Semiconductor device

There is a need to detect faults on a path between a memory access circuit and a shared resource, faults in a logic circuit, and faults in the shared resource. A semiconductor device includes: a first memory access circuit; a second memory access circuit to check the first memory access circuit; a memory that outputs a memory address based on a first access address input from the first memory access circuit; a duplexing comparison circuit that compares the first access address with a second access address output from the second memory access circuit; a first address comparison circuit that compares the first access address with the memory address; and an error control circuit that outputs a control signal based on a comparison result from the duplexing comparison circuit and a comparison result from the first address comparison circuit.

CROSS-REFERENCE TO RELATED APPLICATIONS

The disclosure of Japanese Patent Application No. 2017-189496 filed on Sep. 29, 2017 including the specification, drawings and abstract is incorporated herein by reference in its entirety.

BACKGROUND

The present disclosure relates to a semiconductor device and is applicable to a semiconductor device having a failure detection function, for example.

An in-vehicle microcontroller includes a safety mechanism to monitor operation of a CPU of the microcontroller in addition to safety mechanisms such as an ECC (Error Correction Code) circuit provided for SRAM or flash memory and a BIST (Built in Self Test) circuit to perform self-diagnosis.

The dual lockstep (hereinafter referred to as a lockstep) is a most popular system as the safety mechanism to monitor CPU operations. The system synchronizes clocks of two CPUs mounted on one semiconductor chip and concurrently allows each CPU to perform the same process. The system allows a comparison circuit to compare processing results from the CPUs with each other and performs the process only when the processing results are identical. The lockstep is disclosed in U.S. Patent Application Publication No. 2013/038945, for example.Patent Literature 1: U.S. Patent Application Publication No. 2013/038945

SUMMARY

A bus master such as the CPU, when using a lockstep configuration, can detect faults on the bus master. However, the lockstep configuration cannot detect faults outside the lockstep. That is, it is impossible to detect faults on a path between the bus master based on the lockstep configuration and a shared resource, faults in a logic circuit, and faults in the shared resource when the bus master accesses the shared resource such as the memory. These and other objects and novel features may be readily ascertained by referring to the following description of the present specification and appended drawings.

The description below concisely explains an overview of representative aspects according to the present disclosure. That is, the semiconductor device includes a comparison circuit for access signals to the shared resource.

The above-mentioned semiconductor device can detect a fault on an access path to the shared resource.

DETAILED DESCRIPTION

As above, the bus master such as the CPU using the lockstep configuration can detect faults on the bus master. However, the lockstep configuration cannot detect faults outside the lockstep. That is, it is impossible to detect faults on a path between the bus master based on the lockstep configuration and a shared resource, faults in a logic circuit, and faults in the shared resource when the bus master accesses the shared resource such as the memory.

Concerning the memory, the BIST circuit can detect faults in the memory. However, the technique of the BIST circuit reads a test pattern into the memory using a path inoperable simultaneously with user operations and compares an expected pattern value with a read result. The circuit configuration therefore disables uninterrupted runtime monitoring. Operating the BIST circuit during the runtime allows the BIST circuit to rewrite the data in the memory. The bus master therefore needs to save the memory data in another memory before operating the BIST circuit.

During the runtime, it may be impossible to detect a fault in the shared resource such as the memory subsequent to a lockstep-based duplexing comparison circuit.

To solve this, the semiconductor device according to an embodiment includes a comparison circuit that compares a signal accessing the shared resource with an access signal output from the shared resource. It is thereby possible to detect an access signal fault. There is also provided a circuit to hold a faulty access signal. This can isolate a cause of the fault. Supplying the faulty access signal to a comparator can detect a fault of the comparator.

The description below explains a working example and modifications with reference to the accompanying drawings. In the description below, the same constituent elements are designated by the same reference numerals and a repetitive explanation may be omitted for simplicity.

Working Example

FIGS. 1 through 3are used to outline a configuration and operation of a microcontroller.FIG. 1is a block diagram illustrating a configuration example of the microcontroller.FIG. 2is a block diagram illustrating a flow of addresses and data at the CPU side inFIG. 1.FIG. 3is a block diagram illustrating a flow of addresses and data at the memory controller side inFIG. 1.

