DE102005037237A1 - Device for switching in computer system has two execution units, whereby programmable interruption controller is associated with each execution unit, and memory element in which information of parts of interruption controller is stored - Google Patents

Abstract

The device (G400) has two execution units (G410a,G410b) whereby a programmable interruption controller (G420a,G420b) is associated with each execution unit. The device also has a memory element in which information of parts of interruption controller is stored. An independent claim is also included for a method of switching in a computer system.

Description

transient Error, triggered by alpha particles or cosmic rays, are becoming increasingly a problem for integrated semiconductor circuits. Due to decreasing structure widths, sinking tensions and higher Clock frequencies increases the likelihood that a voltage spike, caused by an alpha particle or cosmic radiation, corrupted a logical value in an integrated circuit. One wrong calculation result can be the result. In security relevant Systems, especially in the motor vehicle, such errors must therefore be reliably detected.

at safety-related systems, such as an ABS control system in a motor vehicle in which detects malfunctions of the electronics safely Need to become, become common in the corresponding control devices of such systems Redundancies used for error detection. Such is for example in known ABS systems in each case the complete microcontroller duplicated, with all ABS functions being redundantly calculated and on agreement being checked. If there is a discrepancy between the results, the ABS system becomes off.

basics Components of a microcontroller are on the one hand from memory modules (e.g., RAM, ROM, cache), the cpu, and I / O ports, the so-called peripherals (e.g., A / D converter, CAN interface). Because memory elements with verification codes (Parity or ECC) effectively monitored can be and peripherals are often application-specific as part of a sensor or actuator signal paths monitored be another redundancy approach in the sole doubling of the Cores of a microcontroller.

Such Microcontrollers with two integrated cores are also called dual-core Architectures known. Both cores are redundant and isochronous (Lockstep mode) the same program segment, the results the two cores are compared, and an error is then added the comparison for agreement be recognized. This configuration of a dual-core system can be considered a comparison mode be designated.

Dual-Core Architectures also improve performance in other applications, So used to a performance increase. Both cores lead different Programs, program segments, and commands out, resulting in an increase in performance achieve, why this configuration of a dual-core system as a performance mode can be designated. This system is also called a symmetric Multiprocessor system (SMP) called.

A Extension of these systems is a switching between software These two modes mean access to a specific address and specialized hardware devices. in the Comparison mode will be the output signals of the cores together compared. In performance mode, the two cores work as one symmetric multiprocessor system (SMP) and run different programs, Program segments or commands off.

at the use of such systems, the problem arises that in the Switching also made a switchover from interrupt sources must become. It is therefore an object of the invention, methods and Funds available to provide optimal switching of the interrupt sources.

Advantages of invention

advantageously, one uses a device for switching in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation a performance mode corresponds to each characterized execution unit a programmable interrupt controller is assigned and that a memory element is included in which information which at least parts of a configuration of at least one of these interrupt controllers describes, are stored.

advantageously, one uses a device in which means are present, the a transfer information from the storage element to at least one of Enable interrupt controller

advantageously, one uses a device in which the means are formed in hardware.

advantageously, Using a device in which the device is designed in such a way that when switching between a performance mode and a Comparison mode a new configuration of at least one interrupt controller is realized that information from the memory element to at least one interrupt controller is transmitted.

advantageously, One uses a device in which all the configuration information at least one interrupt controller contained in the memory element is.

advantageously, one uses a device in which the information for the configuration at least an interrupt controller is used.

advantageously, one uses a device in which the memory element as Register set is formed.

advantageously, one uses a device in which the memory element as Interruptmaskierungsregister is formed.

advantageously, one uses a device in which in a comparison mode Interrupts triggered simultaneously become.

advantageously, Using a device in which the device is designed in such a way that when switching from a performance mode in a comparison mode transmit the same information from the memory element to at least two interrupt controllers becomes.

advantageously, One uses a method for switching in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode, characterized in that each execution unit a programmable interrupt controller is assigned and that a memory element is included in which information which at least parts of a configuration of at least one of these interrupt controllers describes, are stored.

advantageously, One uses a method in which information from the memory element is transmitted to at least one of the interrupt controller.

advantageously, One uses a method in which information about a Hardware medium from the storage element to at least one of the interrupt controllers becomes.

advantageously, One uses a method in which when switching between a performance mode and a compare mode a new configuration at least one interrupt controller is realized by that Transfer information from the storage element to at least one interrupt controller becomes.

advantageously, One uses a method in which all the configuration information at least one interrupt controller transmitted from the memory element becomes.

advantageously, one uses a method in which the information for configuration at least an interrupt controller is used.

advantageously, One uses a method in which interrupts are simultaneously in a compare mode triggered become.

advantageously, One uses a method in which when switching from a Performance mode in a compare mode the same information transferred from the memory element to at least two interrupt controllers becomes.

Further Advantages and advantageous embodiments will be apparent from the features the claims as well as the description.

characters

In the 1 is a multiprocessor system G60 with two execution units G10a, G10b a comparison unit G20, a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 2 is a multiprocessor system G60 with two execution units G10a, G10b a combined comparison and switching unit G70 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 3 is a multiprocessor system G60 with two execution units G10a, G10b a combined Umschaltwunscherkennung, comparison and switching unit G80 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In 4 a multiprocessor system G200 is shown with two execution units G210a, G210b of a switching and comparison unit G260.

In the 5 In a flow diagram, a method is shown that exchanges a special undefined bit combination with a NOP or other neutral bit combination within a specific pipeline stage G230a, G230b.

In 6 is a multiprocessor system H200 with two execution units H210a, H210b and ei ner switching and comparison H260 shown.

In the 7 In a flow chart, a method is shown which shows how, with the aid of the unit ID, the program flow can be separated when changing from a comparison mode to a performance mode in a multiprocessor system with 2 execution units.

In 8th For example, one possible method is shown how, with the aid of the unit ID, the program flow can be separated when changing from a compare mode to a performance mode in a multiprocessor system with 3 execution units.

In 9 is a flowchart showing a method that synchronizes the execution units when switching from the performance mode in the comparison mode.

In 10 a state machine is shown, which represents the switching between a performance and a comparison mode.

In 11 a multiprocessor system G400 is shown with two execution units as well as two interrupt controllers G420a, G4206 including therein contained interrupt masking registers G430a, G430b and various interrupt sources G440a to G440n.

In 12 a multiprocessor system with two execution units, a switching and comparison unit and an interrupt controller with three sets of registers is shown.

In 13 is the simplest form of a comparator shown.

14 shows a comparator with a unit to compensate for a phase shift.

In 15 is the basic behavior of the preferred component M700 (switching and comparison unit) described in comparison mode.

In 16 is the basic behavior of the preferred component M700 (switching and comparison unit) described in the performance mode.

In 17 an embodiment of the switching and comparison unit is shown.

