DE102005037220A1 - Operating modes switching method for use in computer system, involves providing interruption controller and three memory regions, and carrying out access to regions such that one memory region is associated with two execution units - Google Patents

Abstract

The method involves providing a switching unit (G50) for switching between two operating modes, where one mode corresponds to a comparison mode and another corresponds to a performance mode. An interruption controller and three memory regions are provided, where access to the memory regions is carried out such that two memory regions are associated with respective execution unit, and third region is associated with two execution units. An independent claim is also included for a device for switching in a computer system.

Description

transient Error, triggered by alpha particles or cosmic rays, are becoming increasingly a problem for integrated semiconductor circuits. Due to decreasing structure widths, sinking tensions and higher Clock frequencies increases the likelihood that a voltage spike, caused by an alpha particle or cosmic radiation, corrupted a logical value in an integrated circuit. One wrong calculation result can be the result. In security relevant Systems, especially in the motor vehicle, such errors must therefore be reliably detected.

at safety-related systems, such as an ABS control system in a motor vehicle in which detects malfunctions of the electronics safely Need to become, become common in the corresponding control devices of such systems Redundancies used for error detection. Such is for example in known ABS systems in each case the complete microcontroller duplicated, with all ABS functions being redundantly calculated and on agreement being checked. If there is a discrepancy between the results, the ABS system becomes off.

basics Components of a microcontroller are on the one hand from memory modules (e.g., RAM, ROM, cache), the cpu, and I / O ports, the so-called peripherals (e.g., A / D converter, CAN interface). Because memory elements with verification codes (Parity or ECC) effectively monitored can be and peripherals are often application-specific as part of a sensor or actuator signal paths monitored be another redundancy approach in the sole doubling of the Cores of a microcontroller.

Such Microcontrollers with two integrated cores are also called dual-core Architectures known. Both cores are redundant and isochronous (Lockstep mode) the same program segment, the results the two cores are compared, and an error is then added the comparison for agreement be recognized. This configuration of a dual-core system can be considered a comparison mode be designated.

Dual-Core Architectures also improve performance in other applications, So used to a performance increase. Both cores lead different Programs, program segments, and commands out, resulting in an increase in performance achieve, why this configuration of a dual-core system as a performance mode can be designated. This system is also called a symmetric Multiprocessor system (SMP) called.

A Extension of these systems is a switching between software These two modes mean access to a specific address and specialized hardware devices. in the Comparison mode will be the output signals of the cores together compared. In performance mode, the two cores work as one symmetric multiprocessor system (SMP) and run different programs, Program segments or commands off.

at the use of such systems, the problem arises that in the Switching also made a switchover from interrupt sources must become. It is therefore an object of the invention, methods and Funds available to provide optimal switching of the interrupt sources.

Advantages of invention

advantageously, One uses a method for switching in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode, characterized in that a Interrupt controller is provided, and further at least three Memory areas are provided, with access to the memory areas such that at least one first execution unit a first memory area is assigned and at least one second execution unit a second memory area is assigned and at least a third memory area the at least two execution units is assignable.

advantageously, One uses a method in which in the performance mode of each execution unit each one memory area is assigned, wherein the memory areas exactly one interrupt controller is assigned.

advantageously, one uses a method in which in the performance mode of each execution unit each one memory area is assigned, with all memory areas exactly one interrupt controller is assigned.

Advantageously, a method is used in which all interrupt sources interrupt controller are assigned.

advantageously, one uses a method in which in a performance mode at least a first execution unit a first memory area is assigned and at least a second memory area execution unit a second memory area is assigned.

advantageously, one uses a method in which in a comparison mode at least a third memory area the at least two execution units assigned.

advantageously, One uses a method in which in a performance mode only the assignment, in which each execution unit is a memory area is assigned, is active.

advantageously, one uses a procedure in which in a comparison mode only the assignment in which the at least two execution units of at least third memory area is assigned, is active.

advantageously, one uses a procedure in which in each mode only exactly one Scheme of assignments is active, such that it belongs to each execution unit gives exactly one space allocated by one of the active allocations is.

advantageously, One uses a method in which when switching from one Compare in a performance mode the schema of active assignments replaced.

advantageously, one uses a device for switching in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation a performance mode is characterized in that a Interrupt controller is the at least three memory areas are assigned, wherein at least a first memory area of the at least a first execution unit and a second storage area of the at least one second execution unit is assigned and at least a third memory area the at least two execution units is assignable.

advantageously, One uses a device in which each in performance mode execution unit each one memory area is assigned, with exactly one interrupt controller is provided.

advantageously, one uses a device in which interrupt sources the interrupt controller assigned.

advantageously, one uses a device in which at least in performance mode a first execution unit a first memory area is assigned and at least one second execution unit a second memory area is assigned.

advantageously, one uses a device in which at least in comparison mode a third memory area the at least two execution units assigned.

advantageously, one uses a device in which the memory areas in Interruptcontroller are arranged.

advantageously, one uses a device in which in a performance mode only the assignment, in which each execution unit is a memory area is assigned, is active.

advantageously, one uses a device in which in a performance mode only the assignment, in which each execution unit is a memory area is assigned, is active.

advantageously, one uses a device in which in a comparison mode only the assignment in which the at least two execution units the at least third memory area is assigned, is active.

advantageously, one uses a device in which only exactly in each mode a scheme of assignments is active, such that it belongs to each execution unit gives exactly one space allocated by one of the active allocations is.

advantageously, one uses a device in which when switching from a comparison into a performance mode, the scheme of the active ones Assignments changes.

advantageously, one uses a device in which when switching from a comparison into a performance mode a change of active Assignments by the operation done by switches.

advantageously, Use a method according to which a description of the associated Memory areas are not allowed in every mode.

Advantageously, a Ver move to where a description of the associated memory areas is allowed only in those modes in which the assignment is active.

Further Advantages and advantageous embodiments will be apparent from the features the claims as well as the description.

characters

In the 1 is a multiprocessor system G60 with two execution units G10a, G10b a comparison unit G20, a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 2 is a multiprocessor system G60 with two execution units G10a, G10b a combined comparison and switching unit G70 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 3 is a multiprocessor system G60 with two execution units G10a, G10b a combined Umschaltwunscherkennung, comparison and switching unit G80 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 4 a multiprocessor system G200 is shown with two execution units G210a, G210b of a switching and comparison unit G260.

In the 5 In a flow diagram, a method is shown that exchanges a special undefined bit combination with a NOP or other neutral bit combination within a specific pipeline stage G230a, G230b.

In 6 is a multiprocessor system H200 with two execution units H210a, H210b and a switching and comparison unit H260 shown.

In the 7 In a flow chart, a method is shown which shows how, with the aid of the unit ID, the program flow can be separated when changing from a comparison mode to a performance mode in a multiprocessor system with 2 execution units.

In 8th For example, one possible method is shown how, with the aid of the unit ID, the program flow can be separated when changing from a compare mode to a performance mode in a multiprocessor system with 3 execution units.

In 9 is a flowchart showing a method that synchronizes the execution units when switching from the performance mode in the comparison mode.

