Independent functional units on a monolithic semiconductor substrate

Abstract

The invention relates to a semiconductor device (10) comprising a first integrated circuit (12) which is located on a first portion of a monolithic semiconductor substrate (14). It also comprises an additional integrated circuit (18) which is located on another portion of the monolithic semiconductor substrate (14). In addition, a barrier (16) is provided, by means of which the first portion of the monolithic semiconductor substrate (14) is physically separated from the additional portion of the monolithic semiconductor substrate (14). Furthermore, a first monitoring device (20) is provided as part of the first integrated circuit (12), and another monitoring device (22) is provided as part of the additional integrated circuit (18).

Description

[0001] Description

[0002] Independent functional units on a monolithic semiconductor substrate

[0003] The invention relates to a semiconductor device, a method for operating a semiconductor device, a computer program and a computer-readable medium.

[0004] To assess electrical, electronic, and / or programmable systems with regard to functional safety, availability, reliability, and / or independence, predetermined safety requirements are defined within the framework of international standards. For example, regarding functional safety, four different safety levels are defined in more detail in standards such as EN 50129, IEC 61508, and IEC 61511. A high level of functional safety allows for the appropriate protection of the environment, property, and / or human health in various situations. The scope and type of required functional safety are typically determined based on a hazard assessment.

[0005] To achieve a predetermined level of functional reliability and / or system availability, strict requirements must be met. Typically, for demanding applications, independently implemented functional units are used, mounted on separate semiconductor substrates. Currently, integrating two independent functional units on a single-chip system only achieves safety level 3 according to IEC 61508. To provide independent functional units for controlling a safety-critical system, large distances between the respective functional units on printed circuit boards are typically maintained. Alternatively, to ensure independence, separate functional units are combined using mathematical methods or software-based process solutions are implemented.Software-based process solutions include, for example, mathematical coding methods in which a complementary code is executed on diverse or redundant hardware. Achieving security level 4 therefore currently requires a large installation space. Furthermore, existing solutions often involve high power consumption due to the operation of numerous components. Moreover, they typically consume significant computing resources and / or interface bandwidth due to the high communication demands between separate components. However, according to IEC 61508, single-chip systems may only be used up to security level 3. The invention aims to provide an improved semiconductor device, in particular an improved single-chip system.

[0006] This problem is solved by a semiconductor device having the features of claim 1.

[0007] Furthermore, the invention is based on the objective of providing an improved method for operating a semiconductor device.

[0008] This problem is solved by a method with the features of a subordinate method claim.

[0009] Furthermore, the invention is based on the objectives of providing a computer program and a computer-readable medium.

[0010] These tasks are solved by a computer program having the features of the dependent computer program claim and by a computer-readable medium having the features of dependent claim 15.

[0011] Advantageous further training courses are each the subject of dependent sub-claims.

[0012] The semiconductor device according to the invention comprises a first integrated circuit arranged on a first section of a monolithic semiconductor substrate. Such a monolithic semiconductor substrate is commonly referred to in technical circles as a "die" or "chip". Furthermore, the semiconductor device according to the invention comprises a further integrated circuit arranged on a further section of the monolithic semiconductor substrate. Moreover, a barrier is provided according to the invention by means of which the first section of the monolithic semiconductor substrate is physically separated from the further section of the monolithic semiconductor substrate. The semiconductor device according to the invention also comprises a first monitoring device and a further monitoring device. The first monitoring device is implemented as part of the first integrated circuit.The additional monitoring device is implemented as part of the further integrated circuit. Advantageously, the aforementioned monitoring devices are each configured to monitor physical parameters. These parameters may include, alternatively or additionally, current and / or frequency, in addition to those described below. Furthermore, the semiconductor device is preferably implemented as a single-chip system.

[0013] Advantageously, the first integrated circuit is physically separated from the subsequent integrated circuit by means of the aforementioned barrier. The monitoring devices advantageously serve to monitor and / or ensure the function of the barrier in this context. In a preferred embodiment, the barrier physically separates doped regions on the first section from doped regions on the subsequent section. In particular, the barrier extends at least as far as an undoped region of the monolithic semiconductor substrate. Advantageously, the undoped region is a non-losable common potential, which is usually referred to as ground.