In 18 a further embodiment of the switching and comparison unit is shown.

In 19 is a switching and comparison unit that generates a mode signal is shown.

In 20 a general representation of a switching and comparison unit is shown.

21 shows a general representation of a switching and comparing unit which generates a general mode and a general error signal.

In 22 the question answer communication is presented with an external unit.

In 23 the communication with an intelligent actor is shown.

description the embodiments

When execution unit can in the following both a processor, a core, a CPU, as also an FPU (Floating Point Unit), a DSP (Digital Signal Processor), a coprocessor or an ALU (Arithmetic Logical Unit) become.

In the 1 is a multiprocessor system G60 with two execution units G10a, G10b a comparison unit G20, a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

The invention relates to a multiprocessor system G60 shown in 1 . 2 . 3 with at least two execution units G10a, G10b, a comparison unit G20, a switching unit G50 and a unit for switching request recognition G40. The switching unit G50 has at least two outputs to at least two system interfaces G30a, G30b. Registers, memories or peripherals such as digital outputs, D / A converters and communication controllers can be controlled via these interfaces. This multiprocessor system can be operated in at least two modes of operation, a compare mode (VM) and a performance mode (PM).

in the Performance mode will be in the different execution units different commands, program segments or programs in parallel executed. In this operating mode, the comparison unit G20 is deactivated. The switching unit G50 is configured in this operating mode so that each execution unit G10a, G10b is connected to a system interface G30a, G30b. Here is the execution unit G10a with system interface G30a and the execution unit G10b connected to the system interface G30b.

In the comparison mode, identical or similar instructions, program segments or programs are executed in both execution units G10a, G10b. Conveniently, these commands are processed isochronously, but it is also an Ab Work with asynchronicity or a defined clock skew conceivable. The output signals of the execution units G10a, G10b are compared in the comparison unit G20. If there is a difference, an error is detected and suitable measures can be taken. These measures can trigger an error signal, initiate error handling, operate switches or a combination of these and other conceivable measures. The switching unit G50 is configured in a variation such that only one signal is connected to the system interfaces G30a, G30b. In another configuration, the switching unit only causes the compared and thus same signals to be connected to the system interfaces G30a, G30b.

The Switchover request detection G40 detects independently of the currently active mode a switchover to another mode.

In 2 is a multiprocessor system G60 with two execution units G10a, G10b a combined comparison and switching unit G70 consisting of a comparison unit G20 and a switching unit G50 and a unit for Umschaltwunscherkennung G40 shown.

In one embodiment of the situation described above, the switching unit G50 and the comparison unit G20 can be combined to form a common switching and comparison unit (UVE) G70, as in FIG 2 shown. This common component G70 then takes over the tasks of the individual components G50, G20. In 15 . 16 . 17 . 18 and 19 Variants of the UVE G70 are shown.

In a further embodiment, as in 3 1, the switching request recognition unit G40, the comparator G20 and the switching unit G50 may be combined in a common component G80. In a further embodiment, which is not shown in a figure, the switching request recognition G40 and the comparator G20 can be combined in a common component. Also conceivable is a summary Umschaltwunscherkennung G40 with the switch G50 in a common component.

in the further text will be used unless otherwise stated that a switching request recognition G40 and a combined switching and Comparative Unit G70.

A general case of the switching and comparison component, also for use with more than two execution units, is in FIG 20 shown. Of the n execution units to be considered, n signals N140,..., N14n go to the switching and comparison component N100. This can generate up to n output signals N160, ..., N16n from these input signals. In the simplest case, the "pure performance mode", all signals N14i are directed to the corresponding output signals N16i In the opposite limit case, the "pure comparison mode", all signals N140, ..., N14n are directed to only one of the output signals N16i.

At this figure leaves Explain how the various conceivable modes can arise. To is the logical component of a switching logic N110 in this figure contain. This component does not need to exist as a separate component be. It is crucial that the functions described in the system are realized. The switching logic N110 first determines how many output signals it at all gives. It also determines which of the input signals to which contribute to the output signals. It can be an input signal to contribute exactly one output signal. Different in mathematical form formulated, a function is defined by the switching logic, each element of the set {N140, ..., N14n} is an element of the set {N160, ..., N16n} assigns.

The processing logic N120 then determines to each of the outputs N16i how the inputs contribute to that output signal. Also, this component does not have to exist as a separate component. It is again crucial that the functions described are implemented in the system. By way of example, to describe the various possible variations, it is assumed without loss of generality that the output N160 is generated by the signals N141, ..., N14m. If m = 1, this simply means that the signal is switched through, if m = 2 then the signals N141, N142 are compared, as in the comparator in FIG 13 . 14 described. This comparison can be performed synchronously or asynchronously, it can be performed bitwise or only on significant bits or even with a tolerance band.

If m> = 3 there are several Options.

A first option consists in comparing all the signals and in the presence at least two different values to detect an error, which one can signal optional.

A second possibility is to make a k out of m selection (k> m / 2). This can be realized by using Vergieichern. Optionally, an error signal can be generated if one of the signals is detected as deviating. One possibly different An error signal can be generated if all three signals are different.

A third possibility is to apply these values to an algorithm. This For example, the formation of an average, a median, or the use of a Fault Tolerant Algorithm (FTA). Such an FTA is based on omitting extreme values of the input values delete and make a kind of averaging over the remaining values. This averaging can over the total amount of the remaining values or preferably over one be made in HW easily formed subset. In this Case it is not always necessary to actually set the values to compare. For example, averaging only adds up and divide, FTM, FTA or median require a partial Sorting. If necessary, can also be here at sufficiently large extreme values optionally an error signal can be output.

These various options mentioned processing of multiple signals into one signal will be for brevity referred to as comparison operations.

The The task of the processing logic is therefore to determine the exact shape of the Comparison operation for every output signal - and with it also for the associated Input signals - specify. The combination of information of the switching logic N110 (i.e., the above function) and the processing logic (i.e., the determination of the comparison operation per output, i. per function value) is the mode information and this sets the mode. This information is in general Case of course polyvalent, i. not just about a logical bit can be displayed. Not all theoretically conceivable Modes are useful in a given implementation, you will preferably restrict the number of allowed modes. To emphasize is that in the case of only two execution units, where there is only one comparison mode, all the information is on only one logical bit can be condensed.

A Switching from a performance to a comparison mode is in General case characterized in that execution units, the be displayed on different outputs in the performance mode, be displayed in the comparison mode on the same output out. Preferably, this is realized by being a subsystem of execution units where, in the performance mode, all input signals N14i, the in the subsystem are directly connected to corresponding output signals N16i be while they are all mapped to one output in comparison mode. Alternatively, such switching can also be realized thereby be changed that pairings become. It is explained by that one is not in the general case of the one performance mode and speak a comparison mode, although in one given expression of the invention can thus limit the amount of allowed modes that this is the case. But you can always switch from one to another from a performance mode to a comparison mode (and vice versa).