In 10 a state machine is shown, which represents the switching between a performance and a comparison mode.

In 11 a multiprocessor system G400 is shown with two execution units and two interrupt controllers G420a, G420b including therein contained interrupt masking registers G430a, G430b and various interrupt sources G440a to G440n.

In 12 a multiprocessor system with two execution units, a switching and comparison unit and an interrupt controller with three sets of registers is shown.

In 13 is the simplest form of a comparator shown.

14 shows a comparator with a unit to compensate for a phase shift.

In 15 is the basic behavior of the preferred component M700 (switching and comparison unit) described in comparison mode.

In 16 is the basic behavior of the preferred component M700 (switching and comparison unit) described in the performance mode.

In 17 an embodiment of the switching and comparison unit is shown.

In 18 a further embodiment of the switching and comparison unit is shown.

In 19 is a switching and comparison unit that generates a mode signal is shown.

In 20 a general representation of a switching and comparison unit is shown.

21 shows a general representation of a switching and comparing unit which generates a general mode and a general error signal.

In 22 the question answer communication is presented with an external unit.

In 23 the communication with an intelligent actor is shown.

description the embodiments

When execution unit can in the following both a processor, a core, a CPU, as also an FPU (Floating Point Unit), a DSP (Digital Signal Processor), a coprocessor or an ALU (Arithmetic Logical Unit) become.

In the 1 is a multiprocessor system G60 with two execution units G10a, G10b a comparison unit G20, a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

The invention relates to a multiprocessor system G60 shown in 1 . 2 . 3 with at least two execution units G10a, G10b, a comparison unit G20, a switching unit G50 and a unit for switching request recognition G40. The switching unit G50 has at least two outputs to at least two system interfaces G30a, G30b. Registers, memories or peripherals such as digital outputs, D / A converters and communication controllers can be controlled via these interfaces. This multiprocessor system can be operated in at least two modes of operation, a compare mode (VM) and a performance mode (PM).

in the Performance mode will be in the different execution units different commands, program segments or programs in parallel executed. In this operating mode, the comparison unit G20 is deactivated. The switching unit G50 is configured in this operating mode so that each execution unit G10a, G10b is connected to a system interface G30a, G30b. Here is the execution unit G10a with system interface G30a and the execution unit Connect G10b to the system interface G30b.

in the Comparison modes are in both execution units G10a, G10b the same or similar commands, program segments or programs are processed. conveniently, these commands are executed isochronously, but it is also a processing with asynchrony or a defined clock offset conceivable. The output signals the execution units G10a, G10b are compared in the comparison unit G20. At a Difference is detected on an error and it can be appropriate activities be taken. These measures can trigger an error signal, initiate error handling, operate switches or a combination of these and other conceivable measures. The switching unit G50 is configured in a variation that only one signal connected to the system interfaces G30a, G30b. In another Configuration causes the switching unit only that compared and thus signals are equal to the system interfaces G30a, G30b get connected.

The Switchover request detection G40 detects independently of the currently active mode a switchover to another mode.

In 2 is a multiprocessor system G60 with two execution units G10a, G10b a combined comparison and switching unit G70 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In one embodiment of the situation described above, the switching unit G50 and the comparison unit G20 can be combined to form a common switching and comparison unit (UVE) G70, as in FIG 2 shown. This common component G70 then takes over the tasks of the individual components G50, G20. In 15 . 16 . 17 . 18 and 19 Variants of the UVE G70 are shown.

In a further embodiment, as in 3 1, the switching request recognition unit G40, the comparator G20 and the switching unit G50 may be combined in a common component G80. In a further embodiment, which is not shown in a figure, the switching request recognition G40 and the comparator G20 can be combined in a common component. Also conceivable is a summary Umschaltwunscherkennung G40 with the switch G50 in a common component.

in the further text will be used unless otherwise stated that a switching request recognition G40 and a combined switching and Comparative Unit G70.

A general case of the switching and comparison component, also for use with more than two execution units, is in FIG 20 shown. Of the n execution units to be considered, n signals N140,..., N14n go to the switching and comparison component N100. This can generate up to n output signals N160, ..., N16n from these input signals. In the simplest case, the "pure performance mode", all signals N14i are directed to the corresponding output signals N16i In the opposite limit case, the "pure comparison mode", all signals N140, ..., N14n are directed to only one of the output signals N16i.

This figure shows how the various conceivable modes can arise. For this purpose, in this figure, the logical component ei ner switching logic N110 included. This component does not have to exist as a separate component. It is crucial that the functions described are implemented in the system. The switching logic N110 first determines how many output signals there are. It also determines which of the input signals contribute to which of the output signals. An input signal can contribute to exactly one output signal. In other words, in terms of mathematical form, the circuit logic defines a function that assigns an element of the set {N160, ..., N16n} to each element of the set {N140, ..., Nl4n}.

The processing logic N120 then determines to each of the outputs N16i how the inputs contribute to that output signal. Also, this component does not have to exist as a separate component. It is again crucial that the functions described are implemented in the system. By way of example, to describe the various possible variations, it is assumed without loss of generality that the output N160 is generated by the signals N141, ..., N14m. If m = 1, this simply means that the signal is switched through, if m = 2 then the signals N141, N142 are compared, as in the comparator in FIG 13 . 14 described. This comparison can be performed synchronously or asynchronously, it can be performed bitwise or only on significant bits or even with a tolerance band.

If m> = 3 there are several Options.

A first option consists in comparing all the signals and in the presence at least two different values to detect an error, which one can signal optional.

A second option consists in making a k out of m selection (k> m / 2). This can be through Use of comparators can be realized. Optionally, a Error signal generated when one of the signals as different is recognized. One maybe different error signal can be generated if all three signals are different.

A third possibility is to apply these values to an algorithm. This For example, the formation of an average, a median, or the use of a Fault Tolerant Algorithm (FTA). Such an FTA is based on omitting extreme values of the input values to strike and make a kind of averaging over the remaining values. This averaging can over the total amount of the remaining values or preferably over one be made in HW easily formed subset. In this Case it is not always necessary to actually set the values to compare. For example, averaging only adds up and divide, FTM, FTA or median require a partial Sorting. If necessary, can also be here at sufficiently large extreme values optionally an error signal can be output.

These various options mentioned processing of multiple signals into one signal will be for brevity referred to as comparison operations.

The The task of the processing logic is therefore to determine the exact shape of the Comparison operation for every output signal - and with it also for the associated Input signals - specify. The combination of information of the switching logic N110 (i.e., the above function) and the processing logic (i.e., the determination of the comparison operation per output, i. per function value) is the mode information and this sets the mode. This information is in general Case of course polyvalent, i. not just about a logical bit can be displayed. Not all theoretically conceivable Modes are useful in a given implementation, you will preferably restrict the number of allowed modes. To emphasize is that in the case of only two execution units, where there is only one comparison mode, all the information is on only one logical bit can be condensed.

