WO2007017359A1

WO2007017359A1 - Device and method for controlling a computer system

Info

Publication number: WO2007017359A1
Application number: PCT/EP2006/064490
Authority: WO
Inventors: Reinhard Weiberle; Bernd Mueller; Eberhard Boehl; Yorck Collani; Rainer Gmehlich
Original assignee: Robert Bosch Gmbh
Priority date: 2005-08-08
Filing date: 2006-07-21
Publication date: 2007-02-15
Also published as: KR20080032167A; CN101238449A; EP1915691A1; DE102005037262A1; JP2009506406A; TW200732907A

Abstract

Disclosed are a device and a method for controlling a computer system comprising at least two identical or similar functional units. According to the invention, functional units are activated and/or deactivated in accordance with conditions that can be predefined.

Description

Device and method for controlling a computer system

State of the art

The fabrication of complex semiconductor devices such as microcontrollers (μC) or ASICs is error-prone. Since the doping is a statistical process with ever smaller structure sizes, even in the long term, manufacturing errors are unavoidable. It is even becoming apparent that the error rate will increase in the future despite great efforts and progress. Yield, i. the ratio of correctly working components to the number of components produced is about 90% for a controlled manufacturing process (i.e., already 10% reject), but it is quite possible that much lower values may occur. Mechanisms to increase the yield are thus directly cost-cutting. In addition, there is an increasing demand from test and production considerations to be able to deal with defective components in the field.

In order to tolerate errors in the production of memory components such as Flash, RAM or ROM in operation, a meanwhile already partially used means is the use of an error correcting code (ECC). In addition to the storage of the data bits, check bits are also stored with this. The check bits are such that, if only one bit (or a known maximum number of bits) is corrupted, the error is caused by a

Additional logic can be detected and corrected. This causes the entire device (or the corresponding subcomponent of a device) to give a correct result even in the presence of errors. The Mitabspeicherung the check bits requires a significant overhead, while the necessary additional logic causes virtually no large additional costs. Errors in semiconductor circuits, in particular in computer systems, can also occur during the operation of these circuits. In most cases, it is not possible to ensure high availability in a systematic way, even with permanent errors. One of the few exceptions are memory ECC mechanisms. For transient errors in processors, especially CPUs, recovery or reset measures are known. For

Error in execution units is not a realistic, cost-effective concept for tolerating permanent errors known.

It is a first object of the invention to improve the yield in the manufacturing process of .mu.C or of the semiconductor components, in particular by enabling use even for components with defective functional units. A second object of the invention is to increase the availability of components in operation. For this purpose, means are to be made available which make it possible to identify faulty execution units (eg cores, ALUs, processors) in a component, and the "graceful degradation" or run-flat operation of a system using this component. enable.

Advantages of the invention

Consider a semiconductor circuit, for example a μC, which contains at least two identical or similar functional units. At the end of the production process, during assembly, during diagnosis or in test phases during operation, potential faulty functional units are identified by means of a test program. This can advantageously be done by means of a switching and comparison function, for example in a switching and comparison unit, which compares the output signals of a functional unit with the output signals of at least one further functional unit and / or with further reference values. It is stored in a memory element, which functional units are faulty. These functional units are used, e.g. deactivated by the switching and comparison unit or via an interrupt device. The device, while containing faulty functional units, is still usable and functional.

Advantageously, a method for controlling a computer system having at least two identical or similar functional units is described, wherein an activation and / or deactivation of functional units is performed.

Advantageously, a method is described, characterized in that an activation and / or deactivation of functional units takes place as a function of the results of at least a first method step for detecting an error in the computer system and / or at least a second method step for identifying a defective functional unit.

Advantageously, a method is described, characterized in that the computer system contains at least two identical or similar functional units and that is switched between at least two operating modes of the at least two identical or similar functional units of the computer system and a first operating mode a comparison mode and a second operating mode a performance mode speaks.

Advantageously, a method is described, characterized in that errors in the output signals of the functional units to be compared are detected in the comparison mode and the comparison mode corresponds to a first method step for detecting an error in the computer system

Advantageously, a method is described, characterized in that selected functional units of the computer system are switched to an operating mode in which an identification of faulty functional units by comparing the output signals of these functional units with reference values is possible and this

Operating mode corresponds to a second method step for identifying a faulty functional unit in the computer system

Advantageously, a method is described, characterized in that the reference values are stored in a memory device of the computer system and are read out from the memory device when switching to the operating mode for error identification.

