DE102005037239A1 - Processing unit`s e.g. CPU, performance and comparison modes switching method for computer system, involves adding synchronization signal to interruption input of one processing unit during asynchronism of unit in comparison mode - Google Patents

Abstract

The method involves comparing information in a comparison mode of processing units (B10, B11). A synchronization signal (B40) is added to an interruption input of one of the processing units during asynchronism of the processing unit in the comparison mode. The synchronization signal concern about a delay signal e.g. wait-signal, and has higher priority when compared to interruption signals. An independent claim is also included for a device for mode switching in a computer system with two processing units.

Description

State of technology

One A method for detecting errors in a comparison mode is described in Wo 01/46806 A1. The data is stored in a processing unit processed and compared in parallel with two processing units ALUs. In case of an error (soft error, transient error) both work there ALUs as long as independent from each other until the faulty data is removed and a renewed (partially repeated) redundant processing can be performed. The requires that both ALUs work in sync with each other and the Results can be compared exactly to the clock.

in the The prior art discloses methods such as between a comparison mode for error detection, in which tasks are processed redundantly, and a performance mode for better performance can be switched. Prerequisite here is that the processing units for the Comparison mode are synchronized each other. For this it is necessary that both processing units can be stopped and clock-synchronously work to the result data when writing to be able to compare with each other in the memory. These are interventions in the hardware necessary, individual solutions are suggested.

In the patent EP 0969373 A2 On the other hand, a comparison of the results of redundantly operating processing units or processing units is ensured, even if they work asynchronously with one another, ie not with the same clock or with an unknown clock offset.

Out In the aviation industry, voting systems are known that use inputs from Can use standard computers and handle them safely by a majority vote and so that safety-relevant actions can be triggered. A system, the inter-processing unit and inter-control unit communication is combined with each other the FME system, where by a high degree of redundancy too in case of single or even multiple errors the system still able to work stays and from the DASA for Space has been developed (Urban, et al: A survivable avioncs system for space applications, Int. Symposium on Fault-tolerant Computing, FTCS-28 (1998), pp.372-381). This system can even Byzantine errors (that is, particularly malicious errors that do not all components get the same information, but from an intriguer even "deliberately" different incorrect information is distributed to different components) tolerate. Such a system is commercial because of the high cost applicable for particularly critical systems, in very small numbers be made. A cost effective solution that in big numbers is manufacturable and in addition still switching options owns, is not known.

It There is therefore the task of a switching and comparison unit to create, which allows the operating mode of two or more processing units switch without interfering with the structure of these processing units gets along and no additional signals needed for this purpose. It should be possible be different digital or analog signals from different Compare processing units in a comparison mode each other. there This comparison should possibly also possible be if the processing units with different clock signals operate and do not work in sync with each other. It exists beyond that the task of providing means and procedures that synchronize even without hardware intervention.

advantages

advantageously, One uses a method for switching in a computer system with at least two processing units, a switching means and a comparison means, wherein between at least two operating modes is switched and a first mode of operation a comparison mode and a second mode of operation corresponds to a performance mode, wherein information is compared in the comparison mode, characterized that at asynchrony the at least two processing units in the comparison mode Synchronization signal to an interrupt input at least one of the processing units is placed.

advantageously, one uses a method which involves the synchronization signal to a delay signal, in particular a wait signal.

advantageously, one uses a method in which by the synchronization signal at least a processing unit is caused, no more information to process.

advantageously, One uses a method in which the at least one processing unit for one predetermined time is caused to process any more information.

advantageously, One uses a method in which the synchronization signal across from at least one interrupt signal has a higher priority.

advantageously, One uses a method in which the synchronization signal across from all interrupt signals have the highest priority.

advantageously, one uses a method in which by the synchronization signal at least a processing unit is caused to execute an interrupt routine work off.

advantageously, one uses a method in which at least one buffer memory is contained and at least one of the comparative in the comparative mode information for a time dependent on the synchronization signal in the buffer memory is cached.

advantageously, one uses a method in which out of time for at least one of the information is cached, an asynchrony information, in particular a time error, can be determined.

advantageously, one uses a method in which the buffer memory Level of the Memory can be determined, indicating the number of information are in the buffer memory.

advantageously, One uses a method in which the time error thereby determined is that a time recording means, in particular a counting element, is provided, wherein a time value is determined and this with a predetermined maximum time value is compared.

advantageously, One uses a method in which an asynchrony information is determined by the fact that the determined level with a predetermined maximum level is compared.

advantageously, One uses a method in which a default that a next starting date is to be compared, done by a comparison signal.

advantageously, One uses a method whereby a date is compared is to be assigned an identifier by which the comparison triggered Advantageously, a device for switching is used in a computer system having at least two processing units, wherein the device comprises a switching means and a comparison means contains and is switched between at least two modes of operation and a first operating mode a comparison mode and a second operating mode corresponds to a performance mode, in comparison mode information be compared, characterized in that the device is configured such that in asynchrony of the at least two processing units in comparison mode, a synchronization signal to an interrupt input at least one of the processing units is placed.

advantageously, one uses a device in which the comparison means and the switching means structurally external to the processing units Advantageously, a device is used which in which at least one buffer memory is provided.

advantageously, one uses a device which is the buffer memory is a FIFO memory.

advantageously, one uses a device in which each processing unit a buffer memory is assigned.

advantageously, one uses a device in which each processing unit a buffer memory, in particular a FIFO memory is assigned.

advantageously, one uses a device in which means, in particular a counting element, are provided, which are designed such that these out the predeterminable and / or determinable time for the at least one of the information an asynchronous information is temporarily stored, in particular a time error, determine.

advantageously, using a device where means are provided which are designed such that these in the buffer memory a level of the memory that indicates what amount of information are in the buffer memory.

advantageously, one uses a device in which the means are designed in this way are that these determine asynchrony information by that the determined level is compared with a predetermined maximum level.

advantageously, using a device in which synchronization means are provided, which are designed such that this depends on the asynchronous information generate synchronization information.

Advantageously, one uses a Vor direction, in which a monitoring means is provided, which is designed such that it processes the asynchronous information.

advantageously, one uses a device in which the monitoring means to a monitoring system external to the computer system, especially a watchdog, acts.