A Switching from a performance to a comparison mode is in General case characterized in that execution units, the be displayed on different outputs in the performance mode, be displayed in the comparison mode on the same output out. Preferably, this is realized by being a subsystem of execution units where, in the performance mode, all input signals N14i, the in the subsystem are directly connected to corresponding output signals N16i be while they are all mapped to one output in comparison mode. Alternatively, such switching can also be realized thereby be changed that pairings become. It is explained by that one is not in the general case of the one performance mode and speak a comparison mode, although in one given expression of the invention can restrict the amount of allowed modes such that this is the case. But you can always switch from a performance mode in a comparison mode (and vice versa) speak.

Between these modes can be controlled by software, dynamically switched during operation. The changeover is triggered either by the execution of special switchover structure tions, special instruction sequences, explicitly marked instructions, or by accessing particular addresses by at least one of the execution units of the multiprocessor system.

The Fault logic N130 collects the error signals, for example can be generated by the comparators, and optionally the outputs N16i passively, for example, by interrupting them via a switch.

The The following examples concentrate mostly on the case of two execution units, where most concepts are easier to visualize The Switching between modes can be done through different methods be encoded. In a possible Procedures are to use special switching commands issued by the Unit for switching request recognition G40 are detected. Another one potential Method of coding the switching is by accessing a special memory area defines the unit again detected for Umschaltwunscherkennung G40. Another procedure evaluates an external one in the unit for switching request recognition G40 Signal indicating a change, off. The following will be a method is described, the unused bit combinations in existing instruction set of the processor used. Special advantage This procedure is that existing development environments (Assembler, compiler, linker, debugger) can.

In 4 a multiprocessor system G200 with two execution units G210a, G210b and a switching and comparison unit G260 is shown. To switch between a comparison mode and a performance mode (and vice versa), undefined bit combinations of the at least two execution units G210a, G210b are used in the assembler. Non-defined or undefined bit combinations in this sense are understood to mean all bit combinations which are specified as undefined or illegal in the description of the instruction set. These are eg Illegal Operand, Illegal Instruction, Illegal Operation. The general characteristic of these undefined bit combinations is that a normal execution unit when executing such a bit combination either generates an error signal or shows an undefined behavior. So these bit combinations are not needed to represent the semantics of an ordinary program.

For software development can be used with the previous development environment, such as she for Einprozessorsysteme present. This can be realized, for example be that you have a macro "SWITCH MODE TO PM "and a macro "SWITCH MODE TO VM "defines the appropriate place in the code in the sense defined above insert undefined bit combinations.

The Use of this combination is then defined as a general "SWITCH" macro. This then causes a change depending on the current mode in each other. If in the system more than two different Modes must exist there are more such combinations for using this method, preferably one can then be used per switchover mode become.

According to the invention Switchover request by a bit combination not defined in the instruction set coded. These are allowed within an execution unit G210a, G2106 not in the usual way are processed. For this reason, an additional Pipeline stage (REPLACE stage) G230a, G230b proposed that the recognizes corresponding bit combinations and these for further processing replaced by neutral bit combinations. Conveniently, this is the "NOP" (No Operation) command used. A NOP command is characterized by the fact that it is the internal State of the execution unit, does not change to the intruction pointer. The REPLACE Level G230a, G230b is doing after the usual first stage, the FETCH stage G220a G220b and before the rest Pipeline levels G240a, G240b, are not defined in the assembler Bit combinations that are grouped together in one unit, inserted.

According to the invention Here shown implementation of a unit for Umschaltwunscherkennung G40 as a special pipeline stage G230a, G230b in a pipeline unit G215a, G215b, an additional Generate signals G250a, G250b if a corresponding bit combination was detected for switching, a separate switching unit and Comparator G260 signals that a change in processing mode perform is.

The REP stages G230a, G230b are preferably between the FET G220a, G220b and the remaining pipeline stages G240a, G240b in the pipeline units G215a, G215b of the execution units G210a, G210b arranged. The REP stages G230a, G230b detect this the corresponding bit combinations and, in this case, NOP Commands to the rest Steps G240a, G240b continue. At the same time the respective signal G250a or G250b activated. In all other cases, the REP behave Steps G230a, G230b neutral, i. all other commands are unchanged the remaining stages G240a, G240b passed on.

In the 5 In a flowchart, a method is shown which within a specific pipeline stage G230a, G230b has a special undefi exchanged bit combination with a NOP or other neutral bit combination. In FETCH stage G300, a command ie a bit combination is fetched from memory. Thereafter, in block G310, a distinction is made as to whether the fetched bit combination corresponds to the specific undefined bit combination which encodes a switchover. If this is not the case, in the next step G320 the bit combination is transferred without change to the remaining pipeline stages G340 for further processing. If the particular bit combination encoding a switch was detected in step G310, in step G330 it is replaced with the NOP bit combination and then passed to the further pipeline stages G340 for further processing. In an advantageous embodiment, the blocks G310, G320, G330 represent the functionality of a REPLACE stage G230a, G230b according to the invention, which may also contain further functionality.

In 6 is a multiprocessor system H200 with two execution units H210a, H210b and a switching and comparison unit H260 shown. The components H220a, H220b, H240a, H240b have the same meaning as G220a, G220b, G240a, G240b. In an alternative embodiment of the unit for switching request recognition G40, described here by the special pipeline stages H230a, H230b, this has, in addition to the signals H250a, H250b, which signal a changeover, further signals. So that the execution units H210a, H210b can be synchronized when switching from the performance mode to the comparison mode, the pipeline units H215a, H215b of the execution units H210a, H210 each have a signal input H280a, H280b, with which the processing can be stopped. This signal is set by the switching and comparison unit H260 for the pipeline unit H215a or H215b which first detected a switchover command and thus activated the signal H250a or GH50b. Only when both pipeline units H215a, H215b of the execution units H210a, H210b have recognized the switchover command and have synchronized their internal states by means of software or other hardware measures, this signal H280a, H280b is canceled again. When switching from the comparison mode to the performance mode, the H280a, H280b are not needed because no synchronization is necessary.

requirement for the The proposal described here is a unit (referred to as an ID unit) or Procedure, about each execution unit its can determine individual number or unit ID. At a System with two execution units For example, an execution unit for themselves the number 0, the other the number 1 determine. In a system with more than 2 execution units the numbers are assigned or determined accordingly. This ID does not distinguish between a comparison mode and a performance mode but denotes an execution unit one to one. The ID unit may be in the respective execution units be included, for example, implemented as a bit or bit combination in the processor status register or as a separate register or as a single Bit or as to the execution units external unit that provides a corresponding ID on request.

After this the execution units according to one Switchover, have made the switch to the performance mode, although the comparison unit is no longer active, but the execution units to lead still the same commands. That's because the instruction pointers, which identify the position in the program to which an execution work in the next Step works or is currently working, the switching is not to be influenced. So that the execution units then different Execute SW modules can, the program sequence of the execution units must be separated. Therefore, according to the case, the instruction pointers have in the performance mode usually different values, since according to the invention independent commands, Program segments or programs are processed. The separation the program flows happens in the proposal described here by determining the respective execution unit number. Depending on which ID an execution unit owns, leads the execution unit a particular software module. Because each execution unit is an individual number or ID, this can be the program flow of the involved execution units reliable be separated.

