ELECTRONIC SAFETY SWITCHING DEVICE

Description

[0001] The present invention relates to an electronic safety switching device with at least one first and one second signal processing channel, to which input signals can be supplied for signal processing and which provide processed output signals, wherein the first and the second signal processing channel are configured to process the supplied input signals redundantly to each other, wherein the first and the second signal processing channel are each constructed using integrated semiconductor structures, and wherein the first signal processing channel is arranged monolithically on a first semiconductor substrate and the second signal processing channel is arranged monolithically on a second semiconductor substrate.

[0002] Such a safety switching device and such a method are known, for example, from US 2013 / 0231767 A1.

[0003] US 2013 / 0231767 A1 discloses a multi-chip module with a first chip and a second chip, each manufactured on its own substrate (die). The first chip is a control processor for generating a signal to control an industrial process. The second chip is a monitoring processor. The failure of one processor is detected by the other, with each processor having an I / O interface to bring the industrial process to a safe state in response to a fault. Furthermore, the first and second chips are manufactured using different process technologies.

[0004] Safety switching devices of the type mentioned above are primarily used in industrial applications and are found in almost all areas of mechanical and plant engineering. Safety switching devices perform defined safety functions. For example, they ensure the controlled and therefore safe stopping of a movement in a technical system or serve to monitor the position of movable protective devices. In principle, safety switching devices are designed to initiate a safe and reliable response in the event of a fault or breach of protective zones.

[0005] It goes without saying that very high demands are placed on the fault tolerance of such safety switching devices. As a rule, safety switching devices must first undergo appropriate approval by a competent regulatory authority before they may be used in industrial applications. In Germany, for example, the employers' liability insurance association or TÜV (Technical Inspection Association) carries out such approvals. Relevant standards for functional safety include DIN EN 61508 for the development of electrical, electronic, and programmable electronic (E / E / PE) systems and EN 61511 for the development of safety-related systems for the process industry. Among other things, these standards define Safety Integrity Levels (SILs) that serve to assess (E / E / PE) systems with regard to the reliability of their safety functions.Safety switching devices within the meaning of the present invention are devices that meet at least the requirements of a SIL 2.

[0006] A well-known and frequently used measure for achieving the required fault tolerance is to design the safety switching device with multiple redundant channels, where at least two signal processing channels monitor each other. If a fault occurs in one of the signal processing channels, the second signal processing channel is able to detect it and bring about a safe state for personnel in the vicinity of the machine. Particular attention must be paid to potential fault causes that affect several or all redundant signal processing channels in the same way (so-called common-cause faults), as otherwise the required fault tolerance cannot be guaranteed.

[0007] A common procedure for the approval of safety switching devices by the relevant regulatory authorities is that the designer or manufacturer of the safety switching device must submit a thorough and detailed failure analysis that covers every conceivable fault. This analysis must demonstrate that the safety switching device can reliably bring about a safe state for persons even if each fault occurs. Such an analysis is particularly time-consuming for complex safety switching devices with numerous functions, which negatively impacts development and manufacturing costs. Furthermore, this failure analysis must be repeated even for minor changes to the design or structure of the safety switching device, as, for example, a spatially different arrangement of otherwise identical components can introduce new sources of error.

[0008] For this reason, DE 100 53 820 A1 proposes an electronic safety switching device in which essential components of the redundant signal processing channels are formed from integrated semiconductor circuits arranged on a single semiconductor chip. This so-called on-chip redundancy, in which a single integrated and unalterable component is provided while maintaining the separate signal processing channels, has the advantage that the fault analysis required for regulatory approval only needs to be performed once. Subsequent checks can then be limited to quantitatively verifying compliance with the specifications defined during the development of the semiconductor chip, in particular adherence to the intended spatial dimensions and materials used.

[0009] Due to the specific architectural requirements that must be considered in the design and development of semiconductor chips with on-chip redundancy, such chips are often custom-made and generally many times more expensive than standard semiconductor chips with redundant structures, such as modern multi-core processors used for parallel processing. For example, in semiconductor chips with on-chip redundancy used for safety-critical applications, separate physical blocks must be created on the semiconductor substrate for each channel and for each monitoring element, such as a watchdog timer. These blocks must be positioned at a defined distance from each other to prevent mutual interference. Furthermore, each channel must have its own separate inputs and outputs that cannot pass through any of the other blocks.This makes the chip design particularly complex, and the integrated circuits typically occupy an above-average amount of area on a semiconductor substrate, which in turn increases the cost of a single chip.