Between these modes can, over Software controlled, dynamically switched during operation. Is triggered the switching either over execution special switching instructions, special instruction sequences, explicitly marked instructions or by accessing certain addresses through at least one of the execution units of the multiprocessor system.

The Fault logic N130 collects the error signals, for example can be generated by the comparators, and optionally the outputs N16i passively, for example, by interrupting them via a switch.

The The following examples concentrate mostly on the case of two execution units, where most concepts are easier to visualize The Switching between modes can be done through different methods be encoded. In a possible Procedures are to use special switching commands issued by the Unit for switching request recognition G40 are detected. Another one potential Method of coding the switching is by accessing a special memory area defines the unit again detected for Umschaltwunscherkennung G40. Another procedure evaluates an external one in the unit for switching request recognition G40 Signal indicating a change, off. The following will be a method is described, the unused bit combinations in existing instruction set of the processor used. Special advantage This procedure is that existing development environments (Assembler, compiler, linker, debugger) can.

In 4 a multiprocessor system G200 with two execution units G210a, G210b and a switching and comparison unit G260 is shown. To switch between a comparison mode and a performance mode (and vice versa), undefined bit combinations of the at least two execution units G210a, G210b are used in the assembler. Undefined or undefined bit combinations in this sense are all bit combinations that are specified as undefined or illegal in the description of the instruction set. These are eg Illegal Operand, Illegal Instruction, Illegal Operation. General Characteristic of these undefined bit combinations is that a normal execution unit when executing such a bit combination either generates an error signal or shows an undefined behavior. So these bit combinations are not needed to represent the semantics of an ordinary program.

For software development can be used with the previous development environment, such as she for Einprozessorsysteme present. This can be realized, for example be that you have a macro "SWITCH MODE TO PM "and a macro "SWITCH MODE TO VM "defines the appropriate place in the code in the sense defined above insert undefined bit combinations.

The Use of this combination is then defined as a general "SWITCH" macro. This then causes a change depending on the current mode in each other. If in the system more than two different Modes must exist there are more such combinations for using this method, preferably one can then be used per switchover mode become.

According to the invention Switchover request by a bit combination not defined in the instruction set coded. These are allowed within an execution unit G210a, G210b not in the usual way are processed. For this reason, an additional Pipeline stage (REPLACE stage) G230a, G230b proposed that the recognizes corresponding bit combinations and these for further processing replaced by neutral bit combinations.

conveniently, becomes the "NOP" (No Operation) command used. A NOP command is characterized by the fact that it is the internal State of the execution unit, does not change to the intruction pointer. The REPLACE Level G230a, G230b is doing after the usual first stage, FETCH stage G220a G220b and before the remaining pipeline stages G240a, G240b, are not defined bit combinations in the assembler, which are grouped together in one unit.

According to the invention Here shown implementation of a unit for Umschaltwunscherkennung G40 as a special pipeline stage G230a, G230b in a pipeline unit G215a, G215b, an additional Generate signals G250a, G250b if a corresponding bit combination was detected for switching, a separate switching unit and Comparator G260 signals that a change in processing mode perform is.

The REP stages G230a, G230b are preferably between the FET G220a, G220b and the remaining pipeline stages G240a, G240b in the pipeline units G215a, G215b of the execution units G210a, G210b arranged. The REP stages G230a, G230b detect this the corresponding bit combinations and, in this case, NOP Commands to the rest Steps G240a, G240b continue. At the same time the respective signal G250a or G250b activated. In all other cases, the REP behave Steps G230a, G230b neutral, i. all other commands are unchanged the remaining stages G240a, G240b passed on.

In the 5 In a flow diagram, a method is shown that exchanges a special undefined bit combination with a NOP or other neutral bit combination within a specific pipeline stage G230a, G230b. In FETCH stage G300, a command ie a bit combination is fetched from memory. Thereafter, in block G310, a distinction is made as to whether the fetched bit combination corresponds to the specific undefined bit combination which encodes a switchover. If this is not the case, in the next step G320 the bit combination is transferred without change to the remaining pipeline stages G340 for further processing. If the particular bit combination encoding a switch was detected in step G310, in step G330 it is replaced with the NOP bit combination and then passed to the further pipeline stages G340 for further processing. In an advantageous embodiment, the blocks G310, G320, G330 represent the functionality of a REPLACE stage G230a, G230b according to the invention, which may also contain further functionality.

In 6 is a multiprocessor system H200 with two execution units H210a, H210b and a switching and comparison unit H260 shown. The components H220a, H220b, H240a, H240b have the same meaning as G220a, G220b, G240a, G240b. In an alternative embodiment of the unit for switching request recognition G40, described here by the special pipeline stages H230a, H230b, this has, in addition to the signals H250a, H250b, which signal a changeover, further signals. So that the execution units H210a, H210b can be synchronized when switching from the performance mode to the comparison mode, the pipeline units H215a, H215b of the execution units H210a, H210b each have a signal input H280a, H280b, with which the processing can be stopped. This signal is set by the switching and comparison unit H260 for the pipeline unit H215a or H215b which first detected a switchover command and thus activated the signal H250a or GH50b. Only when both pipeline units H215a, H215b of execution units H210a, H210b recognize the switchover command and have synchronized their internal states by software or other hardware measures, this signal H280a, H280b is withdrawn. When switching from the comparison mode to the performance mode, the H280a, H280b are not needed because no synchronization is necessary.

requirement for the The proposal described here is a unit (referred to as an ID unit) or Procedure, about each execution unit its can determine individual number or unit ID. At a System with two execution units For example, an execution unit for themselves the number 0, the other the number 1 determine. In a system with more than 2 execution units the numbers are assigned or determined accordingly. This ID does not distinguish between a comparison mode and a performance mode but denotes an execution unit one to one. The ID unit may be in the respective execution units be included, for example, implemented as a bit or bit combination in the processor status register or as a separate register or as a single Bit or as to the execution units external unit that provides a corresponding ID on request.

After this the execution units according to one Switchover, have made the switch to the performance mode, although the comparison unit is no longer active, but the execution units to lead still the same commands. That's because the instruction pointers, which identify the position in the program to which an execution work in the next Step works or is currently working, the switching is not to be influenced. So that the execution units then different Execute SW modules can, the program sequence of the execution units must be separated. Therefore, according to the case, the instruction pointers have in the performance mode usually different values, since according to the invention independent commands, Program segments or programs are processed. The separation the program flows happens in the proposal described here by determining the respective execution unit number. Depending on which ID an execution unit owns, leads the execution unit a particular software module. Because each execution unit is an individual number or ID, this can be the program flow of the involved execution units reliable be separated.