In the 7 In a flow chart, a method is shown which shows how, with the aid of the unit ID, the program flow can be separated when changing from a comparison mode to a performance mode in a multiprocessor system with 2 execution units. After performing the switch from a comparison to a performance mode G500, a query of the units ID or execution unit number G510 is carried out by both execution units. According to the invention, the execution unit 0 receives the execution unit number 0, the execution unit 1 the execution unit number 1. In G510, a comparison is made of the determined execution unit number with the number 0. If these are the same, the execution unit moves in step G520 This comparison succeeded, with the code for execution unit 0 gone. The execution unit for which this comparison was unsuccessful continues in G530 with the comparison with the number 1. If this comparison is successful, then the code for execution unit 1 in G540 continued. If this comparison is unsuccessful, an execution unit number not equal to 0 and 1 was determined for the corresponding execution unit. This represents an error and continues with G550.

In 8th is a possible method for 3 execution units describe. After performing the switchover from a compare mode to a performance mode H500, the units ID or execution unit number H510 is queried by the execution units. According to the invention, for example, the execution unit 0 will receive the execution unit number 0, the execution unit 1 the execution unit number 1 and execution unit 2 the execution unit number 2. In H510, the determined execution unit number is compared with the number 0. If this is the same In step H520, the execution unit for which this comparison was successful continues with the code for execution unit 0. The execution units for which this comparison was unsuccessful continue to compare with # 1 in H530. In the execution unit for which this comparison is successful, the code for execution unit 1 in H540 is continued. The execution units for which this comparison was unsuccessful continue to compare with number 2 in H535. The execution unit for which this comparison succeeds continues with the execution unit 2 code in H536. If this comparison was unsuccessful, an execution unit number not equal to 0.1 and 2 was determined for the corresponding execution unit. This is an error and H550 will continue. Alternatively to the comparison with a number, the determined execution unit number can also be used directly as an index in a jump table.

Corresponding This method can also be used for multiprocessor systems with more as 3 execution units be applied.

If from the performance mode to the compare mode, then have to several things to be heeded. When switching from the performance mode in the comparison mode must be ensured that the internal conditions the execution units after switching are similar, otherwise in comparison mode may be detected on an error, if the different starting states to different Expenses lead. This can be hardware, software, firmware or in one Combination of all three performed become. The prerequisite for this is that all execution units same or similar commands, programs or program segments after switching to compare mode. In the following is a synchronization method described, which is applicable when the comparison mode thereby distinguishes that identical commands are processed and a bit accurate comparison takes place.

In 9 is a flowchart showing a method that synchronizes the execution units when switching from a performance mode to a comparison mode. In step G600, preferably all interrupts are disabled. This is not only important because the interrupt controllers for the compare mode must be reprogrammed accordingly. Software should also be used to adjust the internal status of the execution units. However, if an interrupt is triggered during the preparation for switching to the comparison mode, then an adjustment is no longer possible without further effort.

step G610: Own the two execution units separate caches, so too must the contents of the caches before switching adjusted to prevent being in compare mode for an address for the an execution unit a cache hit and for another execution units Cache miss occurs. If this is not done by the cache hardware, this is for example, by marking all cachelines as invalid accomplish. It has to wait until the cache (or the caches) completely invalid are. If necessary, this is by a holding pattern in the program code sure. This can also be achieved by other means, It is crucial that after this step the caches in the same State are.

in the Step G620 empties the write buffers of the execution units so that after the switchover no activities of the execution units take place, which still come from the performance mode.

In step G630, the state of the pipeline stages of the execution units is synchronized. For this purpose, for example, one executes an appropriate number of NOP (No operation) instructions before the switching sequence / switching command. The number of NOP instructions depends on the number of pipeline stages and is thus dependent on the respective architecture. Which instruction is suitable as a NOP instruction is also architecture-dependent. If the execution units have an instruction cache, it must be ensured that this instruction sequence is aligned with the boundaries of a cacheline (alignment). Since the instruction cache has been marked as invalid before the execution of these NOPs, these NOPs must first be loaded into the cache. Starts this command sequence on a cacheline limit, the data transfer from the memory (eg RAM / ROM / Flash) to the cache is completed before the command for switching takes place. These must also be taken into account when determining the necessary number of NOPs.

in the Step G640 becomes the command step for switching to the comparison mode actually done.

in the Step G650 becomes the contents of the respective register files each execution unit equalized. Therefor the registers are identical before or after switching To load content. It is important that after switching the content of a register in the execution units is identical before the register contents are transferred externally and thus by the comparison unit is compared.

in the Step G660, the interrupt controllers are reprogrammed, so that an external interrupt signal on all interconnected execution units triggers the same interrupt.

in the Step G670, the interrupts are enabled again.

is it is not clear from the program flow, when in the comparison mode should be switched, so must the involved execution units over the intended changeover. This is preferred in the to the respective execution units belonging Interrupt controller e.g. initiated by SW an interrupt. The interrupt handling then causes the execution of the above-described sequence for interconnection.

In 10 a state machine is shown, which represents the switching between a performance and a comparison mode (and vice versa). When the system is started, caused by a "power on" or reset (software or hardware), the system is set to state G700 via the transition G800. In general, the system is able to respond to an undefined event that is able to A reset always starts in state G700, for example: External events, problems in the power supply, or internal error events that make it impossible to continue working The default state of the system is therefore also the case of the multiprocessor system G60, in which an otherwise undefined state would be assumed, in which case the default state G700 is assumed.This default position of the state G700 is ensured by hardware measures For example, the system state or the state of the switching and comparison unit G60 in a register, in a bit of a register, by a bit combination in a register or by a flip-flop, coded.

By Hardware will then ensure that after a reset or power on always the state G700 is taken. This is ensured by that e.g. the reset signal or the "power on" signal to the reset input or the Set input of the flip-flop or register is performed.

in the State G700, the system is operating in a performance mode. The execution units G10a, G10b work with different commands, programs or program pieces. A switchover request can be recognized, for example, by the fact that an execution unit G10a, G10b executes a special switching command. Other options are a recognition by accessing a special memory address, by an internal signal or by an external signal. As long as no Switchover is required, remains the multiprocessor system G60 and thus also the switching and comparison unit G70 in the state G700. Furthermore, with the changeover request, the recognition of a changeover condition is detected denoted as a switching request in This special system is characterized.

The Remain in state G700 is over the transition G810 shown. Is the execution unit G10a a Umschaltwunsch recognized, then will over the transition G820 the switching and comparison unit G70 in the state G710 transferred. Of the State G710 thus indicates the situation that the execution unit G10a has detected a switchover request and waits for the execution unit G10b also recognizes a switchover request. As long as not If the case is, the switching and comparison unit G70 remains in State G710, what with the transition G830 is shown.

The transition G840 takes place when in the state G710 the execution unit G10b also has a Switch request recognizes. The switching and comparison unit G70 takes thus the state G730. This condition denotes the situation when both execution units G10a, G10b have detected a changeover request. In state G730 find the synchronization procedures take place, with which the two execution units G10a, G10b are synchronized with each other in order subsequently in the Comparative mode to work. While This process leaves the switching and comparison unit G70 in state G730, what with the transition G890 is shown.

