Independent functional units on a monolithic semiconductor substrate

Abstract

The invention relates to a semiconductor device (10). This device comprises a first integrated circuit (12) arranged on a first section of a monolithic semiconductor substrate (14). It also comprises a further integrated circuit (18) arranged on a further section of the monolithic semiconductor substrate (14). Furthermore, a barrier (16) is provided by means of which the first section of the monolithic semiconductor substrate (14) is physically separated from the further section of the monolithic semiconductor substrate (14). In addition, a first monitoring device (20) is provided as part of the first integrated circuit (12), and a further monitoring device (22) is provided as part of the further integrated circuit (18).

Description

The invention relates to a semiconductor device, a method for operating a semiconductor device, a computer program and a computer-readable medium.In order to be able to assess electrical, electronic and / or programmable systems with regard to functional reliability, availability, reliability and / or independence, predetermined safety requirements are established within the scope of international normalizations. With regard to functional safety, for example, four different safety levels are defined in more detail in, inter alia, the standard EN 50129, IEC 61508 or IEC 61511. On the basis of a high functional safety, an environment, health values and / or health of persons can be protected in a situation-appropriate manner. As a rule, a scope and a type of required functional safety are determined on the basis of a risk assessment.In order to achieve a predetermined functional reliability and / or availability of the system, stringent requirements must therefore be fulfilled. Normally, in the case of high requirements, functional units which are designed independently of one another and are arranged on separate semiconductor substrates are provided. In the case that two independent functional units are to be integrated on a single-chip system, only one safety level 3 according to IEC 61508 has been attainable up to now. In order to be able to provide independent functional units for the purpose of controlling a safety-critical system, large distances between the respective functional units on printed circuit boards have hitherto been provided. Alternatively, separate functional units are combined by mathematical methods or software-based process solutions are implemented to maintain independence. The software-based process solutions are, for example, mathematical coding methods in which a complementary code is executed on hardware implemented in diversity or on redundant hardware. In order to be able to reach safety level 4, a large installation space has therefore been required up to now. Furthermore, previous solutions are often associated with high power consumption due to operation of a plurality of components. Moreover, computing capacities and / or an interface power are usually occupied on account of a high communication requirement between separated components. However, one-chip systems may only be used up to a safety level 3 in accordance with the IEC 61508 standard.The object of the invention is to provide an improved semiconductor device, in particular an improved system on chip.This object is achieved by a semiconductor device having the features of claim 1.Furthermore, the object of the invention is to specify an improved method for operating a semiconductor device.This object is achieved by a method having the features of the subordinate method claim.Furthermore, the invention is based on the objects of specifying a computer program and a computer-readable medium.These objects are achieved by a computer program having the features of the subordinate claim 15 and by a computer-readable medium having the features of the subordinate claim 15.Advantageous refinements are the subject matter of dependent dependent claims in each case.The semiconductor device according to the invention comprises a first integrated circuit which is arranged on a first section of a monolithic semiconductor substrate. Such a monolithic semiconductor substrate is usually also referred to in technical circles by the terms "die" or "chip". Furthermore, the semiconductor device according to the invention has a further integrated circuit which is arranged on a further section of the monolithic semiconductor substrate. Furthermore, according to the invention, a barrier is provided by means of which the first section of the monolithic semiconductor substrate is physically separated from the further section of the monolithic semiconductor substrate. Furthermore, the semiconductor device according to the invention has a first guard device and a further guard device. The first monitor device is embodied as part of the first integrated circuit. The further monitoring device is embodied as part of the further integrated circuit. Expediently, the monitoring devices mentioned are each configured to monitor physical characteristic variables. In addition to the physical characteristic variables described below, it can alternatively or additionally be a current intensity and / or a frequency, among other things. Furthermore, the semiconductor device is preferably implemented as a system on chip.Expediently, the first integrated circuit is physically separated from the further integrated circuit by means of the said barrier. In this context, the monitoring devices advantageously serve to monitor and / or ensure a function