DE10149930A1 - Procedure for separating redundant systems during the design of customized circuits - Google Patents

Abstract

A method for producing integrated circuit arrangements for motor vehicle control systems by creating a layout by means of an automated method is proposed, in which at least two logically separate subsystems (5, 6) are provided and, in addition to the logical separation, a spatial (physical) separation of the subsystems the available area of the circuit arrangement is made.

Description

The invention relates to a method according to the preamble of Claim 1.

There are already various processes for designing kun specific integrated circuits (ASICS, FGPAs) in the Known in the field of microelectronics. An ASIC (Application Specific Integrated Circuit) is a customer or application integrated circuit (IC, "Chip"). ASICs are used when an optimum regarding Size, performance and low electrical ver pleasure is required. Depending on the ASIC technology Even from a relatively small number of items, a cost advance partially achieved. The spectrum ranges from simple to pro programmable components (PLDs) over more complex free pro grammable gate arrays (FPGAs) up to full custom ASICs with analog and digital part. With one known per se suitable development software, such as Delft's OCEAN University (NL), Synopsis or CADENCE, can use mask sets (Layout) for specific circuit manufacturing processes (e.g. CMOS, BiCMOS) of certain companies from the customer through Zu assembling of complex buildings that can be called up in libraries stones (IP). The development tools thus allow the design of microcircuits within of manufacturer-specified limits. The development the circuits are made with hardware Description languages such as VHDL, Verilog or using SDL  for signal flow oriented applications.

In electronic control units for regulating the brakes of Motor vehicles, e.g. B. in electronic driving dynamics gene (ESP), or anti-lock regulations (ABS) the regulation and control of various functions made by microprocessor systems. Because of the high required reliability to appropriate control units are known to be safety-critical electronic Circuits completely or partially redundant.

A basic principle of redundancy is that the more existing subsystems (e.g. two identical micro processors) work independently and against each other can monitor or correct each other. It is also possible that the proper functioning of this multiple times existing subsystems from a third circuit unit is compared and if the function deviates further ge appropriate steps are taken.

Corresponding circuits with redundancy are now on well-known development tools, such as CADENCE, developed, are the multiple executed parts systems usually more or less intertwined th.

It has been shown that with the help of the previously described Circuitry manufactured development tools requirements regarding operational safety not yet fully met.  

The invention therefore proposes a method according to claim 1 with which the operational safety of the manufactured scarf can be further increased.

Production takes place according to the method of the invention of integrated circuits for motor vehicles systems by creating a layout using a automated process, this process being preferred either automatically in a computer system or partially automatically, in the designated persons (e.g. develop engineers) interacting with a computer system occur.

For circuit arrangements, which preferably several inte contain partially or fully redundant subsystems, it makes sense for a function that is as safe as possible, in addition to the logical separation also a physical separation of the subsystems during the layout design.

The separate subsystems are preferably redundant circuits ( 5 , 6 ) of an electronic control unit for motor vehicles, in particular an electronic control unit for motor vehicle brake systems.

All subsystems of the manufacturer are preferably located th circuitry on a common chip.

According to the invention, the subsystems are physically of separated from each other. It has been shown that one does not adequate physical separation of the cross subsystems Couplings of the subsystems can occur, their error analysis  is extremely time consuming or even impossible.

The circuit arrangements are preferably produced by means of development tools which are necessary for the creation of wiring networks are suitable, such as in particular CADENCE. With appropriate development tools, which on current computer systems in the form of a computer pro prefabricated semiconductor chips (Semi-Custom Design) according to the requirements tigstellen.

The prefabricated semiconductor chips are be preferred to those that use sea-of-gates technology were put.

The complete physical separation of subsystems is currently available in Sea-Of-Gates technology mask making tools for making lei Railway structures are not sufficiently supported. For example, the automated process of "Ent of the networks (routing) with an autorouter frequently to the undesirable cross already mentioned above couplings. The result is an extensive manual check development process (review process), in which the finished layout must be processed in order to the logical and physical Se to achieve paration.

It shows

Fig. 1 shows an example of a hardware system that can be produced according to the invention, which can be used in electronic brake systems.

