Fault detection circuit, semiconductor device, and fault detection method

Abstract

To provide a fault detection circuit, a semiconductor device, and a fault detection method capable of detecting faults with high accuracy.SOLUTION: A fault detection circuit disclosed herein is provided in a target circuit having a first circuit area that operates in synchronization with a first clock signal, and includes a first detection circuit that outputs a first detection result having a voltage level transitioned in synchronization with the first clock signal, a second detection circuit that outputs a second detection result having a voltage level transitioned in synchronization with the first clock signal, and a first comparison circuit that compares the first detection result with the second detection result and outputs a first comparison result. As a result, the failure detection circuit disclosed herein can detect failures with high accuracy.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a fault detection circuit, a semiconductor device, and a fault detection method, and, for example, to a fault detection circuit, a semiconductor device, and a fault detection method suitable for detecting faults with high accuracy. [Background technology]

[0002] Patent Document 1 discloses a semiconductor device that reduces security risks caused by fault injection attacks. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2023-73928 A Summary of the Invention [Problem to be solved by the invention]

[0004] The semiconductor device disclosed in Patent Document 1 only has measures implemented to reduce security risks due to fault injection attacks, and has the problem that it is not possible to detect failures caused by fault injection attacks. Other problems and novel features will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0005] The fault detection circuit disclosed herein is provided in a target circuit having a first circuit area that operates in synchronization with a first clock signal, and includes a first detection circuit that outputs a first detection result having a voltage level transitioned in synchronization with the first clock signal, a second detection circuit that outputs a second detection result having a voltage level transitioned in synchronization with the first clock signal, and a first comparison circuit that compares the first detection result with the second detection result and outputs a first comparison result.

[0006] The fault detection method disclosed herein is a fault detection method using a fault detection circuit provided in a target circuit having a first circuit area that operates in synchronization with a first clock signal, the method using a first detection circuit to output a first detection result in which a voltage level has been transitioned in synchronization with the first clock signal, using a second detection circuit to output a second detection result in which a voltage level has been transitioned in synchronization with the first clock signal, and using a first comparison circuit to compare the first detection result with the second detection result and output a first comparison result. Effect of the Invention

[0007] The present disclosure can provide a fault detection circuit, a semiconductor device, and a fault detection method that are capable of detecting faults with high accuracy. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing a configuration example of a semiconductor device to which a failure detection circuit according to a first embodiment is applied. [Diagram 2] FIG. 2 is a diagram showing a first specific configuration example of the failure detection circuit provided in the semiconductor device shown in FIG. [Diagram 3] FIG. 3 is a timing chart showing the operation of the failure detection circuit shown in FIG. [Figure 4] FIG. 4 is a diagram showing a second specific configuration example of the failure detection circuit provided in the semiconductor device shown in FIG. [Diagram 5] FIG. 5 is a timing chart showing the operation of the failure detection circuit shown in FIG. [Figure 6] FIG. 6 is a diagram showing a third specific example of the configuration of the failure detection circuit provided in the semiconductor device shown in FIG. [Figure 7] FIG. 7 is a timing chart showing the operation of the failure detection circuit shown in FIG. [Figure 8] FIG. 8 is a block diagram showing a configuration example of a semiconductor device to which the failure detection circuit according to the second embodiment is applied. As shown in FIG. [Figure 9]FIG. 9 is a block diagram showing a configuration example of a semiconductor device to which a failure detection circuit according to the third embodiment is applied. As shown in FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, the embodiments will be described with reference to the drawings. Note that the drawings are simplified, and the technical scope of the embodiments should not be interpreted narrowly based on the description in the drawings. Also, the same elements are given the same reference numerals, and duplicated explanations will be omitted.

[0010] In the following embodiments, when necessary for convenience, the description will be divided into multiple sections or embodiments. However, unless otherwise specified, they are not unrelated to each other, and one is a partial or complete modification, application example, detailed explanation, supplementary explanation, etc. of the other. Furthermore, in the following embodiments, when the number of elements (including the number, numerical value, amount, range, etc.) is mentioned, it is not limited to the specific number, and may be more or less than the specific number, unless otherwise specified or when it is clearly limited to a specific number in principle.

[0011] Furthermore, in the following embodiments, the components (including operation steps, etc.) are not necessarily essential unless otherwise specified or considered to be clearly essential in principle. Similarly, in the following embodiments, when referring to the shape, positional relationship, etc. of the components, etc., it is intended to include those that are substantially similar or similar to the shape, etc., unless otherwise specified or considered to be clearly not essential in principle. The same applies to the above numbers, etc. (including numbers, values, amounts, ranges, etc.).

[0012] <Embodiment 1> 1 is a block diagram showing a configuration example of a semiconductor device 100 to which a fault detection circuit 1 according to a first embodiment is applied. The semiconductor device 100 is, for example, an SoC or an MCU.