If in state G700 first from Off If a changeover request is detected, G860 is switched to state G720 via transition G860. The state G720 thus designates the situation that the execution unit G10b has detected a switchover request and waits until the execution unit G10a likewise recognizes a switchover request. As long as this is not the case, the switching and comparison unit G70 remains in state G720, which is represented by the transition G870. The transition G880 takes place when the execution unit G10a also recognizes a switchover request in state G720. The switching and comparison unit thus assumes the state G730.

If in state G700 both execution units G10a, G10b recognize switching at the same time, immediately transferred to the state G730. This case represents the transition G850

If the shift and compare unit G70 is in state G730 both execution units G10a, G10b detected a changeover request. In this state will be the internal states the execution units G10a, G10b synchronizes to complete these synchronization operations in comparison mode to work. Upon completion of this synchronization work finds the transition G900 instead. This transition indicates the end of the synchronization. Working in state G740 the execution units G10a, G10b in comparison mode. The completion of the synchronization work can from the execution units G10a, G10b itself be signaled. This means that the transition G900 takes place when both execution units G10a, G10b have signaled that they are ready to work in comparison mode. The termination can also over be signaled a fixed time. This means, that in the switching and comparison unit G70 is hard-coded, how long will be left in state G730? This time is set that sure both execution units G10a, G10b have finished their synchronization work. After expiration this time will be the transition G900 initiated. In another variation, the toggle and Comparative unit G70 the states the execution units G10a, Monitor G10b and even recognize if both execution units G10a, G10b have completed their synchronization work. After the recognition becomes then the transition G900 initiated.

So long no switchover request is detected, the multiprocessor system remains G60 in comparison mode, represented by junction G910. When in the state G740 a switchover request is detected, the switchover and comparison unit is via the transition G920 is in state G700. As already described, works the system is in state G700 in performance mode. The separation of program rivers at the transition from state G740 to state G700, can then be as described Procedure performed become.

In 11 there is shown a multiprocessor system G400 having two execution units G410a, G410b and two interrupt controllers G420a, G420b including therein included interrupt masking registers G430a, G430b and various interrupt sources G440a to G440n. Also shown is a switch and compare unit G450 having a special interrupt mask register G460.

advantage enough, owns every execution unit G410a, G410b their own interrupt controller G420a, G420b to be able to handle two interrupts simultaneously in the performance mode. This is particularly advantageous in systems where the interrupt handling represents a bottleneck in system performance. The interrupt sources G440a to G440n are advantageously sent to both interrupt controllers G420a, G420b connected the same way. This connection type causes that without further action on both execution units G410a, G410b the same interrupt is triggered. In performance mode The interrupt controllers G420a, G420b are programmed so that the corresponding interrupt sources G440a to G440n on the various execution units G410a, G410b can be divided appropriately depending on the application. this happens by means of a suitable programming of the interrupt masking registers G430a, G430b. The mask registers look for each interrupt source G440a to G440n one bit in the register. If this bit is set, If the interrupt is disabled, it will not be connected to the execution unit G410a, G410b forwarded. Conveniently in a performance mode, a given interrupt source G440a-bis G440n of exactly one execution unit G410a or G410b edited. Advantageously, this applies at least for some the interrupt sources. This can be achieved that multiple interrupt sources G440a to G440n can be processed simultaneously without interrupt nesting (Interrupt processing is performed by a second interrupt interrupted) or interrupt pending (the processing of the second will be postponed until the processing of the first is finished).

In the compare mode, it must be ensured that the interrupt controllers G420a, G420b simultaneously trigger the same interrupt on all execution units G410a, G410b, otherwise a fault would be detected in accordance with a comparison mode. This means that in the synchronization phase when switching from the performance mode to the comparison mode it must be ensured that the interrupt masking registers G430a, G430b are identical. This synchronization is in the 9 described in step G660. This synchronization can be done by software by programming both interrupt masking registers G430a, G430b with the same value accordingly. It is proposed to use a special register G460 to speed up the switching process. In one embodiment, this register G460 is arranged in the switchover and comparison unit G460, but it may also be included in the switchover request recognition G40, in a combined switchover request detection, in the comparator, in the switchover unit G80, as well as in all combinations. It is also conceivable that this register is arranged outside of these three components at another suitable location. The register G460 contains the interrupt mask, which is to apply in comparison mode. The switching and comparison unit G450 receives from the switching request recognition G40 a signal for switching from a performance to a comparison mode. After the interrupts can be disabled in step G600, the interrupt mask registers G430a, G430b of the interrupt controllers G420a, G420b are reprogrammed. This is now carried out by hardware from the switching and comparison unit G450 in parallel with the other synchronization steps after the switching signal has been received and the interrupt controllers G420a, G4206 have been disabled. Conveniently, the interrupt masking registers G430a, G430b in the compare mode are not individually reprogrammed, but always the central register G460. This is then transmitted synchronously by hardware to the two interrupt masking registers G430a, G430b. The method described herein for an interrupt mask register may be similarly applied to all interrupt status registers located in an interrupt controller. Of course, it is also conceivable to use a different storage medium instead of a register G460, from which the interrupt masking registers G430a, G430b can be transferred as quickly as possible.

In 12 For example, a multiprocessor system G1000 with two execution units G1010a, G1010b, a switchover and comparison unit G1020 and an interrupt controller G1030 with three different register sets G1040a, G1040b, G1050 is proposed. As an alternative to the solution described above, a special interrupt controller G1030 is proposed, as in FIG 12 shown. This is used in a multiprocessor system G1000, which in the example is shown with two execution units G1010a, G1010b, as well as a switching and comparison unit G1020, which can switch between a comparison and a performance mode.

In the performance mode, the register sets G1040a, G1040b are used. In this case, the interrupt controller G1030 operates as well as two interrupt controllers G420a, G420b. This behavior is in 11 shown and described. The register set G1040a is assigned to the execution unit G1010a and the register set G1040b to the execution unit G1010b. The interrupt sources G1060a to G1060n are appropriately masked to the execution units G1010a, G1010b. When switching from a performance mode to a compare mode, the switch and compare unit G1020 generates a signal G1070. This signals to the interrupt controller G1030 that the system is switched to comparison mode or that the system is operating in comparison mode from this point in time. The interrupt controller G1030 then uses the register set G1050. This ensures that the same interrupt signals occur at both execution units G1010a, G1010b. With a change from the comparison mode to the performance mode, which the switching and comparison unit G1020 again signals via the signal G1070 to the interrupt controller G1030, the register sets G1040a, G1040b are switched over again. Conveniently, protection of the corresponding register sets can thus also be achieved by only permitting writing to the register sets G1040a, G1040b in the performance mode, and writing to the register set G1050, which is reserved for the comparison mode, being inhibited by hardware. The same is also possible in the other direction that in comparison mode only writing to the register set G1050 is allowed and writing to the register sets G1040a, G1040b is prohibited.