[0010] Additionally, there are application areas in safety engineering that fundamentally preclude the use of systems with on-chip redundancy. For example, when using non-contact protective devices (NCPDs), systems in which the signal processing units of the individual channels are arranged on a semiconductor substrate are prohibited. Therefore, according to current standards, such protective devices cannot be used with known on-chip redundancy systems.

[0011] Further state of the art is shown in US 2012 / 0193681 A1 and US 2013 / 0176763 A1, which each show semiconductor devices with three-dimensional structures. However, neither of the semiconductor devices shown relates to semiconductor chips for safety switching devices with on-chip redundancy that can be used for safety-critical applications.

[0012] It is therefore an object of the present invention to provide a safety switching device of the type mentioned at the outset, which is small in size, cost-effective, efficient and usable for all common protective devices.

[0013] According to one aspect of the present invention, this problem is solved by an electronic safety switching device of the type mentioned at the outset, characterized in that the first semiconductor substrate and the second semiconductor substrate are assembled into a stack and thus form a single, one-piece electronic component, wherein the stack comprises a further semiconductor substrate, wherein the first semiconductor substrate comprises a first signal processing unit, the second semiconductor substrate comprises a second signal processing unit, and the further semiconductor substrate comprises a control and storage structure, and wherein the first signal processing unit and the second signal processing unit are coupled to the control and storage structure.

[0014] The present invention thus incorporates the idea of ​​using, in contrast to known on-chip redundancy systems, two separate semiconductor substrates stacked on top of each other to form a single electronic component. In this component, the integrated circuits of one signal processing channel form a first layer, which lies above a corresponding second layer containing the integrated circuits of the other signal processing channel. The two separate semiconductor substrates are arranged in two parallel layers, offset from each other in one direction orthogonally. This allows the individual integrated circuits on each semiconductor substrate to be designed independently, without having to consider the specific architectural requirements imposed on integrated circuits with on-chip redundancy.This allows for a simplification of the integrated circuit design, for example, by using a standard design for integrated processing units. Furthermore, the integrated circuits can be arranged efficiently and in a space-saving manner on the respective semiconductor substrate without having to comply with special safety requirements, which in turn reduces manufacturing costs.

[0015] The use of two separate semiconductor substrates also offers the advantage that such an electronic safety switching device can be used for safety-related applications where, due to existing standards, the use of on-chip redundancy systems was previously prohibited. In particular, such a safety switching device can be used for non-contact protective devices, which previously required electronic safety switching devices with completely separate signal processing via separate components and semiconductor chips. The new safety switching device is therefore versatile and flexible, compatible with common protective devices.

[0016] Furthermore, the new safety switching device has the advantage that the stack of two semiconductor substrates can be combined into a single component. In this context, "single component" means, in particular, that the finished electronic component cannot be modified afterward. In other words, the structure of the electronic component is fixed and unalterable during the development and design phases, but the final component is assembled from separate semiconductor substrates into the single component during the manufacturing process. Preferably, the semiconductor substrates in the stack are placed directly on top of each other and permanently bonded together to form the single component.It is particularly advantageous if the single-piece component, after the semiconductor substrates have been assembled into a stack, is encapsulated with a potting compound that forms a form-fitting bond around the semiconductor substrates, creating an integrated, multi-channel logic component that can, for example, be positioned on a printed circuit board in automated assembly processes. A defect analysis during the approval process by a regulatory authority is advantageously only required once, and subsequent checks can be limited to compliance with the necessary design specifications. Such checks are simpler and more cost-effective than a complete, repeated defect analysis.

[0017] Overall, the new safety switching device combines the advantages of an on-chip redundancy system with those of a system built with two independently redundant signal processing systems. The aforementioned task is thus completely solved.

[0018] In a preferred embodiment, the stack has an additional semiconductor substrate.

[0019] In this configuration, in addition to the first and second semiconductor substrates, a further semiconductor substrate is arranged in the stack. This additional substrate is either structured similarly to the other semiconductor substrates or contains structures that can perform other functions. In this way, a "System-on-Stack" (SoS) can be easily constructed, which can implement the relevant functions of a safety switching device on a single chip while simultaneously providing a structural division.

[0020] In a particularly preferred embodiment, the first semiconductor substrate has a first signal processing unit, the second semiconductor substrate has a second signal processing unit, and the further semiconductor substrate has a control and storage structure, wherein the first and the second signal processing unit are coupled to the control and storage structure.

[0021] In this configuration, the additional semiconductor layer serves as a control and memory structure, which can include, for example, a comparator, a watchdog timer, interfaces to peripherals, or RAM / ROM memory. This approach allows for a particularly simple design of the signal processing units, potentially utilizing a standardized layout, with shared elements arranged on the additional semiconductor substrate. This enables the combination of various components into a "system-on-stack" to create robust and cost-effective safety switching devices. Furthermore, by arranging the additional elements of a safety switching device within the single component, other potential sources of error can be reliably eliminated from the outset. In particular, wiring errors, such as those that can occur when connecting discrete components with conductive cables, can be avoided.

