DE10332700A1 - Method for switching between at least two operating modes of a processor unit and corresponding processor unit - Google Patents

Abstract

Method for switching between at least two operating modes of a processor unit having at least two execution units, characterized in that a change from a first operating mode to a second operating mode is triggered by the fact that the processor unit accesses a predetermined memory address.

Description

State of technology

The The invention is based on a method for switching between at least two operating modes of a processor unit and a corresponding processor unit with at least two integrated execution units according to the preambles the independent one Claims.

Such processor units with at least two integrated execution units are also known as dual-core or multi-core architectures. Such dual-core or multi-core architectures are proposed in the current state of the art mainly for two reasons:
On the one hand, an increase in performance, ie a performance increase, can be achieved by considering and treating the two execution units or cores as two arithmetic units on a semiconductor component. In this configuration, the two execution units or cores process different programs or tasks. As a result, an increase in performance can be achieved, which is why this configuration is referred to as a power mode or performance mode.

Of the second reason to realize a dual-core or multi-core architecture, is an increase in security by the two execution units redundantly execute the same program. The results of the two Execution units or CPUs, so cores are compared and an error can be compared recognized for agreement become. In the following, this configuration becomes a security mode or safety mode.

in the Generally, the two configurations mentioned are exclusive to the dual or multi-core architecture, d. H. the computer with the at least two execution units, is basically only operated in one mode, the performance mode or the safety mode.

task The invention is to provide a combined operation of such a dual or multi-core processor unit in terms of at least two modes of operation and thereby an optimized switching strategy, especially between a security mode to increase security and to achieve a performance mode for enhancing performance.

Advantages of invention

It is for safety reasons one redundant design the programs respectively tasks desired, on the other hand is off cost reasons the provision of redundant hardware in the execution of the not safety-critical functions not desirable. This Target conflict is inventively an optimized switching between at least two operating modes and a processor unit solved. Thus, the invention of a method for switching between at least two operating modes of a processor unit with at least two execution units as well corresponding processor unit.

Favorable Way, the switching from a first to a second mode of operation is characterized realized that on a given, acting as a changeover trigger Memory address is accessed. Ie. it will be hardware components as switching means (mode selector) or comparison means and a corresponding method presented as in operation between safety-critical Programs, which are therefore redundant in safety mode and non safety-critical programs that are in performance mode independently of each other on both execution units accomplished can be optimally switched.

there the same programs are in the first operating mode by the at least two execution units processed synchronously and verified by provided comparison means to the effect that the conditions of the processing of the same programs Match execution units. In case of deviations in this regard are then different error responses from an error display via a Emergency operation up to the shutdown of the faulty unit conceivable.

In a special embodiment corresponds to the first mode of operation of the safety mode and the second mode of operation of the power mode. A switch from the second Operating mode in the first operating mode is carried out expedient manner by an interrupt request, in particular triggered by a Interrupt means, the interrupt request on the one hand triggered by a time condition is or by a conditional condition, ie a certain State of at least one of the two execution units or the Occurrence of a particular event.

Advantageously, a special division takes place into at least three separate memory areas, wherein the execution units have access to a first memory area or a second memory area depending on the respective operating mode, or are in contact therewith. It is expedient manner in a special Embodiment of each of the at least two execution units each associated with a first memory area on the processor unit, with which these in the first operating mode, ie in particular the security mode, in connection or access it. In the second operating mode, both execution units have access to or communicate with only one second memory area assigned to both execution units.

Appropriate way are now monitoring devices, in particular the switching means itself provided in such a way that monitors is that in the respective operating mode only to the appropriate Memory areas is accessed or the corresponding connection to the storage areas exists. Ie. in the second operating mode access the evaluation only to the second memory area and not to the first memory areas, and in the first mode of operation access is only to the respective first storage areas, and not on the second memory area, which is checked by the aforementioned monitoring means and in possibly corresponding error reactions such as error message, emergency operation or shutdown is sanctioned.

there is any of the three memory areas mentioned, so at least two first memory areas and the second memory area in a separate memory module provided so that at least three memory modules are available on the processor unit. These are expedient way the safety-critical programs each in a first storage area, and the non-safety-critical programs in the second memory area filed, where appropriate manner the default memory address, which is the named trigger function in terms of the switching comprises, is included in the second memory area.