of the barrier. In a preferred embodiment variant, doped regions provided on the first section are physically separated from doped regions provided on the further section by means of the barrier. In particular, the said barrier extends in depth at least down to an undoped region of the monolithic semiconductor substrate. Expediently, the undoped region is a captive common potential, which is usually referred to as ground.Preferably, the semiconductor device is configured to control a system. The semiconductor device according to the invention makes it possible to achieve, for example, a safety stage 4 according to the standard EN 50129, IEC 61508 or IEC 61511. This makes it possible to provide a required independence from different or redundant functional units, such as data processing devices or control systems. Furthermore, safety-critical systems which relate, for example, to a traffic guidance technology or an emergency management system can thereby be controlled while satisfying high safety requirements. The independent functional units can be realized on the same monolithic semiconductor substrate. This allows a reduced space requirement for secure data processing devices and / or control systems, for example, to be achieved. Furthermore, this makes it possible to provide an energy-saving semiconductor device which has reduced power consumption owing to a reduced number of components. In addition, it is made possible in this way to reduce production costs and production outlay. Moreover, a reduced failure rate and thus an improved availability can be achieved. Furthermore, operating conditions of a component provided uniformly can be monitored reliably. Additional external components for the purpose of monitoring operating conditions of the semiconductor device can be dispensed with at low cost. In particular, monitoring of the operating conditions solely on the basis of an internal functional structure is possible, which itself can be embodied as a still further integrated circuit. By arranging a plurality of independent integrated circuits on the monolithic semiconductor substrate, redesign costs can be kept low.In a preferred application, integrated circuits based on diversity layouts are realized, which are arranged on the monolithic semiconductor substrate. In this way, systematic errors which are based on the use of uniform layouts can be easily avoided. Furthermore, it can be provided that data memories are linked in different ways to the aforementioned integrated circuits. Thereby, different memory cells can be used for the same data to be stored.An advantageous further development provides that the barrier is designed as a thermal and / or electrical insulation. Damaging physical influence from one integrated circuit on an adjacent integrated circuit can be limited or shielded. Expediently, a transmission of a damaging thermal energy or electrical energy can be counteracted with the aid of the barrier. Silicon dioxide (SiO2), silicon nitride (Si3N4) or a material with comparable insulating properties, which is usually used in standard production processes, is preferably provided as the material for the barrier. This makes it possible to prevent leakage currents that can propagate along a surface of the barrier.Furthermore, an advantageous development provides that the first monitoring device and / or the further monitoring device each have a temperature monitor. Thermal influences on adjacent integrated circuits can be detected quickly and reliably. Furthermore, a temperature profile can be recorded at low cost. This enables an early warning of a thermal risk or a thermally induced failure. As a result, high safety requirements with regard to thermal influences can be fulfilled.Preferably, the temperature monitor of the first monitor device is configured as part of the first integrated circuit arranged on the first section. Alternatively or additionally, the temperature monitor of the further monitor device is preferably embodied as part of the further integrated circuit arranged on the further section.An advantageous embodiment variant provides that the temperature monitor has a plurality of temperature sensors. These temperature sensors are advantageously arranged on one side along the barrier. The temperature sensors mentioned are expediently ring oscillators and / or temperature diodes. Alternatively or additionally, temperature sensors of the temperature monitor can be provided in the vicinity of critical regions, such as, for example, at processor cores. An origin of thermal stress can be easily located. For example, a direction of a thermal flow can be determined. Preferably, one or more adjacent integrated circuits may be identified as the origin of thermal stress. Furthermore, it can be detected early, in particular before damage occurs, that a thermal energy penetrates the barrier. In this way, measures can be taken to counteract a thermal failure. Such a measure can consist, for example, in interrupting a supply voltage of a system to be controlled, preferably after the latter has been placed in a safe state.In a further advantageous development, it is provided that the first monitoring device and / or the further monitoring device has a voltage monitor. The voltage monitor is preferably designed as part of the integrated circuit arranged on the first section and / or as part of the further section. This voltage monitor is preferably configured to detect fault over-voltages. Electronic influences caused by an overvoltage, for example, can thereby be quickly detected. An affected