SEMICONDUCTOR DEVICE AND STARTUP CONTROL METHOD FOR SEMICONDUCTOR DEVICE

A semiconductor device includes first and second processor cores configured to perform a lock step operation and including first and second scan chains. The semiconductor device further includes a scan test control unit that controls a scan test of the first and second processor cores using the first and second scan chains, and a start-up control unit that outputs a reset signal for bringing the first and second processor cores into a reset state. The start-up control unit outputs an initialization scan request before the start of a lock step operation, and the scan test control unit performs an initialization scan test operation on the first and second processor cores by using an initialization pattern.

CROSS-REFERENCE TO RELATED APPLICATIONS

The disclosure of Japanese Patent Application No. 2022-172398 filed on Oct. 27, 2022 including the specification, drawings and abstract is incorporated herein by reference in its entirety.

BACKGROUND

The present invention relates to a semiconductor device, and relates to, for example, a semiconductor device having at least two processor cores and having a lock step mode for causing the two processor cores to execute the same program, and a startup control method for the semiconductor device.

There is disclosed a technique listed below.

An in-vehicle microcontroller includes a safety mechanism such as an error detection and correction circuit using an error correction code (ECC) added to an SRAM, a flash memory, or the like, or a built in self test (BIST) circuit that performs self-diagnosis. In addition, the in-vehicle microcontroller includes a safety mechanism that monitors an operation of a processor core.

As the safety mechanism that monitors the operation of the processor core, a general mechanism is a lock step mechanism. A plurality of identical processor cores are mounted on one semiconductor device, and the lock step mechanism determines whether or not the plurality of processor cores perform the same operation. For example, a lock step mode is described in Japanese Unexamined Patent Application Publication No. 2010-198131 (Patent Document 1).

SUMMARY

In the lock step mode, internal states of a plurality of processor cores need to be matched before a lock step operation is started. This is because, when the lock step operation is started in a state where the internal states of the plurality of processor cores do not match, output data of the plurality of processor cores differ and is detected as an error. In order to match the internal states of the plurality of processor cores, for example, it is conceivable to replace all flip-flops included in each of the processor cores with flip-flops having a reset function. However, if all the flip-flops are replaced with flip-flops having a reset function, the circuit area increases.

Patent Document 1 discloses a processor system including a signal line group connecting a storage element of one of the processor cores to a storage element of the other processor core. To switch to the lock step mode, the processor system described in Patent Document 1 transfers data stored in the storage element of the one processor core to the storage element of the other processor core via the signal line group. In the processor system described in Patent Document 1, the stored contents of the two processor cores are matched in this manner.

However, when the signal line group is provided between the storage elements in order to transfer the stored data, the circuit area increases.

Other problems and novel features will become apparent from the description of the present specification and the accompanying drawings.

According to an embodiment, a semiconductor device includes first and second processor cores configured to perform a lock step operation. The first and second processor cores include a first scan chain and a second scan chain, respectively. The semiconductor device further includes a scan test control unit that controls a scan test of the first and second processor cores using the first and second scan chains, and a start-up control unit that outputs a reset signal for bringing the first and second processor cores into a reset state. The start-up control unit outputs an initialization scan request before a lock step operation is started, and the scan test control unit performs an initialization scan test operation on the first and second processor cores by using an initialization pattern.

According to the embodiment, it is possible to match the stored contents of storage elements of the plurality of processor cores that perform the lock step operation while suppressing an increase in the area of a circuit.

DETAILED DESCRIPTION

Hereinafter, a semiconductor device according to an embodiment will be described in detail with reference to the drawings. In the specification and the drawings, the same components or corresponding components are denoted by the same reference signs, and redundant description is omitted. In the drawings, a configuration may be omitted or simplified for convenience of description. In addition, at least some of embodiments may be arbitrarily combined with each other.

First Embodiment

FIG.1is a schematic diagram illustrating an example of a configuration of a main part in a semiconductor device100according to a first embodiment. The configuration will be described. The semiconductor device100illustrated inFIG.1is, for example, a micro controller unit (MCU) or the like including one semiconductor chip. The semiconductor device100illustrated inFIG.1includes a processing unit10, a start-up control unit20, and a scan test control unit30.

The processing unit10includes a first processor core11, a second processor core12, and a comparison unit13. Hereinafter, the first processor core11is referred to as a master core11, and the second processor core12is referred to as a checker core12. The processing unit10further includes an internal memory (not illustrated) including a random access memory (RAM) and a flash memory. The internal memory stores, for example, a program executed by the master core11and the checker core12.