A microcontroller1is a semiconductor device that includes, in a single semiconductor chip, a CPU10including a master-side CPU11and a checker-side CPU12, local memory20, a fault detection circuit30, a memory controller40including a master-side memory controller41and a checker-side memory controller42, shared memory50, a fault detection circuit60, a DMA controller (DMAC)70, and a bus80. The local memory20and the shared memory50are configured as SRAM, for example. The CPU10can access the local memory20and can access also the shared memory50via the memory controller40. The DMAC70can access also the shared memory50via the memory controller40.

The fault detection circuit30at the CPU side includes a master-side address fault detection circuit31, a checker-side address fault detection circuit32, a duplexing comparison circuit33, a master-side ECC circuit34, and a checker-side ECC circuit35.

The fault detection circuit60at the memory controller side includes a master-side address fault detection circuit61, a checker-side address fault detection circuit62, a duplexing comparison circuit63, a master-side ECC circuit64, and a checker-side ECC circuit65.

The CPU11as a memory access circuit may read data from the local memory20. In this case, as illustrated inFIG. 2, the CPU11outputs an address signal (CAA1) for memory access to the local memory20, the address fault detection circuit31, and the duplexing comparison circuit33, and reads a data signal (LD) from the local memory20via the ECC circuit34. The CPU12outputs an address signal (CAA2) for memory access to the address fault detection circuit32and the duplexing comparison circuit33and reads a data signal (LD) via the ECC circuit35. The local memory20outputs the input address signal (CAA1) as a memory output address signal (LOA) to the address fault detection circuits31and32.

The CPU10may write data to the local memory20. In this case, as illustrated inFIG. 2, The CPU11outputs an address signal (CAA1) for memory access to the local memory20, the address fault detection circuit31, and the duplexing comparison circuit33, and outputs a data signal (CD1) to the local memory20and the duplexing comparison circuit33via the ECC circuit34. The CPU12outputs the address signal (CAA2) for memory access to the address fault detection circuit32and the duplexing comparison circuit33, and outputs a data signal (CD2) to the duplexing comparison circuit33via the ECC circuit35. The local memory20outputs the input address signal (CAA1) as the memory output address signal (LOA) to the address fault detection circuits31and32.

The CPU10may write data to the bus80. In this case, as illustrated inFIG. 2, the CPU11outputs a data signal (WD1) to the duplexing comparison circuit33. The CPU12outputs a data signal (WD2) to the duplexing comparison circuit33. The CPU11may read a data signal (RD1) from the bus80. In this case, as illustrated inFIG. 2, the CPU12also reads the data signal (RD1).

The memory controller40as a memory access circuit may read data from the shared memory50. In this case, as illustrated inFIG. 3, the memory controller41outputs an address signal (MAA1) for memory access to the shared memory50, the address fault detection circuit61, and the duplexing comparison circuit63, and reads a data signal (KD) from the shared memory50via the ECC circuit64. The memory controller42outputs an address signal (MAA2) for memory access to the address fault detection circuit62and the duplexing comparison circuit63, and reads a data signal (KD) from the shared memory50via the ECC circuit65. The shared memory50outputs the input address signal (MAA1) as an address signal (KOA) to the address fault detection circuits61and62.

The memory controller40may write data to the shared memory50. In this case, as illustrated inFIG. 3, the memory controller41outputs an address signal (MAA1) for memory access to the shared memory50, the address fault detection circuit61, and the duplexing comparison circuit63, and outputs a data signal (MD1) to the shared memory50and the duplexing comparison circuit63via the ECC circuit64. The memory controller42outputs an address signal (MAA2) for memory access to the address fault detection circuit62and the duplexing comparison circuit63, and outputs a data signal (MD2) to the via the ECC circuit65. The shared memory50outputs the input address signal (MAA1) as an address signal (KOA) to the address fault detection circuits61and62.

The memory controller40may read data to the bus80. In this case, as illustrated inFIG. 3, the memory controller41outputs a data signal (RD1) to the duplexing comparison circuit63. The memory controller42outputs a data signal (RD2) to the duplexing comparison circuit63. The CPU11may write a data signal (WD1) to the memory controller41. In this case, as illustrated inFIG. 3, the data signal (WD1) is also written to the memory controller42.