[0022] In a further particularly preferred embodiment, the additional semiconductor substrate is arranged in the stack between the first and the second semiconductor substrate.

[0023] In this embodiment, the first semiconductor substrate covers one side of the second semiconductor substrate, and the second semiconductor substrate covers the side of the second semiconductor substrate opposite the first side. In other words, the stack is structured like a layered system, with the second semiconductor substrate forming a middle layer. Preferably, the first and second semiconductor substrates completely cover the second semiconductor substrate on their respective sides. This measure physically protects the middle layer, and in particular any memory structures arranged on it, from external influences by the first and second semiconductor substrate layers, thus minimizing the effects of particles and waves on the middle layer. Advantageously, this allows "sensitive" RAM memories to be reliably protected from external influences.

[0024] In a further embodiment, the first and second semiconductor substrates are arranged spatially separated from each other in the stack.

[0025] In this configuration, the first and second semiconductor substrates are not stacked directly on top of each other, but are spatially separated. This measure has the advantage that the integrated semiconductor structures of the semiconductor substrates can be arranged at a distance from one another, thus physically preventing signal crosstalk or short circuits between the processing units.

[0026] In a further embodiment, an insulating layer and / or another semiconductor substrate are arranged between the first and the second semiconductor substrate.

[0027] This approach has the advantage that the first and second semiconductor substrates can be positioned at a defined distance from each other. This allows for the insertion of an insulating layer to electrically decouple the two semiconductor substrates, thereby preventing crosstalk and short circuits between the integrated semiconductor structures. Furthermore, an additional semiconductor substrate can be positioned between the first and second substrates, performing functions utilized by the semiconductor circuits on the first and / or second substrates. It is understood that a combination of insulating layers and semiconductor substrates can also be used as an intermediate layer to further leverage these advantages.

[0028] In a further embodiment, the stack has at least two semiconductor substrates and at least one vertical contact element, wherein the vertical contact element electrically connects the at least two semiconductor substrates.

[0029] In this configuration, the integrated semiconductor structures are arranged on different semiconductor substrates, but can be connected via vertical contact elements within the stack. This measure has the advantage that the semiconductor circuits on the first and second semiconductor substrates can be easily interconnected, for example to enable interprocess communication and to allow monitoring of the individual signal processing channels by the respective other signal processing channel.

[0030] Alternatively, it would also be conceivable to connect the redundant signal processing channels externally, i.e., outside the semiconductor substrates, for mutual data exchange. However, the preferred approach has the advantage that error analysis for mutual data exchange only needs to be performed once during the development of the chip stack, and errors during the installation of the signal processing channel can be reduced. Furthermore, internal data exchange via vertical contact elements is faster and less susceptible to disruptive environmental influences.

[0031] In a further embodiment, the first semiconductor substrate has a first signal processing unit and the second semiconductor substrate has a second signal processing unit, wherein the first signal processing unit has a duty cycle that is shifted in time relative to the second signal processing unit.

[0032] In this configuration, the first and second signal processing units have a processor clock that defines a fixed, preferably identical, duty cycle for the signal processing units. The duty cycle of the first signal processing unit is offset from the duty cycle of the second signal processing unit by at least one clock cycle. This measure has the advantage that common-cause errors can be detected more easily. For example, synchronously occurring errors, such as a simultaneous voltage spike in both signal processing channels, can be detected by the time offset in the processing of the signals by the signal processing units. Preferably, both signal processing units operate with a uniform processor clock that is shifted by one phase to account for the time offset.

[0033] The safety switching device has a first power supply and a second power supply that is separate from the first, with the first power supply being assigned to the first semiconductor substrate and the second power supply being assigned to the second semiconductor substrate.

[0034] In this configuration, the first and second semiconductor substrates are each supplied by a separate power supply, which preferably also has its own monitoring circuit to protect against overvoltages. This measure has the advantage that each semiconductor substrate with its integrated circuits has its own dedicated power supply, thus minimizing the risk of failure due to a faulty power supply or an unexpected overvoltage. This measure further increases the fault tolerance of the safety switching device.

[0035] It is understood that the features mentioned above and those to be explained below can be used not only in the combinations specified, but also in other combinations or on their own, without leaving the scope of the present invention.