In the 7 In a flow chart, a method is shown which shows how, with the aid of the unit ID, the program flow can be separated when changing from a comparison mode to a performance mode in a multiprocessor system with 2 execution units. After performing the switch from a comparison to a performance mode G500, a query of the units ID or execution unit number G510 is carried out by both execution units. According to the invention, the execution unit 0 receives the execution unit number 0, the execution unit 1 the execution unit number 1. In G510, a comparison is made of the determined execution unit number with the number 0. If these are the same, the execution unit moves in step G520 This comparison succeeded, with the code for execution unit 0 gone. The execution unit for which this comparison was unsuccessful continues in G530 with the comparison with the number 1. If this comparison is successful, the execution unit 1 code continues in G540. If this comparison is unsuccessful, an execution unit number not equal to 0 and 1 was determined for the corresponding execution unit. This represents an error and continues with G550.

In 8th is a possible method for 3 execution units describe. After performing the switchover from a compare mode to a performance mode H500, the units ID or execution unit number H510 is queried by the execution units. According to the invention, for example, the execution unit 0 will receive the execution unit number 0, the execution unit 1 the execution unit number 1 and execution unit 2 the execution unit number 2. In H510, the determined execution unit number is compared with the number 0. If this is the same In step H520, the execution unit for which this comparison was successful continues with the code for execution unit 0. The execution units for which this comparison was unsuccessful continue to compare with # 1 in H530. In the execution unit for which this comparison is successful, the code for execution unit 1 in H540 is continued. The execution units for which this comparison was unsuccessful continue to compare with number 2 in H535. The execution unit for which this comparison succeeds continues with the execution unit 2 code in H536. If this comparison was unsuccessful, an execution unit number not equal to 0.1 and 2 was determined for the corresponding execution unit. This is an error and H550 will continue. Alternatively to the comparison with a number, the determined execution unit number can also be used directly as an index in a jump table.

According to this description, this method can also be used for multiprocessor systems with more than 3 execution units who the.

If from the performance mode to the compare mode, then have to several things to be heeded. When switching from the performance mode in the comparison mode must be ensured that the internal conditions the execution units after switching are similar, otherwise in comparison mode may be detected on an error, if the different starting states to different Expenses lead. This can be hardware, software, firmware or in one Combination of all three performed become. The prerequisite for this is that all execution units same or similar commands, programs or program segments after switching to compare mode. In the following is a synchronization method described, which is applicable when the comparison mode thereby distinguishes that identical commands are processed and a bit accurate comparison takes place.

In 9 is a flowchart showing a method that synchronizes the execution units when switching from a performance mode to a comparison mode. In step G600, preferably all interrupts are disabled. This is not only important because the interrupt controllers for the compare mode must be reprogrammed accordingly. Software should also be used to adjust the internal status of the execution units. However, if an interrupt is triggered during the preparation for switching to the comparison mode, then an adjustment is no longer possible without further effort.

step G610: Own the two execution units separate caches, so too must the contents of the caches before switching adjusted to prevent being in compare mode for an address for the an execution unit a cache hit and for another execution units Cache miss occurs. If this is not done by the cache hardware, this is for example, by marking all cachelines as invalid accomplish. It has to wait until the cache (or the caches) completely invalid are. If necessary, this is by a holding pattern in the program code sure. This can also be achieved by other means, It is crucial that after this step the caches in the same State are.

in the Step G620 empties the write buffers of the execution units so that after the switchover no activities of the execution units take place, which still come from the performance mode.

in the Step G630 becomes the state of the pipeline stages of the execution units synchronized. Therefor you lead for example, an appropriate number of NOP (no operation) commands before the switching sequence / switching command off. The number of NOP commands depends on the number of pipeline stages and is dependent on the respective architecture. Which command is suitable as a NOP command, is also architecture dependent. Have the execution units an instruction cache, making sure that this Command sequence aligned to the boundaries of a cacheline (alignment). Because the instruction cache marks invalid before executing these NOPs has been these NOP's only be loaded into the cache. Starts this command sequence at a cacheline boundary such is the data transfer from memory (e.g., RAM / ROM / Flash) to the cache completed before the command to switch. These too must be taken into account when determining the necessary number of NOPs become.

in the Step G640 becomes the command step for switching to the comparison mode actually done.

in the Step G650 becomes the contents of the respective register files each execution unit equalized. Therefor the registers are identical before or after switching To load content. It is important that after switching the content of a register in the execution units is identical before the register contents are transferred externally and thus by the comparison unit is compared.

in the Step G660, the interrupt controllers are reprogrammed, so that an external interrupt signal on all interconnected execution units triggers the same interrupt.

in the Step G670, the interrupts are enabled again.

is it is not clear from the program flow, when in the comparison mode should be switched, so must the involved execution units over the intended changeover. This is preferred in the to the respective execution units belonging Interrupt controller e.g. initiated by SW an interrupt. The interrupt handling then causes the execution of the above-described sequence for interconnection.

In 10 a state machine is shown, which represents the switching between a performance and a comparison mode (and vice versa). When the system is started, caused by "Power On" or reset (software or hardware), the system is powered up via the G800 in the state G700 offset. In general, after an undefined event capable of triggering a reset, the system always starts to operate in state G700. Examples of events that can trigger a reset are external signals, problems with the power supply, or internal error events that make it unnecessary to continue working. The state G700 of the switching and comparison unit G70 and also of the multiprocessor system G60, in which work is carried out in the performance mode, is thus the default state of the system. In all cases in which an otherwise undefined state would be assumed, the default state G700 is assumed. This default position of state G700 is ensured by hardware measures. For example, the system state or the state of the switching and comparison unit G60 can be encoded in a register, in a bit of a register, by a bit combination in a register or by a flip-flop.

By Hardware will then ensure that after a reset or power on always the state G700 is taken. This is ensured by that e.g. the reset signal or the "power on" signal to the reset input or the Set input of the flip-flop or register is performed.

in the State G700, the system is operating in a performance mode. The execution units G10a, G10b work with different commands, programs or program pieces. A switchover request can be recognized, for example, by the fact that an execution unit G10a, G10b executes a special switchover command. Other options are a recognition by accessing a special memory address, by an internal signal or by an external signal. So long there is no switchover, the multiprocessor system remains G60 and thus also the switching and comparison unit G70 in the state G700. In addition, with the Umschaltwunsch the recognition of a Switching condition labeled as one Switchover request is marked in this special system.

The Remain in state G700 is over the transition G810 shown. Is the execution unit G10a a Umschaltwunsch recognized, then will over the transition G820 the switching and comparison unit G70 in the state G710 transferred. Of the State G710 thus indicates the situation that the execution unit G10a has detected a switchover request and waits for the execution unit G10b also recognizes a switchover request. As long as not If the case is, the switching and comparison unit G70 remains in State G710, what with the transition G830 is shown.