[0014] Preferably, the semiconductor device is configured to control a system. The semiconductor device according to the invention makes it possible, for example, to achieve safety level 4 according to standards EN 50129, IEC 61508, or IEC 61511. This provides the necessary independence from different or redundant functional units, such as data processing devices or control systems. Furthermore, it enables the control of safety-critical systems, such as traffic control systems or emergency management systems, while meeting high safety requirements. The independent functional units can be implemented on the same monolithic semiconductor substrate. This allows for a reduced space requirement for, for example, secure data processing devices and / or control systems.Furthermore, this enables the provision of an energy-efficient semiconductor device, which, due to a reduced number of components, exhibits lower power consumption. This also allows for a reduction in manufacturing costs and effort. Moreover, a reduced failure rate and thus improved availability can be achieved. Additionally, the operating conditions of a uniformly provided component can be reliably monitored. Additional external components for monitoring the operating conditions of the semiconductor device can be avoided, thus saving considerable effort. In particular, monitoring of the operating conditions is possible solely based on an internal functional structure, which itself can be implemented as yet another integrated circuit.By arranging several independent integrated circuits on the monolithic semiconductor substrate, redesign costs can be kept low.

[0015] In a preferred application, integrated circuits are implemented on the monolithic semiconductor substrate using diverse layouts. This approach easily avoids systematic errors that arise from the use of uniform layouts. Furthermore, it is possible to integrate data storage devices with these integrated circuits in various ways.

[0016] This allows different memory cells to be used for the same data to be stored.

[0017] An advantageous further development provides that the barrier is designed as a thermal and / or electrical insulator. A damaging physical influence from one integrated circuit to an adjacent integrated circuit can be limited or shielded. The barrier can expediently counteract the transmission of damaging thermal or electrical energy. Silicon dioxide (SiO2), silicon nitride (Si3N4), or a material with comparable insulating properties commonly used in standard manufacturing processes is preferably used as the barrier material. This makes it possible to prevent leakage currents that can propagate along a surface of the barrier.

[0018] Furthermore, an advantageous refinement provides that the first monitoring device and / or the subsequent monitoring device each incorporate a temperature monitor. Thermal influences on adjacent integrated circuits can be detected quickly and reliably. Additionally, a temperature profile can be recorded cost-effectively. This enables early warning of a thermal hazard or a thermally induced failure. As a result, stringent safety requirements regarding thermal influences can be met.

[0019] Preferably, the temperature monitor of the first monitoring device is implemented as part of the first integrated circuit arranged on the first section. Alternatively or additionally, the temperature monitor of the further monitoring device is preferably implemented as part of the further integrated circuit arranged on the further section.

[0020] An advantageous embodiment provides that the temperature monitor has multiple temperature sensors. These temperature sensors are advantageously arranged along one side of the barrier. The temperature sensors are expediently ring oscillators and / or temperature diodes. Alternatively or additionally, temperature sensors of the temperature monitor can be positioned near critical areas, such as processor cores. The source of a thermal load can be easily located. For example, the direction of a thermal flux can be determined. Preferably, one or more adjacent integrated circuits can be identified as the source of a thermal load. Furthermore, it can be detected early, particularly before damage occurs, that thermal energy is penetrating the barrier.This allows measures to be taken to counteract a thermal failure. One such measure could be, for example, interrupting the supply voltage to a system being controlled, preferably after it has been brought to a safe state.

[0021] In a further advantageous embodiment, the first monitoring device and / or the subsequent monitoring device are provided with a voltage monitor. Preferably, the voltage monitor is implemented as part of the integrated circuit arranged on the first section and / or as part of the subsequent section. This voltage monitor is preferably configured to detect fault overvoltages. Electronic influences, such as those caused by an overvoltage, can thus be detected quickly. An affected integrated circuit or an adjacent integrated circuit can then be protected cost-effectively. In particular, this makes it possible to quickly take necessary measures to bring a controlled system into a safe state. This further increases operational reliability.