The address fault detection circuit31and the ECC circuit34detect a fault of the local memory20in region X1. The address fault detection circuit31detects a fault of an address line or a buffer circuit in region X2where the address signal (CAA1) is transmitted. The address fault detection circuit31and the duplexing comparison circuit33detect a fault of an address line or a buffer circuit in region X3where the address signal (CAA1) is transmitted. The duplexing comparison circuit33detects a fault of an address line or a buffer circuit in region X4where the address signal (CAA1) is transmitted.

FIGS. 4 through 6are then used to describe configurations of the fault detection circuits.FIG. 4is a block diagram illustrating a more detailed configuration of the CPU, the fault detection circuit, and the local memory inFIG. 2.FIG. 5is a block diagram illustrating a configuration example of one address fault detection circuit inFIG. 4.FIG. 6is a block diagram illustrating a configuration example of another address fault detection circuit inFIG. 4.

The CPU11includes an address generation circuit13and an address decoder14that generates an address signal (CAA1) for memory access and a memory selection signal (MS1) from an original address generated by the address generation circuit13. The address decoder14decodes a high-order address of the original address (OA) to generate the memory selection signal (MS1) and outputs a low-order address of the original address (OA) as the address signal (CAA1) for memory access.

The address signal (CAA1) is transmitted to the duplexing comparison circuit33, a selection circuit37, and a synchronization circuit38through a signal line111. The address signal (CAA1) is synchronized with a clock at the synchronization circuit38and is transmitted to the address fault detection circuit31. The selection circuit37selects the address signal (CAA1) or a test address (TA) for memory BIST. The selected address is transmitted to the local memory20through a signal line113. The memory selection signal (MS1) is transmitted to the local memory20and the duplexing comparison circuit33through a signal line112.

The CPU12is configured similarly to the CPU11. The address signal (CAA2) for memory access is transmitted to the duplexing comparison circuit33and a synchronization circuit39through a signal line121. The address signal (CAA2) is synchronized with a clock at the synchronization circuit39and is transmitted to the address fault detection circuit32. The memory selection signal (MS2) is transmitted to the duplexing comparison circuit33through a signal line122. The duplexing comparison circuit33transmits an error signal (DE) to the error control circuit36when a signal from the side of the CPU11differs from a signal from the side of the CPU12.

The local memory20includes a synchronization circuit23and a synchronization circuit24. The synchronization circuit23synchronizes the address signal (CAA1) for memory access with the clock. The synchronization circuit24synchronizes the memory selection signal (MS1) with the clock. The local memory20further includes an address decoder25, a control circuit26, a word line driver27, an IO28, and a memory cell array29. The address decoder25decodes an address signal synchronized at the synchronization circuit23. The control circuit26is supplied with a memory selection signal synchronized at the synchronization circuit24. The word line driver27is supplied with a row address. The IO28inputs or outputs data from a column selected by a column address. The local memory20moreover includes a path211that outputs an address signal for memory access synchronized at the synchronization circuit23as a memory output address signal (LOA). The memory output address signal (LOA) from the path211is transmitted to the address fault detection circuits31and32through a signal line212.

As illustrated inFIG. 5, the address fault detection circuit31includes an address comparison circuit311, an error address retaining circuit312, an error address injection circuit313, and a synchronization circuit314. The address comparison circuit311includes a comparator3111and an error address generation circuit3112. The comparator3111compares the address signal (CAA1) input to the local memory20with the memory output address signal (LOA) output from the local memory20and outputs an error detection signal (ED1) if the compared address signals mismatch. The error address generation circuit3112outputs the memory output address signal as an error address signal (EA1). The error detection signal (ED1) is transmitted to the error control circuit36.

The error address retaining circuit312uses the error detection signal (ED1) to retain the error address signal (EA1). The error address retaining circuit312retains only the first generated error address signal. This is because an address fault requires prompt transition to the safe state. For example, the CPU11can read the error address signal (EA1) retained by the error address retaining circuit312.

The error address injection circuit313injects a predetermined pattern into the error address generation circuit3112. The error address generation circuit3112generates a quasi-error address based on the injected pattern by using a circuit (EOR circuit) that inverts one or more bits in a memory output address (LOA). This can test the comparator3111. The error address injection circuit313injects a predetermined pattern also into the error address generation circuit3112of the address comparison circuit311of the address fault detection circuit32to be described later.