The transition G840 takes place when in the state G710 the execution unit G10b also has a Switch request recognizes. The switching and comparison unit G70 takes thus the state G730. This condition denotes the situation when both execution units G10a, G10b have detected a changeover request. In state G730 find the synchronization procedures take place, with which the two execution units G10a, G10b are synchronized with each other in order subsequently in the Comparative mode to work. While This process leaves the switching and comparison unit G70 in state G730, what with the transition G890 is shown.

If in the state G700 first by the execution unit G10b a switching request is detected, then becomes over the transition G860 switched to state G720. State G720 denotes hence the situation that the execution unit G10b is a switchover has recognized and waits until the execution unit G10a also recognizes a switchover request. As long as this is not the case, remains the switching and comparison unit G70 in the state G720, what with the transition G870 is shown. The transition G880 takes place when in state G720 the execution unit G10a also has one Switch request recognizes. The switching and comparison unit takes thus the state G730.

If in state G700 both execution units G10a, G10b recognize switching at the same time, immediately transferred to the state G730. This case represents the transition G850

When the switching and comparing unit G70 is in the state G730, both execution units G10a, G10b have recognized a switching request. In this state, the internal states of execution units G10a, G10b are synchronized to operate in comparison mode upon completion of these synchronization operations. When these synchronization tasks are completed, transition G900 takes place. This transition indicates the end of synchronization. In state G740, execution units G10a, G10b operate in compare mode. The completion of the synchronization work can be signaled by the execution units G10a, G10b itself. This means that transition G900 takes place when both execution units G10a, G10b have signaled that they are ready to operate in compare mode. The termination can also be signaled for a set time. This means that in the switching and comparison unit G70 is permanently coded how long in the state G730 remains. This time is set so that certainly both execution units G10a, G10b their Synchronisati have finished onsarbeiten. After this time the transition G900 is initiated. In a further variation, the switching and comparison unit G70 can monitor the states of the execution units G10a, G10b and recognize themselves when both execution units G10a, G10b have finished their synchronization work. After detection, transition G900 is then initiated.

So long no switchover request is detected, the multiprocessor system remains G60 in comparison mode, represented by junction G910. When in the state G740 a switchover request is detected, the switchover and comparison unit is via the transition G920 is in state G700. As already described, works the system is in state G700 in performance mode. The separation of program rivers at the transition from state G740 to state G700, can then be as described Procedure performed become.

In 11 there is shown a multiprocessor system G400 having two execution units G410a, G410b and two interrupt controllers G420a, G420b including therein included interrupt masking registers G430a, G430b and various interrupt sources G440a to G440n. Also shown is a switch and compare unit G450 having a special interrupt mask register G460.

advantage enough, owns every execution unit G410a, G410b their own interrupt controller G420a, G420b to be able to handle two interrupts simultaneously in the performance mode. This is particularly advantageous in systems where the interrupt handling represents a bottleneck in system performance. The interrupt sources G440a to G440n are advantageously sent to both interrupt controllers G420a, G420b connected the same way. This connection type causes that without further action on both execution units G410a, G410b the same interrupt is triggered. In performance mode The interrupt controllers G420a, G420b are programmed so that the corresponding interrupt sources G440a to G440n on the various execution units G410a, G410b can be divided appropriately depending on the application. this happens by means of a suitable programming of the interrupt masking registers G430a, G430b. The mask registers look for each interrupt source G440a to G440n one bit in the register. If this bit is set, If the interrupt is disabled, it will not be connected to the execution unit G410a, G410b forwarded. Conveniently in a performance mode, a given interrupt source G440a-bis G440n of exactly one execution unit G410a or G410b edited. Advantageously, this applies at least for some the interrupt sources. This can be achieved that multiple interrupt sources G440a to G440n can be processed simultaneously without interrupt nesting (interrupt processing is interrupted by a second interrupt) or Interrupt-Pending (the processing of the second is postponed until the processing of the first is finished) takes place.

In the compare mode, it must be ensured that the interrupt controllers G420a, G420b simultaneously trigger the same interrupt on all execution units G410a, G410b, otherwise a fault would be detected in accordance with a comparison mode. This means that in the synchronization phase when switching from the performance mode to the compare mode, it must be ensured that the interrupt mask registers G430a, G430b are identical. This synchronization is in the 9 described in step G660. This synchronization can be done by software by programming both interrupt masking registers G430a, G430b with the same value accordingly. It is proposed to use a special register G460 to speed up the switching process. In one embodiment, this register G460 is arranged in the switchover and comparison unit G460, but it may also be included in the switchover request recognition G40, in a combined switchover request detection, in the comparator, in the switchover unit G80, as well as in all combinations. It is also conceivable that this register is arranged outside of these three components at another suitable location. The register G460 contains the interrupt mask, which is to apply in comparison mode. The switching and comparison unit G450 receives from the switching request recognition G40 a signal for switching from a performance to a comparison mode. After the interrupts can be disabled in step G600, the interrupt mask registers G430a, G430b of the interrupt controllers G420a, G420b are reprogrammed. This is now performed by hardware from the switching and comparison unit G450 in parallel with the other synchronization steps after the switching signal has been received and the interrupt controllers G420a, G420b have been disabled. Conveniently, the interrupt masking registers G430a, G430b in the compare mode are not individually reprogrammed, but always the central register G460. This is then transmitted synchronously by hardware to the two interrupt masking registers G430a, G430b. The method described herein for an interrupt mask register may be similarly applied to all interrupt status registers located in an interrupt controller. Of course, it is also conceivable to use a different storage medium instead of a register G460, from which the interrupt masking registers G430a, G430b can be transferred as quickly as possible.

In 12 For example, a multiprocessor system G1000 with two execution units G1010a, G101b, a switchover and comparison unit G1020 and an interrupt controller G1030 with three different register sets G1040a, G1040b, G1050 is proposed. As an alternative to the solution described above, a special interrupt controller G1030 is proposed, as in FIG 12 shown. This is used in a multiprocessor system G1000, which in the example is shown with two execution units G1010a, G1010b, as well as a switching and comparison unit G1020, which can switch between a comparison and a performance mode.

In the performance mode, the register sets G1040a, G1040b are used. In this case, the interrupt controller G1030 operates as well as two interrupt controllers G420a, G420b. This behavior is in 11 shown and described. The register set G1040a is assigned to the execution unit G1010a and the register set G1040b to the execution unit G1010b. The interrupt sources G1060a to G1060n are appropriately masked to the execution units G1010a, G1010b. When switching from a performance mode to a compare mode, the switch and compare unit G1020 generates a signal G1070. This signals to the interrupt controller G1030 that the system is switched to comparison mode or that the system is operating in comparison mode from this point in time. The interrupt controller G1030 then uses the register set G1050. This ensures that the same interrupt signals occur at both execution units G1010a, G1010b. With a change from the comparison mode to the performance mode, which the switching and comparison unit G1020 again signals via the signal G1070 to the interrupt controller G1030, the register sets G1040a, G1040b are switched over again. Conveniently, protection of the corresponding register sets can thus also be achieved by only permitting writing to the register sets G1040a, G1040 in the performance mode and by writing to the register set G1050, which is reserved for the comparison mode, being inhibited by hardware. The same is also possible in the other direction that in comparison mode only writing to the register set G1050 is allowed and writing to the register sets G1040a, G1040b is prohibited.