In 13 is the simplest form of a comparator M500, G20 shown. An essential component in a multiprocessor system G60 having at least two execution units G10a, G10b with a changeover between a performance mode and a comparison mode is the comparator M500. In the simplest form he is in 13 shown. The comparison component M500 can receive two input signals M510 and M511. It then compares these to equality, in the context presented here, preferably in the sense of a bit-wise equality. In the same case, the value of the input signals M510, M511 is given to the output signal M520 and the error signal M530 becomes inactive, ie it signals the "good" state If it detects inequality, the error signal M530 is activated The signal M520 can then be optional This has the advantage that the error does not come out of the corresponding system ("fault containment"). That is, other components that are outside the execution units are not corrupted by the potentially erroneous signal. However, there are also systems in which the signal M520 does not have to be deactivated. This is the case, for example, if only system-level fail-silence is required. Then the error signal can be led to external, for example.

From Starting from this basic system are a variety of embodiments conceivable. First For example, component M500 can be called a TSC component (totally self-checking). In this case, the error signal M530 is routed to at least two lines ("dual rail") to the outside, and it is through internal design and error detection measures made sure in every possible Error case of the comparison component this signal is correct or recognizable incorrectly. A dual rail signal provides a binary signal over two Lines available, preferably so that the two lines to each other in error-free case are inverted. A preferred variant in the use of the system according to the invention is it, such a TSC comparator to use.

A second class of embodiments may be distinguished as to which degree of synchronicity the two Inputs M510, M511 (or M610, M611) must have. A possible embodiment is characterized by intermittent synchronicity, i.e. the comparison of the data can be done in one cycle.

A slight change arises from the fact that at a fixed Plasenversatz between the inputs a synchronous delay element is used, for example, the corresponding signals half-integer or integer clock periods delayed. Such a phase shift is useful, to avoid common cause errors, i. such causes of error, the multiple processing units simultaneously and identically can influence.

14 therefore describes a further embodiment. The components and signals M600, M610, M611, M620, M630 in have the same meaning as the corresponding components and signals M500, M510, M511, M520, M530 13 , In 14 Therefore, beyond these components, the component M640 is inserted, which delays the earlier input by the phase offset. Preferably, this delay element is accommodated in the comparator to use it only in the comparison mode.

alternative or in addition you can put intermediate buffers M650, M651 in the input chain to such asynchronicities, which do not represent pure clock or phase offset, as well to be able to tolerate. These intermediate buffers are preferably used as FIFO memories (first-in, first out). Such a memory has an input and an output and can store several memory words. An incoming one Memory word is received when a new memory word arrives in its memory Postponed. After the last place (the depth of the buffer) it will "out moved out of the store ". If such a buffer exists, you can also asynchronisms until tolerate to the maximum depth of the buffer. In this case, must an error signal will be output even if the buffer overflows.

Further one can compare in the embodiments differ according to how the signal M520 (or M620) is generated becomes. A preferred embodiment is it, the input signals M510, M511 (or M610, M611) to the output to set and make the connection by switch interruptible. The particular advantage of this embodiment is that for Switch between performance mode and possible different comparison modes the same switches can be used. Alternatively, the Signals are also generated from internal comparisons become.

A final class of embodiments may be distinguished as to how many inputs are present on the comparator and how the comparator should react. With three inputs, a majority voting, a comparison of all three or a comparison of only two signals can be made. With four or more inputs, correspondingly more embodiments are conceivable. A detailed description of the possible embodiments is given in the description of FIG 20 contain.

The exact choice of the embodiments is preferably with the different operating modes of the overall system to pair. That is, if there are several different performance or Comparison modes are, then these are preferably with the appropriate Coupled mode of the comparator.

At some places in this invention it is necessary or advantageous a comparator or a more general voting processing / sorting element disable or passively make (in the following the simplicity half always referred to as a comparator). There are many possibilities. For one thing, one can lead a signal to the comparator, with it is activated or deactivated. This is in the comparator one additional To insert logic who do this can. One more way is to provide the comparator with no comparative data. A third possibility is to ignore at system level the error signal of the comparator. Next you can also interrupt the error signal itself. all options is common that it does not matter in the system that two or more Data that is potentially compared are different. If If this is the case, the comparator is considered passive or disabled considered.

in the Further, an implementation of a switch is connected with a comparator, so a switching and comparison unit G70 considered. This implementation is particularly favorable if these together with the execution units G10a, G10b are executed within a chip.

By Summary of components comparator and switch arises only a very small hardware overhead when implemented within a chip. A preferred variant of the implementation is it therefore, to combine these two parts into one component. This is a component with at least the input signals (Output execution unit 1, output execution unit 2), at least the output signals (Output 1, Output 2), one logical output signal "Output total "(can physically match Output 1 or Output 2) and a comparator. The component has the ability to toggle the mode in the performance mode, let all signals pass, and in a comparison mode Compare several signals and pass one if necessary. In addition are still further input and output signals advantageous: An error signal for signaling a detected error, a mode signal about the Signal mode in which this component is located, and Control signals to and from the component.

In a preferred embodiment the two or more execution units in performance mode as master connected to a processor internal bus. The comparison unit is deactivated or the error signal that in a different behavior of the execution units in one of possible comparison modes is masked. This means, that the switching and comparison unit for the software is transparent is. In the considered comparison mode, the to be compared physical execution units as a logical execution unit handled on the bus, i. there is only one master on the bus. The error signal of the comparator is activated. The switching and comparison unit separates all but one execution unit via switches from the internal processor bus, duplicates the inputs of the one logical one execution unit and provides these to all execution units involved in the compare mode to disposal. When writing on the bus, the outputs are in the comparison unit compared and on equality, these data are about the written an existing access to the bus.

In 15 and 16 is the basic behavior of the preferred component M700 (switching and comparison unit, corresponds to G70) described. For the sake of simplicity, this figure is drawn only for two execution units. 15 shows the status of the component in comparison mode, 16 in performance mode. The various switch positions in these modes are implemented by M700 through the M760 control. The two execution units M730, M731 can first write in the performance mode on the data and address bus M710 when the switches M750 and M751 are closed, as in 16 shown. It is assumed that possible write conflicts will be resolved either via the bus protocol or through other, not drawn components. In comparison mode, the behavior is different, at least from a logical point of view. As in 15 shown, then the switches M750, M751 are opened and thus the direct access possibilities are interrupted. In contrast to 16 are in 15 then, however, the switches M752, M753 closed. The signals M740, M741 of the execution units M730, M731 are passed to the comparison component M720. This is at least as structured as in 13 drawn, but it can also be extensions, as in 14 described, include. In a representation of the error signal or other signals of the comparison component M720 is in 15 , and 16 but waived. If the two signals match, the switch M754 is closed, and then one of the two matching signals is forwarded to the address / data bus M710. In total, it is necessary that the M700 switching and comparison unit can influence the M750-M754 switches. The respective switch position depends on the mode and the error detection. Variants in which the switch M754 is always closed, and a suitable system response is generated by the error signal, are also covered hereby.