Further Advantages and advantageous embodiments will be apparent from the features the claims as well as the description.

characters

1 shows the basic function of a switching and comparison unit for two processing units

1a shows a generalized representation of a comparator

1c shows an expanded representation of a comparator

1b shows a generalized representation of a switching and comparison unit

2 shows a more detailed representation of the switching and comparison unit for two processing units

3 shows a possible realization of a switching and comparison unit for two processing units

4 shows a more detailed Dartstellung a switching and comparison unit for more than two processing units

5 shows a possible implementation of a switching and comparison unit for more than two processing units

6 shows a possible realization of a control register

7 shows a voting unit for central voting

8th shows a voting unit for decentralized voting

9 shows a synchronization element

10 shows a handshake interface

11 shows a differential amplifier

12 shows a comparator for positive voltage difference

13 shows a comparator for negative voltage difference

14 shows a circuit for storing an error

15 shows an analog-to-digital converter with output register

16 shows the representation of a digital converted analog value with kung and analog bit

17 shows the representation of a digital value as a digital word with digital bit

description the embodiments

A execution unit or processing unit can hereinafter include both a processor / core / CPU, as well as an FPU (Floating Point Unit), DSP (Digital Signal Processor), Coprocessor or ALU (arithmetic logical unit).

It Consider a system of two or more processing units. in principle In safety-relevant systems there is the possibility of such resources either to increase the efficiency to use in which one the different processing units preferably provided with different tasks. Alternatively you can do some The resources also use redundant to each other by using them supplied with the same task and uneven result detects an error.

ever There are several, according to how many processing units there are Modes conceivable. In a two-way system, the two modes "comparison" and "performance" exist as described above. In a threefold system, in addition to the pure performance mode, in which all three processing units work in parallel, and the pure comparison mode, in which all three processing units redundant and is compared, also a 2aus3 voting mode in which all three processing units calculate redundantly and a majority vote is made. Next you can also realize a mixed mode, at the e.g. two of the processing units redundant to each other calculate and compare the results while the third processing unit another, parallel task edited. In a four or more processing units System obviously more combinations are conceivable.

The to be solved Task is that the available processing units can be used variably in a system during operation, without an interference with the existing structure of these processing units (for synchronization purposes, for example). In a special design Each processing unit should be able to operate with its own clock, i. the execution of identical tasks for the purpose of comparison also can work asynchronously to each other.

These Task is solved by that a universal, widely deployable IP is created that switching modes of operation (e.g., comparison, performance, or voting mode) at any time without prior shutdown allows the processing units and the comparison or voting of each other possibly asynchronous streams manages. This IP can be run as a chip, or it can work together with integrated one or more processing units on a chip become. Further, it is not a requirement that this chip only from a piece of silicon exists, it is also possible that this is realized from separate components.

Around the synchronicity between different processing units to ensure Signals are necessary, which is a continuous further program execution prevent individual processing units. This is usually a WAIT signal provided.

If an execution unit does not have a wait signal, it can also be synchronized via an interrupt. The synchronization signal (eg M140 in 2 ) was not routed to a wait input, but placed on an interrupt. This interrupt must have a sufficiently high priority over the processing program and also against other interrupts to interrupt normal operation. The associated interrupt routine only executes a certain number of NOPs (empty commands with no effect on data) before jumping back into the interrupted program, thereby delaying further processing of the processing program. If necessary, the usual memory operations at the beginning and at the end must be carried out in the interrupt routine in order not to impair the normal program execution by the interrupt.

This Operation will continue until synchronicity is established (For example, other processing units provide the expected Comparative data). Exact clock synchronization and in particular phase equality However, with other processing units, this process can be used only conditionally guaranteed. It is therefore recommended that when using the interrupt signal for synchronization the data to be compared is stored in the UVE before they are compared.

Of the Advantage of the invention is that any commercially available standard structures can be used because no extra Signals needed (no interference with the hardware structure) and any output signals monitors these components can be for example, used directly to control actuators. That concludes the review of Transducer structures such as DACs and PWMs with a, the so far after the State of the art can not be tested directly by a comparison.

Provided the review for individual Tasks or SW tasks not needed is, but is also a switch to a performance mode possible, in different tasks to different processing units be distributed.

One Another advantage is that in a comparison or voting mode not all data needs to be compared. Only those to be compared or Data to be selected is in the switching and comparison unit synchronized with each other. The selection of this data is through the Targeted response of the switching and comparison unit variable (programmable) and can be adapted to the respective processing unit architecture as well adapted to the application. This is also the use of diversified μC or software parts easily possible, because only results that can reasonably be compared actually do be compared.

Further For example, any access to a (e.g., external) memory can be monitored or only the control of external I / O modules. internal Signals can over the software-controlled additional Output to the switching module on the external data and / or address bus checked become.

All control signals for the comparison operations are generated in the preferably programmable switching and voting unit and the comparison also takes place there. The processing units (eg, processors) whose outputs are to be compared with each other may use the same program, a duplicate program (which additionally allows recognition of memory access errors), or a diversified program for detecting software errors. It is not necessary to compare all the signals provided by the processing units with each other, but it is also possible to provide certain signals for comparison by means of an identifier (address or control signals) or not. This identifier is evaluated in the switching and comparison device and thus controlled the comparison.

separate Monitor timer Deviations in the time behavior over a definable limit. Some or all modules of the switching and comparison unit can be integrated on a chip, on a common board or also spatially separated be housed. In the latter case, the data and control signals are transmitted via appropriate Bus systems exchanged with each other. Register locally will then be over Bus system described and control the operations by means of the stored therein Data and / or addresses / control signals.

In 1 1 shows the basic function of the switching unit B01 according to the invention for use in connection with two processing units B10 and B11. Various output signals such as data, control and address signals B20 and B21 of the processing units B10 and B11 are connected to the switching unit B01. In addition, there is at least one synchronization signal, in an embodiment of the arrangement according to the invention, the two output signals B40 and B41, which are connected to one of the comparison units.