[0013] 1 includes a fault detection circuit 1 and a target circuit TG1 that is a fault detection target by the fault detection circuit 1. The fault detection circuit 1 is provided in the target circuit TG1, and includes a first detection circuit 111 that is a master, a second detection circuit 112 that is a checker, and a comparison circuit 113.

[0014] The first detection circuit 111 detects the rising edge of a clock signal CLK1 used in the target circuit TG1 and outputs a detection result M1. For example, the first detection circuit 111 transitions the voltage level of the detection result M1 from H level to L level or from L level to H level in synchronization with the rising edge of the clock signal CLK1. In addition, the first detection circuit 111 initializes the voltage level of the detection result M1 to a predetermined level (either H level or L level) at the timing when a reset signal RST1 used in the target circuit TG1 becomes active (e.g., H level).

[0015] The second detection circuit 112 detects the rising edge of a clock signal CLK1 used in the target circuit TG1 and outputs a detection result C1. For example, the second detection circuit 112 transitions the voltage level of the detection result C1 from H level to L level or from L level to H level in synchronization with the rising edge of the clock signal CLK1. In addition, the second detection circuit 112 initializes the voltage level of the detection result C1 to a predetermined level (either H level or L level) at the timing when a reset signal RST1 used in the target circuit TG1 becomes active (e.g., H level).

[0016] The comparison circuit 113 compares the detection result M1 of the first detection circuit 111 with the detection result C1 of the second detection circuit 112 in synchronization with the rising edge of the clock signal CLK1.

[0017] In this embodiment, the first detection circuit 111 and the second detection circuit 112 detect the rising edge of the clock signal CLK1, and the comparison circuit 113 performs the comparison operation in synchronization with the rising edge of the clock signal CLK1, but the present invention is not limited to this. The first detection circuit 111 and the second detection circuit 112 may be configured to detect the falling edge of the clock signal CLK1, and the comparison circuit 113 may be configured to perform the comparison operation in synchronization with the falling edge of the clock signal CLK1.

[0018] For example, when no failure occurs in the target circuit TG1, there is a high possibility that the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate the same value. Therefore, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate the same value, the comparison circuit 113 outputs an error signal ERR1 in an inactive state (for example, L level) indicating that no failure occurs in the target circuit TG1.

[0019] In contrast, when a failure occurs in the target circuit TG1, there is a high possibility that the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 will exhibit different values. Therefore, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 exhibit different values, the comparison circuit 113 outputs an error signal ERR1 in an active state (for example, H level) indicating that a failure has occurred in the target circuit TG1.

[0020] Here, failures in the target circuit TG1 include not only failures that occur naturally in the target circuit TG1, but also tampering with data in the target circuit TG1 due to an external attack, and unintended operation (fluctuation) of the power supply, electromagnetic waves, and clock signal in the target circuit TG1 due to an external attack.

[0021] When the error signal ERR1 becomes active, the semiconductor device 100 stops or initializes the operation of the target circuit TG1 or the semiconductor device 100. Alternatively, when the error signal ERR1 becomes active, the semiconductor device 100 may notify the outside that a failure has occurred in the target circuit TG1, or may issue a CPU interrupt notification to have software handle the failure.

[0022] (First Specific Configuration Example and Operation of Fault Detection Circuit 1) Fig. 2 is a diagram showing a first specific configuration example of the fault detection circuit 1 provided in the semiconductor device 100 as a fault detection circuit 1a. Note that Fig. 2 also shows not only the fault detection circuit 1a but also a target circuit TG1 and the semiconductor device 100 including the target circuit TG1. Fig. 3 is a timing chart showing the operation of the fault detection circuit 1a.

[0023] 2, the failure detection circuit 1a includes a first detection circuit 111a, a second detection circuit 112a, and a comparison circuit 113a. The first detection circuit 111a, the second detection circuit 112a, and the comparison circuit 113a correspond to the first detection circuit 111, the second detection circuit 112, and the comparison circuit 113, respectively.

[0024] The first detection circuit 111a includes a selector 1111, a flip-flop 1112, and an inverter 1113. The selector 1111 selects and outputs either a signal of value "0" or the output of the inverter 1113 in response to the reset signal RST1. For example, the selector 1111 selects and outputs a signal of value "0" when the reset signal RST1 is active (e.g., H level), and selects and outputs the output of the inverter 1113 when the reset signal RST1 is inactive (e.g., L level). The flip-flop 1112 takes in and outputs the output signal of the selector 1111 in synchronization with the rising edge of the clock signal CLK1. The inverter 1113 inverts and outputs the output of the flip-flop 1112. The output signal of the inverter 1113 is also used as a detection result M11, which is one of the detection results M1 of the first detection circuit 111a.

