JPH09288150A - Error detection method, logic circuit and fault tolerant system - Google Patents

Abstract

(57) [Abstract] [PROBLEMS] To realize a self-checking circuit that is indispensable for realizing a highly reliable system without requiring special constraints. An error for testing the comparator is alternately injected into the inputs of the comparators 300 and 300 'by the permuters 80 and 80'.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a self-check circuit and a method of constructing the same, and more particularly to a self-check comparison circuit suitable for a highly reliable system configuration.

[0002]

2. Description of the Related Art Advanced control is required to improve energy (fuel) efficiency, improve operability, improve riding comfort, improve safety and speed of transportation such as aircraft, trains and automobiles. Along with this, computerization of these control devices is progressing. For the safe operation of these transportation facilities, the reliability and fail-safety of the control device (no output on the dangerous side due to the occurrence of a failure) is strongly required.

In order to guarantee the reliability and fail-safety of the control device, it is possible to detect the failure occurrence of the control device,
That is, the self-checking property is important. In order to realize self-checking property, M-out-of-N code or two-wire logic (1-out-of-2 code, that is, M-out) is used.
A method using a so-called redundant code in which the Hamming distance between codes is 2 or more is widely used. According to the above method, it is possible to completely detect a single fault. However, this is not the case when multiple faults occur, and the self-check circuit is
In the case of implementing the above, the generated fault may spread to the entire chip, and a phenomenon equivalent to the generation of multiple faults may be shown. Here, assuming that the probability that an erroneous output will coincide with the code point of the defined output code space O when a failure occurs is random in error,

[0004]

Η = No / Nu (Equation 1) where, No: the number of code points in the output code space O Nu: the number of code points Therefore, how to increase Nu with respect to No is an issue for improving the detection rate.

There are the following two methods for realizing a self-checking circuit by using the above redundant code.

(1) Method of configuring entire circuit with redundant code (2) Method of duplicating functional block section and comparing output of functional block section with self-checking comparison circuit configured with redundant code (1) The method of (1) has to be newly designed for self-checking, and there is a problem that it is difficult to optimize the operating speed of the circuit.

On the other hand, according to the method (2), since only the comparison circuit needs to be newly designed with the redundant logic, the existing processor, memory, etc. can be used for the functional block portion, so that the development cost is greatly increased. Can be reduced to
Since the latest semiconductor technology can be used, speedup can be easily achieved. The self-checking property of this method is largely due to the self-checking property of the comparator.

Therefore, in order to realize a self-checking comparator, the logic itself used in the comparison circuit is Mo.
It has been proposed to use redundant codes such as ut-of-N code and two-wire logic. For example, the literature (edited by Yoshihiro Toma:
RCCO shown in Figure 2.5 (p.31) of "Fault Tolerant System Theory", The Institute of Electronics, Information and Communication Engineers (1990)).
A self-checking comparator can be realized by connecting a (Reduction Circuit for Checker Output) circuit to a tree structure as shown in Fig. 2.6 (p.32).

In the case of the comparator, since the probability of occurrence of a failure in the circuit to be compared is low, it is rare that a mismatch occurs between the signals to be compared. Therefore, when a mismatch is detected, the path that should be activated is rarely activated, and when a failure occurs in the mode in which the output of this path is always fixed to mean "match". , There is a risk that the failure becomes latent. Therefore, in the case of the comparison circuit, in addition to the redundant code described above, not a binary level logic of 0 and 1 but a dynamic logic such as a frequency logic or an alternating inspection method in which the signal level changes in an alternating manner is used. Is used as a signal indicating that the signal is normal (hereinafter referred to as a signature signal). One example is a permuter (perm) that artificially injects faults into the RCCO shown in Figures 2.15 and 5.16 (p.42) of the literature for testing.
uter) is a method of prefixing. According to the above, an AC output can be obtained in a normal state, a fluctuation in the threshold value of the semiconductor element and a fixed failure of 0,1 level (stack-at 0,1).
In the event of a failure due to fluctuations in the DC characteristics of the device (such as a failure), an AC signal cannot be obtained, and the operation of the error detection function is constantly checked by periodically injecting an error to check the self-check of the circuit. King property is significantly improved.

However, the conventional technique has a problem that it is easily affected by the contact between the wiring nets in the semiconductor element. When crosstalk occurs between wiring nets due to a semiconductor device failure, migration of wiring material, insulation failure of the insulating layer, etc., a signature signal of another wiring net (below I will call it a forgery signature). Normally, the fail-safe circuit indicates that it is normal by the signature signal, so it will be recognized as normal even though it is abnormal due to a counterfeit signature due to touching, and the fail-safety of the circuit may be impaired. .