[0022] In an advantageous embodiment, it is proposed that the voltage monitor be configured to monitor the supply voltage of the first integrated circuit or the subsequent integrated circuit. This allows the internal supply voltage of separate integrated circuits to be monitored independently. Overvoltages can be detected and located quickly and reliably.

[0023] Furthermore, an advantageous refinement provides that the first and / or subsequent monitoring devices incorporate functional monitoring for the purpose of fault detection of their respective integrated circuits. This allows for the simple provision of integrated functional monitoring. External components for functional monitoring of an integrated circuit can be dispensed with. Malfunctions within the integrated circuit can thus be detected reliably and quickly. Other integrated circuits and their associated functional units can be informed of malfunctions in other integrated circuits and their associated functional units. This enables the provision of high availability and / or high functional reliability of the controlled system as required.For example, functioning functional units can at least temporarily take over the tasks of the impaired functional unit, thereby ensuring high availability. Furthermore, reliable data processing devices and / or control devices for the purpose of controlling safety-critical systems can be easily provided. In addition, this approach allows for the rapid identification of replacement needs, thus enabling compliance with stringent safety requirements.

[0024] In an advantageous embodiment, at least individual logic functions of independent integrated circuits are laid out and / or implemented diversely. Furthermore, scrambling of memory addresses and / or memory data from one integrated memory to another integrated memory of a further integrated circuit can be provided. This can further reduce systematic errors.

[0025] Furthermore, the invention provides a method for operating a semiconductor device. The semiconductor device in question is, in particular, a semiconductor device of the type described above. By way of example, the method can be used to provide a semiconductor device that can achieve safety level 4 in terms of functional safety, as defined in standards EN 50129, IEC 61508, or IEC 61511. Moreover, the method enables the provision of a semiconductor device with high availability.

[0026] In the method according to the invention, two independent integrated circuits of the semiconductor device, physically separated from each other by a barrier, are operated concurrently. Furthermore, a first monitoring device monitors one of the two integrated circuits. A further monitoring device monitors another of the two integrated circuits. The method according to the invention makes it possible to operate two integrated circuits arranged on the same semiconductor substrate independently and concurrently. Independent operation is understood here in the sense of functional safety. This functional safety can, for example, comply with the requirements of standards IEC 61508 or EN 50129.By combining physical separation with monitoring devices, it is possible to provide a particularly reliable and / or highly available semiconductor device that exceeds safety level 3. Such semiconductor devices can be used for safety-critical applications. Advantageously, this allows railway technology devices, such as signal boxes, air traffic control systems, or robotics systems to be controlled safely and reliably.

[0027] An advantageous further development of the method provides that the temperature along the barrier is monitored by means of the first monitoring device and / or the second monitoring device. Thermal operating conditions of the semiconductor device can be reliably monitored. Furthermore, a transfer of thermal energy between adjacent integrated circuits can be detected quickly and reliably. In the preferred application, the source of the thermal energy can be located cost-effectively.

[0028] In an advantageous embodiment, if a predetermined temperature threshold is exceeded, the supply voltage to a system controlled by the first integrated circuit and / or the second integrated circuit is interrupted in a safe state. This safe state is a well-defined and predetermined state of the system in which there is at most a low, predetermined risk to persons or objects. By interrupting the supply voltage, a temperature increase can be limited in a simple manner. Thermally induced damage or random failures of a controlled system in an undefined state can be reliably prevented. This allows for the cost-effective prevention of a thermally induced failure of one or both integrated circuits.

[0029] A further advantageous development of the method provides that the first monitoring device monitors the supply voltage of the first integrated circuit and / or the second monitoring device monitors the supply voltage of the second integrated circuit. Any overvoltages that occur can be detected quickly. This allows mechanisms to be activated to protect individual integrated circuits from overvoltages. This ensures a high level of operational reliability.