[0025] In other words, the first detection circuit 111a initializes the detection result M11 to an H level when the reset signal RST1 becomes active, and then transitions the voltage level of the detection result M11 from an H level to an L level or from an L level to an H level in synchronization with the rising edge of the clock signal CLK1.

[0026] The second detection circuit 112a includes a selector 1121, a flip-flop 1122, and an inverter 1123. The selector 1121 selects and outputs either a signal of value "0" or the output of the inverter 1123 in response to the reset signal RST1. For example, the selector 1121 selects and outputs a signal of value "0" when the reset signal RST1 is active (e.g., H level), and selects and outputs the output of the inverter 1123 when the reset signal RST1 is inactive (e.g., L level). The flip-flop 1122 takes in and outputs the output signal of the selector 1121 in synchronization with the rising edge of the clock signal CLK1. The inverter 1123 inverts and outputs the output of the flip-flop 1122. The output signal of the inverter 1123 is also used as a detection result C11, which is one of the detection results C1 of the second detection circuit 112a.

[0027] In other words, the second detection circuit 112a initializes the detection result C11 to the H level when the reset signal RST1 becomes active, and then transitions the voltage level of the detection result C11 from the H level to the L level or from the L level to the H level in synchronization with the rising edge of the clock signal CLK1.

[0028] The comparison circuit 113a includes flip-flops 1131, 1132, 1135, and 1136, an exclusive OR circuit (hereinafter referred to as an XOR circuit) 1137, a logical AND circuit (hereinafter referred to as an AND circuit) 1140, and a holding circuit 1141. The flip-flop 1131 captures and outputs the detection result C11 of the second detection circuit 112a in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1132 captures and outputs the output signal of the flip-flop 1131 in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1137 outputs the exclusive OR of the output of the flip-flop 1132 and the detection result M11 of the first detection circuit 111a. The flip-flop 1135 captures and outputs the reset signal RST1 in synchronization with the rising edge of the clock signal CLK1. Flip-flop 1136 captures and outputs the output signal of flip-flop 1135 in synchronization with the rising edge of clock signal CLK1. AND circuit 1140 outputs the logical product of the output signal of XOR circuit 1137 and the inverted signal of the output signal of flip-flop 1136. Hold circuit 1141 holds the output signal of AND circuit 1140 and outputs it as error signal ERR1.

[0029] For example, when the reset signal RST1 is active (e.g., H level), the AND circuit 1140 outputs an L-level signal, and when the reset signal RST1 is inactive (e.g., L level), it outputs a signal of a voltage level according to the detection results M11, C11. Specifically, when the reset signal RST1 is inactive, the AND circuit 1140 outputs an L-level signal if the detection results M11, C11 match, and outputs an H-level signal if the detection results M11, C11 do not match. The holding circuit 1141 outputs an error signal ERR1 in an inactive state (e.g., L level) by being initialized, and switches the error signal ERR1 from an inactive state to an active state (e.g., H level) at the timing when an H-level signal is output from the AND circuit 1140 (i.e., the timing when a mismatch of the detection results M11, C11 is detected).

[0030] 3, if an external attack on the target circuit TG1 causes the detection result C11 of the second detection circuit 112a to not transition correctly from L level to H level, the detection results M11 and C11 will no longer match (time t11). At this time, the comparison circuit 113a outputs an error signal ERR1 in an active state (H level) indicating that a fault has occurred in the target circuit TG1 (time t11).

[0031] (Second Specific Configuration Example and Operation of Fault Detection Circuit 1) Fig. 4 is a diagram showing a second specific configuration example of the fault detection circuit 1 provided in the semiconductor device 100 as a fault detection circuit 1b. Note that Fig. 4 also shows not only the fault detection circuit 1b but also a target circuit TG1 and the semiconductor device 100 including the target circuit TG1. Fig. 5 is a timing chart showing the operation of the fault detection circuit 1b.

[0032] 4, the failure detection circuit 1b includes a first detection circuit 111b, a second detection circuit 112b, and a comparison circuit 113b. The first detection circuit 111b, the second detection circuit 112b, and the comparison circuit 113b correspond to the first detection circuit 111, the second detection circuit 112, and the comparison circuit 113, respectively.

[0033] The first detection circuit 111b includes a selector 1114, a flip-flop 1115, and an inverter 1116. The selector 1114 selects and outputs either a signal of value "1" or the output of the inverter 1116 in response to the reset signal RST1. For example, the selector 1114 selects and outputs a signal of value "1" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1116 when the reset signal RST1 is inactive. The flip-flop 1115 takes in and outputs the output signal of the selector 1114 in synchronization with the rising edge of the clock signal CLK1. The inverter 1116 inverts and outputs the output of the flip-flop 1115. The output signal of the inverter 1116 is also used as a detection result M10, which is one of the detection results M1 of the first detection circuit 111b.