The master core11sequentially reads (fetches) a plurality of instructions (programs) stored in the internal memory, and executes processing according to the instructions. For example, the master core11writes data generated by executing processing according to an instruction to the internal memory or reads data stored in the internal memory. In addition, the master core11outputs a result of processing according to an instruction to a peripheral circuit (not illustrated) via a bus (not illustrated).

The checker core12has the same configuration as the master core11. In other words, the checker core12has a redundant configuration with the master core11.

The processing unit10has a dual-core lock step configuration including the master core11and the checker core12. The dual-core lock step configuration is a configuration in which the two processor cores execute the same processing and detect a failure by comparing the processing results. While the two processor cores are operating in the same state, a lock step operation is performed. In the present embodiment, an input data signal DIN and a clock signal CLK are commonly input to the master core11and the checker core12. In the lock step operation of the present embodiment, an output result of the master core11is output to the peripheral circuit (not illustrated).

The master core11includes a scan chain (first scan chain)110for performing a scan test. The scan chain110includes n scan flip-flops111to11n,where n is an integer of 2 or more. Similarly, the checker core12includes a scan chain (second scan chain)120for performing a scan test. The scan chain120also has n scan flip-flops121to12n.The scan chain110and the scan chain120have the same configuration. Note thatFIG.1illustrates only paths of the scan chains. Hereinafter, each of the scan flip-flops is referred to as a scan FF.

The comparison unit13is enabled when the lock step operation is started. The enabled comparison unit13compares the output of the master core11with the output of the checker core12. In a case where the output of the master core11and the output of the checker core12do not match, the comparison unit13asserts an error signal ERR indicating that a failure has occurred in any of the processor cores.

The start-up control unit20detects power-on of the semiconductor device100and outputs a reset signal RST for bringing the processing unit10into a reset state for a predetermined period. The reset signal RST is commonly input to the master core11and the checker core12of the processing unit10. When the reset signal RST is asserted, the processing unit10is set to a reset state. On the other hand, when the reset signal RST is negated, the reset of the processing unit10is released. The start-up control unit20includes a state machine, and outputs an initialization scan request INI_REQ to the scan test control unit30before the reset is released to start the lock step operation of the processing unit10.

The scan test control unit30controls a scan test of the master core11and the checker core12in response to a scan test request (not illustrated) from the outside or the inside of the semiconductor device100. Specifically, the scan test control unit30generates a scan mode signal SM for setting an operation mode of the scan chains110and120. In addition, the scan test control unit30includes a pattern generation circuit (not illustrated) that generates a scan test pattern SI, and inputs the scan test pattern SI to the scan chains110and120in common. Furthermore, the scan test control unit30includes a detection circuit (not illustrated) that compares output results SO1and SO2of the scan test of the master core11and the checker core12with an expected value and detects a failure. Similarly to a general scan test for failure detection, in the scan test for failure detection of the master core11and the checker core12, a scan-in operation, a capture operation, and a scan-out operation are sequentially performed.

As described above, the scan test control unit30receives the initialization scan request INI_REQ from the start-up control unit20. The scan test control unit30controls an initialization scan test operation of the master core11and the checker core12based on the initialization scan request INI_REQ.

Next, a startup control method for the semiconductor device100will be described with reference toFIG.2.FIG.2is a flowchart illustrating the startup control method for the semiconductor device100.

When the semiconductor device100is powered on, the start-up control unit20asserts the reset signal RST for a predetermined period (step S1). The asserted reset signal RST is supplied to the processing unit10, that is, the master core11and the checker core12, and the master core11and the checker core12enter a reset state. After a lapse of the predetermined period, the start-up control unit20negates the reset signal RST to release the reset (step S2), and outputs an initialization scan request INI_REQ (step S3). The scan test control unit30receives the initialization scan request INI_REQ and performs the initialization scan test operation (step S4).

The initialization scan test operation will be described in detail. When the scan test control unit30receives the initialization scan request INI_REQ, the scan test control unit30performs the scan-in operation. For this scan-in operation, the scan test control unit30outputs a scan mode signal SM indicating a scan shift mode and an initialization pattern SI for the initialization scan test operation. As a result, the initialization pattern SI is scanned into the scan chains110and120.