Advantageously, a method is described, characterized in that a switchover tion between at least two operating modes during operation of the computer system cyclically or on request.

Advantageously, a method is described, characterized in that the switching between at least two operating modes for the purpose of detecting errors and / or the identification of faulty functional units is carried out.

Advantageously, a method is described, wherein a configuration status and / or error status is formed for at least the functional units of the computer system identified as faulty.

Advantageously, a method is described, characterized in that a deactivation of a functional unit takes place in that information about the configuration status or the error status of this functional unit are stored in a memory device such that they can be read during the initialization and / or operation of the semiconductor system and the stored information is processed in such a way that it is not possible to use the units designated as deactivated in operation.

Advantageously, a method is described, characterized in that a configuration status and / or an error status is formed for all activatable and / or deactivatable functional units of the computer system.

Advantageously, a method is described, characterized in that information about the configuration status and / or the error status of the activatable and / or deactivatable functional units are stored in a memory device. Advantageously, a method is described, characterized in that the computer system contains at least two identical or similar functional units and that at least one of the same or similar functional units in the computer system is deactivated by default.

Advantageously, a method is described, characterized in that at least one information about the configuration status of the deactivated functional unit is stored in a memory device. Advantageously, a method is described, characterized in that during or after the identification of a faulty functional unit, a reconfiguration of the computer system takes place in that at least the functional unit identified as faulty is deactivated.

Advantageously, a method is described, characterized in that in the case of deactivation of a functional unit due to an error information about the configuration status and / or an error status of this functional unit is written in a memory device.

Advantageously, a method is described, characterized in that during or after the identification of a faulty functional unit, a reconfiguration of the computer system takes place, whereby the functional unit identified as faulty is deactivated and a standard deactivated but not faulty functional unit is activated.

Advantageously, a method is described, characterized in that the first method step for the detection of an error corresponds to the intended operation of the at least two identical or similar functional units of the computer system in one

Comparison mode corresponds.

Advantageously, a method is described, characterized in that the second method step for identifying a faulty unit corresponds to the execution of an error detection routine on at least one functional unit and a comparison of the results of the error detection routine with reference values.

Advantageously, a method is described, characterized in that before or to the implementation of the method step for identifying a faulty unit ne ne reconfiguration of the computer system is performed, which allows the execution of different functions, commands, program segments or programs on the same or similar functional units ,

Advantageously, a method is described, wherein the reference values of the error codes tion routines are stored together with the error detection routines in a memory device

Advantageously, a method is described, characterized in that during or after the identification of a faulty functional unit, a reconfiguration of the computer system takes place, whereby at least the functional unit identified as faulty is deactivated.

Advantageously, a method is described, characterized in that in case of deactivation of a functional unit due to an error, a configuration status and an error status of this functional unit are written to a memory device. Advantageously, a method is described, characterized in that at least part of the functions, commands, program segments or programs that are intended for processing in a first operating mode before reconfiguration of the computer system are executed after a reconfiguration of the computer system in a second operating mode ,

Advantageously, a method is described, wherein the first operating mode corresponds to a comparison mode and the second operating mode corresponds to a performance mode or an error mode with only one active functional unit.

Advantageously, a method is described, characterized in that the deactivation of functional units takes place irreversibly by interrupting electrical connections to or between functional units of the computer system.

Advantageously, a method is described, characterized in that an interruption of electrical connections in the computer system is achieved by electrical action on at least a part of the connections.

Advantageously, a method is described, characterized in that an activation and / or deactivation of functional units takes place during operation of the computer system and using devices which are part of the computer system or which are permanently connected to the computer system. Advantageously, a device for controlling a computer system with at least two identical or similar functional units is described, characterized in that means are provided which enable activation and / or deactivation of functional units of the computer system depending on predefinable conditions. Advantageously, a device is included, characterized in that means are provided to enable error detection in the computer system and / or identification of faulty functional units.

Advantageously, a device is included, wherein the device contains switching means which enables a switchover between at least two operating modes of the at least two identical or similar functional units of the computer system and a first operating mode corresponds to a comparison mode and a second operating mode corresponds to a performance mode.

Advantageously, a device is included, characterized in that the device

Contains means for switching selected functional units of the computer system in an operating mode in which an identification of faulty functional units by comparing the output signals of these functional units with reference values is possible.