integrated circuit or an integrated circuit adjacent thereto can then be protected at low cost. In particular, this makes it possible to take rapidly necessary measures in order to put a system to be controlled into a safe state. This can further increase operational reliability.In an advantageous embodiment variant, it is proposed that the voltage monitor is configured to monitor a supply voltage of the first integrated circuit or of the further integrated circuit. An internal supply voltage of separate integrated circuits can thereby be respectively monitored separately. Over-voltages are detectable and localizable quickly and reliably.Furthermore, an advantageous development provides that the first monitoring device and / or the further monitoring device has function monitoring for the purpose of detecting failure of a respectively associated integrated circuit. As a result, integrated function monitoring can be provided in a simple manner. External components for the purpose of function monitoring of an integrated circuit can be dispensed with. Malfunctions within the integrated circuit can thus be detected reliably and quickly. Further integrated circuits and functional units based thereon can be informed of malfunctions of other integrated circuits and functional units based thereon. As a result, a high level of availability and / or a high level of functional reliability of the system to be controlled can be provided as required. By way of example, functional units that are functional can at least temporarily perform tasks of the impaired functional unit, as a result of which high availability can be provided. Moreover, operationally reliable data processing devices and / or control devices can be provided in a simple manner for the purpose of controlling safety-critical systems. Furthermore, in this way, a need for replacement can be quickly detected, as a result of which high safety requirements can be fulfilled.In an advantageous embodiment variant, at least individual logic functions of independent integrated circuits are diversely laid out and / or diversely implemented. Moreover, scrambling of memory addresses and / or memory data of an integrated memory with respect to a further integrated memory of the further integrated circuit can be provided. Systematic errors can thereby be further reduced.The invention further provides a method of operating a semiconductor device. By way of example, the method can be used to provide a semiconductor device which, with regard to functional reliability, can reach a safety level 4 in the sense of the standard EN 50129, IEC 61508 or IEC 61511. Moreover, the method makes it possible to provide a semiconductor device with high availability.In the method according to the invention, two integrated circuits of the semiconductor device which are independent of one another and are physically separated from one another by means of a barrier are operated in a concurrent manner. Furthermore, a first of the two integrated circuits is monitored by means of a first monitoring device. Another of the two integrated circuits is monitored by means of a further monitoring device.The method according to the invention makes it possible to operate two integrated circuits arranged on the same semiconductor substrate independently of one another in a concurrent manner. In this context, independent operation is to be understood in terms of functional safety. This functional safety can, for example, meet the specifications from the standard IEC 61508 or EN 50129. By means of a combination of a physical separation and the monitoring devices, it is possible to provide a particularly functionally reliable and / or highly available semiconductor device beyond a safety stage 3. Such semiconductor devices can be used for safety-critical applications. Advantageously, apparatuses in railway technology, such as, for example, signal stations, flight monitoring or robotics, can thereby be controlled in a safe and reliable manner.An advantageous further development of the method provides that a temperature along the barrier is monitored by means of the first monitoring device and / or by means of the further monitoring device. Thermal operating conditions of the semiconductor device can be reliably monitored. Furthermore, a transfer of thermal energy between adjacent integrated circuits is quickly and reliably recognizable. An origin of the thermal energy can be localized in a cost-effective manner in the preferred application.In an advantageous embodiment variant, it is provided that, in the event of a predetermined temperature threshold value being exceeded, a supply voltage of a system to be controlled by means of the first integrated circuit and / or by means of the further integrated circuit is interrupted in a safe state of the system to be controlled. The safe state is in the present case a well-defined and predetermined state of the system in which there is at most a slight predetermined risk to persons or objects. By means of the interruption of the supply voltage, a temperature increase can be limited in a simple manner. Thermally induced damage or arbitrary failures of a system to be controlled in an undefined state can be reliably avoided. A thermally induced failure of one or both integrated circuits can thereby be counteracted in a cost-effective manner.An advantageous development of the method further provides that a supply voltage of the first integrated circuit is monitored by means of the first monitoring device and / or a supply voltage of the further integrated circuit