As illustrated inFIG. 6, the address fault detection circuit32includes the address comparison circuit311but does not include the error address retaining circuit312, the error address injection circuit313, and the synchronization circuit314.

The error control circuit36detects the error detection signal (ED1or DE) and outputs an interrupt request signal (IR), a reset request signal (RR), or a terminal output signal (TO) based on settings. The bus master such as the CPU or the system can thereby detect an error occurrence.

The description below explains operations of the entire circuit inFIG. 4.

The original address signal (OA) generated from the address generation circuit13in the master-side CPU11is input to the address decoder14and is decoded into the memory selection signal (MS1) and the address signal (CAA1) for memory access. Before input to the local memory20, the memory selection signal (MS1) and the address signal (CAA1) are input to the duplexing comparison circuit33and are compared to the memory selection signal (MS2) and the address signal (CAA2) from the checker-side CPU12, respectively.

The address signal (CAA1) branches to an input to the duplexing comparison circuit33and then passes through a selection circuit (multiplexer)37to select a test address signal (TA) for memory BIST. During the runtime (user mode), the selection circuit (multiplexer)37always selects the address signal (CAA1) output from the bus master.

The address signal along the signal line113is subject to retiming in the synchronization circuit23configured by a flip-flop in the local memory20, branches prior to the address decoder25, and is output from the local memory20. At this time, a read/write (R/W) access to the local memory20is performed as usual while the asserted memory selection signal (MS1) and the address signal allow the address decoder25to select an address space for the memory cell array29. The memory output address signal (LOA) is input to the address fault detection circuit31. The comparator3111of the address fault detection circuit31compares the address signal (CAA1) with the memory output address signal (LOA). When the comparator3111detects an address signal mismatch, the address comparison circuit311outputs the memory output address signal (LOA) as an error address (EA1) and the error address retaining circuit312retains the error address (EA1). At this time, the address comparison circuit311inputs the error detection signal (ED1) to the error control circuit36.

The memory output address signal (LOA) is input to the address fault detection circuit32. The comparator3111of the address fault detection circuit32compares the address signal (CAA2) with the memory output address signal (LOA). When the comparator3111detects an address signal mismatch, the address fault detection circuit32outputs the memory output address signal (LOA) as an error address (EA2) and outputs an error detection signal (ED2).

When a user predetermines a process for each error, the error control circuit36outputs the reset request signal (RR), the interrupt request signal (IR), and the terminal output signal (TO). The system detects an error occurrence based on these signals output from the error control circuit36. Subsequently accessing the error control circuit36and the error address retaining circuit312can specify an error cause and a destination address of incorrect writing or reading.

The error address injection circuit313is used to diagnose a fault for the comparator3111of the address comparison circuit311. Setting the error address injection circuit313inverts some bits of the memory output address signal (LOA) and allows the comparator3111to perform comparison with the address signal (CAA1). When the comparator3111is not faulty, there obviously occurs a mismatch between a signal output from the error address generation circuit3112and the address signal (CAA1), making it possible to test a fault for the comparator3111.

With reference toFIGS. 4 and 5, there has been described the case where the CPU10as the memory access circuit accesses the local memory20. The same applies to a case where the CPU40as the memory access circuit accesses the shared memory50.

Comparison between an address input to the memory from the memory access circuit and an address output from the memory makes it possible to detect address faults on the memory subsequent to the lockstep. Retaining an address output from the memory as an error address makes it possible to detect a destination address for incorrect writing and specify data destroyed by incorrect writing.

Modifications

Typical modifications will be described below. The following description of the modifications assumes that the same reference symbols as used for the above-mentioned working example are used for the parts including the configuration and the function similar to those explained in the above-mentioned working example. The description of the above-mentioned working example is applicable to the description of those parts as needed within a technologically undeviating scope. Parts of the above-mentioned working example and all or part of the modifications are interchangeably applicable as needed within a technologically undeviating scope.

First Modification

With reference toFIGS. 7 and 8, the description below explains a case where there is a plurality of the local memories20(for example, two local memories such as local memory20A and local memory20B).FIG. 7is a block diagram illustrating another configuration example of the CPU, the fault detection circuit, and the local memory inFIG. 2.FIG. 8is a block diagram illustrating a configuration example of the address fault detection circuit inFIG. 7.