A device is advantageously included, characterized in that the device comprises comparison means for comparing output signals of functional units with output signals of at least one further functional unit or with reference values and generating error information in the event of a discrepancy.

Advantageously, a device is included, characterized in that the device comprises memory means in which reference values for the output signals of functional units are stored and further comprises means for supplying reference values from the memory device to a comparison device.

Advantageously, a device is included, characterized in that means are provided to form a configuration status and / or an error status for all activatable and / or deactivatable functional units of the computer system. A device is advantageously included, characterized in that the device contains means for storing data in which at least information about the configuration status or the error status of the activatable and / or deactivatable functional units is stored.

Advantageously, a device is included, wherein the means for storing data are non-volatile storage means.

A device is advantageously included, characterized in that means are present which read out the configuration statuses and / or error statuses of the functional units stored in a memory device during initialization and / or operation of the computer system and activate them depending on the data read and an error signal from the comparison device and / or deactivation of functional units.

Advantageously, a device is included, wherein means are provided which can perform a deactivation of functional units irreversibly.

Advantageously, a device is included, that means are present, which interrupts at least one electrical connection to this or in these functional units for the irreversible deactivation of functional units.

Advantageously, a device is included in which means are provided which can bring about an interruption of electrical connections to or in functional units by electrical action on at least a part of these connections.

A device is advantageously included, characterized in that the means for error detection, for activation and / or deactivation of functional units are part of the computer system or are permanently connected to the computer system.

Further advantages and advantageous embodiments will become apparent from the features of the claims and the description. characters

Figure 1 describes a general switching component with a switching logic and processing logic

FIG. 2 describes the connection of the switching component with a memory element

FIG. 3 describes a basic process for increasing the yield using a storage element

FIG. 4 describes a principle method for increasing availability, graceful degradation and emergency operation.

FIG. 5 describes the connection of the switching component with an influencing component

FIG. 6 describes a principle method for increasing the yield using an influencing component

FIG. 7 describes the structure of a possible memory element

Description of the embodiments

An execution unit may in the following designate both a processor / core / CPU and an FPU (floating point unit), a DSP (digital signal processor), a coprocessor or an ALU (arithmetic logical unit).

In FIG. 1, a general case of the switching and comparison unit is first shown, also for the use of more than two execution units. Of the n execution units to be considered, n signals N 140,..., N14n go to the switching and comparison component N100. This can generate up to n output signals N160, ..., N16n from these input signals. In the simplest case, the "pure performance" In the opposite limit case, the "pure comparison mode", all the signals N140,..., N14n are only routed to exactly one of the output signals N16i.

This figure shows how the various conceivable modes can arise. For this purpose, the logical component of a switching logic N10 is included in N100. It is first task of the switching logic to determine which inputs are switched to no output, i. which inputs are ignored, have no consequences or are inactive. This function of the switching logic is often referred to below as the first function of the switching logic. Furthermore, switching logic NI 10 determines how many output signals there are and which of the input signals contribute to which of the output signals. An input signal can contribute at most to exactly one output signal. This function of the switching logic is often referred to below as the second function of the switching logic.

In other words, in mathematical form, without blocking of signals by the switching logic, a function is defined which assigns to each element of the set {N140, ..., N14n} an element of the set {N160, ..., N16n}. With the disabling of individual input signals, a function is more generally defined by the switching logic which assigns to each element of a fixed subset of {N140, ..., N14n} (the unlocked signals) an element of the set {N160, ..., N16n assigns}.

The processing logic N 120 then determines to each of the outputs N16i how the inputs contribute to that output signal. To describe the various possible variations by way of example, it is assumed without loss of generality that the output N 160 is generated by the signals N141,..., N 14m. If m = 1, this simply means that the signal is switched through, if m = 2 then the signals N141, N142 are compared. This comparison can be performed synchronously or asynchronously, it can be performed bitwise or only on significant bits or even with a tolerance band. A preferred possibility is that execution units run in lockstep mode (ie same instructions at the same clock rate). A fixed clock or phase offset is also an advantageous solution. If m> = 3, there are several possibilities.

A first possibility is to compare all signals and to detect an error in the presence of at least two different values, which can be optionally signaled.

A second possibility is to make a k out of m selection (k> m / 2). This can be realized by using comparators. Optionally, an error signal can be generated if one of the signals is detected as deviating. A possibly different error signal can be generated if all three

Signals are different.