is monitored by means of the further monitoring device. Any transients that may occur can be quickly detected. This enables mechanisms to be activated for the purpose of protecting individual integrated circuits from overvoltage. This makes it possible to provide a high level of operational reliability.Expediently, in the event that a predetermined threshold value of the supply voltage is exceeded, the supply voltage of the system to be controlled by means of the first integrated circuit and / or by means of the further integrated circuit is interrupted in a safe state of the system to be controlled. Damage caused by tension can be avoided at low cost. In the preferred application, a failure of an integrated circuit associated with an overvoltage can be avoided.Another advantageous development provides that the first monitoring device and / or the further monitoring device are monitored by means of a monitoring infrastructure on the basis of software-based checking and / or monitoring methods.The test and / or monitoring methods mentioned are preferably already known methods. For example, a process monitoring is carried out on the basis of a diversity-implemented watchdog. The mentioned watchdog is to be understood in the sense of electrical technology and information. Hereinafter, a hardware- or software-implemented function for the purpose of failure detection is referred to as watchdog. The diversity-implemented watchdogs are preferably implemented in the form of additional independent integrated circuits on the monolithic semiconductor substrate. Alternatively or additionally, test and / or monitoring methods can be provided which are already known from secure microcomputer systems by Siemens (also referred to as SMIMIS for short). Such a checking and / or monitoring method is preferably implemented on a processor core of the first integrated circuit. Further preferably, a further test and / or monitoring method is implemented on a processor core of the further integrated circuit. Based on hardware- and / or software-based checking and / or monitoring methods, high safety requirements can be achieved in a simplified manner. Furthermore, reliable failure detection can be provided.In a preferred embodiment variant, it is provided that a hardware-implemented, specific re-ordering of the memory contents is implemented for the purpose of increasing operational reliability. This makes it possible to avoid the same systematically induced errors in the two integrated circuits. In this way, a high availability of the system to be controlled can be achieved. In a preferred application, a high functional reliability of the system to be controlled in the event of a failure of an integrated circuit or of a functional unit based thereon can be provided by transferring memory contents to a functional functional unit. Tasks to be completed by the failed functional unit can be recognized and processed quickly and reliably by a functional unit that is taking over. A control method or a regulation method can thereby be continued reliably and reliably, preferably without interruptions. This makes it possible to achieve a highest safety level at low cost.Moreover, the invention provides a computer program which, when executed, causes a data processing device to carry out the method according to the invention. The data processing device can be, for example, a computer, a microcontroller, a processor or another programmable hardware component. The data processing device is expediently configured to read in, receive, write, transmit and / or manage data. Furthermore, the data processing device can be a virtualized hardware resource, a computer cloud and / or a runtime environment with changeable computing and / or storage capacities. The mentioned runtime environment is to be understood in this context in the sense of informatives. In the preferred application, the data processing device is part of each of the two integrated circuits arranged on the monolithic semiconductor substrate.Furthermore, the invention provides a computer readable medium. This includes instructions which cause a data processing device to carry out the method according to the invention. The data processing device is in particular a data processing device of the type described above.Expediently, the computer-readable medium is embodied as a CD-ROM, a DVD, a USB or flash memory or a non-physical medium, such as a data stream and / or a digital carrier signal.The above-described characteristics, features and advantages of the invention and the manner in which these are achieved are explained in more detail in conjunction with the figures in the following description of the exemplary embodiment of the invention and its variations. Where appropriate, the same reference numerals are used in the figures to refer to the same or corresponding elements of the invention. The exemplary embodiment and its variations serve to explain the invention and do not restrict the invention to the combinations of features specified therein, nor with respect to functional features. In addition, all features indicated in the exemplary embodiment can be considered in isolation and combined in a suitable manner with the features of any claim. The figures described below are schematic drawings, not to scale.The following are shown: FIG. 1 shows an exemplary embodiment of a semiconductor device according to the invention in a schematic illustration; FIG. 2 shows an illustration of an example of a method according to the invention for providing a high safety level for a