[0030] Advantageously, if a predetermined supply voltage threshold is exceeded, the supply voltage to the system controlled by the first integrated circuit and / or the subsequent integrated circuit is interrupted while the system is in a safe state. Voltage-related damage can thus be avoided cost-effectively. In the preferred application, the failure of an integrated circuit due to overvoltage can be prevented.

[0031] Another advantageous further development provides that the first guard device and / or the subsequent guard device are monitored by means of a monitoring infrastructure using software-based testing and / or monitoring procedures.

[0032] The aforementioned testing and / or monitoring methods are preferably already known. For example, process monitoring is based on a diversely implemented watchdog. The term "watchdog" is to be understood in the sense of electrical engineering and computer science. In this context, a watchdog is defined as a hardware- or software-implemented function for the purpose of fault detection. Preferably, the diversely implemented watchdogs are implemented as additional independent integrated circuits on the monolithic semiconductor substrate. Alternatively or additionally, testing and / or monitoring methods already known from Siemens' safe microcomputer systems (also abbreviated as SIMIS) may be provided. Preferably, such a testing and / or monitoring method is implemented on a processor core of the first integrated circuit.Preferably, an additional testing and / or monitoring procedure is implemented on a processor core of the further integrated circuit. High safety requirements can be met in a simplified manner using hardware- and / or software-based testing and / or monitoring procedures. Furthermore, reliable fault detection can be provided.

[0033] In a preferred embodiment, a hardware-implemented, specific reordering of the memory contents is implemented to increase operational reliability. This prevents the same systematically caused errors in both integrated circuits. In this way, high availability of the controlled system can be achieved. In a preferred application, high functional reliability of the controlled system in the event of a failure of an integrated circuit or a functional unit based on it can be ensured by transferring memory contents to a functioning functional unit. Tasks to be performed by the failed functional unit can be quickly and reliably identified and processed by a replacement functional unit.This allows a control or regulation process to continue reliably and safely, preferably without interruption. This makes it possible to achieve the highest level of safety with minimal effort.

[0034] Furthermore, the invention provides for a computer program which, when executed, causes a data processing device to carry out the method according to the invention.

[0035] The data processing device can be, for example, a computer, a microcontroller, a processor, or another programmable hardware component. The data processing device is expediently configured to read, receive, write, transmit, and / or manage data. Furthermore, the data processing device can be a virtualized hardware resource, a cloud computing environment, and / or a runtime environment with variable computing and / or storage capacities. In this context, the term "runtime environment" is to be understood in the sense of computer science. In the preferred application, the data processing device is part of each of the two integrated circuits arranged on the monolithic semiconductor substrate.

[0036] Furthermore, the invention provides for a computer-readable medium. This medium contains instructions that cause a data processing device to carry out the method according to the invention. The data processing device is, in particular, a data processing device of the type described above.

[0037] Advantageously, the computer-readable medium is implemented as a CD-ROM, a DVD, a USB or flash memory device, or a non-physical medium such as a data stream and / or a digital carrier signal. The properties, features, and advantages of the invention described above, as well as the manner in which they are achieved, are explained in more detail in the following description of the exemplary embodiment of the invention and its variations, in conjunction with the figures. Where appropriate, the same reference numerals are used in the figures for the same or corresponding elements of the invention. The exemplary embodiment and its variations serve to illustrate the invention and do not limit the invention to the combinations of features specified therein, including functional features.Furthermore, all features specified in the exemplary embodiment can be considered in isolation and combined as appropriate with the features of any claim. The figures described below are schematic and not to scale.

[0038] They show:

[0039] FIG 1 shows an embodiment of a semiconductor device according to the invention in a schematic representation;

[0040] FIG 2 illustrates an example of a method according to the invention for providing a high level of security for a semiconductor device.

[0041] FIG 1 shows a schematic representation of a semiconductor device 10 in which two identical integrated circuits 12, 18 are arranged on a monolithic semiconductor substrate 14.