For this reason, in the prior art, the occurrence of cross contact was prevented by adding a special design constraint to the wiring interval and the like. However, according to this method, it is necessary to form transistors and wirings on a semiconductor substrate based on restrictions that are completely different from those of general-purpose semiconductors, and thus it is not possible to enjoy the benefits of existing technology, design automation tools, etc. In many cases, there were many manual work steps.

In order to solve the problems of the prior art, Japanese Patent Laid-Open No. 7-234801 filed by the present inventors assigns a unique signal waveform to each wiring net in a semiconductor device as a signature. Only when the signal waveform matches the signal waveform specific to the wiring net, the method is considered to be a valid signature.

According to the prior application, a signal waveform peculiar to each wiring net is assigned as a signature, and only when the signal waveform matches the signal waveform peculiar to the wiring net, it is regarded as a valid signature. Therefore, crosstalk between wiring nets, migration of wiring materials,
Even if a contact signal is generated due to poor insulation of the insulating layer and a signature signal is induced from another wiring net, the false signature does not match the signal waveform unique to the wiring net, so that the signature can be distinguished from the proper signature. Therefore, special wiring restrictions for preventing mixed touches, which were indispensable for the complete detection of faults in the conventional technology, are no longer required, and the existing semiconductor technology, design automation tools, etc. can be benefited, and the development cost is reduced. It can be expected that the time will be greatly reduced.

[0014]

In the above-mentioned application, the improvement of the error detection rate is sufficiently taken into consideration, but it was necessary to further consider it from the viewpoint of increasing the operating speed. In the prior application, as shown in FIG. 19, an error is injected into half of the signal output from the processor by the processor according to a predetermined pattern. Therefore, the self-checking comparator must operate at twice the frequency of the processor bus cycle. Conversely, the processor bus can operate only at half the maximum operating frequency of the self-checking comparator. RISC (Reduced Instruct
An ion set computer) normally takes several machine cycles for one data transfer for a single access, but normally one data transfer continues for four times in one machine cycle during burst transfer. Therefore, the self-checking comparator must operate at twice the machine cycle of the processor. That is, since the maximum operating frequencies of semiconductors in the same process are usually the same, the maximum operating frequency of the self-checking comparator limits the operating frequency of the entire system. An object of the present invention is to speed up the operation of the system by operating the other parts constituting the system at the maximum operating frequency of the self-checking comparator.

[0015]

In order to achieve the above object, the present invention takes the following means.

(1) Two types of comparators (one type in the prior art) constituting a self-checking comparator are provided.

(2) Errors are alternately injected into the comparators provided in the above two ways at the same frequency as the bus cycle according to a predetermined pattern.

According to the invention, the errors are alternately injected for testing the comparator, so that in one cycle the error is injected only in the input signal to the first comparator and in the next cycle the error is injected. Errors are only injected into the input signal to the two comparators. That is, in the cycle in which the error is injected only into the input signal to the first comparator, the first comparator is confirmed to have the function of detecting the mismatch, and at the same time, the inputs of the second comparator match each other. Make sure that. Then, in the cycle in which an error is injected only into the input signal to the second comparator, the function of the second comparator to detect the mismatch is confirmed, and at the same time the inputs of the first comparator match each other. Make sure that.

According to the present invention, it is possible to simultaneously check the function of detecting the mismatch of the comparators and the match / mismatch of the signals to be compared, so that a self-checking comparator capable of high-speed operation can be realized.

[0020]

BEST MODE FOR CARRYING OUT THE INVENTION A detailed description will be given below of an embodiment of the present invention with reference to the drawings.