semiconductor device.FIG. 1 shows a schematic illustration of a semiconductor device 10, in which two integrated circuits 12, 18 of identical construction are arranged on a monolithic semiconductor substrate 14.In the present exemplary embodiment, the two integrated circuits 12, 18 mentioned are each designed as functional units which are independent of one another. By way of example, the two integrated circuits 12, 18 each have a data processing device 26, a memory 28 and a communication device 30. Although the two integrated circuits 12, 18 are configured independently of one another, a data transmission between these two integrated circuits 12, 18 is nevertheless made possible by means of the communication device 30. Expediently, a system, not shown in detail, and an associated process, relating to, for example, an operation of a railway signal box, are controlled by means of the two integrated circuits 12, 18. Preferably, the integrated circuits 12, 18 are further configured to bring and / or maintain the system to be controlled in a safe state.A first integrated circuit 12 of the two integrated circuits 12, 18 mentioned is arranged on a first section of the monolithic semiconductor substrate 14. A second integrated circuit 18 of the two integrated circuits 12, 18 is arranged on a further section of the monolithic semiconductor substrate 14. Between said portions a barrier 16 is arranged. By means of the barrier 16, the first section of the monolithic semiconductor substrate 14 is physically separated from the further section of the monolithic semiconductor substrate 14. In the present exemplary embodiment, the barrier 16 separates doped regions provided on the first section from doped regions provided on the further section. In particular, the barrier 16 extends in depth as far as an undoped region of the monolithic semiconductor substrate 14. For this purpose, silicon dioxide or an insulation material with comparable properties is provided as a material for the barrier 16, for example.The exemplary embodiment of the semiconductor device 10 described here further has a first guard device 20 and a second guard device 22. The first monitoring device 20 is part of the first integrated circuit 12. the second monitoring device 22 is part of the second integrated circuit 18.For the purpose of temperature monitoring, the temperature monitor 24 has a plurality of temperature sensors 24. These are arranged distributed along the barrier 16 by way of example. A first part of the temperature sensors 24 is arranged on one side on a side of the barrier 16 assigned to the first integrated circuit 12 and belongs to the first monitor device 20. As a result, a thermal flow from the first integrated circuit 12 to the second integrated circuit 18 or vice versa can be detected. Furthermore, it is possible in this way to localize from which of the two integrated circuits 12, 18 a potentially damaging thermal energy is emitted. A thermal state of the semiconductor device 10 can thereby be easily and reliably determined and monitored. In this way, a thermally induced failure of the two integrated circuits 12, 18 can be predicted and counteracted. In an advantageous embodiment, it is provided that, in the event of a predetermined temperature threshold value being exceeded by means of an external control device, which is not shown in detail, a supply voltage of the system to be controlled is interrupted 108. Furthermore, it can be provided that a supply voltage of at least one of the integrated circuits 12, 18 affected by a critical thermal state is interrupted 108. Usually, however, the supply voltage of at least one of the two integrated circuits 12, 18 is maintained in order to maintain a safe state of the system to be controlled.Furthermore, each of the two monitoring devices 20, 22 has a respective voltage monitor 32. This is configured, for example, to monitor a supply voltage of a respective associated integrated circuit 12, 18. If a supply voltage occurs which exceeds a predetermined threshold value, then, by way of example, the supply voltage of a system controlled by means of the semiconductor device 10 is interrupted 108 by means of the external control device and not shown in detail. As already explained above, depending on the application, an interruption 108 of a supply voltage of at least one of the integrated circuits 12, 18 can furthermore be provided.In a further advantageous embodiment variant, the monitoring devices 20, 22 each have a function monitoring for the purpose of detecting failure of a respectively associated integrated circuit 12, 18. Preferably, such function monitoring is integrated in each of the two integrated circuits 12, 18. Alternatively or additionally, the function monitoring can be part of an additional integrated circuit, which is preferably independent of the first integrated circuit 12 as well as of the further integrated circuit 18. In the specific application, this additional integrated circuit, not shown in detail, having a barrier 16 of the aforementioned type can be separated from the first and the further section of the monolithic semiconductor substrate 14. By way of example, the function monitoring can be realized in the form of a diversity-implemented watchdog. This enables independent viewing units to be provided on the monolithic semiconductor substrate 14.FIG. 2 illustrates an example of a method 100 for operating a semiconductor device 10.With the example of method 100 described in the present case, a functionally reliable and / or highly available semiconductor device 10 