The Switching unit contains at least one control register B15, the at least one memory element for a binary Has character (bit) B16, which switches the mode of the comparison unit. B16 can take at least the two values 0 and 1 and can both by the signals B20 or B21 of the processing units or by internal processes of the changeover unit are set or reset become.

is B16 set to the first value, the switching unit operates in comparison mode. In this mode, all incoming data signals will turn off B20 compared with the data signals from B21, provided that certain specifiable Comparison conditions of the control and / or address signals from the Signals B20 and B21 met are the validity signal the data and the intended comparison for that data.

are these comparison conditions on both signals B20 and B21 simultaneously Fulfills, so the data from these signals are compared directly and if inequality an error signal B17 is set. Is only the Comparison condition from either the signals B20 or B21 met, so the corresponding synchronization signal B40 or B41 is set. This signal causes in the corresponding processing unit B10 or B11 stop the processing, and thus a prevention the forwarding of the corresponding signals, not previously could be compared with each other. The signal B40 or B41 remains until the corresponding comparison condition of the each other processing unit B21 or B20 is met. In this case, the comparison is performed and the corresponding synchronization signal reset.

Around the comparison in the described non-simultaneous provision the data to be compared by the two processing units To ensure it is either necessary that the data and comparison conditions the corresponding processing unit as long as the corresponding Values are held until the corresponding synchronization signal B40 or B41 reset was or will have to the first provided data in the switching unit until comparison get saved.

ever after which processing unit provides data first, this must be done with the further processing of their program or their Processes wait until the other processing unit has the appropriate Provides comparative data.

In a special version of the switching unit after 1 can be dispensed with one of the signals B40 or B41, if it is always ensured that the associated processing unit does not provide comparative data rather than the other processing unit.

is B16 set to the second value, so are the synchronization signals B20 and B21 and the error signal B17 always inactive, for example set to the value 0. There is no comparison and both processing units work independently.

An essential component in the system according to the invention is the comparator. In the simplest form he is in 1a shown. The comparison component M500 can receive two input signals M510 and M511. It then compares these to equality, in the context presented here, preferably in the sense of a bit-wise equality. If it detects inequality, the error signal M530 is activated and the signal M520 is deactivated. In the same case, the value of the input signals M510, M511 is given to the output signal M520 and the error signal M530 does not become active, ie it signals the "good" state In this case, the error signal M530 is routed to at least two lines ("dual rail") to the outside, and it is ensured by internal design and fault detection measures that in any possible error case Comparison component of this signal is correct or recognizable incorrect. A preferred embodiment in the use of the system according to the invention is to use such a TSC comparator.

A second class of embodiments may be distinguished as to what degree of synchronicity the two inputs M510, M511 (or M610, M611) must have. One possible variant is characterized by intermittent synchronicity, ie the comparison of the data can be carried out in one cycle. A slight change arises from the fact that a synchronous delay element is used with a fixed phase offset between the inputs, which delays the corresponding signals, for example, by integer or half clock periods. Such a phase offset is useful to avoid common cause errors, ie, those that can simultaneously affect multiple processing units. In 1c Therefore, component M640 is added beyond the components of frame M5, delaying the previous input by the phase offset. Preferably, this delay element is accommodated in the comparator to use this element only in the comparison mode. Alternatively or additionally, in order to be able to tolerate asynchronisms as well, intermediate buffers can be placed in the input chain. Preferably, these are designed as FIFO memory. If such a buffer exists, one can also tolerate asynchronisms up to the maximum depth of the buffer. In this case, an error signal must be output even if the buffer overflows.

Further one can compare in the embodiments differ according to how the signal M520 (or M620) is generated becomes. A preferred embodiment is it, the input signals M510, M511 (or M610, M611) to the output to set and make the connection by switch interruptible. The particular advantage of this variant is that for switching between performance mode and possible different comparison modes the same switches are used can. Alternatively you can the signals are also generated from internal buffers become.

A last class of embodiments can be distinguished by how many inputs on the comparator and how the comparator should react. With three inputs can a majority vote, a comparison of all three or a comparison of only two signals be made. With four or more inputs are appropriate more variants conceivable. These variants are preferably with the couple different operating modes of the overall system.

To set out the general case is in 1b a generalized representation of a switching and comparing unit, as they should preferably be used. Of the n execution units to be considered, n signals N140,..., N14n go to the switching and comparison component N100. This can generate up to n output signals N160, ..., N16n from these input signals. In the simplest case, the "pure performance mode", all signals N14i are directed to the corresponding output signals N16i In the opposite limit case, the "pure comparison mode", all signals N140, ..., N14n are directed to only one of the output signals N16i.

At this figure leaves Explain how the various conceivable modes can arise. To is the logical component of a switching logic N110 in this figure contain. The component does not have to exist as such, crucial is that their function exists. She first determines how many output signals are there at all gives. Furthermore, the switching logic N110 determines which of the input signals to which of the output signals contribute. This can be an input signal contribute to exactly one output signal. In mathematical form In other words, a function is defined by the switching logic, each element of the set {N140, ..., N14n} is an element of the set {N160, ..., N16n} assigns.

The Function of the processing logic N120 then applies to each of the outputs N16i firmly, in what form the inputs contribute to this output signal. Also this component does not have to be present as a separate component. Decisive is again that the described functions are realized in the system. To exemplify the different variations to describe, is without limitation the generality assumed that the output N160 by the signals N141, ..., N14m is generated. If m = 1 this simply corresponds to a through connection of the signal, if m = 2 then the signals N141, N142 are compared. This comparison can be done synchronously or asynchronously, it can be bitwise or only on significant bits or even with one Tolerance band performed become.

If m> = 3 there are several Options.

A first option is to compare all the signals and if present at least two different values to detect an error, which one can signal optional.

A second possibility is to make a k out of m selection (k> m / 2). This can be realized by using comparators. Optionally, an error signal gene if one of the signals is detected as deviating. A possibly different error signal can be generated if all three signals are different.