FIG. 1 shows a basic embodiment of the present invention. In the figure, the case of comparing 1-bit data with each other is shown as an example for simplification, but as shown in FIG. 3 and subsequent figures, it is expanded to the case of comparing data with an arbitrary number of bits. Conceivable. Signal a0 (1 from function block A
0) is injected with an error for testing the comparator by the permuters 80 and 80 ', and the signal a0' (1 after the error injection) is injected.
0 '), a0 "(10") and the comparators 300, 30
Input to 0 '. The permuters 80 and 80 'are exclusive OR as shown in the figure, and have a function of artificially injecting an error for testing. Here, since the errors for testing the comparator are alternately injected in the permuters 80 and 80 ', as shown in FIG. 2, in a certain cycle, the input signal a0' (1
0 ') is injected into the error only, and in the next cycle, the error is injected only into the input signal a0 "(10") of the comparator 300'. That is, the input signal a0 ′ (1
In the cycle in which the error is injected only into 0 '), the comparator 30
A value of 0 confirms the function of detecting a mismatch, and at the same time, a comparator 300 'confirms that the inputs a0 (10) and b0 (20) match. Then, in a cycle in which an error is injected only into the input signal a0 ″ (10 ″) of the comparator 300 ′, the comparator 300 ′ is confirmed to have a function of detecting a mismatch, and at the same time, the comparator 300 outputs the input a0 (10). b0
Confirm that (20) matches. According to the present embodiment, since the function of detecting the mismatch of the comparator and the match / mismatch of the signals to be compared can be checked at the same time, a self-checking comparator capable of high speed operation can be realized. FIG. 3 shows an embodiment of a comparator applied to the embodiment of FIG. 1 of JP-A-7-234801. Signals a0 to an from the functional block A
Permuters 80 to 8n and 80 'to (10 to 1n)
At 8n ', an error for a test is injected according to the orthogonal waveform (test pattern) generated by the orthogonal waveform generation circuit 100, and signals a0 to an (10' to 1) after error injection are injected.
n '), a0' to an '(10 "to 1n"). Then, the signals 10 'to 1n' after error injection are compared with the comparison circuit 30.
.About.3n, signals b0 to bn from the functional block B (20 to
2n), the comparison results 40 to 4n are collected in the assembly circuit 5, and the signature output 6 indicates that the signature output 6 is normal only when the comparison result 40 to 4n indicates a normal signature. Output a signal. Further, the signals 10 "to 1n" after error injection are compared with the comparison circuit 30 '.
3n ′ to signals b0 to bn (20
.About.2n) and the comparison results 40'-4n 'are collected in the assembly circuit 5', and the comparison result 40'- 4n 'is collected in the assembly circuit 5'.
Only when 4n 'indicates a normal signature, a signature signal indicating normal is output to the signature output 6'.

The operation of the comparison circuits 30 to 3n is as follows, as in Japanese Patent Application Laid-Open No. 7-234801 filed by the inventors.

Here, the signals a0 'to an'after error injection are set.
If any one of (10 ′ to 1n ′) is represented by ai,

[0024]

Ai ′ = ai ^ pi (Equation 2) where i: signal number (i: 0 ... n) pi: orthogonal waveform (test pattern) generated by the orthogonal waveform generation circuit 100 ^: exclusive It becomes the operator of Exclusive OR. Furthermore, if any one of the comparison results c0 to cn (40 to 4n) is represented by ci,

[0025]

## EQU00003 ## ci = ai '^ bi = ai ^ pi ^ bi ... (Equation 3) Here, when the functional blocks A and B are normal, since ai = bi, ai ^ bi = 0. Therefore,

[0026]

[Equation 4] ci = pi (Equation 4)

Since arbitrary pi (i: 1 ... n) are orthogonal to each other, ci and cj (i ≠ j) are also orthogonal. Assuming that ai and pi are statistically independent or orthogonal, ai and ai 'are also orthogonal to each other, and bi,
ai 'are also orthogonal to each other. Therefore, there are correlations between these waveform groups that are not orthogonal and between ai and bi and p
It is between i and ci. Therefore, in order to prevent the occurrence of the counterfeit signature due to the above-mentioned touch, if the circuit layout is considered so as to physically separate ai and bi and between pi and ci, the influence of the forgery signature due to the touch may occur. Can be prevented.

As described above, according to Japanese Patent Application Laid-Open No. 7-234801 filed by the present inventors, it is possible to provide a complete self-checking comparator without requiring special wiring restrictions. .

The operation of the comparison circuits 30'-3n 'is similar to the operation of the comparison circuits 30-3n described above.

Here, the permuters 80 to 8n, 80 '
In some cycles, as shown in FIG. 2, the comparators inject errors for testing the comparators alternately at ~ 8n '.
An error is injected into only one bit of the input signals a0 ′ to an ′ (10 ′ to 1n ′) of 300, and in the next cycle, the input signals a0 ″ to an ″ (1 of the comparator 300 ′ are input.
An error is injected into only one bit out of 0 ″ to 1n ″). That is, the input signals a0 ′ to aa of the comparator 300
In a cycle in which an error is injected into only one bit of n '(10' to 1n '), the comparator 300 is confirmed to have a function of detecting a mismatch, and at the same time, the comparator 300' inputs a0 to an (10). ~ 1n) and b0-bn (20-2
Make sure that n) matches. Subsequently, the input signals a0 "to an" (10 "to 1n") of the comparator 300 'are input.
In a cycle in which an error is injected into only one of the bits, the comparator 300 'is confirmed to have the function of detecting a mismatch, and at the same time, the comparator 300 receives inputs a0 to an (10 to 10).
Confirm that 1n) and b0 to bn (20 to 2n) match. As described above, according to the present embodiment, since the function of detecting the mismatch of the comparator and the match / mismatch of the signals to be compared can be checked at the same time, a self-checking comparator capable of high speed operation can be realized.