[0034] In other words, the first detection circuit 111b initializes the detection result M10 to the L level when the reset signal RST1 becomes active, and then transitions the voltage level of the detection result M10 from the L level to the H level or from the H level to the L level in synchronization with the rising edge of the clock signal CLK1.

[0035] The second detection circuit 112b includes a selector 1124, a flip-flop 1125, and an inverter 1126. The selector 1124 selects and outputs either a signal of value "1" or the output of the inverter 1126 in response to the reset signal RST1. For example, the selector 1124 selects and outputs a signal of value "1" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1126 when the reset signal RST1 is inactive. The flip-flop 1125 takes in and outputs the output signal of the selector 1124 in synchronization with the rising edge of the clock signal CLK1. The inverter 1126 inverts and outputs the output of the flip-flop 1125. The output signal of the inverter 1126 is also used as a detection result C10, which is one of the detection results C1 of the second detection circuit 112b.

[0036] In other words, the second detection circuit 112b initializes the detection result C10 to the L level when the reset signal RST1 becomes active, and then transitions the voltage level of the detection result C10 from the L level to the H level or from the H level to the L level in synchronization with the rising edge of the clock signal CLK1.

[0037] The comparison circuit 113b includes flip-flops 1133, 1134, 1135, and 1136, an XOR circuit 1138, an AND circuit 1140, and a holding circuit 1141. The flip-flop 1133 captures and outputs the detection result C10 of the second detection circuit 112b in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1134 captures and outputs the output signal of the flip-flop 1133 in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1138 outputs the exclusive OR of the output of the flip-flop 1134 and the detection result M10 of the first detection circuit 111b. The flip-flop 1135 captures and outputs the reset signal RST1 in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1136 receives and outputs the output signal of the flip-flop 1135 in synchronization with the rising edge of the clock signal CLK1. The AND circuit 1140 outputs the logical product of the output signal of the XOR circuit 1138 and the inverted signal of the output signal of the flip-flop 1136. The holding circuit 1141 holds the output signal of the AND circuit 1140 and outputs it as the error signal ERR1.

[0038] For example, when the reset signal RST1 is active (e.g., H level), the AND circuit 1140 outputs an L-level signal, and when the reset signal RST1 is inactive (e.g., L level), the AND circuit 1140 outputs a signal of a voltage level according to the detection results M10, C10. Specifically, when the reset signal RST1 is inactive, the AND circuit 1140 outputs an L-level signal if the detection results M10, C10 match, and outputs an H-level signal if the detection results M10, C10 do not match. The holding circuit 1141 outputs an error signal ERR1 in an inactive state (e.g., L level) by being initialized, and switches the error signal ERR1 from an inactive state to an active state (e.g., H level) at the timing when an H-level signal is output from the AND circuit 1140 (i.e., the timing when a mismatch between the detection results M10, C10 is detected).

[0039] 5, if an external attack on the target circuit TG1 causes the detection result C10 of the second detection circuit 112b to not transition correctly from L level to H level, the detection results M10 and C10 will no longer match (time t21). At this time, the comparison circuit 113b outputs an error signal ERR1 in an active state (H level) indicating that a fault has occurred in the target circuit TG1 (time t21).

[0040] (Third Specific Configuration Example and Operation of Fault Detection Circuit 1) Fig. 6 is a diagram showing a third specific configuration example of the fault detection circuit 1 provided in the semiconductor device 100 as a fault detection circuit 1c. Note that Fig. 6 also shows not only the fault detection circuit 1c but also a target circuit TG1 and the semiconductor device 100 including the target circuit TG1. Fig. 7 is a timing chart showing the operation of the fault detection circuit 1c.

[0041] 6, the failure detection circuit 1c includes a first detection circuit 111c, a second detection circuit 112c, and a comparison circuit 113c. The first detection circuit 111c, the second detection circuit 112c, and the comparison circuit 113c correspond to the first detection circuit 111, the second detection circuit 112, and the comparison circuit 113, respectively.

[0042] The first detection circuit 111c includes selectors 1111 and 1114, flip-flops 1112 and 1115, and inverters 1113 and 1116. The selector 1111 selects and outputs either a signal of value "0" or the output of the inverter 1113 in response to a reset signal RST1. For example, the selector 1111 selects and outputs a signal of value "0" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1113 when the reset signal RST1 is inactive. The flip-flop 1112 takes in and outputs the output signal of the selector 1111 in synchronization with the rising edge of the clock signal CLK1. The inverter 1113 inverts and outputs the output of the flip-flop 1112. The output signal of the inverter 1113 is also used as a detection result M11, which is one of the detection results M1 of the first detection circuit 111c. The selector 1114 selects and outputs either a signal of value "1" or the output of the inverter 1116 in response to the reset signal RST1. For example, the selector 1114 selects and outputs a signal of value "1" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1116 when the reset signal RST1 is inactive. The flip-flop 1115 takes in and outputs the output signal of the selector 1114 in synchronization with the rising edge of the clock signal CLK1. The inverter 1116 inverts and outputs the output of the flip-flop 1115. The output signal of the inverter 1116 is also used as a detection result M10, which is one of the detection results M1 of the first detection circuit 111b.