Next, the scan test control unit30performs the capture operation. In order to perform the capture operation, the scan test control unit30switches the scan mode signal SM. In the capture operation, a combination circuit (not illustrated) between the scan FFs operates similarly to the normal operation. As a result, the internal state of the master core11and the internal state of the checker core12can be matched with each other. When the capture operation is completed, the scan test control unit30outputs an initialization scan test operation completion notification INI_ACK to the start-up control unit20.

When receiving the initialization scan test operation completion notification INI_ACK, the start-up control unit20asserts the reset signal RST again and sets the processing unit10to the reset state (step S5). At this time, for example, program counters included in the master core11and the checker core12are initialized, and a timer and an input/output port are initialized. Thereafter, the start-up control unit20negates the reset signal RST to release the reset of the processing unit10(step S6). Subsequently, the comparison unit13is enabled (step S7). For example, this enabling is implemented by asserting an enable signal (not illustrated) of the comparison unit13. Then, the clock signal CLK is commonly supplied to the master core11and the checker core12, and the lock step operation is started (step S8).

The semiconductor device100according to the present embodiment performs the initialization scan test operation after the semiconductor device100is powered on and before the lock step operation is started. In the scan-in operation in the initialization scan test operation, the same pattern is scanned into the scan chain110of the master core11and the scan chain120of the checker core12. By performing the capture operation in this state, the internal states of the master core11and the checker core12can be matched with each other.

Each of the master core11and the checker core12includes a storage element having no reset function. These storage elements not having a reset function cannot be initialized according to the reset after the semiconductor device100is powered on. However, according to the present embodiment, the same pattern is set in the scan chain of each core, and the capture operation is performed. As a result, values can also be set to the storage elements that do not have a reset function. Therefore, regardless of the complexity of the internal circuits of the cores, the contents stored in the storage element in the master core11and the contents stored in the storage element in the checker core12can be matched.

In addition, the initialization scan test operation in the present embodiment only needs to match the stored contents of the storage elements of the master core11and the checker core12, and thus, the scan-out operation performed in the general scan test for failure detection can be omitted. In addition, in the initialization scan test operation in the present embodiment, the pattern may be shorter than a test pattern for performing a scan test for failure detection. Therefore, the initialization scan test operation can be performed in a short time. That is, it is possible to shorten the processing time for matching the internal states of the master core11and the checker core12before the start of the lock step operation.

In the present embodiment, the initialization scan test operation uses the scan chains provided in advance for performing a failure detection scan test of each core. Therefore, it is not necessary to provide a new circuit in order to match the internal states of the cores. That is, the internal states of the cores can be matched without increasing the circuit scale.

Second Embodiment

Next, a second embodiment will be described. In the second embodiment, a semiconductor device100aas another form of the semiconductor device100according to the first preferred embodiment will be described.FIG.3is a schematic diagram illustrating an example of a configuration of a main part in the semiconductor device100aaccording to the second embodiment. The configuration example illustrated inFIG.3is different from the configuration example illustrated inFIG.1in the following two points. The first difference is that a clock control unit40is further included. The second difference is that the processing unit10is replaced with a processing unit10a.The processing unit10ais different from the processing unit (seeFIG.1) described in the first embodiment in further including an input control unit14. Other configurations and operations are the same as those of the semiconductor device100described in the first embodiment, and thus, the same configurations are denoted by the same reference signs, and repeated description is omitted.

As illustrated inFIG.3, the semiconductor device100aincludes the clock control unit40. The clock control unit40controls whether or not to supply a clock signal CLK to a master core11and a checker core12. The clock control unit40receives a reset signal RST from a start-up control unit20. When the asserted reset signal RST is input to the clock control unit40, the clock control unit40negates a clock enable signal CEN and stops clock supply to the master core11and the checker core12. On the other hand, when the reset is released and the reset signal RST is negated, the clock control unit40asserts the clock enable signal CEN and starts clock supply to the master core11and the checker core12.

The processing unit10ahas a clock delay type dual-core lock step configuration. The processing unit10aincludes an input control unit14in addition to the master core11and the checker core12. The input control unit14includes clock gating cells (hereinafter, referred to as CGCs)141and142and delay circuits143and144. In addition, the processing unit10aincludes a comparison unit13ainstead of the comparison unit13described in the first embodiment.