In 17 a variant of the switching and comparison unit is shown. Even for a simple system with only two execution units G10a, G10b, there are many variants of the implementation of a switching and comparison unit. Another, which is particularly advantageous when no buffers are to be used in the comparator is in 17 shown. As in figure 15 . 16 are the M840, M841 signals of the execution units. The latter are not drawn in this figure. In the component M800 according to the invention, there is a mode logic M810 which specifies the mode of the component. In the performance mode it closes the switch M831, in comparison mode it opens it. Next it gives the mode signal to the comparator M820. This always compares in this implementation, but uses the result of the comparison and the mode signal to drive switch M830. In the performance mode the switch is always closed, in comparison mode always when there is no error.

Of course you can Also, once an error has been detected, the switch will continue stay open, until a corresponding reset comes.

In 18 a further embodiment of the switching and comparison unit is shown. This alternative, although it has more switches, but leaves the comparator in the performance mode inactive and therefore easier to deal with asynchronisms. Again there are the two signals M940, M941 of the execution units. The latter are not drawn again in this picture. In the component M900 according to the invention, there is a mode logic M910 which specifies the mode of the component. In performance mode, it closes switch M931 and opens switches M932, M933. Thus, the comparison component M920 is not loaded with data in this mode. This allows longer buffer times for asynchronisms, or lower buffer depths in one implementation. In performance mode, the M930 switch is always closed. In compare mode, component M910 closes switches M932, M933 and interrupts direct access to the bus by opening switch M931. Optionally, the M910 mode logic can still communicate the mode to the M920 comparator. In the comparison mode, the switch M930 is closed in error-free case. In the event of an error, the comparison component M920 interrupts the forwarding of the signal M940 to the bus by opening the switch M930.

In the drawings described it is possible without any effort, the Mode or error signals to the outside. It is further, especially for generating the internal mode state, easily possible, that further signals go to the component.

In summary is thus a preferred implementation of this component in that there are several processing units that Output signals to the bus (e.g., address / data bus). It is essential in that the component comprises at least two of the output signals of the execution units can process (for example, compare, but possibly also vote or sort) and that the component affects at least one switch can be interrupted with the at least one of the direct bus accesses. Especially useful This is when the execution units Are computer cores. Furthermore, it is advantageous if the state the influenceable switch the operating mode of the arithmetic unit characterized.

The System properties, in particular the possible comparison modes are then implemented particularly well when the component sends a signal to the Can set address data bus. Advantageously, this is a through connection one of the output signals of one of the execution units. Alternatively, you can this from the processing of different output signals of the different ones execution units arise.

As for example in the descriptions of the figures 17 . 18 became clear, one can identify in the system and - depending on the division into the components - also in one of the components a mode information. Depending on the implementation, this mode information may even be available explicitly in a subcomponent. In a preferred implementation, this signal may also be routed out of the component and made available to other parts of the system.

In the general case you can the behavior of the invention 21 explain. The signals and components N100, N110, N120, N130, N140, N141, N142, N143, N14n, N160, N161, N162, N163, N16n have the same meaning as in FIG 20 , In addition, the mode signal N150 and the error signal N170 are drawn in this figure. The optional error signal is generated by fault circuit logic N130, which collects the error signals, and is either a direct forwarding of the single error signals or a bundling of the error information contained therein. The mode signal N150 is optional, but its use outside of this component can be beneficial in many places. The combination of the information of the switching logic N110 (ie the in the description of 20 described function) and the processing logic (ie, the determination of the comparison operation per output signal, ie per function value) is the mode information and this sets the mode. Of course, in the general case this information is multivalued, ie not representable only via a logical bit. Not all the theoretically conceivable modes are useful in a given implementation, it is preferable to restrict the number of modes allowed. The mode signal then brings the relevant mode information to the outside. An HW implementation is preferably shown so that the externally visible mode signal can be configured. Preferably, the processing logic and circuitry are also configured to be configurable. Preferably, these configurations are coordinated. Alternatively, one can give only or additionally changes of the mode signal to the outside. This has advantages especially in a two-configuration.

Preferably, this mode signal is protected. An implementation in the two-system will be based, for example, on the implementation in 17 is shown in 19 shown. There, the signal M850 from the switching and comparison unit brought out. In a two-way system, this information can be represented logically over one bit. A hedge can then preferably be displayed via a dual-rail signal. In the general case, the signal can also be protected by a doubling, which is optionally inverted. Alternatively, one can also generate a parity, which is preferably internally generated intrinsically safe, or use a CRC (cyclic redundancy check) or ECC (error correcting code).

The Mode signal can be outside the component can be used. First, it can be self-monitoring of the operating system. This is from a SW point of view for one Responsible for switching and should always know in which mode the system is in place and bring the system into this mode as well. A review of this Signal can thus be used for protection. This can be done directly first happen. An alternative possibility but it is also over Timer or other "independent" units request to make the operating system plausible with this signal.

Generally Optionally, this signal can also be stored in other data sinks of a μC (or more generally Arithmetic unit) can be used. For example, an MPU (memory protection unit) may be programmed to handle certain memory accesses (from certain execution units) only allowed in certain modes. An MPU is a unit, which can ensure that only allowed accesses to the data / address bus carried out For example, by using the for certain program parts Access to specific address spaces in derogation. Through an introduction the mode signal to the MPU, corresponding configuration and programming this MPU, and evaluation of these configuration data and the mode signal, can be an extra Hedging done. Maybe simplified even the programming, if the mode signal already sufficient Information for review is. Then a quasi-static programming is sufficient for the initialization time of the μC. The same can for Peripheral units apply. Again, there are applications where Access to a corresponding peripheral element only in certain Modes is allowed. By an introduction of the mode signal to the Peripheral element, corresponding configuration and programming of the peripheral element, and evaluation of this configuration data and the mode signal, additional protection can be provided. In certain circumstances This even simplifies programming if the mode signal already sufficient information to check is. Then one is enough Quasi-static programming at the initialization time of the μC off. Analogous the evaluation of this signal can also be used on the interrupt controller become. Such surveillance can then the basis or an integral part of the security concept turn off. By suitable execution and SW structuring can make it possible be the security concept for a whole bug class in the considered application on this one Build mode signal. This is particularly advantageous if the mode signal in a suitable form, as described above, is intrinsically safe. It is then further advantageous in this case if the considered component has the possibility of an error signal to send or a shutdown path, if they have a discrepancy detected between the mode signal and the access to itself.