[0043] That is, when the reset signal RST1 becomes active, the first detection circuit 111c initializes the detection result M11 to the H level and initializes the detection result M10 to the L level, and then transitions the voltage levels of the detection results M11 and M10 from the H level to the L level or from the L level to the H level in synchronization with the rising edge of the clock signal CLK1. Note that, under normal circumstances, when one of the detection results M11 and M10 indicates the H level, the other indicates the L level.

[0044] The second detection circuit 112c includes selectors 1121 and 1124, flip-flops 1122 and 1125, and inverters 1123 and 1126. The selector 1121 selects and outputs either a signal of value "0" or the output of the inverter 1123 in response to the reset signal RST1. For example, the selector 1121 selects and outputs a signal of value "0" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1123 when the reset signal RST1 is inactive. The flip-flop 1122 takes in and outputs the output signal of the selector 1121 in synchronization with the rising edge of the clock signal CLK1. The inverter 1123 inverts and outputs the output of the flip-flop 1122. The output signal of the inverter 1123 is also used as a detection result C11, which is one of the detection results C1 of the second detection circuit 112c. The selector 1124 selects and outputs either a signal of value "1" or the output of the inverter 1126 in response to the reset signal RST1. For example, the selector 1124 selects and outputs a signal of value "1" when the reset signal RST1 is active, and selects and outputs the output of the inverter 1126 when the reset signal RST1 is inactive. The flip-flop 1125 takes in and outputs the output signal of the selector 1124 in synchronization with the rising edge of the clock signal CLK1. The inverter 1126 inverts and outputs the output of the flip-flop 1125. The output signal of the inverter 1126 is also used as a detection result C10, which is one of the detection results C1 of the second detection circuit 112b.

[0045] That is, when the reset signal RST1 becomes active, the second detection circuit 112c initializes the detection result C11 to the H level and initializes the detection result C10 to the L level, and then transitions the voltage levels of the detection results C11 and C10 from the H level to the L level or from the L level to the H level in synchronization with the rising edge of the clock signal CLK1. Note that, under normal circumstances, when one of the detection results C11 and C10 indicates the H level, the other indicates the L level.

[0046] The comparison circuit 113c includes flip-flops 1131 to 1136, XOR circuits 1137 and 1138, a logical sum circuit (hereinafter referred to as an OR circuit) 1139, an AND circuit 1140, and a holding circuit 1141. The flip-flop 1131 takes in and outputs the detection result C11 of the second detection circuit 112c in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1132 takes in and outputs the output signal of the flip-flop 1131 in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1137 outputs the exclusive logical sum of the output of the flip-flop 1132 and the detection result M11 of the first detection circuit 111c. The flip-flop 1133 takes in and outputs the detection result C10 of the second detection circuit 112c in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1134 takes in and outputs the output signal of the flip-flop 1133 in synchronization with the rising edge of the clock signal CLK1. The XOR circuit 1138 outputs the exclusive OR of the output of the flip-flop 1134 and the detection result M10 of the first detection circuit 111c. The OR circuit 1139 outputs the logical OR of the output signal of the XOR circuit 1137 and the output signal of the XOR circuit 1138. The flip-flop 1135 takes in and outputs the reset signal RST1 in synchronization with the rising edge of the clock signal CLK1. The flip-flop 1136 takes in and outputs the output signal of the flip-flop 1135 in synchronization with the rising edge of the clock signal CLK1. The AND circuit 1140 outputs the logical AND of the output signal of the OR circuit 1139 and the inverted signal of the output signal of the flip-flop 1136. A holding circuit 1141 holds the output signal of the AND circuit 1140 and outputs it as an error signal ERR1.

[0047] For example, when the reset signal RST1 is active (e.g., H level), the AND circuit 1140 outputs an L level signal, and when the reset signal RST1 is inactive (e.g., L level), it outputs a signal of a voltage level according to the detection results M11, C11 and the detection results M10, C10. Specifically, when the reset signal RST1 is inactive, if the detection results M11, C11 match and the detection results M10, C11 match, the AND circuit 1140 outputs an L level signal, and when the detection results M11, C11 do not match or the detection results M10, C10 do not match, the AND circuit 1140 outputs an H level signal. The holding circuit 1141 is initialized to output an inactive error signal ERR1 (e.g., L level), and switches the error signal ERR1 from the inactive state to an active state (e.g., H level) when an H level signal is output from the AND circuit 1140 (i.e., when a mismatch between the detection results M11 and C11, or a mismatch between the detection results M10 and C10 is detected).