[0036] Exemplary embodiments of the invention are shown in the drawing and are explained in more detail in the following description. They show: Figure 1 is a simplified representation of a preferred embodiment of the new safety switching device on a machine system, Figure 2 is a perspective representation of an embodiment of a one-piece electronic component of the new safety switching device, Figure 3 is a schematic representation of an embodiment of a chip stack of the new safety switching device, and Figure 4 is a schematic representation of a preferred embodiment of a chip stack of the new safety switching device.

[0037] In the Fig. 1 is an embodiment of the new electronic safety switching device in its entirety designated by reference numeral 10.

[0038] In this embodiment, the safety switching device is assigned to a technical system 12, which is represented here by a robot 14. During operation, the robot 14 poses a danger to a person who is in its working area. For this reason, the robot 14's working area is protected against unauthorized access by a protective device 16. In this case, the protective device 16 is a non-contact protective device in the form of a light curtain 18, which is arranged in the access area to the technical system 12 such that a person or object entering the access area interrupts at least one of a plurality of light beams emitted between a transmitter / receiver combination of the light curtain 18.

[0039] The light curtain 18 is connected to the safety switching device 10 via lines 20 and supplies it with input signals depending on its current state. In the case of an active protective device, such as the light curtain 18 shown here, redundant input signals, so-called OSSD signals, are generated automatically by the protective device and transmitted to the safety switching device 10. Passive protective devices, such as the emergency stop button 22 shown here, generally receive an output signal from the safety controller 10 and loop this back to the safety switching device 10 as an input signal.

[0040] In this embodiment, the safety switching device 10 has an I / O unit 24 with a plurality of device connections for receiving input signals and providing output signals. In some embodiments, these device connections are terminal blocks arranged on one side of the housing 26 of the safety switching device 10, for example, in the form of spring-clamp terminals or screw terminals. In other embodiments, the device connections can be plugs or sockets containing multiple contact elements, with each pin forming a device connection. M8 sockets with five contact pins are frequently used for connecting protective devices or other sensors at the field level.

[0041] In the case shown here, the light grid 18 generates two redundant input signals (OSSD1, OSSD2) which are fed to the safety switching device 10 via separate lines 20. In other embodiments, the input signals can also be transmitted via two wires of a single connecting cable. It is also conceivable that the input signals are transmitted to the safety switching device 10 via a bus, for example, a safe fieldbus. In such a case, the I / O unit 24 is designed as a communication module that implements the protocol of the bus used. The input signals can be read by the communication module and provided to the safety switching device 10 as a redundant input signal pair.

[0042] In the present embodiment, the safety switching device 10 has a first signal processing channel 28 and a second signal processing channel 30, which are designed to be redundant to each other and are configured to evaluate the input signals of a protective device 16, 22 redundantly to each other. The two signal processing channels 28, 30 are at least partially constructed using integrated semiconductor structures, wherein the integrated semiconductor structure of the first signal processing channel 28 is arranged on a first semiconductor substrate 32 and the integrated semiconductor structure of the second signal processing channel 30 is arranged on a second semiconductor substrate 34. The first and second semiconductor substrates 32, 34 are combined to form a chip stack 36 and encapsulated to form a single electronic component 38 in a manner known per se.

[0043] In preferred embodiments, all essential components of a signal processing channel are built on a semiconductor substrate using integrated semiconductor structures, and the semiconductor substrates are assembled into a stack 36. Thus, a chip stack 36 preferably includes inputs and outputs, central processing units, memory, comparators, and A / D converters, with the aid of which the input signals can be processed reliably. Alternatively or additionally, the signal processing channels 28, 30 can also include further discrete components that are not designed as integrated semiconductor structures.In the case shown here, the safety switching device 10 has, for example, a switching element 40a, 40b for each signal processing channel 28, 30, each of which is capable of switching a high voltage potential 42 to a device terminal 44a, 44b of the safety switching device 10 in order to enable or interrupt a current flow to a contactor 46a, 46b. Thus, each switching element 40 can switch off an actuator, such as a contactor 46a, 46b, or a solenoid valve.

[0044] Contactors 46a and 46b each have normally open contacts 48a and 48b. These contacts are connected in series in a power supply path from a power supply 50 to the robot 14. As soon as the safety switching device 10 switches off contactors 46a and 46b, contacts 48a and 48b drop out, and the power supply 50 to the robot 14 is switched off. Those familiar with the technology understand that such a "radical" shutdown is described here as an example. Alternatively, in the event of a safety requirement, only parts of the robot 14, such as the hazardous drives, can be switched off, while other parts of the robot 14 remain operational. A delayed shutdown is also conceivable, allowing the robot 14 to be slowed down in a controlled manner before the drives are switched off.