The functional blocks 110 and 111 are provided with the signals a0 to an (10 to 1n) and b which are always valid.
It does not always output 0 to bn (20 to 2n), but signals a0 to an (10 to 1n) and b0 to bn (20 to 2n).
Are often output with a strobe signal indicating that is valid. In such a case, as shown in FIG. 4, the strobe signals 130 and 131 cause signals a0 to aa to be generated.
It may be held by the latch 120 when n (10 to 1n) and b0 to bn (20 to 2n) are valid. The type of signal used as a strobe signal for a circuit using a microprocessor differs depending on the microprocessor, and AS (Address Strob) is used for address signals and control signals.
e), BS (Bus Start), etc.
A (Transfer Acknowledge), DTACK (Data Tr
Signals such as ansfer Acknowledge) can be used as strobe signals.

FIG. 5 shows an embodiment in which the present invention is applied to an RCCO tree comparator of Document 2. Function block 11
For the signals a0 to an (10 to 1n) from 0, the quadrature waveform generation circuit 10 is provided with permuters 80 to 8n and 80 'to 8n'.
An error for testing is injected according to the quadrature waveform (test pattern) generated by 0, and the signal 10 'after error injection is injected.
~ 1n ', 10 "~ 1n", RCCO tree 3,
Input to 3 '. In the case of the RCCO tree, the signature outputs 6 and 6'also have two-line logic. Inside the RCCO tree 3, the inputs and outputs of the RCCO are orthogonal to each other, as in the embodiment of FIG. 1, and it is possible to prevent the influence of the occurrence of a counterfeit signature due to contact.

In the following description of the embodiments, the description will be made based on the comparison circuit shown in FIG. 3, but the comparison circuit using the RCCO tree can be similarly implemented unless otherwise specified.

FIG. 6 shows signals b0 to bn from the function 111.
(20 to 2n) is also an embodiment in which error is injected by the permuters 90 to 9n and 90 'to 9n' by the orthogonal waveform generated by the orthogonal waveform generation circuit 100. According to this embodiment, it is possible to prevent the stack fault at the input of the comparison circuit from becoming latent when bi has the same value for a long time. For example, when bi is an address signal and the program uses only an address in a specific area, the value of the upper bits of the address becomes a constant value for a long time.

FIG. 7 shows an embodiment in which the functional blocks 110 and 111 are provided with the orthogonal waveform generating circuits 100 and 101 separately and independently. According to this embodiment, the orthogonal waveform generation circuit 10
Since 0 and 101 are duplicated, the orthogonal waveform generation circuit 1
Any one of 00 and 101 failures can be detected and reported. Furthermore, according to this embodiment,
You can take advantage of the independence of the two systems.

FIG. 8 shows an embodiment in which a pulse-on waveform is used in a time slot specific to each wiring net as an orthogonal waveform. According to this embodiment, the output patterns p0 to pn of the quadrature waveform generation circuit 100 and the functional blocks 110 and 11 are obtained.
The comparison results c0 to cn (40
4n) is as shown in the figure.

FIG. 9 shows an embodiment of the quadrature waveform generation circuit 100 for generating the pattern shown in FIG. At power-on reset of the system, the reset signal becomes active, the flip-flop 1001 is preset (1 is set as an initial value), and the flip-flop 1002 is reset.
~ 100 m is reset (1 is set as an initial value). That is, the flip-flop strings 1001 to 100
A value of 1,0,0,0,0, ... 0 is set in m.
After the power-on reset, the pattern of 1, 0, 0, 0, 0, ... 0 is sequentially shifted according to the CLK (clock) signal to generate the pattern of FIG. If the flip-flops 1001 to 100m are made redundant and a redundant majority of the outputs of the flip-flops are taken in each stage, a soft error of the flip-flops due to noise, radiation, etc., or a temporary event called a single event upset is performed. The influence of error (transient fault) can be prevented, and the reliability can be improved. The quadrature waveform generation circuit 100 can also be used in the RCCO tree 3 of FIG.