One Another advantage arises when comparing the states of execution units in the first operating mode, explicit comparison means on the processor unit are provided and these comparison means only in the first mode of operation are in function and in transition in the second operating mode except Function are set so that in nonredundant, not safety critical Operation no comparison and thus under no circumstances provoked Error reaction occurs.

Further Advantages and advantageous embodiments will be apparent from the features the claims as well as the contents of description and drawing.

drawing

The Invention will now be described with reference to the drawing Figures closer explained. It shows

1 a processor unit according to the invention with at least two execution units and the hardware components according to the invention.

2 discloses a switch from the safety mode to the power mode, whereas

3 represents a changeover from power mode to safety mode.

description the embodiments

In Control applications, in particular in the field of vehicle control, such as engine control, brake control or steering and transmission etc., but also in industrial applications such as automation or in the machine tool area, there are generally software tasks or programs that require redundant execution for security reasons, to detect the occurrence of errors. Such safety-critical Applications have but in addition to these safety-critical programs also software components or programs that are also buggy allowed to, since she is not for the provision of the safety-critical function itself are necessary or are concerned, but only an additional function, in particular to provide a comfort function. For security reasons a redundant design is desired, off cost reasons not willing to keep redundant hardware available. According to the invention this Problem by the optimized switching between at least two operating modes, the processor unit, as already in the advantages described and below explains solved.

Thus, the use of the invention in a safety-critical system, such as a vehicle-intrusive system such as brake, steering, transmission or engine is shown below. The processor unit according to the invention of the system consists of a dual-core architecture accordingly 1 So a processor unit 100 with at least two execution units 101 and 102 (CPU1 and CPU2). The two execution units 101 . 102 So CPU1 and CPU2 are each a memory in this example 110 respectively. 111 also referred to as RAM1 and RAM2. Both execution units 101 and 102 are with a comparison means, a comparator 170 connected. Each execution unit also has a connection to a switching means, a mode selector 130 respectively. 131 , with which also the comparison block, the comparison means 170 Compounds has. About one bus each 140 respectively. 141 is ever because volatile memory 110 respectively. 111 as well as the switching means 130 and 131 each with a first storage means 150 respectively. 151 and a second storage means 180 connected.

In this embodiment Two operating systems are used, one for the safety critical Programs or tasks and one for the non-safety-critical programs or tasks. As operating system for the safety-critical programs, for example, OSEKtime OS, and as the operating system for the non-safety-critical tasks used for example OSEK OS.

The Application software is, as already mentioned, divided into safety-critical Programs and non-safety-critical programs. All programs or tasks classified as non-safety critical may fail to incorrectly executed or at all not executed become. A danger of the entire system or the environment is not possible. Of the safe operation of the entire system is alone by the safety as critical classified programs or tasks possible. However, there is the Possibility that the operation, provided he alone by the safety-critical tasks or programs is carried out, to a loss of quality the overall function leads, however within tolerable tolerances as tolerable was classified.

The safety-relevant, ie the safety-critical tasks or programs become redundant on both execution units 101 and 102 , so both CPUs, CPU1 and CPU2 running. These programs are processed under the control of the first operating system, here OSEKtime OS. This is the in 1 illustrated non-volatile memory area 150 respectively. 151 doubled in two parts, so that corresponding to two execution units two first memory areas 150 and 151 available. In these first memory areas, the safety-critical programs or tasks are duplicated, ie redundant. Ie. Each of the safety-critical tasks is on the one hand in the memory area 150 and on the other hand in the memory area 151 localized. In this case, in particular the first operating system itself can be classified as safety-critical and is therefore likewise stored in both memory areas. Ie. in our example, that the operating system OSEKtime OS on the one hand in the memory area 150 and on the other hand in the memory area 151 is stored in each case. In this case, the two first memory areas are each designed as a separate nonvolatile memory module ROM1 or ROM2 in a particular embodiment, which can be implemented as ROM, PROM, EPROM, EEPROM, flash EPROM, etc.