[0045] It is understood that safety switching devices are not limited to the embodiment shown here. Safety switching devices within the meaning of the invention also include, for example, configurable safety switching devices, programmable safety controllers, or safe modules of a standard controller.

[0046] In the Fig. 2 Figure 38 shows a highly simplified embodiment of a one-piece electronic component 38. The same reference numerals denote identical parts as previously shown in the figure. Fig. 1 .

[0047] The single-piece electronic component 38 is implemented here as a microchip with a dual inline package (DIP) package. Within the DIP package, a chip stack 36 with a first semiconductor substrate 32 and a second semiconductor substrate 34 is arranged on a carrier 52. The semiconductor structures on the two semiconductor substrates 32 and 34 are connected via conductor tracks 54 using suitable interconnection technology, such as bonding. The conductor tracks 54 are in turn connected to contact pins 56, through which the semiconductor structures can be contacted externally. For example, input signals can be applied to the integrated semiconductor structures on the semiconductor substrates 32 and 34 via the contact pins 56, and output signals can be routed to the outside via these contact pins 56.

[0048] Unlike conventional electronic components, the new safety switching device has at least two semiconductor substrates 32, 34 arranged within the electronic component 38. The semiconductor substrates 32, 34 are preferably stacked overlapping to form a cuboid stack 36. Each semiconductor substrate contains an independent semiconductor structure that represents a signal processing channel. Coupling of the integrated semiconductor structures of the first semiconductor substrate 32 with the semiconductor structures of the second semiconductor substrate 34 can be achieved within the electronic component 38 via the conductor tracks 54 on the carrier 52 inside the DIP package, or via a connection between the terminal pins 56 outside the package. However, it is particularly preferred that the integrated semiconductor structures are coupled to each other within the stack 36. As will be shown below with reference to the Fig. 3 As explained in more detail, vertical connections parallel to the vertical axis 58 of the chip stack 36 are integrated into the semiconductor substrates 32, 34.

[0049] At the end of the manufacturing process, the DIP package is fitted with a cover (not shown here). This cover is placed over the conductive traces 54 and the chip stack 36. The conductive traces 54 and the chip stack 36 are thus securely enclosed within the DIP package and reliably protected from alterations and environmental influences. Likewise, subsequent modifications to the structure of the signal processing channels or their coupling are either impossible or severely restricted.

[0050] It is understood that a DIP package, as shown here, is only one possible package type in which a chip stack 36 described herein can be arranged and is not to be understood as limiting. Other common package types, such as a small-outline (SO) package using SMD technology, are equally conceivable for the construction of a single-piece electronic component proposed here. Furthermore, in another embodiment, the unpackaged chip stack 36 could also be encapsulated by a potting compound that surrounds the chip stack 36 and forms a form-fitting seal around the semiconductor substrates 32, 34. By packaging the chip stack in a package and / or using a potting compound, an integrated, multi-channel logic component is created that can, for example, be positioned on a printed circuit board in automated assembly processes.

[0051] Fig. 3 Figure 1 shows a simplified schematic representation of an embodiment of a chip stack 36. In this embodiment, the chip stack 36 comprises a first and a second semiconductor substrate 32, 34, which are arranged one above the other to form a stack. Semiconductor structures are arranged on each of the semiconductor substrates 32, 34, forming a monolithic circuit with active and passive components. In the case shown here, an electronic circuit of a first signal processing channel 28 is arranged on the first semiconductor substrate 32, and an electronic circuit of a second signal processing channel 30 is arranged on the second semiconductor substrate 34.

[0052] During manufacturing, the semiconductor substrates 32, 34 can initially be produced independently of one another and provided with a corresponding semiconductor structure. Alternatively, both semiconductor substrates 32, 34 can initially be part of a common base semiconductor substrate on which several semiconductor structures for different chips are formed simultaneously. Subsequently, the base semiconductor substrate is divided into several individual chips, which are then stacked on top of each other to form a chip stack. To avoid common-cause defects, however, the individual semiconductor substrates of the chip stack 36 preferably come from different production batches.

[0053] The chip stack 36 is not limited to the use of specific semiconductor substrates and starting materials. Besides common silicon semiconductors, organic semiconductors, so-called plastic electronics, can also be used, for example. Preferably, the chip stack 36 has very thin semiconductor substrates, whereby sufficient stability can be achieved through stacking. Likewise, the semiconductor substrates do not necessarily have to be identical. A design with semiconductor substrates of different thicknesses is also conceivable. For example, a base layer could be formed from a thicker semiconductor substrate than the other layers of the stack 36 in order to provide a stable base for the stack 36.