An essential further purpose is the evaluation of the mode signal outside of the arithmetic unit. A direct application is the evaluation in a decrementing watchdog. Such a "watchdog" consists of at least one (counter) register, which can be set by the microprocessor to an integer value After setting this register, the "watchdog" automatically decrements the value of the register with a fixed period , If the value of the register is zero or if an overflow occurs, the watch dog generates an error signal, if the error signal is not to be generated, the microprocessor must reset the value of the register in good time. If the microprocessor executes the software correctly, it is assumed that in this case also the "Watch-Dog" is no longer correctly operated and thus an error signal from the "Watch-Dog" is generated. The integrity of the hardware and data structures can be reliably verified in a compare mode, but it must be ensured that the microprocessor periodically switches back into it, so the task of the "watchdog" described here is not just to generate an error signal. if it is not reset within a defined period, but also if the microprocessor within a defined period no longer switches back to the defined comparison mode. For example, the "watchdog" can only be reset when the signal mode indicates the defined comparison mode of the arithmetic unit, thus ensuring that the arithmetic unit periodically returns to this mode, alternatively or additionally, the value in the register of the "watchdog "decrements only when certain interrupts are triggered at the microprocessor. For this, the external interrupt signals of the μC must also be coupled to the watchdog. The watchdog stores which interrupts switch the μC to the defined comparison mode. The watchdog is "pulled up" as soon as such an interrupt comes, it is reset by the before Handensein the correct mode signal.

All in general, it is useful especially in the application to a security concept, the mode signal in a μC-external To evaluate the source. A key point in securing the correct Run the software on a machine, as in the invention is the correct change between the different allowed modes. First should the changeability even be checked preferably also the correct change. As described above, You may also be interested in having a special mode regularly accepted becomes. Such a method is always particularly advantageous when the mode signal itself is intrinsically safe.

One possibility is to pass the mode signal to an ASIC or another μC. This can at least check the following points via timers and simple logic using this signal:
Does the arithmetic unit sufficiently often (eg at the latest every 1000μs) in one or more defined modes?
Is a certain signal always output when changing to a mode?
Does the arithmetic unit regularly go out of a mode?
Are certain simple patterns of sequence of modes valid?
Is a general temporal pattern valid (eg on average <70% in mode 1 and <50% in mode 2)

any Combination of logical, temporal characteristics of the mode signal, if necessary supplemented by utilization of additional Signals.

In 22 In this case, the basic configuration for an additional proposal is described. In which a special question-and-answer game is performed between such a partner ASIC or μC and the arithmetic unit under consideration having this invention. N300 is a computational unit that can send such a mode signal. This may be, for example, a μC with multiple execution units and another component that can generate this mode signal. For example, this other component may be as in 19 or 21 be realized. N300 gives this signal N310 to the partner (eg other processor, other μC or ASIC) N330. This can ask about the N320 signal to N300 questions which N300 has to answer via N321. Such a question may be a computational task whose correct result is to be delivered via N321 from N300 within a defined time interval. N330 can check the correctness of this result independently of N300. For example, the results are stored in N330 or N330 can calculate them yourself. If an incorrect value is detected, an error is detected. The special feature of the proposed question-answer communication is that a parallel to the response, the mode signal is observed. Preferably, the questions are to be asked so that to answer by N300, they must adopt certain modes. This can be reliably verified that all mode changes are functional, and that provided in the program flow mode changes are also performed. Especially when initializing a system, but also during operation, this can serve as an essential component of a security concept.

A further application of this idea is the evaluation of the mode signal in an actuator control. In many applications in the automotive sector is today a trend towards so-called intelligent actuators. these are Actuators with a minimum amount of electronics that is sufficient Actuator command to receive, and then to control the actuator, that this command is then executed.

The basic idea is in 23 shown. An arithmetic unit N400, which has the invention, sends an actuating command via the connection N420 to an (intelligent) actuator or an actuator control N430. In parallel, it sends the mode signal to this actuator via the N410 connection. Actuator N430 uses the mode signal to check whether control is permitted and optionally returns an error status via signal N440. If the drive is faulty, it assumes the non-critical fail-silence state in the system.

Claims (24)

Method for switching in a computer system having at least two execution units, wherein switching means are provided which are configured such that they switch between at least two operating modes, wherein a first mode of operation corresponds to a comparison mode and a second mode of operation a performance mode, characterized in that an interrupt controller provided and at least three memory areas are provided, the access to the memory areas being such that at least one first execution unit is assigned a first memory area and at least one second execution unit is assigned a second memory area and at least one third memory area can be assigned to the at least two execution units , A method according to claim 1, characterized in that assigned in the performance mode of each execution unit each have a memory area is, wherein the memory areas exactly one interrupt controller is assigned. Method according to one of the preceding claims, characterized characterized in that in the performance mode of each execution unit each one memory area is assigned, with all memory areas exactly one interrupt controller is assigned. Method according to one of the preceding claims, characterized in that all interrupt sources belong to the interrupt controller assigned. Method according to one of the preceding claims, characterized characterized in that in a performance mode at least a first execution unit a first memory area is assigned and at least a second memory area Execution unit second memory area is assigned. Method according to one of the preceding claims, characterized characterized in that in a comparison mode at least a third Memory area associated with the at least two execution units is. Method according to one of the preceding claims, characterized characterized in that in a performance mode only the assignment, at the every execution unit a memory area is assigned, is active. Method according to one of the preceding claims, characterized characterized in that in a comparison mode, only the assignment, at the at least two execution units the at least third memory area is assigned, is active. Method according to one of the preceding claims, characterized characterized in that in each mode only exactly one scheme of assignments is active, such that there is exactly one memory area for each execution unit which is assigned by one of the active assignments. Method according to one of the preceding claims, characterized characterized in that when switching from a comparison in a performance mode changes the scheme of active assignments. Method according to one of the preceding claims, characterized characterized in that a description of the associated memory areas not allowed in every mode. Method according to one of the preceding claims, characterized characterized in that a description of the associated memory areas is only allowed in those modes where the mapping is active. Device for switching over in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation a performance mode is characterized in that a Interrupt controller is the at least three memory areas are assigned, wherein at least a first memory area of the at least a first execution unit and a second storage area of the at least one second execution unit is assigned and at least a third memory area the at least two execution units is assignable. Device according to claim 13, characterized in that that in the performance mode of each execution unit each have a memory area is assigned, with exactly one interrupt controller is provided. Apparatus according to claim 13 to l4, characterized that all interrupt sources are assigned to the interrupt controller. Device according to claim 13 to 15, characterized in the performance mode, at least one first execution unit a first memory area is assigned and at least a second memory area execution unit a second memory area is assigned. Apparatus according to claim 13 to 16, characterized that in comparison mode, at least a third memory area the at least two execution units assigned. Apparatus according to claim 13 to 17, characterized the memory areas are arranged in the interrupt controller. Device according to Claims 13 to 18, characterized that in a performance mode, only the allocation, at each execution unit a memory area is assigned, is active. Apparatus according to claim 13 to 19, characterized that in a performance mode, only the allocation, at each execution unit a memory area is assigned, is active. Apparatus according to claim 13 to 20, characterized in that in a Vergleichsmo Only the assignment in which the at least two execution units are assigned to the at least third memory area is active. Apparatus according to claim 13 to 21, characterized that in each mode only exactly one scheme of assignments is active, such that it belongs to each execution unit gives exactly one memory space, which is due to one of the active assignments assigned. Apparatus according to claim 13 to 22, characterized that when switching from a comparison mode to a performance mode, the Scheme of active assignments changes. Device according to claim 13 to 23, characterized that when switching from a comparison mode to a performance mode Change of active assignments by the operation of switches takes place.