It is not necessarily a double storage of safety-critical programs or tasks required. These can also be protected by using an ECC code (Error Code and Correction). Such methods for error detection in a memory are diverse, the basic requirement is the protection with an error detection or error correction code, ie a signature. In the simplest case, this signature can only consist of a signature bit, for example a parity bit. On the other hand, the protection can also be realized by more complex ED codes (Error Detection) such as a Berger code or a Bose-Lin code, etc., or even by a more complex ECC code such as a Hamming code, etc. to allow a safer error detection by appropriate number of bits. However, it can also be used as a code generator, for example a generator table (hardwired or in software), to assign a desired code pattern of any length to certain input patterns of the bits in the context of the address. This can be ensured in particular by the correction function, the data security in memory and a double storage can be avoided. Nevertheless, there is a redundant processing of the safety-critical programs in the two execution units, which errors in the cores, so the execution units are revealed by comparison according to the invention, in which case contrary to the invention 1 only a first storage area is necessary.

The non-safety-relevant or safety-critical programs or tasks are calculated to increase performance on both execution units, so CPUs distributed and executed under the control of the respective sub-operating system, so here the OSEK subsystem. In particular, an independent operating system, here an independent OSEK system, thus runs on each of the two execution units. The second memory area 180 , in which the non-safety-critical programs or tasks are located, is simply present. He is from both execution units 101 respectively. 102 used or accessed by both. In a particular embodiment, this second memory area can also be embodied as a separate non-volatile memory module ROM3 and configured as ROM, PROM, EPROM, EEPROM, flash EPROM, etc.

In this case, the memory areas, that is, the first and second memory areas may be designed so that the first memory areas or the first memory area (for ECC protection), for example, between 0 and X based on the addresses and the second memory area of X + 1 to Y also related are formed on the addresses. In the further will of a doubled first Memory area assumed, and as previously explained, only a single first secured memory area can be used. Then, as already stated, the first memory area from 0 to X is present twice in each case in a first memory area. Each first memory area is assigned to an execution unit concretely.

In the first operating mode, in this example the safety mode, run on both execution units, so both CPUs 101 and 102 redundant and in particular synchronously the safety-critical programs or tasks. In the comparison means, the comparator 170 , the respective CPU states are compared with each other. In this case, certain states of the program can be assigned specific states which can then be compared in a non-time-critical manner, that is to say at any time, provided that they are buffered and can be unambiguously assigned, for example, by an identifier. In the preferred case, however, the safety-critical programs or tasks are processed not only redundantly, but synchronously, so that a comparison of the respective states of the execution units can be performed directly during operation. The new commands and / or data are then correspondingly from the respectively associated first memory area 150 respectively 151 loaded and processed. In the comparator 170 the CPU states are checked for coincidence, and if there is a deviation of the states that should correspond, errors are detected. As a fault reaction on the one hand, an error message regarding the respective system in which the processor unit is installed, possible and on the other error responses such as an emergency operation, ie operating the system, the processor unit inherent in a safe emergency operation, for example, with extra dedicated programs and / or data. It can also be used in a further error analysis, z. An n-out m-test, where n and m are natural numbers and n> 2 and m>n> m / 2 or else a 1 from k-code, where k corresponds to a natural number> 1. If, for example, such an test unambiguously identifies an execution unit as faulty, a shutdown of this execution unit and emergency operation of the remaining unit or a switchover of the faulty execution unit into emergency operation can also take place as a further error reaction.

In safety mode, that is to say the safety mode or, more generally, the first operating mode, access of the execution units is permitted only to addresses or data in the first memory areas. Ie. In the first operating mode, the respective execution unit may only access the first memory area, in particular assigned to it. This is done by monitoring means, in particular the switching means or mode selectors 130 respectively 131 or monitoring means in the mode selectors 130 and 131 checked. If errors occur in this case, a comparable error reaction, as described above, with respect to a comparison error in accordance with the CPU states is conceivable and predictable. Ie. but also that the switching means, so here the mode selectors 130 respectively 131 for this case of the first operating mode, a connection into the respectively associated first memory area 150 respectively 151 via bus 140 respectively 141 or monitor a corresponding access violation.