A third possibility is to apply these values to an algorithm. This For example, the formation of an average, a median, or the use of a Fault Tolerant Algorithm (FTA). Such an FTA is based on omitting extreme values of the input values delete and make a kind of averaging over the remaining values. This averaging can over the total amount of the remaining values, or preferably over one be made in HW easily formed subset. In this case It is not always necessary to actually compare the values. at the averaging, for example, only has to be added and divided FTM, FTA or median require partial sorting. If necessary, can also be here at sufficiently large extreme values optionally an error signal can be output These different mentioned options processing of multiple signals into one signal will be for brevity referred to as comparison operations.

The The task of the processing logic is therefore to determine the exact shape of the Comparison operation for every output signal - and with it also for the associated Input signals - specify. The combination of information of the switching logic N110 (i.e., the above function) and the processing logic (i.e., the determination of the comparison operation per output, i. per function value) is the mode information and this sets the mode. This information is in general Case of course polyvalent, i. not just about a logical bit can be displayed. Not all theoretically conceivable Modes are useful in a given implementation, you will preferably restrict the number of allowed modes. To emphasize is that in the case of only two execution units, where there is only one comparison mode, all the information is on only one logical bit can be condensed.

A Switching from a performance to a comparison mode is in General case characterized in that execution units, the be displayed on different outputs in the performance mode, be displayed in the comparison mode on the same output out. Preferably, this is realized by being a subsystem of execution units where, in the performance mode, all input signals N14i, the in the subsystem are switched directly to corresponding output signals N16i be while they are all mapped to one output in comparison mode. Alternatively, such switching can also be realized thereby be changed that pairings become. It is represented by that in the general case can not speak of the performance mode and the comparison mode, although in a given aspect of the invention, the amount restrict the allowed modes so can that be the case. But you can always switch from one to another from the performance to the compare mode (and vice versa).

Between these modes can, over Software controlled, dynamically switched during operation. Is triggered the switch thereby, for example, the execution of special switching instructions, special instruction sequences, explicitly marked instructions or by accessing certain addresses through at least one of the execution units of the multiprocessor system.

In 2 a detailed two-processor or two μC system with a switching and comparison unit M100 according to the invention is shown, in which optionally also various of the drawn signals can be dispensed with. It consists of two processing units (M110, M111) and a switchover and comparison unit M100. From each processing unit, data signals (M120, M121) and address / control signals (M130, M131) go to the switching unit, and each processing unit optionally also receives data from the switching unit (M150, M151) and control signals (M140, M141). The unit M100 outputs data (M160, M161) and status information M169 and receives signals such as data (M170, M171) and control signals M179, which can also be forwarded to the processing units. Via M170, M171 and M179, the operating mode of the unit M100 can optionally also be set independently of the processing units; Similarly, the processors can set the operating mode via the outputs M120, M121 (eg data bus) and the control and address signals M130, M131 (eg Write) in the unit M100 - eg performance mode (without comparison) or comparison mode (with comparison of the signals M120, M121 and / or the signals M170, M171, coming from eg peripheral units). In the performance mode, the outputs M120, M121 are forwarded to the outputs M160, M161, if necessary in conjunction with control signals, and conversely the inputs M170, M171 to M150, M151. In comparison mode, the outputs are compared and advantageously forwarded to M160, M161 only in the error-free case, where either both outputs are used, or only one of them. Similarly, a check of input data M170, M171 is possible, which are forwarded to the processing units. In the case of a faulty comparison of the signals in comparison mode, an error signal is generated and eg using double-rail signals: fail-safe - signaled to the outside (component of status information M169). Status M169 may also include the operating mode or information about the skew of the execution unit signals. In the case of non-provision of comparison data of a processing unit in a predetermined (programmable) time interval, the error signal is also activated. In case of an error, the outputs M160, M161 can be disabled (fail silent behavior). This can affect both digital and analog signals. However, these output driver stages can also output the instantaneous (non-buffered) output signals M120, M121 of a processing unit, with the possibility of subsequent error detection. This is tolerated by a safety-related system as long as the fault tolerance time is not exceeded, ie the time that a (sluggish) system is not yet catastrophically responding to errors and therefore still has the possibility of correction.

Also Output signals M180, M181, which are not led to the UVE and internal signals of a processing unit, at least in terms of Their calculated value can be compared by taking this value on the outputs M120, M121 for purposes of comparison. Corresponding can also with input signals M190, M191, which do not come via M100.

Around to monitor the unit M100 can it for selected or all signals M160, M161 may be possible, they are via M170, M171 or M190, M191 back to read. This can also ensure in comparison mode, that erroneous signals from the unit M100 are detected. Through a suitable shutdown path to which (in an OR operation) M100, M110, M111 access, thus can have a fail-silence behavior of the entire system.

In 3 is one possible implementation of the switching and comparison unit M100 2 shown in detail. The unit M100 contains a control register M200 with at least one bit representing the mode (performance / comparison) and a status register M220 with at least one bit representing the error status in comparison mode. The wait and interrupt signals are controlled by further bits in the control register for both processing units. It may also be necessary to differentiate between different interrupts, for example for synchronization purposes, for preparing for the operating mode switches and for error handling.

optional There are other control registers, such as M240, which is the maximum allowed time difference (in number of clock periods) between the Processing units for controlling an internal or external Contains watchdogs, and M241 with the time difference value (clock period number), from which the fastest processor temporarily stopped by means of WAIT or interrupt signals or delayed supposed to, for example, an overflow of data registers.

in the Status register M220 is e.g. stored next to the error bit as well, how big the Clock offset between the processing units is up to date. To is e.g. at least one timer M230 always from a processing unit started when a (over Address and control signals, e.g. certain address range) especially indicated data value is provided first and the value the timer is always taken into the status register, if the corresponding Data value is provided by the second processing unit. The timer will be over also preferably set so that even at different Program sequences accordingly WCET (worst case execution time) guarantees all processing units have to deliver a date. If the preset value is exceeded by the timer, a Error signal output.

The outputs M120, M121 of the processing units are in M100 in particular for the comparison mode in a buffer memory M250, M251 store, provided it is digital data and they are not provided in a timely manner can be. Preferably, this memory may be implemented as a FIFO. If this memory only has a depth of 1 (register), then e.g. by wait signals for it to ensure that the output of other values until the comparison delayed is to avoid data loss.