A third option is to apply these values to an algorithm. This can be, for example, the formation of an average value, a median value, or the use of a fault-tolerant algorithm (FTA). Such an FTA is based on eliminating extreme values of the input values and performing a kind of averaging over the remaining values. This averaging can be done over the entire set of residual values, or preferably over a subset that is easy to form in HW. In this case, it is not always necessary to actually compare the values. For example, averaging only adds and divides, FTM, FTA, or median require partial sorting. If necessary, an error signal can optionally also be output at sufficiently large extreme values.

These various possibilities of processing a plurality of signals into one signal are referred to as comparison operations for the sake of brevity. The task of the processing logic is thus to determine the exact shape of the comparison operation for each output signal - and thus also for the associated input signals. This is referred to below as the second function of the processing logic. The possible identification of faulty execution units, which is usually possible as a result of this, is referred to below as the first function of the processing logic.

The combination of the information of the switching logic NI10 (ie the above-mentioned function) and the processing logic (ie the determination of the comparison operation per output signal, ie per function value) is the mode information and this sets the mode. Of course, in the general case this information is multivalued, ie not representable only via a logical bit. Not all the theoretically conceivable modes are useful in a given implementation, it is preferable to restrict the number of modes allowed. It should be emphasized that in the case of only two execution units, where there is only one compare mode, all the information can be condensed to only one logical bit.

Switching from a performance mode to a comparison mode is characterized in the general case by the fact that execution units that are displayed in the performance mode on different outputs are mapped in the compare mode to the same output. This is preferably realized in that there is a subsystem of execution units in which in the performance mode, all input signals N14i to be considered in the subsystem are switched directly to corresponding output signals N16i, while in comparison mode they are all switched to on

Output are shown out. Alternatively, such switching can also be realized by changing pairings. It is represented by the fact that in the general case one can not speak of the performance mode and the comparison mode, although in a given form of the invention one can restrict the set of allowed modes such that this is the case. But you can always from one

Switch from the performance mode to the compare mode (and vice versa).

The following describes how, with the aid of such a switching and comparison component and a few other elements, under certain conditions, the yield in the manufacturing process of semiconductor devices, e.g. can increase μC.

The basic idea is roughly sketched the following:

On the component, for example, a μC, more execution units, as needed in operation.

Thus, you can work with less than the full number of correctly working execution units in operation. The prerequisite is that incorrectly operating units are identified and can not affect the overall system. The use of a switching and comparison unit described above makes it possible to prevent the signals of faulty execution units from further spreading in the system via the switching logic N10.

The processing logic N120 makes it possible to compare signals of different execution units. By a suitable comparison one can identify faulty execution units. This is possible if you use a sufficiently bug-covering test program. Optionally, you can also use external means of identification with.

By having such a test at any time, e.g. at the end of the tape, at initialization time or during assembly, stores the result (ie an unambiguous identification of the erroneous execution units) in a non-volatile memory, if possible, and that this result affects the switching logic Nl 10 in such a way that the signals of erroneous execution units have no effect, One obtains a μC whose correctly operating execution units can still be used, even if faulty execution units are present.

By thus implemented in the product fault tolerance can increase the yield, as well as faulty components can be used as long as the number of still correctly working execution units is large enough. This depends on the application.

This idea will now be detailed.

One possible logical form of the switching and comparison unit is described above. While it is advantageous for the application of the invention described herein, it is not necessary that the component exist as such and that the named sub-components switching and processing logic exist.

Crucial to the first function of the switching logic is that outputs of potentially defective components in a suitable form can be ignored. This can be done by interrupting these outputs, for example by switches. Another option is to set the outputs to a standard "catcher" for to switch faulty signals. Another option is to mark the output signals as invalid. Yet another possibility, which may be used beyond or alternatively, is to prevent the occurrence of such output signals by deactivating the corresponding component itself. This can in turn be realized by deactivating the component, stopping, interrupting the clock or interrupting the input signals. This also has the advantage that the power loss is minimized and thus life, reliability and temperature load is optimized. In the following, all execution units whose output can be ignored by any means will be referred to as passive or inactive.

It is first of all decisive for the first function of the processing logic that a faulty component can be identified. A preferred option is to have all execution units execute the same program in parallel. Preferably, but not necessarily, this can be realized by operating the execution units in a lockstep mode or else with a fixed clock or phase offset.