The integrated circuit for the above-described embodiment has already been filed by the inventor and others in Japanese Patent Laid-Open No. 7-234.
It goes without saying that the circuit shown in FIG. 8, FIG. 11 or FIG. 13 of the 801 publication may be used.

FIG. 15 is a layout example of the present invention. Signals a0 to an (10 to 10 from the functional block 110
1n) is latched by the latch 120 by the strobe signal 130, and the quadrature waveform of the quadrature waveform generation circuit 100 is exclusive ORed by the permuters 80 to 8n and 80 'to 8n', and a0 'to an' (10 'to 1n). ′), A0 ″ 〜a
In the same manner, the signals b0 to bn (20 to 2n) from the functional block 111 are latched by the latch 121 by the strobe signal 131 and the orthogonal waveform of the orthogonal waveform generation circuit 101. Permuter 90-
9n, 90 'to 9n' take an exclusive OR, and b0 'to
bn '(20' to 2n '), b0 "to bn" (20 "to
2n ″). The signal a generated as described above
0'-an '(10'-1n'), a0 "-an" (1
0 "to 1n"), b0 'to bn' (20 'to 2n'),
b0 "to bn" (20 "to 2n") are compared by comparison circuits 40 to 4n and 40 'to 4n', respectively, and a comparison result c0 is obtained.
~ Cn (40-4n), c0'-cn '(40'-4
n '), and the signature output 6, 6 in the assembly circuit 5, 5'.
6 '. The process up to this point is as described in the above embodiment.

Here, the comparison circuits 40 to 4n and 40 'to 4
n ', the integrated circuits 5 and 5'in the area 0 (200), the functional block 110, the latch 120, the orthogonal waveform generation circuit 100,
The permuters 80 to 8n and 80 'to 8n' are set to the area 1 (2
01), functional block 111, latch 121, quadrature waveform generation circuit 101, permuters 90'-9n ', 90'-
9n 'is divided into two areas, area 2 (202). When these circuits are made into individual chips, area 0 (20
0), area 1 (201), and area 2 (202) are formed as separate chips. Further, when these circuits are put in the same chip, if the distance between the area 0 (200), the area 1 (201), and the area 2 (202) is set, or the power supply ground is separated, depending on the layout. It is possible to prevent the spread of obstacles. According to the layout of this embodiment described above,
Correlated signals, ie between ai and bi and pi,
Since the ci can be geometrically, physically, or electrically isolated from each other, it is possible to prevent the influence of the generation of the counterfeit signature due to the contact. When designing a high-performance LSI, the general layout (floor plan) relies on heuristics such as human experience and intuition, and the method of automatically wiring the details based on a certain algorithm is generally efficient. good. Therefore, most of the existing automatic wiring tools have a function of automatically inputting detailed wiring by inputting a rough layout (floor plan) by a human.
Therefore, the method according to the present embodiment has good compatibility (compatibility) with the functions of the existing automatic wiring tools, and the functions of these automatic wiring tools can be utilized to the maximum extent.

According to the present embodiment, the functional blocks according to the ordinary logic design are simply logically or optically copied to be composed of the comparison circuits 40 to 4n, 40 'to 4n' and the assembly circuits 5 and 5 '. The self-check can be easily performed by combining with the region 0 (200) to be provided, and not only the reliability can be improved but also the development cost man-hours can be significantly reduced.

FIG. 11 shows an embodiment of a self-checking computer using the present invention. As described below, the present invention can be applied to a self-checking computer, just like the embodiment shown in FIG. 16 of Japanese Patent Application Laid-Open No. 7-234801 already filed by the inventors. Each of the functional blocks 110 and 111 has an MPU (Micro-Proces
sing unit), WDT (Watch Dig Timer), INTC
Computer components such as (interrupt controller) are connected to the internal buses 212 and 213. Also, in each functional block, the interfaces 204, 20
5 to the external buses 206 and 207. The comparator according to the present invention compares the signals on the internal buses 212 and 213 with the signatures superposed by the permuters 80 to 8n and 90 to 9n in accordance with the patterns generated by the orthogonal waveform generation circuits 100 and 101, thereby functional blocks 110, The normality / abnormality of 111 is determined. Internal bus 2
When the signals of 12 and 213 match, the comparator (area 0 (200)) outputs the signature signal to the signature output 6. As shown further, the functional block 110 (region 1
(201)), and the function block 111 (area 2 (20
2)), according to the layout shown in FIG. 15 of Japanese Patent Application Laid-Open No. 7-234801, which is already filed by the inventors, the area 0 (200) of the comparator is separated from each other by separating the power supply ground. If they are arranged on one chip after being mounted, a one-chip self-checking microcomputer can be realized. For simplicity, the latches 120 and 121 are omitted in the figure.