Farther is there a comparison unit M210 that outputs the digital data the input memories M250, M251, the direct inputs M120, M121 or M170, M171 compared with each other. This comparison unit can also compare serial digital data (e.g., PWM signals) with one another e.g. in the memory unit M250, M251 receive the serial data and convert to parallel data, which is then compared in M210 become. Likewise asynchronous digital input signals M170, M171 via additional memory units M270, M271 be synchronized. As with the input signals 120, 121, these are preferably buffered in a FIFO.

Switching between performance and comparison mode is done by setting or resetting the mode bit in the control register, which causes eg corresponding interrupts in the two processing units. The Ver the same is itself everanlasst by the provided data M120, M121 and the associated addresses and control signals M130, M131. In this case, certain signals from M120 and M130 or M121 and M131 can act as an identifier indicating whether a comparison of the assigned data is to take place.

This is another embodiment over the simple switching in 1 , Here, advantageously, during the transition to a comparison mode by means of the interrupt routines, various preparations have to be made so that the same initial conditions are created for both processing units. If the processing unit is done with it, the processor-specific ready bit in the control register is set by her and the processing unit remains in the wait state until the other processing unit indicates its readiness by its ready-bit (see also description of the Contolregister in 6 ).

In this comparison unit analogue data can also be compared with one another in a suitable analog comparison unit M211 (analogue compare unit). This presupposes, however, that the output of the analogue signals is sufficiently synchronous with each other or that the analogue compare unit provides for the storage of the data digitized by an ADC implemented there (see further comments on this) 12 to 14 ). Synchronicity can be achieved by comparing the digital outputs of the processing units (data, address and control signals) as described above and maintaining the processing unit too fast. For this purpose, the digital signals which are processed as the source of the analog signals in the processing unit can also be supplied via the outputs M120, M121 to the unit M100, although these signals are otherwise not needed externally. This redundant comparison in addition to the comparison of the analog signals ensures that an error in the calculation can be detected earlier and also facilitates the synchronization of the processing units. The comparison of the analog signals causes additional error detection for the DAC (digital to analog converter) of the processing unit. In other structures of the DCSL architectures such a possibility does not exist.

For analog Input signals from the peripheral units is also a comparison possible. Especially when it comes to redundant sensor signals of the same System parameter is needed you then no additional Synchronization measures but only optionally a control signal that is the validity indicates the sensor signals. The realization of a comparison analog Signals will still be shown in detail.

4 shows a multiprocessor system with at least n + 1 processing units, each of these components in turn can also consist of several sub-processing units (CPUs, ALUs, DSPs with corresponding additional components). The signals of these processing units are also connected to a switching and comparison unit, as in the two-system after 2 has been described. All components and signals in this figure therefore have the same meaning in content as the corresponding components and signals in 2 , In the multiprocessor system, the M300 switchover and comparison unit can differentiate between the performance mode (all processing units execute different tasks), different comparison modes (the data of two or more processing units are to be compared and an error is to be signaled in case of deviations) and different voting modes ( Majority decision in case of deviation according to different predefinable algorithms). For each processing unit can be decided separately, in which mode it works and with what other processing units together they may work in these modes. Exactly how the switchover takes place is described later in the description of the control registers 6 continue running.

5 shows a possible implementation of a switching unit for a multiprocessor system with n + 1 processing units. For each processing unit, at least one control register M44i is provided in the control unit of the switching and comparison module. A preferred set of control registers is in 6 shown and described in detail. M44i corresponds to the control register Ci.

Various embodiments in the control register are conceivable. It can have appropriate bit combinations be described whether an error detection or a fault tolerance pattern should be used. Depending on the effort you put into the unit M300 you can also specify which type of fault tolerance pattern (2 out of 3, median, 2 out of 4, 3 out of 4, FTA, FTM ...) you want to use. Next you can make it configurable, which output one turns on. It is also possible then to form embodiments which Components for which Date on this configuration can influence.

The output signals of the processing units involved are then compared with one another in the switching unit. Since the signals are not necessarily processed clock-accurate, a caching of the data is required. there It is also possible to compare data in the switching unit which is given to the switching unit with a greater time difference from the different processing units. By using a buffer (eg designed as FIFO memory: first-in-first-out or else in a different buffer form), a plurality of data can initially also be received by one processing unit, while other processing units do not yet provide any data. In this case, a measure of the synchronicity of the two processing units is the fill level of the FIFO memory. If a certain predefinable fill level is exceeded, the processing unit furthest advanced in the processing is temporarily stopped either by an existing WAIT signal or by suitable interrupt routines, in order to wait for the slower processing units progressing in the processing. The monitoring should be extended to all externally available signals of a processing unit; this also includes analog signals or PWM signals. In the switching unit structures are provided to allow a comparison of such signals. In addition, it is proposed to specify a maximum time deviation between the data to be compared and to monitor it by means of at least one timer.

In the general case, if more than two processing units are interconnected by a common switching unit, a control register is required for each of these processing units or processing units. A special version of these control registers is in 6 explained.

The (n + 1) lower bits B500x to B50nx of the respective control register Cx are uniquely assigned to the n + 1 processors / processing units. The bit B514x of the control register Cx switches between comparison / voting on the one hand and parallel work on the other hand and corresponds to the value of B16 1 , Bit B513x indicates whether the processing unit in question is ready for comparison, bit B512x controls the synchronization signal (WAIT or INTERRUPT) and bit B511x can be used to prepare the corresponding processing unit x for the comparison by an interrupt. Similarly, bit B5110x controls an interrupt that returns the processing unit to parallel mode.

are B50ik and B50kk of the control register Ck is set to one (0≤i, k≤n)., So means in this embodiment, that the outputs the processing unit i with those of the processing unit k to be compared. In addition, B50jk is equal to one, then voted between i, j and k and the voting result is output at the output k of the UVE (0≤i, j, k≤n). This can be done for each group of processing units a special way of voting or even only a majority settlement can be determined, as already in the explanation to the picture M4 enumerated has been. General need all bits B50ik for the processing units i to be compared / voted (in the control register Ck), if at the output k the UVE outputs the voting result shall be. Parallel output on other outputs is possible.