Through a suitable comparison, a majority decision can be used to identify a potentially present defective component. Optionally, the results of this program can additionally be compared with the previously known results by an external unit (watchdog, other μC, test device, ASIC) during a production, initialization or band test. This is particularly advantageous if there are only two execution units, since in this case a third information for identifying the faulty execution unit is necessary when a difference occurs between the two execution units. In addition to the comparison operations described above, such a comparison can also be implemented in such a way that it is performed only in pairs or on subsets, until a clear identification of potentially erroneous execution units is possible. The processing logic must thus identify the faulty components as a result of this first function.

The test program must be designed in such a way that an error is most likely to have an effect. To develop such a program, for example, an error model (eg, stuck-at model) may be used, a portion of the application code may be run, or a complete command test. In the case of the tape test, this may correspond to a test program today, which is based on the is limited. But you can also link this with a common today band test and test only those components with this program, which have already failed by the first band end test. This last procedure has the particular advantage that only components are subjected to an additional process step, which otherwise belong to the committee. Each component gained through this last "rescue step" directly increases the yield of the manufacturing process.

After the first function of the processing logic identifies the faulty units, this information must be stored. When applying the method according to the invention to the production process for increasing the yield, a non-volatile storage element is preferably used. This then stores which execution units are inactive.

FIG. 2 shows the function of this memory element. The elements N510,

N520, N54i, N56i of the switching and comparing unit N500 in Fig. 2 have the same functions as the elements N10, N120, N14i, N16i of the switching and comparing unit N100 in Fig. 1. In addition, a memory element N530 is shown. The processing logic N520 sends the information about the execution units identified as faulty to the memory element N530. On this can the switching logic

N510 and perform the first function of the switching logic so that the elements marked as inactive by N530 actually become inactive.

Of course, the memory element can be located inside the switching and comparison unit, but it can also be outside, even outside the component. For example, when mounting a μC in a controller or a PC, an external element is conceivable because then a more extensive test using the periphery may possibly be used.

The basic process idea for increasing the yield in the production is described in FIG. In a first step N600 (identification step), an identification of erroneous execution units takes place. The identification uses the first function of the processing logic N520 and thus the test program. In the second step N610 (storage step), the error information is stored. The corresponding Information is given by the processing logic N520 to the memory element N530. In the third step N620 (configuration), the switching logic N510 uses the information from N530 and uses the first function of the switching logic to configure the outputs of the execution units according to the required activity and passivity. It should be emphasized that although this can optionally be done by SW, in a preferred application the configuration is not exercised by SW control here.

The main reason for inactivity is flaws. However, in a preferred extension, other reasons may be valid. For example, it is possible for execution units to be marked as inactive even for completely error-free components in this memory element.

In particular, if the test expires not only at the end of the tape but during operation (for example, in an initialization phase or even during normal operation), it is possible that faults which do not arise during operation but during operation are detected. Through the second function of the switching logic (to link the active execution units together in operation) and the second function of the processing logic (to make a comparison for the signals connected to an output) as illustrated in the description of Figure 1, it is easily possible to do so as well Operation to detect faults and identify faulty execution units.

If error-free execution units are marked as inactive, it is possible to exchange a unit identified as faulty for a faultless but inactive unit when an error occurs during operation. For this purpose, information is preferably stored in the memory element N530 as to whether the execution unit is only inactive or whether it is also faulty. Advantageously, it is not possible in operation to change the information that a given execution unit is faulty.

FIG. 7 shows a possible structure of a memory element 0100 (corresponds to FIG

N530). It contains a first memory area Ol 10, in which there are, preferably in accordance with the number of execution units, memory locations O120, ..., O12n. Each memory location is preferably realized via at least one bit. The number or address of the memory location O12i is indicated by the number or identification of an uniquely linked. For example, a bit in 0120 that is set to 0 indicates that the associated execution unit is active. If set to 1, the associated execution unit should be inactive. This information can be fault tolerant or linked to other information in the memory locations O120, ..., O12n, the basic information content, based on this application remains the same.

Optionally, there is additionally a second memory area 0140, in which there are memory locations 0130,..., O13n, preferably corresponding to the number of execution units. Each memory location is preferably realized via at least one bit. The number or

Address of the memory location O13i is uniquely linked to the number or identification of an execution unit. For example, a bit in 0130 that is set to 0 indicates that the associated execution unit is healthy. If it is set to 1, it means that the associated execution unit is faulty. This information may be error tolerant or associated with additional information in the memory locations

O130, ..., O13n, but the basic information content related to this application remains the same. Optionally, this memory area can not be described or only under special circumstances or in a special way, so that it is ensured that an execution unit once marked as defective is not erroneously marked as error-free.