[0042] In the present embodiment, the two integrated circuits 12 and 18 are each implemented as independent functional units. For example, each of the two integrated circuits 12 and 18 comprises a data processing device 26, a memory 28, and a communication device 30. Although the two integrated circuits 12 and 18 are implemented independently of each other, data transmission between them is enabled by means of the communication device 30. Advantageously, the two integrated circuits 12 and 18 are used to control a system (not shown in detail) and an associated process, for example, the operation of a railway signal box. Preferably, the integrated circuits 12 and 18 are further configured to bring the controlled system into and / or maintain it in a safe state.A first integrated circuit 12 of the two aforementioned integrated circuits 12, 18 is arranged on a first section of the monolithic semiconductor substrate 14. A second integrated circuit 18 of the two integrated circuits 12, 18 is arranged on a further section of the monolithic semiconductor substrate 14. A barrier 16 is arranged between the aforementioned sections. By means of the barrier 16, the first section of the monolithic semiconductor substrate 14 is physically separated from the further section of the monolithic semiconductor substrate 14. In the present embodiment, the barrier 16 separates doped regions on the first section from doped regions on the further section. In particular, the barrier 16 extends in depth to an undoped region of the monolithic semiconductor substrate 14.Furthermore, barrier 16 is designed as both thermal and electrical insulation. For this purpose, silicon dioxide or an insulating material with comparable properties is provided as an example material for barrier 16.

[0043] The embodiment of the semiconductor device 10 described herein further comprises a first monitoring device 20 and a second monitoring device 22. The first monitoring device 20 is part of the first integrated circuit 12. The second monitoring device 22 is part of the second integrated circuit 18. By way of example, the first monitoring device 20 and the second monitoring device 22 each comprise a temperature monitor 24 and a voltage monitor 32.

[0044] For temperature monitoring purposes, the temperature monitor 24 has several temperature sensors 24. These are arranged, for example, distributed along the barrier 16. A first set of temperature sensors 24 is arranged on one side of the barrier 16, corresponding to the first integrated circuit 12, and belongs to the first monitoring device 20. Another set of temperature sensors 24 is arranged on one side of the barrier 16, corresponding to the second integrated circuit 18, and belongs to the second monitoring device 22. These are, for example, configured as ring oscillators or temperature diodes. This allows a thermal flux from the first integrated circuit 12 to the second integrated circuit 18, or vice versa, to be detected. Furthermore, this allows the localization of which of the two integrated circuits 12, 18 is emitting potentially damaging thermal energy.The thermal state of the semiconductor device 10 can thus be easily and reliably determined and monitored. In this way, a thermally induced failure of the two integrated circuits 12, 18 can be predicted and counteracted. In an advantageous embodiment, it is provided that, in the event of a predetermined temperature threshold being exceeded, a supply voltage of the system to be controlled is interrupted by means of an external control device (not shown in detail) 108. Furthermore, it can be provided that a supply voltage of at least one of the integrated circuits 12, 18 affected by a critical thermal state is interrupted 108. However, the supply voltage of at least one of the two integrated circuits 12, 18 is usually maintained in order to maintain a safe state of the system to be controlled.

[0045] Furthermore, each of the two monitoring devices 20, 22 has a voltage monitor 32. This is configured, for example, to monitor the supply voltage of a respective associated integrated circuit 12, 18. If a supply voltage exceeds a predetermined threshold, the supply voltage of a system controlled by the semiconductor device 10 is interrupted, for example, by means of the external control device (not shown in detail) 108. As previously explained, depending on the application, an interruption 108 of the supply voltage of at least one of the integrated circuits 12, 18 can also be provided.

[0046] In a further advantageous embodiment, the monitoring devices 20, 22 each have a function monitoring circuit for the purpose of detecting the failure of a respective associated integrated circuit 12, 18. Preferably, such function monitoring is integrated into each of the two integrated circuits 12, 18. Alternatively or additionally, the aforementioned function monitoring can be part of an additional integrated circuit, which is preferably independent of both the first integrated circuit 12 and the second integrated circuit 18. In a specific application, this additional integrated circuit, which is not shown in detail, can be separated from the first and the second section of the monolithic semiconductor substrate 14 by a barrier 16 of the aforementioned type. By way of example, the function monitoring can be implemented in the form of a diverse watchdog timer.This allows independent observation units to be created on the monolithic semiconductor substrate 14.