The CPU11includes the address generation circuit13and the address decoder14that generates an address signal (CAA1) for memory access and memory selection signals (MS1A and MS1B) from an original address generated by the address generation circuit13. The address decoder14decodes a high-order address of the original address (OA) to generate the memory selection signals (MS1A and MS1B) and outputs a low-order address of the original address (OA) as the address signal (CAA1) for memory access.

The address signal (CAA1) is transmitted to the duplexing comparison circuit33, selection circuits37A and37B, and synchronization circuits38A and38B. The address signal (CAA1) is synchronized with the clock at the synchronization circuits38A and38B and is transmitted to address fault detection circuits31A and31B. The selection circuits37A and37B select the address signal (CAA1) or test addresses (TAA and TAB) for memory BIST. The selected addresses are transmitted to the local memories20A and20B. The memory selection signal (MS1B) is transmitted to the local memory20B and the duplexing comparison circuit33. The memory selection signal (MS1A) is transmitted to the local memory20A and the duplexing comparison circuit33.

The CPU12is configured similarly to the CPU11. The address signal (CAA2) for memory access is transmitted to address fault detection circuits32A and32B, the duplexing comparison circuit33, and synchronization circuits39A and39B. Memory selection signals (MS2A and MS2B) are transmitted to the duplexing comparison circuit33.

The local memories20A and20B are configured similarly to the local memory20. The local memory20A outputs the address signal for memory access synchronized with the clock at the synchronization circuit23as a memory output address signal (LOAA). The local memory20B outputs the address signal for memory access synchronized with the clock at the synchronization circuit23as a memory output address signal (LOAB). The memory output address signal (LOAA) is transmitted to the address fault detection circuits31A and32A. The memory output address signal (LOAB) is transmitted to the address fault detection circuits31B and32B.

As illustrated inFIG. 8, the address fault detection circuit31A includes the address comparison circuit311, an error address retaining circuit312A, the error address injection circuit313, and the synchronization circuit314. The address comparison circuit311includes the comparator3111and the error address generation circuit3112. The comparator3111compares the address signal (CAA1) input to the local memory20with the memory output address signal (LOAA) output from the local memory20A and outputs an error detection signal (ED1A) if the compared address signals mismatch. The error address generation circuit3112outputs the memory output address signal as an error address signal (EA1A). The error detection signal (ED1A) is transmitted to the error control circuit36.

The error address retaining circuit312A uses the error detection signal (ED1A) to retain the error address signal (EA1A) and uses the error detection signal (ED1B) to retain the error address signal (EA1B). The error address retaining circuit312A retains only the first generated error address signal. This is because an address fault requires prompt transition to the safe state. For example, the CPU11can read the error address signal (EA1A) or the error address signal (EA1B) retained by the error address retaining circuit312.

The error address injection circuit313injects a predetermined pattern into the error address generation circuit3112. The error address generation circuit3112generates a quasi-error address based on the injected pattern by using the circuit (EOR circuit) that inverts one or more bits in a memory output address (LOAA). This can test the comparator3111. The error address injection circuit313injects a predetermined pattern also into the error address generation circuit3112of the address comparison circuit311of the address fault detection circuit32to be described later.

Similarly to the address fault detection circuit32according to the working example (FIG. 6), the address fault detection circuits31B,32A, and32B include the address comparison circuit311but do not include the error address retaining circuit312, the error address injection circuit313, and the synchronization circuit314. The error detection signal (ED1B) and the error address signal (EA1B) are transmitted to the error address retaining circuit312A of the address fault detection circuit31A.

The error detection signal (ED1B) is transmitted to the error control circuit36.

The error control circuit36detects the error detection signal (ED1A, ED1B, or DE) and outputs the interrupt request signal (IR), the reset request signal (RR), or the terminal output signal (TO) based on settings. The bus master such as the CPU or the system can thereby detect an error occurrence.

The address signal (CAA2) for memory access is transmitted to the duplexing comparison circuit33and the synchronization circuits39A and39B. The address signal (CAA2) is synchronized with the clock at the synchronization circuits39A and39B and is transmitted to the address fault detection circuits32A and32B. The memory selection signals (MS2A and MS2B) are transmitted to the duplexing comparison circuit33. The duplexing comparison circuit33transmits the error signal (DE) to the error control circuit36when a signal from the side of the CPU11differs from a signal from the side of the CPU12.