In the second operating mode of this embodiment, the non-safety-critical programs or tasks are processed. On both execution units, so the CPUs 1 and 2 ( 101 . 102 ) run various non-safety-critical programs. This includes, for example, the operating system itself for the second operating mode, ie the OSEK subsystem. The two execution units or CPUs thus share a non-volatile second memory area, which, as previously described, can be designed. However, each CPU has its own volatile memory area RAM1 and RAM2, 110 respectively 111 assigned. Since such non-safety-critical programs are not or not all executed twice, there is at least the theoretical possibility that both execution units block each other by waiting for release of a resource. This is done by appropriate distribution of the tasks or programs, for example after a schedule on the execution units 101 and 102 counteract. In this case, other measures such as an alternate access or depending on the particular program prioritized access, etc. are possible. In this second operating mode, the power mode according to our embodiment, no access to an address in the first memory area is permitted. Again, the check is carried out by checking means, in particular by the switching means, the mode selectors, or the checking means are executed separately in the mode selectors. If a faulty access is detected in the second operating mode, a corresponding error reaction can also be initiated here. On the one hand, an error response corresponding to the first operating mode is conceivable and predeterminable. This makes sense, in particular, since in the event of erroneous access, safety-critical memory areas may indeed be accessed. On the one hand, this can be realized in that a connection to the second memory area is established only in the second operating mode and the connection to the first memory areas is clipped into this operating mode or the access to the first memory area is otherwise prevented and only in the second memory area is allowed.

The switching between the operating modes is now detailed in the 2 and 3 described again.

In order to move from the first operating mode, that is to say here the safety mode or safety mode into the second operating mode, that is to say power mode or performance mode, access to a predetermined or excellent address is required, whereby a change to the second operating mode takes place. This excellent address can occur in the first memory area during program execution or be supplied accordingly from the outside. Ie. in the first operating mode or security mode, only addresses or a program in the first memory area may be accessed; if in this security mode to another address, for example in the second memory area is accessed, there is an error with a possible corresponding error response, as described above. In 2 this is once again clarified. In the block 200 are both execution units 101 and 102 in the first operating mode, ie the safety mode. In query 210 it is checked whether the address of the next instruction is equal to the trigger address of the corresponding excellent switching address. If this is not the case, then both processing units continue to be in the first operating mode and thus each access the first memory areas 150 . 151 to. However, if the address of the next command and / or date corresponds to the trigger address, then the block takes place 220 the changeover or the change to the second operating mode, the power or performance mode. Each execution unit also receives an address in the second memory area, in which the processing in the second operating mode is to continue. In this case, the comparison unit or the comparison means 170 switched off, so disabled (disabled). In the block 230 is thus the first processing unit 101 in the second operating mode and in the block 231 the second execution unit 102 also in the second operating mode, the performance mode. Ie. The only way to get from the safety mode, the safety mode in the performance mode is in the concrete example, for example, a call a specific OSEKtime T _trigger task such as the ttidle task of the OSEKtime operating system, respectively one contained therein, as a trigger Address excellent address, in particular the start address of this program part or this task. In particular, if the two execution units are working synchronously, this call necessarily occurs simultaneously in both CPUs. The T _Trigger task just like ttidle is eg a call of the OSEK scheduler which is in the second memory area 180 lies. For example, in the switching devices, so the mode selectors 130 . 131 this corresponding address is set as the trigger address to switch to the power mode. This is as I said in the block 210 So just the mode selectors, the switching means tested. Thus, future address access may just until a new change to security mode only in the ROM area 180 , So the non-volatile second memory area done.

In 3 now the switching or the change from the power mode, so the performance mode in particular back to the first operating mode, the safety mode or safety mode is shown. In block 300 is execution unit 101 , so CPU 1 in the second operating mode, the performance mode. Likewise is in block 310 the second execution unit 102 in just this power mode, this second mode of operation of this embodiment. In block 320 or block 321 Now an interrupt request, an interrupt is triggered for each execution unit, by which a switch to block 330 from both execution units 101 and 102 into the first operating mode, the safety mode. In this case, the comparison means of the comparator 170 turned back on, and in block 340 Then both execution units run again in the security mode, the first operating mode. The interrupt request can be triggered on the one hand by a time condition, ie a timer interrupt or triggered by a state or event condition. That is, to switch from the power mode to the secure mode, an interrupt request of the first OSEKtime operating system is generated. This timer interrupt of the OSEKtime operating system, which has a higher priority than the OSEK operating system, is programmed the same in both CPUs because the same OSEKtime system is running on both CPUs. Especially for synchronously running OSEKtime systems, the interrupt, ie the interrupt request, arrives at both CPUs at the same time. By definition, the OSEKtime Scheduler Intenupt has by definition a very high priority, especially the highest priority. Both interrupt requests are executed concurrently at synchronicity accordingly. As already mentioned, with embodiments of these interruption requirements, the comparison means as well 170 also set in function again, ie in the first operating state, the security mode, switched and the execution units run in particular redundant again.