A One in B50ii of the control register i (0 ≤ i, ≤ n) indicates that the output i should be active in the comparison unit. Carry all control registers Ci only in the corresponding memory locations B50ii a one (i = 0, 1, ... n), all processing units work in performance mode with arbitrarily different programs and own output signals. If all n + 1 lower bits B50ik are equal to one (i = 0, 1, ... n), and is as well B514k set, then the output signals of all processing units by voting by majority vote and to the output k of the UVE issued; if n = 1, only one comparison takes place.

In the following versions is described as an example, as a process in the transition to a comparison / voting in a system with several processing units can look like.

The bit B514i in the control register Ci is set to activate the comparison or the voting. This bit may be set by the processing unit itself as well as by the switching and comparing unit depending on certain system conditions, timing conditions or other conditions (such as accessing particular memory areas, errors or implausibilities). If bits B50ii and B50ki are set with B514i, the UVE automatically sets bits B511i and B511k, triggering interrupts in the processing units i and k. These interrupts cause the processing units to jump to a particular program location, perform certain initialization steps to transition to the compare mode, and then issue a feedback to the switch and compare unit. The ready signal causes an automatic reset of the interrupt bit B511i in the respective control register Ci of the processing unit and at the same time the setting of the wait bit B512i. If all wait bits of the processing units involved are set, they are reset by the switchover and compare unit simultaneously. The processing units then start to process the program parts to be monitored. In an advantageous embodiment, writing to a control register Ci with the bit B514i set is prevented by locking (HW or SW). This makes sense, that the configuration of the comparison can not be changed during execution. A change in the control register Ci is possible only after resetting the bit B514i. This reset causes interrupts in the respective processing units by setting bits B510x in the control registers of all involved processing units to transition to normal mode (parallel operation).

The Consistency of all control registers to each other is monitored according to user specifications and in the event of an error, an error signal is generated, the component the status information is. For example, it should not happen that one processing unit simultaneously performs simultaneous comparisons for several independent or voting processes are used, because then the synchronization not guaranteed is. Conceivable, however, is a comparison of several processing units without an output of the data signals, but only for the purpose of Generate error signal in case of inequality.

In a further embodiment is the entry in several or all control registers on one Comparison or a voting involved processing units similar to make, i. the corresponding bits of these processing units are to be set the same, if necessary with the exception of the own bit i controlling the output.

In 7 is the voting unit Q100 shown for central voting. Voting can be carried out both by means of suitable hardware and by software. The voting algorithm (eg bit-accurate voting) is to be specified. The voting unit Q100 receives several signals Q110, Q111, Q112 and forms from these an output signal Q120, which results from voting (eg an m out of n selection).

kick an error in the comparison, is in the respective control register the error bit is set. In a voting, the date of the relevant Processing unit ignored; in a simple comparison of the Output blocked.

Any data not available in time before the programmed time expires will be treated as error. The resetting of the error bits is system-dependent and possibly enables reintegration of the processing unit concerned. In the event that the processing units and / or the voter are not spatially concentrated, a decentralized voting in conjunction with a suitable bus system is also provided 8th possible. In 8th a remote voting unit Q200 is controlled by a control unit Q210. It is connected via bus systems Q221, Q222, receives data via these bus systems and also outputs them there.

The reset of the comparison and voting bits in a control register with active Output bit causes an interrupt in the participating processing units, which are then returned to a parallel mode of operation. In this case, each processing unit can have a different entry address own, which is managed separately. The program processing can even from the same program memory. The accesses but are separate and usually to different addresses. If the safety-relevant part is low compared to the parallel modes has to be weighed whether its own program memory with duplicated security part possibly less expensive is. The data memory can also be shared in performance mode become. The accesses are then successively, for example by means of of the AHB / ABP bus.

When Special feature is still to mention that the Error bits must be evaluated by the system. For a safe shutdown to ensure in case of failure, are the safety-relevant signals in a suitable form redundant to realize (for example in the 1-out-of-2 code).

In the previous UVEs after the 1 . 2 . 3 . 4 and 5 At first, it was assumed that the processing units work with equal or derived clocks that are in constant phase relation with each other. If clocks of different oscillators and generators are used for the processing devices, in which the phase relationships change, one must synchronize the signals generated with them when they change the clock domain. A synchronization element M800 is in 9 shown. In order to securely store and compare the digital data in particular, synchronization devices M800 are required, which can be attached anywhere in the signal flow. These once ensure the storage of data M820 with the clock M830 of the processing unit that provides this data. For reading, the clock is then used with which the date M840 is further processed. Such a synchronization stage M800 can be developed as a FIFO in order to be able to store a plurality of data (see 9 ). In the general case, the synchronization of the data alone is not sufficient, but it is also the sync signal of the data to synchronize with the receive clock.

In addition, a handshake interface is required ( 10 ), that the request M850 and acknowledgment signals M880 guarantee acceptance. Such an interface is always necessary when the clock domain changes to ensure secure transmission of data from one clock domain to another. When writing, the data M820 from the area Q305 are provided synchronized with the clock M830 in the register cells M800 and a write request signal M850 indicates the provision of the data. This write request signal is taken from the area Q306 with the clock M860 in a memory element M801 and as a synchronized signal M870 it indicates the provision of the data. With the next active clock edge of clock M860, the synchronized data M840 is then accepted and in the process an acknowledgment signal M880 is sent back. This confirmation signal is synchronized by the clock M830 in another memory element M801 to the signal M890 and thus the provision of the data is terminated. New data can then be written to the relevant register. Such interfaces are state of the art and known and can work in special embodiments by an additional coding very fast, without having to wait for an acknowledgment signal.

In a particular embodiment are the memory elements M800 as FIFO memory (first-in, first- out).

The circuits for comparing analog signals of 11 to 14 assume that the processing units that provide the analog signals to be compared are synchronized with each other so that the comparison makes sense. The synchronization can be done by the corresponding signals B40 and B41 of 1 be achieved.

11 shows a differential amplifier. With the help of this element two voltages can be compared.