External bus 2 in addition to internal buses 212 and 213
If 06 and 207 are checked by the comparator (area 0 (200)), the operation of the entire LSI including the operation of the interfaces 204 and 205 can be further monitored.

According to the present embodiment, an MP with a normal design
U, WDT, INTC (interrupt controller), and other functional blocks of a microcomputer composed of microcomputer components are simply logically or optically (at a mask pattern level) duplicated to be duplicated, and a comparison circuit is provided. A self-checking microcomputer can be easily realized by combining with a region 0 (200) composed of 40 to 4n and the integrated circuit 5, and a highly reliable self-checking circuit can be realized with less development man-hours and costs. can do.

FIG. 12 shows an embodiment of a fault tolerant computer system using a self-checking computer. As described below, the present invention can be applied to a fault tolerant computer system, just like the embodiment shown in FIG. 17 of Japanese Patent Laid-Open No. 7-234801 filed by the inventors. External bus 206 from self-checking computer 203, 203 '
The signals output to (207) and 206 '(207') are selected by the output selection circuit 210 and become the final output 211. The output selection circuit 210 has signature outputs 6, 6 '.
Is controlled by the switching control signal 209 generated by the switching control circuit 208 based on the above. That is, the output of the self-checking computer regarded as normal is selected based on the signature outputs 6, 6'from the self-checking computer 203, 203 '.

FIG. 13 shows an embodiment of the configuration of the switching control circuit 208. Signature monitoring circuit 212 ', 21
3'monitors the signature outputs 6, 6 ', 6 ", 6"', and if the signature outputs 6, 6 ', 6 ", 6"' are normal, the monitoring results 214, 215 are "normal". Is output, and if the signature outputs 6, 6 ', 6 ", 6"' are abnormal, a signal indicating "abnormal" is output to the monitoring results 214, 215. In the decision logic 216, only when the signature outputs 6 and 6'are abnormal and the signature outputs 6 "and 6"'are normal, the switching control signal 209 is set to "external bus 20".
6 '(207') is selected to output a signal meaning "select external bus 206 (207)".
It outputs a signal of meaning. In the drawing, for simplification, the signal indicating “normal” of the monitoring results 214 and 215 is at the normal binary H level, the signal indicating “abnormal” is at the L level, and the switching control signal 209 “external bus” is used. 206 '(2
A signal that means "select 07 ')" is shown at H level, and a signal that means "select external bus 206 (207)" is shown at L level. However, these signals are not limited to the binary logic, but the redundancy control such as the two-wire logic, the frequency logic, and the unique signature for each net provided in the present invention can be used to improve the reliability of the switching control circuit 208. , The reliability of the entire system can be further improved.

Subsequently, the signature monitoring circuit 212 ',
A description will be added to the embodiment 213 '. When the signature outputs 6, 6 ', 6 ", 6"' have periodic waveforms, the signature monitoring circuits 212, 213 can be realized by monitoring arrival of pulses at a constant interval with a counter, for example. The signature monitoring circuits 212 'and 213' can be realized by a sequential circuit of state transitions as shown in Fig. 6. That is, the signature outputs 6 and 6'or the signature outputs 6 "and 6"'are alternately arranged in a constant cycle. Each time, it goes back and forth between two states of "GOOD 0" and "GOOD 1" indicating "normal" and outputs a signal indicating "normal". If the signature outputs 6 and 6'or the signature outputs 6 "and 6"'are no longer alternating in a constant cycle, the state becomes "FAIL" indicating "abnormal" and a signal indicating "abnormal" is output. To do.