The CGC141receives the clock signal CLK and supplies the clock signal CLK to the master core11or stops the supply of the clock signal CLK based on the clock enable signal CEN. The CGC142controls the supply of the clock signal CLK to the checker core12based on a clock enable signal CENd.

The delay circuit143delays an input data signal DIN by a predetermined number of clock cycles. Hereinafter, the input data signal DIN delayed by the delay circuit143is referred to as an input data signal DINd. The input data signal DINd is supplied to the checker core12.

The delay circuit144delays the clock enable signal CEN by a predetermined number of clock cycles. Hereinafter, the clock enable signal CEN delayed by the delay circuit144is referred to as a clock enable signal CENd. The clock enable signal CENd is supplied to the CGC142.

In this manner, the checker core12receives the input data signal DIN after the master core11receives the input data signal DIN. In addition, due to the clock enable signal CENd, the clock signal CLK is supplied to the checker core12after being supplied to the master core11. That is, the checker core12executes the same processing as that of the master core11with a delay of a predetermined number of clock cycles. By delaying the processing timing of the checker core12, peaks of power consumption and the like can be dispersed.

Next, the configurations of the delay circuits143and144will be described.FIG.4is a block diagram illustrating an example of the configurations of the delay circuits143and144according to the present embodiment.

The delay circuit143includes a plurality of flip-flops (FFs)1430to1434. The plurality of flip-flops1430to1434are connected in series and function as a shift register using the clock signal CLK as a shift clock. In the present embodiment, an example is shown in which the delay circuit143outputs the input data signal DINd obtained by delaying the input data signal DIN by 5 clock cycles, but the present invention is not limited thereto.

The delay circuit144includes a plurality of flip-flops (FFs)1440to1444. The plurality of flip-flops1440to1444are connected in series and function as a shift register using the clock signal CLK as a shift clock. In the present embodiment, the delay circuit144outputs the clock enable signal CENd obtained by delaying the clock enable signal CEN by the same number of clock cycles (5 clock cycles) as that in the delay circuit143. The delay circuit144has substantially the same configuration as the delay circuit143, but is different from the delay circuit143in that the flip-flop1444at the last stage has a reset function. The flip-flop1444having the reset function is reset by the reset signal RST generated by the start-up control unit20.

FIG.5is a block diagram illustrating an example of a configuration of the comparison unit13aaccording to the present embodiment. The comparison unit13aincludes a delay circuit131aand a comparison circuit132a.The delay circuit131adelays the output of the master core11by the same number of clock cycles as that in the delay circuit143. The delay circuit131amay have a configuration equivalent to that of the delay circuit143. The comparison unit13acompares the output of the master core11delayed by the delay circuit131awith the output of the checker core12. As a result, the outputs based on the same processing of the master core11and the checker core12are compared. In a case where the comparison result does not indicate a match between the outputs, the comparison unit13aasserts an error signal ERR indicating that a failure has occurred in any of the processor cores.

Similarly to the first embodiment, the semiconductor device100aaccording to the second embodiment uses scan chains of the master core11and the checker core12to perform an initialization scan test operation for matching the internal states of the master core11and the checker core12before starting the lock step operation.

With reference toFIGS.6and7, a startup control method for the semiconductor device100aaccording to the second embodiment will be described.FIG.6is a flowchart illustrating the startup control method for the semiconductor device100a.FIG.7is a waveform chart illustrating internal waveforms during startup control for the semiconductor device100a.

When the semiconductor device100ais powered on, the start-up control unit20asserts the reset signal RST for a predetermined period (step S10). The clock control unit40negates the clock enable signal CEN according to the asserted reset signal RST. The asserted reset signal RST is supplied to the processing unit10a,that is, the master core11and the checker core12, and the master core11and the checker core12enter a reset state.

After a lapse of the predetermined period, the start-up control unit20negates the reset signal RST to release the reset (step S20). When the reset signal RST is negated, the clock control unit40asserts the clock enable signal CEN. Based on the asserted clock enable signal CEN, the CGCs141and142start supplying the clock signal CLK to the master core11and the checker core12, respectively.

Subsequently, the start-up control unit20outputs an initialization scan request INI_REQ (step S30). The scan test control unit30receives the initialization scan request INI_REQ and performs the initialization scan test operation (step S40). Since the initialization scan test operation in the present embodiment is similar to the initialization scan test operation described in the first embodiment, detailed description thereof will be omitted. When the initialization scan test operation is completed, the scan test control unit30notifies the start-up control unit20of an initialization scan test operation completion notification INI_ACK.