In this case, B100 is an operational amplifier, to whose negative input B101 a signal B141 is connected, which is connected via a resistor B110 with the value R _in to the input signal B111, to which the voltage value V ₁ is applied. The positive input B102 is connected to the signal B142, which is connected via the resistor B120 with the value R _in to the input B121, to which the voltage value V ₂ is applied. The output B103 of this operational amplifier is connected to the output signal B190, which has the voltage value V _out . The signal B190 is connected via the resistor B140 with the value R _f with the signal B141 and the signal B142 is connected via the resistor B130 with the value R _f with the signal B131 carrying the voltage value of the analog reference point V _agnd.

The output voltage can be calculated using the voltage and resistance values given above according to the following formula: V out = R f / R in (V 2 - V 1 ). (1)

If the differential _{amplifier is} only operated with a positive operating voltage, as is usually the case with CMOS, a voltage between the operating voltage and the digital ground is selected as the analog ground V _agnd , usually the mean potential. If the two analog input voltages V ₁ and V _{2 are} only slightly different, then the output voltage V _{out will have} only a small difference V _diff to the analog ground (positive or negative).

Using 2 comparators is now checked whether the output voltage is above V _{diff agnd} + V ( 12 ) or below V _agnd - V _{diff is} also the analogous reference point ( 13 ). It will be in 12 the input signal B221 is connected to the signal B242 via the resistor B150 having the value R ₁ and connected to the positive input B202 of the operational amplifier B200. Furthermore, the signal B242 is connected via the resistor B160 with the value R ₂ to the signal B231, which is used as the digital reference potential V _dgng . The negative input B201 of the operational amplifier is connected to the input signal 211, which carries the voltage value of a reference voltage V _ref . The output B203 of the operational amplifier B200 is connected to the output B290 carrying the voltage V _above .

In 13 Accordingly, the input signal B321 is connected via the resistor B170 with the value R ₃ to the signal B342, which is connected to the negative input B301 of the operational amplifier B300. This signal B342 is further connected via the resistor B180 with the value R4 to the signal B331, which also carries the digital reference potential V _dgnd . The positive input B302 of the operational amplifier B300 is connected to the input signal B311 which carries voltage value of a reference voltage V _ref . The output B303 of the operational amplifier B300 is connected to the output signal B390, which carries the voltage value V _below .

This is achieved by dimensioning the resistors B150, B160, B170 and B180 with their values R ₁ , R ₂ , R ₃ and R ₄ in relation to the fixed reference voltage V _ref applied to the signals B211 and B311 as follows become: V ref = (V agnd + V diff ) · R 2 / (R 1 + R 2 ) (2) V ref = (V agnd - V diff ) · R 4 / (R 3 + R 4 ) (3) V diff = ((V 2max - V 1min ) · R f / R in ) - V agnd (4)

V _{2max denotes} the maximum tolerated voltage _value of V ₂ at signal B121 and V _1min the minimum tolerated voltage _value of V ₁ at signal B111. The reference voltage source can be provided externally, or realized by an internally realized bandgap (temperature-compensated and operating voltage-independent reference voltage). In equation (4), the maximum tolerated difference V _{diff is determined} from the maximum positive deviation V _2max and the associated maximum negative deviation V _1min , ie (V _2max -V _1min ) is the maximum tolerated voltage deviation of redundant analog signals to each other compared to each other should be.

If one of the voltage values at the two signals B290 or B390 (V _up or V _down positive, there is a greater deviation of the analog signals than they should be tolerated.) If the processors that supply these analog signals are synchronized, there is thus an error The synchronization is given, for example, when the ready signal in the control register of the corresponding processing units is active, or certain digital signals are sent to the UVE which indicate a certain state of the signal indicating the analogue signal concerned and thus also the value to be compared in the sense of an identifier A circuit which stores the error is in 14 shown. In this circuit, the two input signals B390 and B290 are linked to the output signal B411 via a NOR circuit (logical OR circuit with subsequent inversion) B410. This signal B411 is combined with the input signal B421 in another NOR element B420 to the output signal B421. This signal B421 is linked in an OR circuit B430 with the signal B401 to the signal B431, which serves as an input signal for the memory element (D flip-flop) B400. The output signal B401 of this element B400 indicates an error with the value 1.

The D-type flip-flop B400 stores a 1 with the clock B403 if one of the two voltage values V _below or V at the _top of the signals B390 or B290 is positive, ie the value is high as a digital signal, the signal B421 is not active and no reset signal B402 is present. The error remains stored until the signal Reset was active at least once.

Please note when sizing the circuits 11 to 13 That the resistance to each other matchen, that is, the resistance ratios of R _f and R _in, R ₁ and R ₂ and R ₃ and R ₄ are as independent as possible of manufacturing tolerances constant. With the signal B421 can be controlled whether the circuit should be active, or just takes place a synchronization of the processing units, in which should not be compared. The signal B402 resets a previous error and therefore allows a new comparison.

15 shows an ADC. Depending on the existing requirements, such as conversion speed, accuracy, resolution, noise immunity, linearity and frequency spectrum, this ADC can be implemented using the various known conversion methods. For example, one can choose the principle of successive approximation, where one compares the analog signal with a generated signal from a digital-to-analog converter (DAC) by means of a comparator, wherein the digital input bits of the DAC systematically from the MSB (most significant bit - most significant bit) to LSB (least significant bit) is set to high as a test and reset immediately if the DAC's analog output signal is higher than the analog input signal (the signal to be converted). The DAC controls with its digital bits from the LSB to the MSB either resistors or capacitances with the weights 1, 2, 4, 8, 16, ... in such a way that the setting of the next higher bit always has twice the effect on the analog value like the previous one. After all bits have been set and, if necessary, reset again, the value of the digital word corresponds to the digital representation of the analog input signal. For higher speed requirements, continuous data streams can also use a converter that continuously processes the analog signal and outputs a serial digital signal that approximates this analog stream through the serial bit stream. The digital word is here represented by the bit sequence stored in a shift register. However, such transducers presuppose that changes in the analog signal are constantly made during the conversion period because they can not process constant values.