[0047] FIG 2 illustrates an example of a method 100 for operating a semiconductor device 10.

[0048] The semiconductor device 10 mentioned is, in particular, a semiconductor device of the type described in connection with FIG. 1. The example of method 100 described here provides a functionally reliable and / or highly available semiconductor device 10, which is intended, for example, to control a safety-critical system (not shown in detail), such as a railway signal box. In particular, the semiconductor device 10, implemented as a single-chip system, is operated with regard to functional reliability such that a safety level 4 according to one of the standards EN 50129, IEC 61508, or IEC 61511 is achieved. Safety level 4 is achieved here by providing a combination of several implementation features that, beyond safety level 3, enable the provision of an operationally reliable and dependable semiconductor device 10.Depending on the requirements, this can achieve either high operational reliability and / or high availability.

[0049] The example of method 100 provides that two independent integrated circuits 12, 18 of the semiconductor device 10, which are physically separated by a barrier 16, are operated in parallel 102. Furthermore, it is provided that a first integrated circuit 12 is monitored by means of a first monitoring device 20 104. Furthermore, a second integrated circuit 18 is monitored by means of a second monitoring device 22 104.

[0050] The monitoring devices 20, 22 are, in particular, monitoring devices of the type described in connection with FIG. 1. Using the temperature monitor 24 of the first and the second monitoring devices 20, 22 described in this context, the temperatures of the first integrated circuit 12 and the second integrated circuit 18 are monitored by way of example 106. Preferably, these temperatures are monitored by means of the temperature sensors 24, which are arranged, by way of example, distributed along the barrier 16 106. As soon as a detected temperature on one side of the barrier 16 exceeds a predetermined temperature threshold, a system to be controlled by means of the integrated circuits 12, 18 is, by way of example, put into a safe state. Advantageously, a supply voltage of the system to be controlled is then interrupted 108.In a preferred application, the supply voltage to the integrated circuits 12, 18 is initially maintained to keep the controlled system in a safe state. An interruption 108 of the supply voltage of the controlled system is achieved, for example, by means of an external control device (not shown in detail). By interrupting the supply voltage 108 of the controlled system, a temperature-sensitive integrated circuit 12, 18 can be cooled and / or replaced. This minimizes the risk of damaging thermal effects on an adjacent integrated circuit 12, 18. Overheating of the entire semiconductor device 10, and thus a potential uncontrolled failure of the controlled system, can be quickly prevented.

[0051] Furthermore, it is provided that, in addition to the previously described temperature monitoring 106, the supply voltage of each of the two integrated circuits 12, 18 is monitored 110. For this purpose, both the first monitoring device 20 and the second monitoring device 22 each have the voltage monitor 32 already described in connection with FIG. 1. If a value of the supply voltage detected by the voltage monitor 32 exceeds a predetermined threshold, the system to be controlled is brought into a safe state and the supply voltage of the system to be controlled is interrupted in the manner described above 108. In a special embodiment, all integrated circuits 12, 18 can be de-energized to protect against overvoltage.

[0052] Furthermore, it is provided that the first guard device 20 and the second guard device 22 are monitored by means of a higher-level monitoring infrastructure 104. Preferably, the higher-level monitoring infrastructure is implemented as a hardware- and / or software-based testing and / or monitoring procedure. The testing and / or monitoring procedure can be process monitoring based on diversely implemented watchdogs. For example, these diversely implemented watchdogs can be provided as additional independent integrated circuits on the monolithic semiconductor substrate 14 in a manner not shown in detail. Moreover, testing and / or monitoring procedures already known from Siemens' safe microcomputer systems are expediently used.In the preferred application, at least some of the testing and / or monitoring procedures are implemented on a data processing device 26 of the first integrated circuit 12 or the second integrated circuit 18. Furthermore, a hardware-implemented, specific reordering of memory contents in the memory 28 may be provided. Systematic failures or errors in the first integrated circuit 12 or the second integrated circuit 18 can thus be detected quickly and reliably. The interaction of the aforementioned safety precautions makes it possible to provide a safety level 4 for a single-chip system in which several data processing devices 26 can be operated independently of one another on a monolithic semiconductor substrate 14.Although the invention has been further illustrated and described in detail by the preferred embodiments, the invention is not limited by the disclosed examples and other variations can be derived by the person skilled in the art without leaving the scope of protection of the invention.