is provided, which is provided by way of example to control a safety-critical system, not shown in more detail, such as a railway signal box by way of example. In particular, the semiconductor device 10 designed as a system on chip is operated with regard to functional reliability in such a way that a safety level 4 is reached in accordance with one of the standards EN 50129, IEC 61508 or IEC 61511. The safety stage 4 is achieved in the present case by providing a combination of a plurality of realization properties which, beyond the safety stage 3, enables the provision of an operationally reliable and reliable semiconductor device 10. Depending on requirements, either a high level of functional reliability and / or a high level of availability can thereby be achieved.The example of the method 100 provides for two integrated circuits 12, 18 of the semiconductor device 10 which are independent of one another and are arranged physically separately by means of a barrier 16 to be operated in a concurrent manner 102. Furthermore, it is provided that a first integrated circuit 12 is monitored 104 by means of a first monitoring device 20. Furthermore, a second integrated circuit 18 is monitored 104 by means of a second monitoring device 22.The monitoring devices 20, 22 are in particular monitoring devices of the type described in connection with FIG. 1 Temperatures of the first integrated circuit 12 and of the second integrated circuit 18 are monitored 106 in the present case by way of example on the basis of the temperature monitor 24 of the first and of the second monitoring device 20, 22 described in this connection. These temperatures are preferably monitored 106 by means of the temperature sensors 24, which are arranged distributed along the barrier 16 by way of example. As soon as a detected temperature exceeds a predetermined temperature threshold value on one side of the barrier 16, a system to be controlled by means of the integrated circuits 12, 18 is put into a safe state, for example. Expediently, a supply voltage of the system to be controlled is then interrupted 108. In a preferred application, a supply voltage of the integrated circuits 12, 18 themselves is initially maintained so that the system to be controlled is maintained in the safe state. An interruption 108 of the supply voltage of the system to be controlled takes place, for example, by means of an external control device, not shown in more detail. By interrupting 108 the supply voltage of a system to be controlled, a temperature-sensitive integrated circuit 12, 18 can be cooled and / or replaced. A risk of damaging thermal influence on an adjacent integrated circuit 12, 18 can thereby be kept small. Overheating of the entire semiconductor device 10 and thus a possible arbitrary failure of the system to be controlled can be quickly counteracted.Furthermore, it is provided that, in addition to the temperature monitoring 106 described above, a supply voltage of each of the two integrated circuits 12, 18 is monitored 110. For this purpose, both the first monitor device 20 and the second monitor device 22 each have the voltage monitor 32 already described in connection with FIG. 1. If a value of the supply voltage detected by means of the voltage monitor 32 is above a predetermined threshold value, then in the present case, for example, the system to be controlled is brought into a safe state and the supply voltage of the system to be controlled is interrupted 108 in the manner described above. In a particular variant embodiment, all integrated circuits 12, 18 can be switched to a non-energized state for protection against an overvoltage.Moreover, it is provided that the first monitoring device 20 and the second monitoring device 22 are monitored 104 by means of a superordinate monitoring infrastructure. The superordinate monitoring infrastructure is preferably embodied as a hardware- and / or software-based checking and / or monitoring method. The test and / or monitoring methods can be a process monitoring based on diversity-implemented watchdogs. By way of example, these diversity implemented watchdogs may be provided as additional independent integrated circuits on the monolithic semiconductor substrate 14 in a manner not shown in more detail. Moreover, testing and / or monitoring methods already known from secure microcomputer systems of Siemens are expediently used. In the preferred application, at least some of the test and / or monitoring methods are implemented on a data processing device 26 of the first integrated circuit 12 or of the further integrated circuit 18. Furthermore, it can be provided that a hardware-implemented, specific re-ordering of memory contents of the memories 28 is provided. Systematically caused failures or errors in the first integrated circuit 12 or the second integrated circuit 18 can thereby be quickly and reliably detected. Cooperation of the above-described safety measures makes it possible to provide a safety stage 4 for a system on chip, in which a plurality of data processing devices 26 can be operated independently of one another on a monolithic semiconductor substrate 14.Although the invention has been illustrated and described in more detail by the preferred exemplary embodiments, the invention is not restricted by the disclosed examples and other variations can be derived therefrom by the person skilled in the art without departing from the scope of protection of the invention.Regardless of the grammatical sex of a certain term, individuals with male, female or other sex identity are included.