Fig. 1 shows a layout on microchip 10 for a Mikrocon troller, which is constructed redundantly twice. Two redundant subsystems 5 and 6 are provided on chip 10 , which are constructed essentially the same internally. Both subsystems are separated by the isolation module 7 , via which permissible connections 2 of the subsystems (e.g. clock supply, reset, comparison results, etc.) are performed. For reasons of complexity, the test logic 8, likewise arranged on the chip, for monitoring the error-free operation is generally not designed redundantly. The subsystems 5 and 6 , as well as the test logic 8 are ver with contacts 9 for the electrical leads of the chip through connections 1 connected.

According to the method according to the invention, for the purpose of physically separating subsystems 5 and 6, a validation is carried out as described below.

First, a logical separation in the register Transmission level (RTL level) made. Every instance of Hardware description language (HDL entity) is during the Design of the register transfer level of a subsystem assigned to a specific system class.

In the present example, these are the classes:

• A) subsystem 5 ,
• B) subsystem 6 ,
• C) Isolation module 7 and
• D) Test module 8 .

All bus systems at the highest design level (RTL top level) are then logically replaced by multiple point-to-point connections. Then, based on the description created above, all connections between classes A) to D) are automatically extracted using a script (e.g. using the synthesis tool) and classified as follows:
Class 1 : Connections 1 to the contact surfaces 9 ,
Class 2 : Connections 2 from the sub-modules 5 , 6 to the insulation module 7 ,
Class 3 : Connections 3 to test module 8 and
Class 4 : Connections 4 between the sub-modules 5 , 6 .

By using the method described above The classification of modules and connections is carried out this way with an automated way to check the phy physical separation at the layout level.

Once the classification process has been completed, the results are evaluated automatically (using a script) according to the following rules:
Rule 1 : Classes 1-3 represent permitted connections and should be ignored.
Rule 2 : If class 4 is not empty, there is an error in the logical separation of the subsystems. The design defined at the outset must then be changed. The above steps will then be repeated.

If the part of the procedure described above abge is closed, the design of the layout level (Physikali separation).

The individual classes described above become then automatically highlighted in color by script and the Placement of the associated cells optically with the layout tool checked.

Now, an imaginary physical separation line 11 is defined in the layout, which runs through the insulation module 7 and separates the two subsystems in such a way that the test module 8 is on the separated side of only one of the subsystems. Then all lines that cross in the layout separation line 11 are detected via the layout tool. The detected lines are then automatically compared with the connections already found at the RTL level. If additional connections are found, there is an error in the physical separation. The layout must then be modified.

With the help of the described method one is accelerated Development of integrated electronic circuits possible with multiple executed subsystems, because correcting errors in an early design phase can be. In contrast, the known method Check the logical separation of the subsystems first  at the end of the design process after completion of the layout performed manually and optically. Here, what is common Occurs, found errors, is a considerable time and knockout very intensive new design to be run through.

Claims (9)

1. A method for producing integrated circuit arrangements for motor vehicle control systems by creating a layout by means of an automated method, characterized in that at least two logically separate subsystems ( 5 , 6 ) are provided and in addition to the logical separation, a spatial (physical) separation of the Subsystems on the available area of the circuit arrangement is made before. 2. The method according to claim 1, characterized in that the separate subsystems are redundant circuits ( 5 , 6 ) of an electronic control unit for motor vehicles. 3. The method according to claim 1 or 2, characterized net that the pre-determined by the automated process separation into two spatially separated sub-areas is subsequently checked again. 4. The method according to any one of claims 1 to 3, characterized ge indicates that the integrated circuit arrangement a user-specific circuit (ASIC), which especially manufactured using sea-of-gates technology was, is. 5. The method according to any one of claims 1 to 4, characterized ge indicates that the logical separation in the register  Transmission level (RTL) takes place with each instance the hardware description language (HDL entity) Subsystem is assigned to a certain class. 6. The method according to claim 5, characterized in that after the logical separation, all bus systems on the highest design level (RTL top level) logically multiple point-to-point connections can be replaced. 7. The method according to claim 6, characterized in that the created point-to-point connections in classes to be grouped. 8. The method according to any one of claims 1 to 7, characterized in that in addition to the subsystems, a common test logic ( 8 ) is provided which is connected to the existing subsystems via a bus system ( 3 ). 9. The method according to any one of claims 1 to 8, characterized in that an insulation module ( 7 ) is provided which is connected to the existing subsystems via bus systems ( 2 ) and through the insulation module one for detangling the bus systems ( 1 , 2nd , 3 ) the separation line provided.