[0053] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

Claims

Patent claims 1. Semiconductor device (10) comprising: - a first integrated circuit (12) which is arranged on a first section of a monolithic semiconductor substrate (14); - a further integrated circuit (18) which is arranged on a further section of the monolithic semiconductor substrate (14); - a barrier (16) by means of which the first section of the monolithic semiconductor substrate (14) is physically separated from the further section of the monolithic semiconductor substrate (14); - a first monitoring device (20) which is designed as part of the first integrated circuit (12); - a further monitoring device (22), which is designed as part of the further integrated circuit (18).

2. Semiconductor device (10) according to claim 1, characterized in that the barrier (16) is designed as a thermal and / or electrical insulation.

3. Semiconductor device (10) according to claim 1 or 2, characterized in that the first monitoring device (20) and / or the further monitoring device (22) each has a temperature monitor (24).

4. Semiconductor device (10) according to claim 3, characterized in that the temperature monitor (24) has several temperature sensors which are arranged on one side along the barrier (16).

5. Semiconductor device (10) according to one of the preceding claims, characterized in that the first monitoring device (20) and / or the further monitoring device (22) has a voltage monitor (32).

6. Semiconductor device (10) according to claim 5, characterized in that the voltage monitor (32) is configured to monitor a supply voltage of the first integrated circuit (12) or of the further integrated circuit (18).

7. Semiconductor device (10) according to one of the preceding claims, characterized in that the first monitoring device (20) and / or the further monitoring device (22) has a functional monitoring for the purpose of detecting a failure of a respective associated integrated circuit (12, 18).

8. Method (100) for operating a semiconductor device (10), wherein - two independent integrated circuits (12, 18) of the semiconductor device (10) which are physically separated from each other by means of a barrier (16) are operated in parallel (102); - by means of a first monitoring device (20) a first of the two integrated circuits (12) is monitored (104); - by means of a further monitoring device (22) another of the two integrated circuits (18) is monitored (104).

9. Method (100) according to claim 8, in which a temperature along the barrier (16) is monitored by means of the first monitoring device (20) and / or by means of the further monitoring device (22) (106).

10. Method (100) according to claim 9, wherein, in the event that a predetermined temperature threshold is exceeded, a supply voltage of a system to be controlled by means of the first integrated circuit (12) and / or by means of the further integrated circuit (18) is interrupted in a safe state of the system to be controlled (108).

11. Method (100) according to one of claims 8 to 10, in which a supply voltage of the first integrated circuit (12) is monitored by means of the first monitoring device (20) and / or a supply voltage of the further integrated circuit (18) is monitored by means of the further monitoring device (22) (110).

12. Method (100) according to claim 11, wherein, in the event that a predetermined threshold of the supply voltage is exceeded, the supply voltage of the device is reduced by means of the first integrated circuit (12) and / or the system to be controlled by means of the further integrated circuit (18) is interrupted in the safe state of the system to be controlled (108).

13. Method (100) according to one of claims 8 to 12, wherein the first guard device (20) and / or the further guard device (22) is monitored by means of a higher-level monitoring infrastructure using software-based testing and / or monitoring methods (104).

14. Computer program which, when executed, causes a data processing device (26) to carry out the method (100) according to one of claims 8 to 13.

15. Computer-readable medium comprising instructions which cause a data processing device (26) to perform the method (100) according to any one of claims 8 to 13.

Images