In 13 is the simplest form of a comparator M500, G20 shown. An essential component in a multiprocessor system G60 having at least two execution units G10a, G10b with a changeover between a performance mode and a comparison mode is the comparator M500. In the simplest form he is in 13 shown. The comparison component M500 can receive two input signals M510 and M511. It then compares these to equality, in the context presented here, preferably in the sense of a bit-wise equality. In the same case, the value of the input signals M510, M511 is given to the output signal M520 and the error signal M530 becomes inactive, ie it signals the "good" state If it detects inequality, the error signal M530 is activated The signal M520 can then be optional This has the advantage that the error does not come out of the corresponding system ("fault containment"). That is, other components that are outside the execution units are not corrupted by the potentially erroneous signal. However, there are systems where the M520 signal does not need to be disabled. This is the case, for example, if only system-level fail-silence is required. Then the error signal can be led to external, for example.

From Starting from this basic system are a variety of embodiments conceivable. First For example, component M500 can be called a TSC component (totally self-checking). In this case, the error signal M530 will be on at least two lines ("dual rail ") led to the outside, and it is through internal design and error detection measures made sure in every possible Error case of the comparison component this signal is correct or recognizable incorrectly. A dual rail signal provides a binary signal over two Lines available, preferably so that the two lines to each other in error-free case are inverted. A preferred variant in the use of the system according to the invention is it, such a TSC comparator to use.

A second class of embodiments may be distinguished as to which degree of synchronicity the two Inputs M510, M511 (or M610, M611) must have. A possible embodiment is characterized by intermittent synchronicity, i.e. the comparison of the data can be done in one cycle.

A slight change arises from the fact that with a fixed phase shift between the inputs a synchronous delay element is used, for example, the corresponding signals half-integer or integer clock periods delayed. Such a phase shift is useful, to avoid common cause errors, i. such causes of error, the multiple processing units simultaneously and identically can influence.

14 therefore describes a further embodiment. The components and signals M600, M610, M611, M620, M630 in have the same meaning as the corresponding components and Signals M500, M510, M511, M520, M530 off 13 , In 14 Therefore, beyond these components, the component M640 is inserted, which delays the earlier input by the phase offset. Preferably, this delay element is accommodated in the comparator to use it only in the comparison mode.

alternative or in addition you can put intermediate buffers M650, M651 in the input chain to such asynchronicities, which do not represent pure clock or phase offset, as well to be able to tolerate. These intermediate buffers are preferably used as FIFO memories (first-in, first out). Such a memory has an input and an output and can store several memory words. An incoming one Memory word is received when a new memory word arrives in its memory Postponed. After the last place (the depth of the buffer) it will "out moved out of the store ". If such a buffer exists, you can also asynchronisms until tolerate to the maximum depth of the buffer. In this case, must an error signal will be output even if the buffer overflows.

Further one can compare in the embodiments differ according to how the signal M520 (or M620) is generated becomes. A preferred embodiment is it, the input signals M510, M511 (or M610, M611) to the output to set and make the connection by switch interruptible. The particular advantage of this embodiment is that for Switch between performance mode and possible different comparison modes the same switches can be used. Alternatively, the Signals are also generated from internal comparisons become.

A final class of embodiments may be distinguished as to how many inputs are present on the comparator and how the comparator should react. With three inputs, a majority voting, a comparison of all three or a comparison of only two signals can be made. With four or more inputs, correspondingly more embodiments are conceivable. A detailed description of the possible embodiments is given in the description of FIG 20 contain.

The exact choice of the embodiments is preferably with the different operating modes of the overall system to pair. That is, if there are several different performance or Comparison modes are, then these are preferably with the appropriate Coupled mode of the comparator.

At some places in this invention it is necessary or advantageous a comparator or a more general voting / processing / sorting element to deactivate or make passive (hereafter the simplicity half always referred to as a comparator). There are many possibilities. For one thing, one can lead a signal to the comparator, with it is activated or deactivated. This is in the comparator one additional To insert logic who do this can. One more way is to provide the comparator with no comparative data. A third possibility is to ignore at system level the error signal of the comparator. Next you can also interrupt the error signal itself. all options is common that it does not matter in the system that two or more Data that is potentially compared are different. If If this is the case, the comparator is considered passive or disabled considered.

in the Further, an implementation of a switch is connected with a comparator, so a switching and comparison unit G70 considered. This implementation is particularly favorable if these together with the execution units G10a, G10b are executed within a chip.

By Summary of components comparator and switch arises only a very small hardware overhead when implemented within a chip. A preferred variant of the implementation is it therefore, to combine these two parts into one component. This is a component with at least the input signals (Output execution unit 1, output execution unit 2), at least the output signals (Output 1, Output 2), one logical output signal "Output total "(can physically match Output 1 or Output 2) and a comparator. The component has the ability to toggle the mode in the performance mode, let all signals pass, and in a comparison mode Compare several signals and pass one if necessary. In addition are still further input and output signals advantageous: An error signal for signaling a detected error, a mode signal about the Signal mode in which this component is located, and Control signals to and from the component.

In a preferred embodiment, the two or more execution units in the performance mode are connected as a master to a processor-internal bus. The comparison unit is deactivated or the error signal which is generated in the case of a different behavior of the execution units in one of the possible comparison modes is masked. This means that the switching and comparison unit is transparent to the software. In the comparison mode under consideration, the physical execution units to be compared are treated as a logical execution unit on the bus, ie only one master occurs on the bus. The Error signal of the comparator is activated. The switching and comparison unit separates all but one execution unit via switches from the processor-internal bus, duplicates the inputs of the one logical execution unit and makes them available to all execution units involved in the comparison mode. When writing to the bus, the outputs in the compare unit are compared, and if equal, this data is written over the one available access to the bus.

In 15 and 16 is the basic behavior of the preferred component M700 (switching and comparison unit, corresponds to G70) described. For the sake of simplicity, this figure is drawn only for two execution units. 15 shows the status of the component in comparison mode, 16 in performance mode. The various switch positions in these modes are implemented by M700 through the M760 control. The two execution units M730, M731 can first write in the performance mode on the data and address bus M710 when the switches M750 and M751 are closed, as in 16 shown. It is assumed that possible write conflicts will be resolved either via the bus protocol or through other, not drawn components. In comparison mode, the behavior is different, at least from a logical point of view. As in 15 shown, then the switches M750, M751 are opened and thus the direct access possibilities are interrupted. In contrast to 16 are in 15 then, however, the switches M752, M753 closed. The signals M740, M741 of the execution units M730, M731 are passed to the comparison component M720. This is at least as structured as in 13 drawn, but it can also be extensions, as in 14 described, include. In a representation of the error signal or other signals of the comparison component M720 is in 15 , and 16 but waived. If the two signals match, the switch M754 is closed, and then one of the two matching signals is forwarded to the address / data bus M710. In total, it is necessary that the M700 switching and comparison unit can influence the M750-M754 switches. The respective switch position depends on the mode and the error detection. Variants in which the switch M754 is always closed, and a suitable system response is generated by the error signal, are also covered hereby.