Claims

Semiconductor device (10) comprising: - a first integrated circuit (12) arranged on a first section of a monolithic semiconductor substrate (14); - a further integrated circuit (18) arranged on a further section of the monolithic semiconductor substrate (14); - a barrier (16), by means of which the first section of the monolithic semiconductor substrate (14) is physically separated from the further section of the monolithic semiconductor substrate (14); - a first guard device (20), which is embodied as part of the first integrated circuit (12); - a further guard device (22), which is embodied as part of the further integrated circuit (18).Semiconductor device (10) according to Claim 1, characterized in that the barrier (16) is designed as a thermal and / or electrical insulation.Semiconductor device (10) according to Claim 1 or 2, characterized in that the first monitoring device (20) and / or the further monitoring device (22) each have a temperature monitor (24).Semiconductor device (10) according to Claim 3, characterized in that the temperature monitor (24) has a plurality of temperature sensors which are arranged on one side along the barrier (16).Semiconductor device (10) according to one of the preceding claims, characterized in that the first monitor device (20) and / or the further monitor device (22) has a voltage monitor (32).Semiconductor device (10) according to Claim 5, characterized in that the voltage monitor (32) is configured to monitor a supply voltage of the first integrated circuit (12) or of the further integrated circuit (18).Semiconductor device (10) according to one of the preceding claims, characterized in that the first monitoring device (20) and / or the further monitoring device (22) has function monitoring for the purpose of detecting failure of a respectively associated integrated circuit (12, 18).Method (100) for operating a semiconductor device (10), in which - two integrated circuits (12, 18) of the semiconductor device (10) which are independent of one another and are physically separated from one another by means of a barrier (16) are operated in a concurrent manner (102); - a first of the two integrated circuits (12) is monitored (104) by means of a first monitoring device (20); - a further of the two integrated circuits (18) is monitored (104) by means of a further monitoring device (22).Method (100) according to claim 8, wherein a temperature along the barrier (16) is monitored (106) by means of the first monitoring device (20) and / or by means of the further monitoring device (22).Method (100) according to Claim 9, in which, in the event that a predetermined temperature threshold value is exceeded, a supply voltage of a system to be controlled by means of the first integrated circuit (12) and / or by means of the further integrated circuit (18) is interrupted (108) in a safe state of the system to be controlled.Method (100) according to one of Claims 8 to 10, in which a supply voltage of the first integrated circuit (12) is monitored (110) by means of the first monitoring device (20) and / or a supply voltage of the further integrated circuit (18) is monitored (110) by means of the further monitoring device (22).Method (100) according to claim 11, wherein in case a predetermined threshold value of the supply voltage is exceeded, the supply voltage of the system to be controlled by means of the first integrated circuit (12) and / or by means of the further integrated circuit (18) is interrupted (108) in the safe state of the system to be controlled.Method (100) according to one of Claims 8 to 12, in which the first monitoring device (20) and / or the further monitoring device (22) is monitored (104) by means of a superordinate monitoring infrastructure on the basis of software-based checking and / or monitoring methods.A computer program which, when executed, causes a data processing device (26) to perform the method (100) according to any one of claims 8 to 13.A computer readable medium comprising instructions that cause a data processing device (26) to perform the method (100) of any of claims 8 to 13.

Images