal; a second flip-flop for capturing and outputting an output signal of the second selector in synchronization with the first clock signal; and a second inverter, configured to invert the output signal of the second trigger and output the second detection result, The first detection circuit also includes: a third selector for selecting and outputting a second initial value or the third detection result as the other of 0 and 1 based on the first reset signal; a third flip-flop, configured to capture and output an output signal of the third selector in synchronization with the first clock signal; and a third inverter, configured to invert the output signal of the third trigger and output the third detection result; The second detection circuit also includes: a fourth selector, configured to select and output the second initial value or the fourth detection result based on the first reset signal; a fourth flip-flop, configured to capture and output an output signal of the fourth selector in synchronization with the first clock signal; and A fourth inverter is used to invert the output signal of the fourth trigger and output the second detection result.

7. The fault detection circuit according to claim 1, The target circuit further includes a second circuit region operating in synchronization with the second clock signal, a third detection circuit configured to output a third detection result obtained by converting the voltage level synchronously with the second clock signal, a fourth detection circuit configured to output a fourth detection result obtained by converting the voltage level in synchronization with the second clock signal, The second comparison circuit is used to output a second comparison result by comparing the third detection result and the fourth detection result.

8. The fault detection circuit according to claim 7, When the first detection result and the second detection result match, the first comparison circuit outputs a first comparison result indicating that no failure has occurred in the first circuit area of ​​the target circuit, When the first detection result and the second detection result mismatch, the first comparison circuit outputs a first comparison result indicating that a failure has occurred in the first circuit region of the target circuit, When the third detection result and the fourth detection result match, the second comparison circuit outputs a second comparison result indicating that no failure has occurred in the second circuit region of the target circuit, When the third detection result and the fourth detection result mismatch, the second comparison circuit outputs a second comparison result indicating that a failure has occurred in the second circuit region of the target circuit.

9. The fault detection circuit according to claim 7, The first circuit area and the second circuit area are driven by different power supply voltages, The first detection circuit, the second detection circuit and the first comparison circuit are arranged in the first circuit area, The third detection circuit, the fourth detection circuit, and the second comparison circuit are provided in the second circuit region. 10 . A semiconductor device configured with the failure detection circuit according to claim 1 and a target circuit.

11. A fault detection method performed by a fault detection circuit provided in a target circuit, the target circuit having a first circuit region operating in synchronization with a first clock signal, the method comprising: outputting a first detection result obtained by transitioning a voltage level in synchronization with the first clock signal by using a first detection circuit, outputting a second detection result obtained by transitioning the voltage level in synchronization with the first clock signal by using a second detection circuit, By using a first comparison circuit, a first comparison result is output by comparing the first detection result and the second detection result.

Images