The address decoder14in the CPU11decodes an original address (OA) generated by the address generation circuit13and generates the memory selection signals (MS1A and MS1B) and an access address (CAA1) for the local memories20A and20B. The memory selection signal (MS1A or MS1B) selects an access to the local memory20A or20B and enables an access to the local memory20A or the local memory20B. The comparator3111of the address fault detection circuit31A or31B then compares a memory output address (LOAA or LOAB) output from the local memory selected and accessed by the CPU11with the access address (CAA1) input to the local memory20A or20B from the CPU11. When a comparison result from the comparator3111shows a mismatch, the error address retaining circuit312retains the error address (EA1A or EA1B) and the error control circuit36is notified of the error detection signal (ED1A or ED1B) similarly to the working example.

Setting the error address injection circuit313can inject a fault into both of the memory output addresses (LOAA and LOAB). The error address injection circuit injects a fault depending on the memory as an access destination to test the comparator3111of the address fault detection circuit31A or31B.

With reference toFIGS. 7 and 8, there has been described the case where the CPU10as the memory access circuit accesses the local memory20. The same applies to a case where the CPU40as the memory access circuit accesses the shared memory50.

It is possible to prevent an area from increasing by allowing each memory to share the duplexing comparison circuit, the error address injection circuit, the error address retaining circuit, or the error control circuit. No need to settle a common circuit for each memory contributes to reducing the software processing time. Moreover, the error address injection circuit can be assigned to address signals output from the memory in common. The test can be performed along the memory space without understanding a physical memory configuration.

Second Modification

With reference toFIGS. 9 and 10, the description below explains an example of performing fault detection on a circuit in the memory access circuit.FIG. 9is a block diagram illustrating another configuration example of the CPU, the fault detection circuit, and the local memory inFIG. 2.FIG. 10is a block diagram illustrating a configuration example of the address fault detection circuit inFIG. 9.

The CPU11includes the address generation circuit13, the address decoder14, a synchronization circuit15, and an address generation circuit16. The address decoder14generates an address signal (CAA1) for memory access and memory selection signals (MS1A and MS1B) from an original address generated by the address generation circuit13. The address decoder14decodes a high-order address of the original address (OA) to generate the memory selection signals (MS1A and MS1B) and outputs a low-order address of the original address (OA1) as the address signal (CAA1) for memory access. The synchronization circuit15outputs the original address (OA1) synchronized with the clock. The original address (OA1) is transmitted to address fault detection circuits31AS and31BS. The address generation circuit16generates address signals (UA1A and UA1B) corresponding to the high-order side of the original address (OA) from the memory selection signals (MS1A and MS1B). The address signal (UA1A) is synchronized with the clock at the synchronization circuit38A and is transmitted to the address fault detection circuit31AS. The address signal (UA1B) is synchronized with the clock at the synchronization circuit38B and is transmitted to the address fault detection circuit31BS.

The address signal (CAA1) is transmitted to the duplexing comparison circuit33and the selection circuits37A and37B. The selection circuits37A and37B select the address signal (CAA1) or test addresses (TAA and TAB) for memory BIST. The selected addresses are transmitted to the local memories20A and20B. The memory selection signal (MS1B) is transmitted to the local memory20B and the duplexing comparison circuit33. The memory selection signal (MS1A) is transmitted to the local memory20A and the duplexing comparison circuit33.

The CPU12is configured similarly to the CPU11. The address signal (CAA2) for memory access is transmitted to the duplexing comparison circuit33. The memory selection signals (MS2A and MS2B) are transmitted to the duplexing comparison circuit33.

The local memories20A and20B are configured similarly to the local memory20. The local memory20A outputs the address signal for memory access synchronized at the synchronization circuit23as the memory output address signal (LOAA). The local memory20B outputs the address signal for memory access synchronized at the synchronization circuit23as the memory output address signal (LOAB). The memory output address signal (LOAA) is transmitted to the address fault detection circuits31AS and32AS. The memory output address signal (LOAB) is transmitted to the address fault detection circuits31BS and32BS.