By using inactive but error-free execution units, it is possible to use the cold redundancy that this method offers for faultless components to increase the availability and reliability.

Another way to use the invention is to enable graceful degradation and limp home modes.

The premise here is that an error has been discovered during operation via the above-mentioned second function of the processing logic. A then preferably used method is described in FIG. First, an error is detected in step N700 (error detection). This can be done, for example, by using a test program. However, when the system is in a compare mode, such as can be set via the second functions of the processing logic and circuitry, there is one Such error detection also possible in normal operation, ie the application software acts as a test program. This is particularly advantageous for two reasons: on the one hand, you do not need a dedicated test program, on the other hand, all errors of the execution units that have any effect are discovered in this way. In step N705 it is checked whether a faulty execution unit can already be identified by the existing configuration of switching and processing logic. If so, steps N710 (Fault Detection Configuration) and N720 (Identification Step) are already completed, and it goes directly to Step N730. This is the case, for example, when the error occurs in a subsystem in which the signals from 3 execution units are compared. If not (in step N705)

If, for example, an error is detected in a subsystem of two execution units that are running in a compare mode), a configuration must be selected in step N710 that allows error identification. The easiest way to do this is, for example, by combining the "suspected candidates" (ie all execution units involved in the subsystem that generated an error) with a sufficient number of other execution units together through the switching logic N510 to an output signal. Preferably, the SW part which has disclosed the error is reused as the test program, but a dedicated test program can also be used The first function of the processing logic then makes it possible to execute step N720 and to identify the erroneous execution unit Alternatively, however, another method of identification may be chosen: for example, one of the suspected candidates is accepted and coupled with another error-free execution unit. If no error is identified, another execution unit is faulty n this execution unit to be closed. Although the latter method does not offer the same security of identification, it can be used more easily during operation, so it would be advantageous if e.g. in a motor vehicle just runs a critical maneuver that is influenced by the device. After the identification of the erroneous execution unit is completed, the two steps N730 (storage step, corresponds to N610) and N740 (configuration, corresponds to N620) are executed.

It should be emphasized that in this last step by the method according to the invention there are now several advantageous possibilities. If there are a sufficient number of error-free but inactive execution units, one can, as described above, restore a fully functional system.

If there are too few error-free execution units for normal operation, you can run the existing software as well as possible on the existing execution units. This is particularly advantageous if the system is normally specified with runtime reserves. Then it is likely that even a reduced amount of execution units provides sufficient performance to ensure operation. This can be supported in particular at the system level by avoiding particularly performance-intensive operating states (for example high speeds in the engine of a motor vehicle).

If there are too few error-free execution units for normal operation, one can alternatively run only a subset of the application.

If there are too few error-free execution units for normal operation, you can run the application in other modes in a third possibility. For example, one can do without a strong comparison mode and use only a weaker comparison mode or a performance mode. In this case, although only a weaker error detection or fault tolerance is given for the following operation, but this is tolerable under certain circumstances, since this condition may only be maintained for a limited time. This option is particularly easy to implement with this invention, since only the components and methods set out here have to be used. Of course, combinations of these variants are also conceivable.

A fundamentally different possibility of using the idea of this invention is to dispense with the memory element and to use other means for deactivating potentially defective execution units in such a way that they are reliably and irreversibly deactivated. This can be done by influencing (for example separation or connection) of lines in the component.

Different options are: Use of anti-foot for dedicated lines (this can be used in operation, maintenance, assembly, or manufacturing), mechanical treatment (soldering, disconnecting) of wires, laser, electron, X-ray, or special electrical Signals and chemical influence on the lines.

Instead of the memory element to an influencing component is necessary. FIG. 5 shows the function of this influencing component. The elements N810, N820, N84i, N86i of the switching and comparing unit N800 in Fig. 5 have the same functions as the elements N10, N120, N14i, N16i of the switching and comparing unit N100 in Fig. 1. Moreover, an influencing component is N830 shown. The processing logic N820 sends the information about the execution units identified as faulty to the influencing component N830. This has means, as enumerated above, to influence lines or functional groups in the component so that execution units are deactivated. N830 may be a component within the device, controller, or system, but N830 may also be a machine in the manufacturing process or a human operator of such a machine. It is also possible that this component is used in maintenance. Optionally, the corresponding information can still be given to the switching logic so that it performs the first function in such a way that the elements marked as inactive by N830 actually become inactive.