Further, FIG. 15 shows a conversion circuit 21 in front of the switching control circuit provided by FIG. 18 of Japanese Patent Application Laid-Open No. 7-234801 already filed by the inventors.
This is an example in which 6,217 are provided. It should be noted that the signature monitoring circuit 2 is composed of a sequential circuit of state transitions as shown in FIG.
12, 213 can be realized. Post-conversion signature 600,
Every time 600 ′ alternates at a constant cycle, it reciprocates between two states of “GOOD 0” and “GOOD 1” indicating “normal”, and outputs a signal indicating “normal”. If the post-conversion signatures 600 and 600 'do not alternate in both sides at a constant cycle, the state becomes "FAIL" indicating "abnormal" and a signal indicating "abnormal" is output. Further, the conversion circuits 216 and 217 can be realized by a state transition sequential circuit as shown in FIG. Every time the signature outputs 6 and 6'or the signature outputs 6 "and 6"'alternate with each other in a constant cycle, "out = 0" and "out" indicating "normal"
= 1 ”between two states and the converted signature 60
0 and 1 are alternately output as 0 and 600 '. Further, FIG. 18 shows the state transition of the embodiment of the conversion circuits 216 and 217 with further improved safety. Each time the signature outputs 6 and 6'or the signature outputs 6 "and 6"'alternate with each other at a constant cycle, "out" indicating "normal"
It reciprocates between two states of "= 0" and "out = 1", and 0 and 1 are alternately output as post-conversion signatures 600 and 600 '. If the signature outputs 6 and 6'or the signature outputs 6 "and 6"'do not alternate in a constant cycle on both sides, the state becomes "FAIL" indicating "abnormal", and the converted signatures 600 and 600' are obtained. A signal indicating "abnormal", for example, a signal fixed to 0 or 1 is output. Also,
If the signature outputs 6, 6 ', 6 ", 6"' are more complicated waveforms, they are correlated with the reference (template) waveform, and if the correlation is 1.0, it is judged to be normal. If it is less than 1.0, the signature monitoring circuits 212 and 213 can be realized by judging the above.

According to this embodiment, it is possible to construct a hot standby type fault tolerant system in which the self-checking computer 203 is the main system and the self-checking computer 203 'is the sub-system (standby system).
Moreover, the error detection method provided by the present invention with less omission of detection can provide a system more reliable than the conventional one.

Further, the self-checking computer provided by the present invention can be applied to a fault tolerant system having various configurations other than the system configuration described above. For example, it can be applied to Japanese Patent Application No. 63-266055 (hereinafter referred to as an already-applied patent), which has been filed by the inventors. The subsystems 1-1 to 1-N shown in FIG. 5 of the already filed patent are replaced with the self-checking computer 203 provided by the present invention, and the output of the already filed patent is 3-
This can be applied by replacing 1 to 3-N with the external bus 208 (207) of the present invention and replacing the mutual diagnosis results 4-1 and 4-N of the previously filed patent with the signature output 6 of the present invention.

Although not described in this specification,
Japanese Patent Application Laid-Open No. 7-234801 already filed by the inventors
The present invention can be applied to a self-checking comparator exactly like the embodiment shown in FIG. 19 of the publication.

[0052]

According to the present invention, it is possible to provide a new method capable of guaranteeing the fail-safe property even if a counterfeit signature is generated due to contact. Therefore, according to the present invention, it is possible to take advantage of existing semiconductor technology, design automation tools, etc. without requiring special constraints in realizing a fail-safe logic circuit, and to significantly reduce both development cost and time. Can be expected.

[Brief description of drawings]

FIG. 1 is an explanatory diagram of a basic embodiment of the present invention.

FIG. 2 is a timing chart of the operation of the basic embodiment of the present invention.

FIG. 3 is a block diagram of a basic embodiment of the present invention.

FIG. 4 is a block diagram of an embodiment corresponding to functional blocks.

FIG. 5 is a block diagram of an embodiment of an RCCO tree.

FIG. 6 is a block diagram of an embodiment in which a quadrature waveform is added to an output from a functional block 111.

FIG. 7 is a block diagram of an embodiment in which an orthogonal waveform generation circuit is duplicated.

FIG. 8 is an explanatory diagram of an example of an orthogonal function waveform.

FIG. 9 is a block diagram of an embodiment of a quadrature waveform generation circuit.

FIG. 10 is a block diagram of a circuit layout according to the present invention.

FIG. 11 is a block diagram of a self-checking computer according to the present invention.

FIG. 12 is a block diagram of a fault tolerant computer system using a self-checking computer.

FIG. 13 is a block diagram of the inside of a switching control circuit.

FIG. 14 is an explanatory diagram of state transition of the signature monitoring circuit.

FIG. 15 is a block diagram of the inside of a switching control circuit.

FIG. 16 is an explanatory diagram of state transition of the signature monitoring circuit.

FIG. 17 is an explanatory diagram of state transition of the conversion circuit.

FIG. 18 is an explanatory diagram of state transition of a conversion circuit.

FIG. 19 is a timing chart of the operation of the conventional technique.

[Explanation of symbols]

6, 6 '... Output, 10 ... Signal from functional block A, 2
0 ... Signal from functional block B, 80 ... Permuter.