As illustrated inFIG. 10, the address fault detection circuit31AS includes the address comparison circuit311, the error address retaining circuit312A, the error address injection circuit313, the synchronization circuit314, and a coupling circuit315. The address comparison circuit311includes the comparator3111and the error address generation circuit3112. The comparator3111compares the original address signal (OA1) input to the local memory20with an address resulting from coupling the memory output address signal (LOAA) with the high-order address signal (UA1A). The error detection signal (ED1A) is output if the compared address signals mismatch. The error address generation circuit3112outputs a memory output address signal as the error address signal (EA1A). The error detection signal (ED1A) is transmitted to the error control circuit36.

The error address retaining circuit312A equals the first modification. The error address injection circuit313equals the first modification.

The address fault detection circuits31BS,32AS, and32BS include the address comparison circuit311and the coupling circuit315but do not include the error address retaining circuit312A, the error address injection circuit313, and the synchronization circuit314. The error detection signal (ED1B) or the error address signal (EA1B) is transmitted to the error address retaining circuit312of the address fault detection circuit31A. The error address retaining circuit312retains only the first generated error address signal. This is because an address fault requires prompt transition to the safe state. For example, the CPU11can read the error address signal (EA1A) or the error address signal (EA1B) retained by the error address retaining circuit312.

The error detection signal (ED1B) is transmitted to the error control circuit36.

The error control circuit36detects the error detection signal (ED1A, ED1B, or DE) and outputs the interrupt request signal (IR), the reset request signal (RR), or the terminal output signal (TO) based on settings. The bus master such as the CPU or the system can thereby detect an error occurrence.

The CPU12is configured similarly to the CPU11. The address generation circuit16generates address signals (UA2A and UA2B) corresponding to the high-order side of the original address (OA) from the memory selection signals (MS2A and MS2B). The address signal (UA2A) is synchronized with the clock at the synchronization circuit39A and is transmitted to the address fault detection circuit32A. The address signal (UA2B) is synchronized with the clock at the synchronization circuit39B and is transmitted to the address fault detection circuit32B. The address signal (CAA2) for memory access is transmitted to the duplexing comparison circuit33. The memory selection signals (MS2A and MS2B) are transmitted to the duplexing comparison circuit33. The duplexing comparison circuit33transmits the error signal (DE) to the error control circuit36when a signal from the side of the CPU11differs from a signal from the side of the CPU12.

The address generation circuit16in the CPU11encodes the memory selection signal (MS1A or MS1B) output from the address decoder14to again generate a high-order address signal (UA1A or US1B). The comparator3111of the address fault detection circuit31A or31B compares the original address signal (OA) output from the address generation circuit13with an address signal resulting from coupling the high-order address signal (UA1A or US1B) generated by the address generation circuit16with the low-order address signal (memory output signal LOAA or LOAB)) output from the local memory20A or20B. It is thereby possible to detect a fault of the address decoder14.

With reference toFIGS. 9 and 10, there has been described the case where the CPU10as the memory access circuit accesses the local memory20. The same applies to a case where the CPU40as the memory access circuit accesses the shared memory50.

According to the working example and the first modification, the address fault detection circuit cannot detect a fault on the address line or the address decoder in the memory access circuit. According to the second modification, an address before input to the address decoder in the memory access circuit is output outside the bus master and is compared with an address output from the memory in the address fault detection circuit. It is thereby possible to detect a fault on the address decoder in the memory access circuit of a product that includes the memory access circuit unrelated to the lockstep configuration.

While there has been described the embodiment, the working example, and the modifications of the present invention created by the inventors, it is to be distinctly understood that the present invention is not limited to the embodiment, the working example, and the modifications, but may be otherwise variously modified.

For example, the working example and the modifications have described the case where the memory access circuit accesses the memory, but not limited thereto. The above is also applicable to a case where the memory access circuit accesses the shared resource such as a circuit including a register.

The working example and the modifications have described detection of a fault on an address path by comparing addresses to access the memory, but not limited thereto. For example, memory selection signals may be compared.

The working example and the modifications have described the case of using one set of the master-side CPU and the checker-side CPU and one set of the local memory and the fault detection circuit, but not limited thereto. Two or more sets may be applicable.