The basic process idea for increasing the yield using the influencing component N830 is described in FIG. In a first step N900 (identification step) an identification of faulty execution units takes place. The

Identification uses the first function of the processing logic N820 and thus the test program. In the second step N910, the error information is given by the processing logic N820 to the influencing component N830. In the third step N920, the influencing component N830 uses this information in order to use the means at its disposal to influence the lines or functional groups in the component in such a way that the faulty components are inactive. In the optional fourth step N930, the switching logic N810 uses the information and uses the first function of the switching logic to configure the outputs of the execution units according to the required activity and passivity. Of course, such an influencing component can also be used in operation. All the advantages that apply when using a memory element are also applicable here, since the effect on the system is the same. But then it is advantageous if the influencing component is present as HW component in the system.

Apart from the execution units mentioned in the description of the embodiments, the advantageous methods and devices can also be applied to further components of a semiconductor circuit, such as e.g. Analog / digital converters, timer modules, intrinsic controllers, communication controllers or control units are used.

In the following, the totality of these components of a semiconductor circuit is summarized under the term functional units.

In another preferred embodiment, the invention described herein is used with ECC protection for other memory elements. In this case, a highly available component is created in which both memory and execution units are made fault-tolerant and thus make it possible to maximize both the yield and to ensure optimal availability during operation.

Claims

claims

1. A method for controlling a computer system having at least two identical or similar functional units, characterized in that an activation and / or deactivation of functional units is performed depending on predeterminable conditions.

2. The method according to claim 1, characterized in that an activation and / or deactivation of functional units in dependence on the results of at least a first method step for detecting a fault in the computer system and / or at least a second method step for identifying a faulty functional unit takes place.

3. The method according to claim 1, characterized in that the computer system contains at least two identical or similar functional units and that is switched between at least two operating modes of the at least two identical or similar functional units of the computer system and a first operating mode a comparison mode and a second mode of operation Performance mode corresponds.

4. The method according to claim 2 and 3, characterized in that in the comparison mode errors in the output signals of the functional units to be compared are detected and the comparison mode corresponds to a first method step for detecting an error in the computer system

5. The method according to any one of the preceding claims, characterized in that selected functional units of the computer system are switched to an operating mode in which an identification of faulty functional units by comparing the output signals of these functional units with reference values is possible and this mode of operation a second method step for identifying a corresponds to an erroneous functional unit in the computer system

6. The method according to claim 5, characterized in that the reference values in a

Memory device of the computer system are stored and read when switching to the operating mode for error identification from the memory device.

7. The method of claim 3 or claim 5, characterized in that a switchover between at least two operating modes during operation of the computer system is cyclic or on request.

8. The method according to claim 7, characterized in that the switching between at least two operating modes for the purpose of detecting errors and / or the identification of faulty functional units takes place.

9. The method according to any one of the preceding claims, characterized in that a configuration status and / or error status is formed for at least the function units of the computer system identified as faulty.

10. The method according to claim 9, characterized in that a deactivation of a

Function unit is effected in that information about the configuration status or the error status of this functional unit are stored in a memory device that they can be read during initialization and / or operation of the semiconductor system and the stored information is processed so that a use of as disabled marked units in operation is not possible.

11. The method according to any one of the preceding claims, characterized in that for all activatable and / or deactivatable functional units of the computer system, a configuration status and / or an error status is formed.

12. The method according to claim 11, characterized in that information about the configuration status and / or the error status of the activatable and / or deactivatable functional units are stored in a memory device.

13. The method according to claim 1, characterized in that the computer system contains at least two identical or similar functional units and that at least one of the same or similar functional units in the computer system is disabled by default.

14. The method according to claim 13, characterized in that at least one information about the configuration status of the deactivated functional unit is stored in a memory device.

15. The method according to claim 14, characterized in that during or after the identification of a faulty functional unit, a reconfiguration of the computer system takes place in that at least the functional unit identified as faulty is deactivated.

16. The method according to claim 15, characterized in that in the case of deactivation of a functional unit due to an error information about the configuration status and / or an error status of this functional unit is written in a memory device.