For lower speed requirements also converters can be used according to the counting principle, for example, by means of the input voltage or the input current cause a corresponding constant charging or discharging a capacitor connected to an integrator. The time required for this is measured and set in relation to the time required in the opposite direction to discharge or charge the same capacitor (integrator) by means of a reference voltage source or a corresponding reference current. The time unit is measured in cycles and the number of clocks required is a measure of the analog input value. Such a method is, for example, the dual-slope method in which the one slope is determined by the discharge in accordance with the analog value and the second edge is determined by the recharge according to the reference value (see also http://www.exstrom.com/journal/adc/dsadc.html).

The ADC B600 from 15 is controlled by a trigger signal B602, which is typically an output of the processor providing the analog signal and optionally an identifier B603 which provides information about the type of analog signal being provided to enable discrimination of multiple analog signals. With the trigger signal B602, the converted analog word is taken into the memory area B640 as a digital value in a register B610 and optionally together with the identifier B603, which is stored in B620 and possibly an additional signal B604 (which is 1 for the marking of an analog value), which is stored in the memory B630. The memory area B640 can advantageously also be realized as a FIFO (first-in, first-out) if a plurality of values are to be stored and the first stored value is also to be re-evaluated first. If memory area B640 is used for both digital and digitized analogue values, then advantageously all digital values are supplemented by a bit A = 0 at the MSB location, corresponding to B630, to obtain from digitized analog values A = 1 (B630) distinguish (see 16 and 17 ). Both B602 and B603 are part of the digital output data O _{i of} a processor i. In 16 the parts of the stored digitized analog value are shown separately as they are stored in the memory area. B710 is the digitized analog value itself, B720 is the associated identifier, and B730 is the analog bit, which in this case is to be stored as 1. In 17 is a variant of a stored in the same memory area digital value. In B810, the digital value itself is stored, in B820 an optiona option is provided which, for example, indicates whether the digital value is to be compared at all or whether it may also contain further conditions for the comparison. In B830, the value 0 is then stored to indicate that it is a digital value.

To the Comparison of cached digital and analog signals the sequence of the storage and possibly the A-bit (B730 or B830) and the identifier B720 or B820 in conjunction with the converted Digital value B710 or digital value B810 tested. There is also the possibility e.g. because of different bit width, the analog and the digital To accommodate signals in separate memories (two FIFOs). Of the Comparison is then event-driven: whenever a value of a Processor transferred to the UVE will be checked whether the other processors involved already have such a value have provided. If that is not the case, the value becomes stored in the corresponding FIFO or memory, in the other case the Comparison carried out immediately, where also the FIFO can serve as a memory. A comparison For example, it is always completed when the participants are involved FIFOs are not empty. For more than two processors involved or comparison signals can be determined by voting, whether all signals are allowed for distribution (fail silent behavior) or if possibly the error state is signaled only by an error signal becomes.

Claims (26)

Method for switching in a computer system having at least two processing units, a switching means and a comparison means, wherein between at least two operating modes is switched and a first operating mode a comparison mode and a second operating mode corresponds to a performance mode, in the comparison mode information is compared, characterized in that at Asynchrony of the at least two processing units in the comparison mode, a synchronization signal is applied to an interrupt input of at least one of the processing units. Method according to claim 1, characterized in that that the synchronization signal is a delay signal, in particular a wait signal. Method according to claim 1 or 2, characterized in that by the synchronization signal at least one processing unit causing it to stop processing information. Method according to claim 3, characterized that causes the at least one processing unit for a predetermined time will no longer process any information. Method according to claim 1, characterized in that that the synchronization signal with respect to at least one interrupt signal a higher one priority has. Method according to claim 1, characterized in that that the synchronization signal against all interrupt signals the highest priority has. Method according to claim 1 or 2, characterized in that by the synchronization signal at least one processing unit is caused to execute an interrupt routine. A method according to claim 1, characterized in that at least one buffer memory enthal and at least one of the information to be compared in the comparison mode is temporarily stored in the buffer memory for a time dependent on the synchronization signal. Method according to claim 8, characterized in that that out of time for the at least one of the information is cached, an asynchronous information, in particular a time error, can be determined. Method according to claim 8, characterized in that that in the buffer memory a level of the memory can be determined is, which indicates the amount of information in the buffer memory are located. Method according to claim 9, characterized that the time error is determined by having a time detection means, in particular a counting element, is provided, wherein a time value is determined and this with a predetermined maximum time value is compared. Method according to claim 10, characterized in that that asynchronous information thereby is determined that the determined level with a predetermined maximum level is compared. Method according to claim 1, characterized in that that one prescription, that one next Starting date to be compared, by a comparison signal he follows. Method according to claim 1, characterized in that that a date to be compared is assigned an identifier which triggers the comparison. Device for switching over in a computer system with at least two processing units, wherein the device a switching means and a comparison means and between at least two modes of operation is switched and a first mode of operation a comparison mode and a second mode of operation a performance mode where information is compared in comparison mode, characterized in that the device is designed in such a way is that at asynchrony the at least two processing units in the comparison mode Synchronization signal to an interrupt input at least one of the processing units is placed. Device according to claim 15, characterized in that that the comparison means and the switching means structurally external are provided to the processing units Device according to claim 15, characterized in that that at least one buffer memory is provided. Device according to claim 17, characterized in that that the buffer memory is a FIFO memory. Device according to claim 15, characterized in that that each processing unit is assigned a buffer memory. Device according to claim 15, characterized in that that each processing unit is a buffer memory, in particular a FIFO memory is assigned. Device according to claim 15, characterized in that that means, in particular a counting element, are provided, which are designed such that these out the predeterminable and / or determinable time for the at least one of the information an asynchronous information is temporarily stored, in particular a time error, determine. Device according to claim 15, characterized in that that means are provided which are designed such that these determine a level of the memory at the buffer memory, which indicates the amount of information in the buffer memory. Device according to claim 22, characterized in that in that the means are designed to provide asynchronicity information determine that the determined level with a predetermined maximum level is compared. Apparatus according to claim 21 or 23, characterized in that synchronization means are provided which are designed in this way are that dependent on this from the asynchronous information one Create synchronization information. Apparatus according to claim 21 or 23, characterized that a monitoring means provided is, which is designed such that this is the asynchronous information processed. Device according to claim 25, characterized in that that it is the monitoring means an external to the computer system monitoring means, in particular a watchdog, acts.