[0048] 7, when an external attack on the target circuit TG1 causes, for example, the detection results M11, C11, and M10 to transition correctly, but the detection result C10 does not transition correctly, the detection results M10 and C10 will not match (time t31). At this time, the comparison circuit 113c outputs an error signal ERR1 in an active state (H level) indicating that a fault has occurred in the target circuit TG1 (time t31). In other words, the fault detection circuit 1c can detect a fault in the target circuit TG1 more accurately than the fault detection circuits 1a and 1b.

[0049] In this way, the fault detection circuit 1 of this embodiment can always accurately detect faults in the target circuit TG1, such as tampering with data in the target circuit TG1 due to an external attack, and unintended operation of the power supply, electromagnetic waves, and clock signals in the target circuit TG1 due to an external attack.

[0050] <Embodiment 2> 8 is a block diagram showing a configuration example of a semiconductor device 100 to which a fault detection circuit 2 according to the second embodiment is applied. The fault detection circuit 2 further includes a first detection circuit 121, a second detection circuit 122, and a comparison circuit 123 in addition to a first detection circuit 111, a second detection circuit 112, and a comparison circuit 113. The first detection circuit 121, the second detection circuit 122, and the comparison circuit 123 have the same configurations as the first detection circuit 111, the second detection circuit 112, and the comparison circuit 113, respectively.

[0051] The first detection circuit 111, the second detection circuit 112, and the comparison circuit 113 constitute a partial failure detection circuit 11 for detecting a failure in a circuit area A1 of the target circuit TG1 that operates in synchronization with a clock signal CLK1. The first detection circuit 121, the second detection circuit 122, and the comparison circuit 123 constitute a partial failure detection circuit 12 for detecting a failure in a circuit area A2 of the target circuit TG1 that operates in synchronization with a clock signal CLK2.

[0052] The configurations and operations of the first detection circuit 111, the second detection circuit 112, and the comparison circuit 113 constituting the partial failure detection circuit 11 are basically as already described. However, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate the same value, the comparison circuit 113 outputs an error signal ERR1 in an inactive state (for example, L level) indicating that no failure has occurred in the circuit area A1 of the target circuit TG1 that operates in synchronization with the clock signal CLK1. Also, when the detection result M1 of the first detection circuit 111 and the detection result C1 of the second detection circuit 112 indicate different values, the comparison circuit 113 outputs an error signal ERR1 in an active state (for example, H level) indicating that a failure has occurred in the circuit area A1 of the target circuit TG1 that operates in synchronization with the clock signal CLK1.

[0053] In this embodiment, the first detection circuit 111 and the second detection circuit 112 detect the rising edge of the clock signal CLK1, and the comparison circuit 113 performs the comparison operation in synchronization with the rising edge of the clock signal CLK1, but the present invention is not limited to this. The first detection circuit 111 and the second detection circuit 112 may be configured to detect the falling edge of the clock signal CLK1, and the comparison circuit 113 may be configured to perform the comparison operation in synchronization with the falling edge of the clock signal CLK1.

[0054] Next, the first detection circuit 121, the second detection circuit 122, and the comparison circuit 123 that configure the partial failure detection circuit 12 will be described.

[0055] The first detection circuit 121 detects the rising edge of a clock signal CLK2 used in the target circuit TG1 and outputs a detection result M2. For example, the first detection circuit 121 transitions the voltage level of the detection result M2 from H level to L level or from L level to H level in synchronization with the rising edge of the clock signal CLK2. In addition, the first detection circuit 121 initializes the voltage level of the detection result M2 to a predetermined level (either H level or L level) at the timing when a reset signal RST2 used in the target circuit TG1 becomes active (e.g., H level).

[0056] The second detection circuit 122 detects the rising edge of a clock signal CLK2 used in the target circuit TG1 and outputs a detection result C2. For example, the second detection circuit 122 transitions the voltage level of the detection result C2 from H level to L level or from L level to H level in synchronization with the rising edge of the clock signal CLK2. In addition, the second detection circuit 122 initializes the voltage level of the detection result C2 to a predetermined level (either H level or L level) at the timing when a reset signal RST2 used in the target circuit TG1 becomes active (e.g., H level).

[0057] The comparison circuit 123 compares the detection result M2 of the first detection circuit 121 with the detection result C2 of the second detection circuit 122 in synchronization with the rising edge of the clock signal CLK2.

[0058] In this embodiment, the first detection circuit 121 and the second detection circuit 122 detect the rising edge of the clock signal CLK2, and the comparison circuit 123 performs the comparison operation in synchronization with the rising edge of the clock signal CLK2, but the present invention is not limited to this. The first detection circuit 121 and the second detection circuit 122 may be configured to detect the falling edge of the clock signal CLK2, and the comparison circuit 123 may be configured to perform the comparison operation in synchronization with the falling edge of the clock signal CLK2.