17. The method according to claim 15, characterized in that during or after the identification of a faulty functional unit is a Umkonfϊguration the computer system, wherein the identified as a faulty functional unit is deactivated and a default disabled, but not faulty functional unit is activated.

18. The method according to claim 3, characterized in that the first method step for detecting an error corresponds to the intended operation of the at least two identical or similar functional units of the computer system in a comparison mode.

19. Method according to claim 18, characterized in that the second method step for identifying a faulty unit corresponds to processing an error detection routine on at least one functional unit and comparing the results of the error detection routine with reference values.

20. The method according to claim 19, characterized in that prior to or to carry out the method step for identifying a faulty unit, a reconfiguration of the computer system is performed, the execution of different functions, commands, program segments or programs on the same or similar functional units allows.

21. The method according to claim 19, characterized in that the reference values of the error detection routines are stored together with the error detection routines in a memory device.

22. The method according to claim 19, characterized in that during or after the identification of a faulty functional unit, a reconfiguration of the computer system takes place, wherein at least the functional unit identified as defective is deactivated.

23. The method according to claim 22, characterized in that in the case of deactivation of a functional unit due to a fault, a configuration status and a Fehlersta- tu of this functional unit are written in a memory device.

24. The method according to claim 22, characterized in that at least a part of the functions, commands, program segments or programs, which are determined before a reconfiguration of the computer system for processing in a first operating mode, be processed after a Umkonfϊguration the computer system in a second mode of operation.

25. The method according to claim 24, characterized in that the first operating mode corresponds to a comparison mode and the second operating mode corresponds to a performance mode or a failure mode with only one active functional unit.

26. The method of claim 15 or claim 22, characterized in that the deactivation of functional units takes place irreversibly by interrupting electrical connections to or between functional units of the computer system.

27. Method according to claim 26, characterized in that an interruption of electrical connections in the computer system is achieved by electrical action on at least a part of the connections.

28. The method according to any one of the preceding claims, characterized in that an activation and / or deactivation of functional units takes place during operation of the computer system and using devices that are part of the computer system or that are constantly connected to the computer system.

29. Device for controlling a computer system having at least two identical or similar functional units, characterized in that means are provided which enable activation and / or deactivation of functional units of the computer system depending on predefinable conditions.

30. The device according to claim 29, characterized in that means are provided to enable error detection in the computer system and / or identification of faulty functional units.

31. The device according to claim 30, characterized in that the device contains switching means which enables a switching between at least two operating modes of the at least two identical or similar functional units of the computer system and a first operating mode corresponds to a comparison mode and a second operating mode to a performance mode.

32. Apparatus according to claim 30, characterized in that the device includes means for switching selected functional units of the computer system into an operating mode in which an identification of faulty functional units by a

Comparison of the output signals of these functional units with reference values is possible.

33. The device according to claim 32, characterized in that the device comprises comparison means for comparing output signals of functional units with output signals of at least one further functional unit or with reference values and generating error information in the event of a discrepancy.

34. Apparatus according to claim 33, characterized in that the device comprises storage means in which reference values for the output signals of functional units are stored and further comprises means for supplying reference values from the memory means to a comparison means.

35. Device according to one of the preceding claims, characterized in that means are provided to form a configuration status and / or an error status for all activatable and / or deactivatable functional units of the computer system.

36. Device according to one of the preceding claims, characterized in that the device contains means for storing data in which at least one information about the configuration status or the error status of the activatable and / or deactivatable functional units are stored.

37. Apparatus according to claim 36, characterized in that the means for storing data are non-volatile storage means.

38. Device according to one of the preceding claims, characterized in that means are provided which upon initialization and / or operation of the computer system stored in a memory device configuration status and / or Fehlerstati of

Read functional units and can perform an activation and / or deactivation of functional units depending on the read data and an error signal of the comparison device.

39. Device according to one of the preceding claims, characterized in that means are provided which can perform a deactivation of functional units irreversibly.

40. Apparatus according to claim 39, characterized in that means are provided which interrupts the irreversible deactivation of functional units at least one electrical connection to this or in these functional units.

41. Apparatus according to claim 40, characterized in that means are provided which can effect an interruption of electrical connections to or in functional units by electrical action on at least a part of these compounds.

42. Device according to one of the preceding claims, characterized in that the means for error detection, for activation and / or deactivation of functional units are part of the computer system or are constantly connected to the computer system.