[0054] The integrated semiconductor structures on the semiconductor substrates are initially independent of each other and are only coupled after stacking. Coupling occurs externally or within the stack via vertical contact elements 60. In the case shown here, the chip stack 36 has several vertical contact elements 60 for coupling. The vertical contact elements 60 are conductors that are formed parallel to the stacking direction 62 of the chip stack 36. The vertical contact elements 60 are also referred to as "Through Silicon Vias" (TSVs) and establish an electrical connection between two semiconductor substrates. The vertical contact elements 60 are holes or recesses in the semiconductor substrates that are created by drilling or special etching processes. The holes in the semiconductor substrates contact the semiconductor structures in the semiconductor substrate and extend to the surface at least on one side of the semiconductor substrate.The holes are filled with conductive material, such as copper or aluminum, and are arranged flush on top of each other when the semiconductor substrates are stacked, so that the conductive material in a hole of the first semiconductor substrate 32 comes into electrical contact with the conductive material of another hole in the second semiconductor substrate 34. In this way, direct connections can be created between the semiconductor structures of the first semiconductor substrate 32 and the second semiconductor substrate 34, enabling virtually latency-free interprocess communication between the two semiconductor structures.

[0055] It is understood that alternatively a connection between the semiconductor substrates 32, 34, as before with regard to Fig. 2 As described, it can also be created outside the chip stack 36. For this purpose, the contacts of the semiconductor structures on the semiconductor substrates are brought outwards and preferably connected to each other within the single-piece component.

[0056] For contacting the semiconductor structures of the first semiconductor substrate 32, first contact surfaces 64 are arranged on the surface of the first semiconductor substrate 32 for illustrative purposes. These surfaces can be contacted via bond wires 66 in a manner known per se. In this preferred embodiment, second contact surfaces 68 are also arranged on the surface of the first semiconductor substrate 32, through which the semiconductor structures of the second semiconductor substrate 34 can be contacted. The second contact surfaces 68 are connected to the semiconductor structures of the second semiconductor substrate 34 via further vertical contact elements 70 in the manner described above. Advantageously, the common methods for contacting unpackaged semiconductor chips can thus also be used for contacting the unpackaged chip stack 36. Alternatively or additionally, contact surfaces can also be formed on the second semiconductor substrate that can be contacted externally.

[0057] As an alternative to bond wires 66, other methods for contacting the unpackaged chip stack 36 are conceivable, such as flip-chip assembly, also known as controlled collapse chip connection (C4). In flip-chip assembly, the unpackaged chip stack 36 is mounted directly onto a substrate, without additional connecting wires, with the active contact side of one of the semiconductor substrates 32, 34 facing downwards. This results in particularly small package dimensions and short conductor lengths. Short circuits caused by touching bond wires can thus be prevented particularly easily and effectively. Furthermore, in flip-chip bonding technology, all contacts are connected simultaneously, which reduces manufacturing time. In addition to soldering and conductive adhesive bonding, thermal bonding can also be used as a joining method for bonding the chips.Flip-chip assembly also has the advantage that, as a rule, only a small amount of mechanical stress is exerted on the chip during contacting. This allows even very thin and porous semiconductor substrates 32, 34 to be used for creating the chip stack 36. A chip assembled using the flip-chip method is generally no longer separately encapsulated, but rather coated with an alloy or filler material to protect it from environmental influences and changes. Such a "housing" is particularly cost-effective to manufacture.

[0058] Fig. 4 Figure 1 shows a particularly preferred embodiment of a chip stack 36 in a simplified schematic representation. In this embodiment, the chip stack 36 is formed from a first semiconductor substrate 32, a second semiconductor substrate 34, and a further semiconductor substrate 72. The first semiconductor substrate 32 and the second semiconductor substrate 34 are essentially identical in structure. Thus, the first semiconductor substrate 32 includes a first signal processing unit 74 as an integrated semiconductor structure, and the second semiconductor substrate 34 includes a second signal processing unit 76 as an integrated semiconductor structure.

[0059] In a particularly preferred embodiment, the first and second signal processing units 74, 76 are functionally identical but diverse in design to reduce the risk of common cause errors during signal processing. The first signal processing unit 74 is assigned to the first signal processing channel 28, and the second signal processing unit 76 is assigned to the second signal processing channel 30. The first and second signal processing units 74, 76 process the input signal in parallel and independently generate an output signal depending on the input signal. Preferably, only the first and second signal processing units 74, 76 are arranged on the first and second semiconductor substrates 32, 34.