When receiving the initialization scan test operation completion notification INI_ACK, the start-up control unit20asserts the reset signal RST again (step S50). As illustrated inFIG.7, when the reset signal RST is asserted at time T1, the clock control unit40negates the clock enable signal CEN. InFIG.7, the asserted signal indicates the high level, and the negated signal indicates the low level, but the present invention is not limited thereto. The CGC141stops the supply of the clock signal CLK to the master core11on the basis of the negated clock enable signal CEN. In this case, the CGC142receives the negated clock enable signal CENd via the delay circuit144. However, among the plurality of flip-flops included in the delay circuit144, the flip-flop1444at the last stage has the reset function. Therefore, as illustrated inFIG.7, the clock enable signal CENd supplied to the CGC142is negated at the same timing (time T1) as the clock enable signal CEN supplied to the CGC141. As a result, the numbers of clocks input to the master core11and the checker core12can be equalized from the start to the completion of the initialization scan test operation. That is, a state in which the internal states of the master core11and the checker core12match is maintained.

Thereafter, the start-up control unit20negates the reset signal RST to release the reset (step S60). In response to the release of the reset, the clock control unit40asserts the clock enable signal CEN (at time T2inFIG.7). The supply of the clock signal CLK to the master core11is started on the basis of the clock enable signal CEN. Furthermore, the supply of the clock signal CLK to the checker core12is started on the basis of the signal (clock enable signal CENd) obtained by delaying the clock enable signal CEN (at time T3inFIG.7). Subsequently, the comparison unit13ais enabled (step S70), and the lock step operation is started (step S80).

As described above, inFIG.7, the clock control unit40resets the clock enable signal CEN according to the reset signal RST output after the start-up control unit20performs the initialization scan test operation. Specifically, the clock control unit40negates/asserts the clock enable signal CEN in response to assertion/negation of the reset signal RST. Furthermore, the delay circuit144resets the clock enable signal CENd on the basis of the reset signal RST. Specifically, the delay circuit144negates the clock enable signal CENd in response to assertion of the reset signal RST, and asserts the clock enable signal CENd after a delay of a predetermined number of cycles from the negation of the reset signal RST.

In the present embodiment, in order to equalize the numbers of clocks supplied to the master core11and the checker core12in the initialization scan test operation, the flip-flop at the last stage in the delay circuit144has the reset function. All the flip-flops included in the delay circuit144can be flip-flops having a reset function only in order to equalize the numbers of clocks supplied to the cores in the initialization scan test operation. In this case, there is a possibility that the clock enable signal CENd output from the delay circuit144may become unstable when the reset is released. Therefore, the numbers of clocks given to the cores before the start of the lock step operation are different, and as a result, values set in storage circuits at the time of starting the lock step operation may not match between the master core11and the checker core12. However, in the present embodiment, since only the flip-flop1444at the last stage in the delay circuit144has the reset function, when the reset is released, the flip-flop1444takes in and outputs a value output from the flip-flop1443in the previous stage (see the time T2inFIG.7). Therefore, the clock enable signal CENd does not become unstable when the reset is released.

According to the second embodiment, even in the processing unit10ahaving the clock delay type dual lock step configuration, by performing the initialization scan test operation on the two cores in the processing unit, the internal states of the cores before the start of the lock step operation can be matched with each other.

In the second embodiment, only the flip-flop1444at the last stage in the delay circuit144is configured as a flip-flop having a reset function, but a plurality of flip-flops in the delay circuit144may be configured as flip-flops having a reset function as long as the clock enable signal CENd output from the delay circuit144does not become unstable when the reset is released.

In each of the first and second embodiments, the initialization scan test operation includes the scan-in operation and the capture operation. Since the initialization scan test operation is not intended for failure detection, the scan-out operation is not essential. However, in the initialization scan test operation, the scan-out operation may be performed following the capture operation.

In addition to the lock step operation mode in which the master core11and checker core12included in the semiconductor device perform the same process, the semiconductor device may have a free-step operation mode in which the master core11and the checker core12perform different processes. When the free-step operation mode is switched to the lock step operation mode, the initialization scan test operation described in the present embodiment may be performed in order to match the internal states of the two processor cores.

Although the invention made by the present inventors has been specifically described based on the embodiments, the present invention is not limited to the above embodiments, and it goes without saying that various modifications can be made without departing from the gist of the present invention.