[0059] For example, when no failure occurs in the circuit area A2 of the target circuit TG1 that operates in synchronization with the clock signal CLK2, there is a high possibility that the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 will exhibit the same value. Therefore, when the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 exhibit the same value, the comparison circuit 123 outputs an error signal ERR2 in an inactive state (e.g., L level) indicating that no failure occurs in the circuit area A2 of the target circuit TG1.

[0060] In contrast, when a failure occurs in the circuit area A2 of the target circuit TG1, there is a high possibility that the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 will exhibit different values. Therefore, when the detection result M2 of the first detection circuit 121 and the detection result C2 of the second detection circuit 122 exhibit different values, the comparison circuit 123 outputs an error signal ERR2 in an active state (for example, H level) indicating that a failure has occurred in the circuit area A2 of the target circuit TG1.

[0061] In this way, the failure detection circuit 2 according to the present embodiment can individually detect failures in multiple circuit areas that operate in synchronization with different clock signals in the target circuit TG1, making it easier to identify the cause of the failure.

[0062] In the present embodiment, the fault detection circuit 2 is described as having two partial fault detection circuits 11 and 12, but is not limited to this. The fault detection circuit 2 may have three or more partial fault detection circuits arranged in three or more circuit areas that operate in synchronization with different clock signals.

[0063] <Embodiment 3> 9 is a block diagram showing an example of a configuration of a semiconductor device 100 to which a fault detection circuit 3 according to an embodiment 3 is applied. The fault detection circuit 3 has the same circuit configuration as the fault detection circuit 2.

[0064] Here, in the failure detection circuit 3, the partial failure detection circuit 11 is arranged in a circuit area B1 driven by the power supply voltage VDD1, and the partial failure detection circuit 12 is arranged in a circuit area B2 driven by the power supply voltage VDD2. That is, the partial failure detection circuit 11 detects a failure in the circuit area B1 driven by the power supply voltage VDD1 of the target circuit TG1, and the partial failure detection circuit 12 detects a failure in the circuit area B2 driven by the power supply voltage VDD2 of the target circuit TG1.

[0065] In this way, the failure detection circuit 3 according to the present embodiment can individually detect failures in multiple circuit areas that are driven by different power supply voltages in the target circuit TG1, making it easier to identify the cause of the failure.

[0066] In the present embodiment, the fault detection circuit 3 is described as having two partial fault detection circuits 11 and 12, but is not limited to this. The fault detection circuit 3 may have three or more partial fault detection circuits arranged in three or more circuit areas each driven by a different power supply voltage.

[0067] The invention made by the inventor has been specifically described above based on the embodiments, but it goes without saying that the present invention is not limited to the embodiments already described, and various modifications are possible without departing from the gist of the invention.

[0068] Furthermore, the present disclosure can be realized by causing a CPU to execute a computer program to perform part or all of the processing of the fault detection circuit.

[0069] The above-mentioned program includes a set of instructions (or software code) for making the computer perform one or more functions described in the embodiment when the program is loaded into the computer. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or the tangible storage medium includes a random-access memory (RAM), a read-only memory (ROM), a flash memory, a solid-state drive (SSD) or other memory technology, a CD-ROM, a digital versatile disc (DVD), a Blu-ray® disk or other optical disk storage, a magnetic cassette, a magnetic tape, a magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, the transitory computer-readable medium or the communication medium includes an electrical, optical, acoustic, or other form of propagating signal. [Explanation of symbols]

[0070] 1 Fault detection circuit 1a, 1b, 1c Fault detection circuit 2. Fault detection circuit 3. Fault detection circuit 11 Partial failure detection circuit 12 Partial failure detection circuit 100 Semiconductor device 111 First detection circuit 111a, 111b, 111c First detection circuit 112 Second detection circuit 112a, 112b, 112c Second detection circuit 113 Comparison circuit 113a,113b,113c comparison circuit 121 First detection circuit 122 Second detection circuit 123 Comparison circuit 1111 Selector 1112 Flip-flop 1113 Inverter 1114 Selector 1115 Flip-flop 1116 Inverter 1121 Selector 1122 Flip-flop 1123 Inverter 1124 Selector 1125 Flip-flop 1126 Inverter 1131~1136 Flip-flop 1137,1138 Exclusive OR circuit (XOR circuit) 1139 Logical sum circuit (OR circuit) 1140 Logical product circuit (AND circuit) 1141 Holding circuit TG1 target circuit

Claims

1. a target circuit having a first circuit area that operates in synchronization with a first clock signal; a first detection circuit that outputs a first detection result obtained by transitioning a voltage level in synchronization with the first clock signal; a second detection circuit that outputs a second detection result obtained by transitioning a voltage level in synchronization with the first clock signal; a first comparison circuit that compares the first detection result with the second detection result and outputs a first comparison result; A fault detection circuit comprising:

2. the first comparison circuit outputs a first comparison result indicating that no fault has occurred in the first circuit area when the first detection result and the second detection result match, and outputs a first comparison result indicating that a fault has occurred in the first circuit area when the first detection result and the second detection result do not match.