[0060] The first and second signal processing units 74, 76 operate together as a fault-tolerant system and process the input signal in parallel. Such redundancy is also known as Dual Modular Redundancy (DMR) and provides high robustness against faults. DMR systems can reliably detect faults, but cannot readily determine in which channel a fault occurred. Therefore, in another embodiment, the safety switching device could have at least one further signal processing unit, preferably also integrated in the single-piece electronic component, thus creating triple redundancy. Systems with triple redundancy are also known as Triple Modular Redundancy (TMR) systems and are used, for example, in aircraft or in systems with high availability requirements.TMR systems can not only detect errors, but also correct them based on the majority principle.

[0061] In this embodiment, the signal processing units 74 and 76 are each operated with their own processor clock. Preferably, the processor clocks of the first and second signal processing units 74 and 76 are phase-shifted relative to each other. This allows the signal processing units 74 and 76 to process the input signal in parallel, but with a slight time offset. This further increases fault tolerance, as a disturbance occurring simultaneously on both channels, such as a brief voltage spike, can be reliably detected.

[0062] Furthermore, in this preferred embodiment, the additional semiconductor substrate 72 is arranged between the first semiconductor substrate 32 and the second semiconductor substrate 34. The additional semiconductor substrate 72 has one or more separate integrated semiconductor structures that form a control and memory structure, which can be coupled to the integrated semiconductor structures of the first semiconductor substrate 32 and / or the second semiconductor substrate 34. In the example shown here, the control and memory structure includes a comparator 78, memory areas 80a, 80b, and a watchdog timer 82, which can assist in signal processing or monitor the proper functioning of the signal processing units 74, 76.

[0063] The comparator 78, for example, is an electronic circuit that compares two digital values. The "watchdog" 82 is an integrated circuit that can prevent a complete failure of the electronic component due to a software failure. The "watchdog" is designed, for example, as a counter that is set to a specific value by the software at regular intervals and continuously decremented by the hardware. Should the counter reach the value 0, a software failure is assumed, and the "watchdog" executes a predetermined reaction, which in this case specifically triggers the safety function of the safety switching device. The memory areas 80a and 80b can, for example, be working memory for the processing units 74 and 76, or read-only memory containing stored parameters of the safety switching device.

[0064] It is understood that the additional semiconductor substrate 72, as shown here, does not necessarily have to be arranged between the first and second semiconductor substrates 32, 34 in the chip stack 36. Alternatively, the additional semiconductor substrate 72 could also be arranged above or below the first and second semiconductor substrates 32, 34. The arrangement shown here is particularly preferred when both the first and second signal processing units 74, 76 are coupled to the control and storage structure of the additional semiconductor substrate 72. Furthermore, the almost complete coverage of the additional semiconductor substrate 72 by the first and second semiconductor substrates 32, 34 provides particularly good protection against radiation and wave interference.

[0065] The integrated semiconductor structures on the first, second and further semiconductor substrates 32, 34, 72 are coupled as before with reference to Fig. 3 described, via vertical contact elements 60. Likewise, contacting of the semiconductor substrates can be carried out as described above via contact surfaces on the surface and further vertical contact elements (not shown here).

[0066] In the example shown here, the comparator 78 is coupled to both the first signal processing unit 74 on the first semiconductor substrate 32 and the second signal processing unit 76 on the second semiconductor substrate 34. In this way, the signal processing units 74 and 76 can be connected to the comparator 78 very efficiently and homogeneously, and with virtually any width. In a single duty cycle, a comparison of values ​​between the first signal processing unit 74 and the second signal processing unit 76 can thus be performed with virtually no latency.

[0067] With regard to the memory areas 80a, 80b, the contact elements 60 can be arranged such that the first signal processing unit 74 can exclusively access a first memory area 80a and the second signal processing unit 76 can exclusively access a second memory area 80b. The "watchdog" 82 can, in turn, advantageously be connected to both signal processing units 74, 76 and monitor their correct operation. Furthermore, in this configuration, it is also possible for the first semiconductor substrate 32 to be directly connected to the second semiconductor substrate 34 by means of a vertical contact element extending from the first semiconductor substrate 32 through the second semiconductor substrate 72 to the second semiconductor substrate 34.

[0068] Contrary to the representation in Fig. 4 Furthermore, the first, second, and subsequent semiconductor substrates 32, 34, 72 can have different material properties and, in particular, different substrate thicknesses. Preferably, the subsequent semiconductor substrate 72 is thicker than the first and second semiconductor substrates 32, 34 to enable shielding of the two signal processing units 74, 76 from each other. Thus, a thicker subsequent semiconductor substrate 72 physically prevents crosstalk between the first signal processing unit 74 and the second signal processing unit 76, and vice versa.