In 17 a variant of the switching and comparison unit is shown. Even for a simple system with only two execution units G10a, G10b, there are many variants of the implementation of a switching and comparison unit. Another, which is particularly advantageous when no buffers are to be used in the comparator is in 17 shown. As in 15 . 16 are the M840, M841 signals of the execution units. The latter are not drawn in this figure. In the component M800 according to the invention, there is a mode logic M810 which specifies the mode of the component. In the performance mode it closes the switch M831, in comparison mode it opens it. Next it gives the mode signal to the comparator M820. This always compares in this implementation, but uses the result of the comparison and the mode signal to drive switch M830. In the performance mode the switch is always closed, in comparison mode always when there is no error. Of course, even if an error has been detected, the switch will remain open until a corresponding reset occurs.

In 18 a further embodiment of the switching and comparison unit is shown. This alternative, although it has more switches, but leaves the comparator in the performance mode inactive and therefore easier to deal with asynchronisms. Again there are the two signals M940, M941 of the execution units. The latter are not drawn again in this picture. In the component M900 according to the invention, there is a mode logic M910 which specifies the mode of the component. In performance mode, it closes switch M931 and opens switches M932, M933. Thus, the comparison component M920 is not loaded with data in this mode. This allows longer buffer times for asynchronisms, or lower buffer depths in one implementation. In performance mode, the M930 switch is always closed. In compare mode, component M910 closes switches M932, M933 and interrupts direct access to the bus by opening switch M931. Optionally, the M910 mode logic can still communicate the mode to the M920 comparator. In the comparison mode, the switch M930 is closed in error-free case. In the event of an error, the comparison component M920 interrupts the forwarding of the signal M940 to the bus by opening the switch M930.

In the drawings described it is possible without any effort, the Mode or error signals to the outside. It is further, especially for generating the internal mode state, easily possible, that further signals go to the component.

In summary, a preferred implementation of this component is thus characterized in that there are several processing units that can write output signals to the bus (eg address / data bus). It is essential that the component process at least two of the output signals of the execution units can (eg compare, but possibly also vote or sort) and that the component can influence at least one switch with which at least one of the direct bus accesses is interrupted. This is especially useful if the execution units are machine cores. Furthermore, it is advantageous if the state of the influenceable switch characterizes the operating mode of the arithmetic unit.

The System properties, in particular the possible comparison modes are then implemented particularly well when the component sends a signal to the Can set address data bus. Advantageously, this is a through connection one of the output signals of one of the execution units. Alternatively, you can this from the processing of different output signals of the different ones execution units arise.

As for example in the descriptions of the figures 17 . 18 became clear, one can identify in the system and - depending on the division into the components - also in one of the components a mode information. Depending on the implementation, this mode information may even be available explicitly in a subcomponent. In a preferred implementation, this signal may also be routed out of the component and made available to other parts of the system.

In the general case you can the behavior of the invention 21 explain. The signals and components N100, N110, N120, N130, N140, N141, N142, N143, N14n, N160, N161, N162, N163, N16n have the same meaning as in FIG 20 , In addition, the mode signal N150 and the error signal N170 are drawn in this figure. The optional error signal is generated by fault circuit logic N130, which collects the error signals, and is either a direct forwarding of the single error signals or a bundling of the error information contained therein. The mode signal N150 is optional, but its use outside of this component can be beneficial in many places. The combination of the information of the switching logic N110 (ie the in the description of 20 described function) and the processing logic (ie, the determination of the comparison operation per output signal, ie per function value) is the mode information and this sets the mode. Of course, in the general case this information is multivalued, ie not representable only via a logical bit. Not all the theoretically conceivable modes are useful in a given implementation, it is preferable to restrict the number of modes allowed. The mode signal then brings the relevant mode information to the outside. An HW implementation is preferably shown so that the externally visible mode signal can be configured. Preferably, the processing logic and circuitry are also configured to be configurable. Preferably, these configurations are coordinated. Alternatively, one can give only or additionally changes of the mode signal to the outside. This has advantages especially in a two-configuration.

Preferably, this mode signal is protected. An implementation in the two-system will be based, for example, on the implementation in 17 is shown in 19 shown. There, the signal M850 is led out of the switching and comparison unit. In a two-way system, this information can be represented logically over one bit. A hedge can then preferably be displayed via a dual-rail signal. In the general case, the signal can also be protected by a doubling, which is optionally inverted. Alternatively, one can also generate a parity, which is preferably internally generated intrinsically safe, or use a CRC (cyclic redundancy check) or ECC (error correcting code).

The Mode signal can be outside the component can be used. First, it can be self-monitoring of the operating system. This is from a SW point of view for one Responsible for switching and should always know in which mode the system is in place and bring the system into this mode as well. A review of this Signal can thus be used for protection. This can be done directly first happen. An alternative possibility but it is also over Timer or other "independent" units request to make the operating system plausible with this signal.

In general, this signal can optionally also be used in other data sinks of a μC (or more general arithmetic unit). For example, a memory protection unit (MPU) may be programmed to allow certain memory accesses (of particular execution units) only in certain modes. An MPU is a unit that can ensure that only permitted accesses are made to the data / address bus, for example by blocking access to certain address spaces for certain program sections. By feeding the mode signal to the MPU, corresponding configuration and programming of this MPU, and evaluating this configuration data and the mode signal, additional protection can be provided. This may even simplify programming if the mode signal is already sufficient information to check. Then a quasi-static programming is sufficient for the initialization time of the μC. The same can apply to peripheral units. Again, there are applications where access to a corresponding peripheral element is allowed only in certain modes. By an introduction of the mode signal to the peripheral element, corresponding configuration and programming of the peripheral element, and evaluation of this configuration data and the mode signal, an additional protection can take place. This may even simplify programming if the mode signal is already sufficient information to check. Then a quasi-static programming is sufficient for the initialization time of the μC. Analogously, the evaluation of this signal can also be used on the interrupt controller. Such monitoring can then form the basis or an integral part of the security concept. Through suitable design and software structuring, it may be possible to construct the security concept for an entire error class in the application under consideration on this mode signal. This is particularly advantageous when the mode signal is intrinsically safe in a suitable form as described above. It is then further advantageous in this case if the considered component has the possibility to send an error signal or to actuate a shutdown path if it detects a discrepancy between the mode signal and the access to itself.