2. The fault detection circuit according to claim 1.

3. the first detection circuit is configured to further output a third detection result, the third detection result being a voltage level transitioned complementary to the first detection result in synchronization with the first clock signal; the second detection circuit is configured to further output a fourth detection result, the fourth detection result being transitioned in voltage level complementary to the second detection result in synchronization with the first clock signal; the first comparison circuit is configured to compare the first detection result with the second detection result, and to compare the third detection result with the fourth detection result, and to output the first comparison result.

2. The fault detection circuit according to claim 1.

4. the first comparison circuit outputs a first comparison result indicating that no fault has occurred in the first circuit area when the first detection result and the second detection result match and the third detection result and the fourth detection result match, and outputs a first comparison result indicating that a fault has occurred in the first circuit area when the first detection result and the second detection result do not match or when the third detection result and the fourth detection result do not match.

4. The fault detection circuit according to claim 3.

5. The first detection circuit is a first selector that selects and outputs either a first initial value, which is one of 0 and 1, or the first detection result based on a first reset signal; a first flip-flop that receives and outputs an output signal of the first selector in synchronization with the first clock signal; a first inverter that inverts an output signal of the first flip-flop to output the first detection result; The second detection circuit is a second selector that selects and outputs either the first initial value or the first detection result based on the first reset signal; a second flip-flop that receives and outputs an output signal of the second selector in synchronization with the first clock signal; a second inverter that inverts an output signal of the second flip-flop and outputs the second detection result, 2. The fault detection circuit according to claim 1.

6. The first detection circuit is a first selector that selects and outputs either a first initial value, which is one of 0 and 1, or the first detection result based on a first reset signal; a first flip-flop that receives and outputs an output signal of the first selector in synchronization with the first clock signal; a first inverter that inverts an output signal of the first flip-flop to output the first detection result; The second detection circuit is a second selector that selects and outputs either the first initial value or the first detection result based on the first reset signal; a second flip-flop that receives and outputs an output signal of the second selector in synchronization with the first clock signal; a second inverter that inverts an output signal of the second flip-flop to output the second detection result, The first detection circuit is a third selector that selects and outputs either a second initial value, which is the other of 0 and 1, or the third detection result, based on the first reset signal; a third flip-flop that captures and outputs an output signal of the third selector in synchronization with the first clock signal; a third inverter that inverts an output signal of the third flip-flop to output the third detection result, The second detection circuit is a fourth selector that selects and outputs either the second initial value or the fourth detection result based on the first reset signal; a fourth flip-flop that receives and outputs an output signal of the fourth selector in synchronization with the first clock signal; a fourth inverter that inverts an output signal of the fourth flip-flop and outputs the fourth detection result.

4. The fault detection circuit according to claim 3.

7. the target circuit further includes a second circuit area that operates in synchronization with a second clock signal; a third detection circuit that outputs a third detection result whose voltage level has been transitioned in synchronization with the second clock signal; a fourth detection circuit that outputs a fourth detection result whose voltage level has been transitioned in synchronization with the second clock signal; a second comparison circuit that compares the third detection result with the fourth detection result and outputs a second comparison result; Further equipped with 2. The fault detection circuit according to claim 1.

8. the first comparison circuit outputs a first comparison result indicating that no fault has occurred in the first circuit area of ​​the target circuit when the first detection result and the second detection result match, and outputs a first comparison result indicating that a fault has occurred in the first circuit area of ​​the target circuit when the first detection result and the second detection result do not match; the second comparison circuit outputs a second comparison result indicating that no fault has occurred in the second circuit area of ​​the target circuit when the third detection result and the fourth detection result match, and outputs a second comparison result indicating that a fault has occurred in the second circuit area of ​​the target circuit when the third detection result and the fourth detection result do not match.

8. The fault detection circuit according to claim 7.

9. the first circuit area and the second circuit area are driven by different power supply voltages, the first detection circuit, the second detection circuit, and the first comparison circuit are disposed in the first circuit area; the third detection circuit, the fourth detection circuit, and the second comparison circuit are disposed in the second circuit area; 8. The fault detection circuit according to claim 7.

10. A fault detection circuit according to claim 1; the target circuit; A semiconductor device comprising:

11. A fault detection method by a fault detection circuit provided in a target circuit having a first circuit area that operates in synchronization with a first clock signal, comprising: outputting a first detection result obtained by transitioning a voltage level in synchronization with the first clock signal using a first detection circuit; outputting a second detection result obtained by transitioning a voltage level in synchronization with the first clock signal using a second detection circuit; using a first comparison circuit to compare the first detection result with the second detection result and output a first comparison result; Fault detection methods.

Images