[0069] Finally, the Fig. 4 A first and a second power supply 84, 86, which are configured separately from each other. The first power supply 84 is coupled to the first semiconductor substrate 32, and the second power supply 86 is coupled to the second semiconductor substrate 34. The integrated semiconductor structures of the first semiconductor substrate 32 are supplied with a supply voltage via the first power supply 84, and the integrated semiconductor structures of the second semiconductor substrate 34 are supplied with a supply voltage via the second power supply 86. Preferably, the first and second power supplies 84, 86 each include an overvoltage monitoring unit (not shown here). The overvoltage monitoring unit is configured to decouple the power supply in the event of an overvoltage, for example, by means of a crowbar circuit.

[0070] It goes without saying that the in Fig. 4 The structures shown can be combined with one another as desired in a different embodiment. The chip stack 36 is therefore not limited to the three semiconductor substrates 28, 30, 72 shown. In further advantageous embodiments, additional semiconductor substrates and / or other layers, such as insulating layers, can be arranged in the chip stack 36. It is also conceivable that a multitude of the structures shown in the Fig. 4 The systems shown are housed in a chip stack to create extremely space-saving, n-channel, highly available, and fault-tolerant "systems-on-stack." This allows for the creation of very cost-effective, flexible, and safe safety switching devices with dual or multiple redundancies that can meet the requirements of safety integrity level SIL3.

[0071] One aspect of the present invention is thus an electronic safety switching device with at least a first signal processing channel and a second signal processing channel, to which input signals can be supplied for signal processing and which provide processed output signals, wherein the first signal processing channel and the second signal processing channel process the supplied input signals redundantly to each other, and wherein the first signal processing channel and the second signal processing channel are each constructed using integrated semiconductor structures, wherein the first signal processing channel is arranged monolithically on a first semiconductor substrate and the second signal processing channel is arranged monolithically on a second semiconductor substrate, wherein the first and the second semiconductor substrates are assembled into a stack and form a single electronic component.

Claims

1. Electronic safety switching device (10), comprising at least a first processing channel (28) and a second signal processing channel (30) to which input signals may be supplied for signal processing, and which provide processed output signals, wherein the first signal processing channel (28) and the second signal processing channel (30) are configured to process the supplied input signals redundantly with respect to one other, wherein the first signal processing channel (28) and the second signal processing channel (30) are respectively configured with the aid of integrated semiconductor structures, wherein the first signal processing channel (28) is arranged monolithically on a first semiconductor substrate (32), and the second signal processing channel (30) is arranged monolithically on a second semiconductor substrate (34), characterized in that the first semiconductor substrate (32) and the second semiconductor substrate (34) are combined into a stack (36) to form a one-piece electronic component (38), wherein the stack (36) comprises an additional semiconductor substrate (72), wherein the first semiconductor substrate (32) comprises a first signal processing unit (74), the second semiconductor substrate (34) comprises a second signal processing unit (76), and the additional semiconductor substrate (72) comprises a control and memory structure, and wherein the first signal processing unit (74) and the second signal processing unit (76) are coupled to the control and memory structure.

2. Electronic safety switching device according to claim 1, wherein the control and memory structure comprises a comparator (78) for cross-checking the first signal processing unit (74) and second signal processing unit (76), wherein the comparator (78) is directly connected to the first signal processing unit (74) and second signal processing unit (76).

3. Electronic safety switching device according to any one of claims 1 to 2, wherein the additional semiconductor substrate (72) is arranged in the stack (36) between the first semiconductor substrate (32) and the second semiconductor substrate (34).

4. Electronic safety switching device according to any one of claims 1 to 3, wherein the first semiconductor substrate (32) and the second semiconductor substrate (34) are arranged spatially distanced from one another in the stack (36).

5. Electronic safety switching device according to any one of claims 1 to 4, wherein an insulation layer is arranged between the first second semiconductor substrate (32) and the second semiconductor substrate (34).

6. Electronic safety switching device according to any one of claims 1 to 5, wherein the stack (36) comprises at least two semiconductor substrates (32, 34, 72) and at least one vertical contact element (60), wherein the vertical contact element (60) electrically connects the at least two semiconductor substrates (32, 34, 72).

7. Electronic safety switching device according to any one of claims 1 to 6, wherein the first signal processing unit (74) comprises an operating cycle which is time-shifted with respect to the second signal processing unit (76).

8. Electronic safety switching device according to any one of claims 1 to 7, wherein the electronic safety switching device (10) further comprises a first voltage supply (84), and a second voltage supply (86) which is separate from the first voltage supply (84), and wherein the first voltage supply (84) is associated with the first semiconductor substrate (32), and the second voltage supply (86) is associated with the second semiconductor substrate (34).