One Another essential use is the evaluation of the mode signal outside the arithmetic unit. A direct application is the evaluation in a decrementing watchdog. Such a "watchdog" consists of at least one (counter) register, which is set to an integer value by the microprocessor can be. After setting this register, the "Watch-Dog" independently decrements the Value of the register with a fixed period. Is the value of the register Zero or overflow on, the "watch-dog" generates an error signal. If the error signal is not generated, the microprocessor must Reset the value of the register in good time. This can (within limits) be checked whether the microprocessor executes the software correctly. Does the microprocessor perform the Software no longer correct, it is believed that in this Case also the "Watch-Dog" no longer correct is operated and thus an error signal is generated by the "Watch-Dog." The integrity of the hardware and the data structures can be reliably verified in a comparison mode, but it must be ensured that the microprocessor regularly switches back to these. The task of the "watchdog" described here is therefore not just an error signal if he does not within a defined period of time more is reset but also if the microprocessor within a define Period does not return to the defined comparison mode. For example, the "Watch-Dog" can only be reset, if the mode signal is the defined comparison mode of the arithmetic unit displays. This ensures that the arithmetic unit regularly in this Mode returns. Alternative or supplementary the value in the register of the "Watch-Dog" is decremented only then, when certain interrupts are triggered at the microprocessor. To do this the external interrupt signals of the μC are also coupled to the watchdog become. The watchdog stores which interrupts the μC in the Define comparison mode. The watchdog is "raised" as soon as one Interrupt comes, it is reset by the presence of the correct mode signal.

All in general, it is useful especially in the application to a security concept, the mode signal in a μC-external To evaluate the source. A key point in securing the correct Run the software on a machine, as in the invention is the correct change between the different allowed modes. First should the changeability even be checked preferably also the correct change. As described above, You may also be interested in having a special mode regularly accepted becomes. Such a method is always particularly advantageous when the mode signal itself is intrinsically safe.

One possibility is to pass the mode signal to an ASIC or another μC. This can at least check the following points via timers and simple logic using this signal:
Does the arithmetic unit sufficiently often (eg at the latest every 1000μs) in one or more defined modes?

Becomes when switching to a mode always a certain signal output?

going the arithmetic unit regularly off out of a mode?

are certain simple patterns of sequence of modes valid?

is a general temporal pattern is valid (for example, on average <70% in mode 1 and <50% in mode 2)

any Combination of logical, temporal characteristics of the mode signal, if necessary supplemented by utilization of additional Signals.

In 22 In this case, the basic configuration for an additional proposal is described. In between such a partner ASIC or μC and the arithmetic unit under consideration, which has this invention, a special question and answer game is performed. N300 is a computational unit that can send such a mode signal. This may be, for example, a μC with multiple execution units and another component that can generate this mode signal. For example, this other component may be as in 19 or 21 be realized. N300 gives this signal N310 to the partner (eg other processor, other μC or ASIC) N330. This can ask about the N320 signal to N300 questions which N300 has to answer via N321. Such a question may be a computational task whose correct result is to be delivered via N321 from N300 within a defined time interval. N330 can check the correctness of this result independently of N300. For example, the results are stored in N330 or N330 can calculate them yourself. If an incorrect value is detected, an error is detected. The special feature of the proposed question-answer communication is that a parallel to the response, the mode signal is observed. Preferably, the questions are to be asked so that to answer by N300, they must adopt certain modes. This can be reliably verified that all mode changes are functional, and that provided in the program flow mode changes are also performed. Especially when initializing a system, but also during operation, this can serve as an essential component of a security concept.

A further application of this idea is the evaluation of the mode signal in an actuator control. In many applications in the automotive sector is today a trend towards so-called intelligent actuators. these are Actuators with a minimum amount of electronics that is sufficient Actuator command to receive, and then to control the actuator, that this command is then executed.

The basic idea is in 23 shown. An arithmetic unit N400, which has the invention, sends an actuating command via the connection N420 to an (intelligent) actuator or an actuator control N430. In parallel, it sends the mode signal to this actuator via the N410 connection. Actuator N430 uses the mode signal to check whether control is permitted and optionally returns an error status via signal N440. If the drive is faulty, it assumes the non-critical fail-silence state in the system.

Claims (18)

Device for switching over in a computer system having at least two execution units, wherein switching means are provided which are adapted to switch between at least two operating modes, wherein a first operating mode corresponds to a comparison mode and a second operating mode corresponds to a performance mode, characterized in that each execution unit is programmable Interrupt controller is assigned and that a memory element is included in the information that describes at least parts of a configuration of at least one of these interrupt controller are stored. Device according to claim 1, characterized in that there are means for transmitting information from the memory element to at least one of the interrupt controller enable Device according to claim 2, characterized in that that the funds are designed in hardware. Device according to one of the preceding claims, characterized characterized in that the device is designed such that when switching between a performance mode and a comparison mode a new configuration of at least one interrupt controller thereby is realized that information from the memory element to at least transferred to an interrupt controller becomes. Device according to one of the preceding claims, characterized characterized in that the entire configuration information at least an interrupt controller is included in the memory element. Device according to one of the preceding claims, characterized characterized in that the information for the configuration at least an interrupt controller is used. Device according to one of the preceding claims, characterized in that the memory element is formed as a register set is. Device according to one of the preceding claims, characterized characterized in that the memory element as an interrupt masking register is trained. Device according to one of the preceding claims, characterized characterized in that in a comparison mode interrupts simultaneously to be triggered. Device according to one of the preceding claims, characterized in that the device is designed such that when switching from a performance mode in a comparison mode, the same information from the memory element to at least two interrupt controllers is transmitted. Method for switching over in a computer system with at least two execution units, wherein switching means are provided, which are designed such that these switch between at least two modes of operation, wherein a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode, characterized in that each execution unit a programmable interrupt controller is assigned and that a memory element is included in which information which at least parts of a configuration of at least one of these interrupt controllers describes, are stored. Method according to claim 11, characterized in that that information from the memory element to at least one of Transfer interrupt controller becomes. Method according to one of claims 11 to 12, characterized that information about a Hardware medium from the storage element to at least one of Interruptcontroller is transmitted. Method according to one of claims 11 to 13, characterized that when switching between a performance mode and a comparison mode a new configuration of at least one interrupt controller thereby is realized that information from the memory element to at least transferred to an interrupt controller becomes. Method according to one of claims 11 to 14, characterized that the entire configuration information of at least one interrupt controller transmitted from the storage element becomes. Method according to one of claims 11 to 15, characterized that the information for the configuration of at least one interrupt controller is used. Method according to one of claims 11 to 16, characterized that in a comparison mode, interrupts are triggered simultaneously. Method according to one of claims 11 to 17, characterized that when switching from a performance mode in a comparison mode transmit the same information from the memory element to at least two interrupt controllers becomes.