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Naoto Miyazaki 7-1, 1-1 Omika-cho, Hitachi-shi, Ibaraki Hitachi Co., Ltd. Hitachi Research Laboratory (72) Inventor Yuichiro Morita 7-chome, Omika-cho, Hitachi-shi, Ibaraki No. 1 Hitachi Ltd. Hitachi Research Laboratory

Claims (16)

[Claims] 1. A logic circuit with an error detection function for comparing outputs of multiplexed function blocks and detecting an error, comprising a plurality of comparison function units for comparing outputs of the function blocks and detecting an error, A logic circuit characterized in that a pseudo error is alternately injected into the input of the comparison function unit. 2. The synthesizing means for superimposing, as the pseudo error, a unique waveform previously assigned to each block on one or both of the outputs of the multiplexed functional block, A logic circuit that detects an error based on the output from the synthesizing means. 3. The waveform synthesizing unit according to claim 2, wherein the synthesizing unit generates a unique waveform pre-allocated for each of the functional blocks, and the generated unique waveform and an output from the functional block. A logic circuit having a logical operation means for calculating an exclusive OR. 4. A logic circuit which comprises a functional block for outputting a plurality of signals in a multiplex configuration and which compares the outputs of these functional blocks, and outputs the output of the functional block in a logic circuit for detecting an error based on the comparison result. And a plurality of comparison function units for detecting errors and alternately injecting pseudo errors into the inputs of the comparison function units. 5. The synthesizing means according to claim 4, further comprising: synthesizing means for superimposing, as the pseudo error, a peculiar waveform previously assigned to each output signal to the output signals of the one or both functional blocks. A logic circuit for detecting an error by comparing the output from the means with the output from the other functional block. 6. The waveform synthesizing means according to claim 5, wherein the synthesizing means generates a unique waveform previously assigned to each output signal, the generated unique waveform and the one or both functional blocks. A logic circuit having a logic operation means for calculating an exclusive OR with each output signal from. 7. The logic circuit according to claim 5, wherein the unique waveforms previously assigned to the respective output signals are mutually uncorrelated waveforms. 8. The logic circuit according to claim 5, wherein the unique waveforms previously assigned to the respective output signals are mutually orthogonal waveforms. 9. The first synthesizing means for superimposing a unique waveform previously assigned to each output signal on the output signals of the one or both functional blocks, and the other functional block. Second synthesizing means for superimposing a unique waveform previously assigned to each output signal on the output signal of 1), and an output from the first synthesizing means and an output from the second synthesizing means. A logic circuit that detects an error by comparing. 10. A method of comparing an output signal between functional blocks that output a plurality of signals configured in a duplex manner to detect an error, and comparing the outputs of the functional blocks to detect an error. An error detection method comprising a plurality of units, wherein pseudo errors are alternately injected into the inputs of the comparison function unit. 11. The dual waveform according to claim 10, wherein a unique waveform previously assigned to each output signal is superimposed on each output signal of one or both of the dual-functional blocks. An error detection method for detecting an error by comparing each output signal of the other of the functional blocks converted into each output signal and each output signal on which the unique waveform is superimposed. 12. A predicamental OR of each output signal of one or both of the duplicated functional blocks and a unique waveform previously assigned to each output signal. According to the error detection method, the characteristic waveform is superimposed. 13. The dual waveform according to claim 11, wherein a unique waveform previously assigned to each output signal is superposed on each output signal of one or both of the dual functional blocks. When each output signal of the other of the functionalized blocks is compared with each output signal on which the unique waveform is superimposed, and as a result of the comparison, a waveform other than the previously assigned unique waveform is removed. Is an error detection method for determining an error. 14. The dual structure according to claim 11, wherein a unique waveform previously assigned to each output signal is superposed on each output signal of one or both of the duplexed functional blocks. Each of the other output signals of the functional blocks that have been converted and each output signal on which the unique waveform is superimposed are compared, and as a result of the comparison, if the pre-assigned unique waveform is not obtained, , An error detection method for determining an error. 15. A functional block that outputs a plurality of signals is configured in a multiplexed manner, and a plurality of comparison function units that compare the outputs of the function blocks and detect an error are provided, and the inputs of the comparison function unit are alternately simulated. A first error and a second computer for detecting an error by injecting a physical error and comparing the outputs from the functional blocks, and selecting either the output of the first computer or the second computer to the outside. A switching control circuit for outputting, wherein the switching control circuit selects one of the computer outputs based on the error detection signal output from the first and second computers. Tolerant system. 16. The synthesizing means according to claim 15, further comprising: synthesizing means for superimposing, as the pseudo error, a unique waveform previously assigned to each output signal on the output signals of the one or both functional blocks. A fault tolerant system for detecting errors by comparing the output from the means with the output from the other functional block.