In addition to the already mentioned timer interrupt, a state or event interrupt can also be used in order to bring about the aforementioned operating mode change from the second to the first operating mode. In this case, a certain state of the execution units, for example ei trigger a high-priority interrupt, which then has validity for both execution units. This can be done, for example, by processing the programs in the ROM 180 be generated state in a CPU, which triggers such a high-priority interrupt request, which also applies to the second CPU. Likewise, an event, in particular also an externally supplied to the processor unit event trigger such an interrupt and thus the operating mode change. Preferably, the first variant is the timer interrupt, but the state or event interrupt, as described, is also conceivable and hereby disclosed.

In order to is according to the task an optimized switching between two modes of operation of a processor unit with two integrated execution units shown according to the invention, the concrete embodiment not limiting with regard to the basic ideas of the subject invention can work.

Claims (28)

Processor unit with at least two execution units, wherein switching means are contained by which can be switched between at least two operating modes of the processor unit, characterized in that the switching means are configured such that a change from a first operating mode to a second operating mode is triggered by the fact that Processor unit is accessed to a predetermined memory address. Processor unit according to Claim 1, characterized that the first operating mode corresponds to a safety mode, where the two execution units execute the same programs and comparison means are provided, which results from the processing of the same programs conditions the execution units on agreement to compare. Processor unit according to Claim 2, characterized that the execution units are formed such that they in the first operating mode the execute the same programs synchronously. Processor unit according to claim 1, comprising at least three separate memory areas, wherein in the first mode of operation each execution unit respectively with each execution unit associated first memory area is in communication. Processor unit according to claim 1, comprising at least two separate memory areas, wherein in the second mode of operation both execution units only with one, two execution units associated second memory area in connection. Processor unit according to Claims 1 and 5, characterized that the given memory address is accessed should be located in the second memory area. Processor unit according to claim 1, comprising at least two separate memory areas, wherein in the first mode of operation both execution units associated with only one, both execution units first storage area in connection. Processor unit according to Claims 1 and 7, characterized that the given memory address as a trigger address in the first Memory area is included and the following address is accessed should be included in the second memory area. Processor unit according to Claims 1 and 5, characterized that monitoring means, in particular the switching means are provided which are so for monitoring are formed, that the evaluation means in the second operating mode only communicate with the second memory area. Processor unit according to claim 1 and 4, characterized characterized in that monitoring means, in particular the switching means are provided which are so for monitoring are formed, that the evaluation means in the first operating mode only in each case with the first memory area in connection. Processor unit according to claim 4 or 5, characterized characterized in that each of the memory areas in a separate Memory module is provided. Processor unit according to Claim 2, characterized that the comparison means at transition in the second operating mode, which corresponds to a power mode except Function are set and a comparison of states only takes place in the first operating mode. Processor unit according to Claim 1, characterized that interrupt means are included, which are designed such are that this one return in the first mode of operation by an interrupt request enable. Processor unit according to Claim 13, characterized that the interrupt request is triggered by a time condition. Processor unit according to Claim 13, characterized that the interrupt request by a condition condition triggered becomes. Method for switching between at least two Operating modes of a processor unit with at least two execution units characterized in that a change from a first mode of operation in a second operating mode is triggered by the fact that the processor unit a given memory address is accessed. Method according to claim 16, characterized in that that the execution units in the first operating mode, execute the same programs synchronously. Method according to claim 16, characterized in that that in both modes of operation various programs are processed In the first operating mode, safety-critical programs are redundant from both execution units and in the second mode of operation non-safety critical programs be processed. Method according to claim 18, characterized that the safety-critical programs are redundant in the execution units respectively assigned first memory areas are stored. Method according to claim 18, characterized that the non-safety-critical programs in a single second memory area are stored and both execution units in second operating mode access only the second memory area. Method according to claim 16, characterized in that that safety-critical programs are redundant in the first operating mode be processed and the resulting states to match be compared. Method according to claim 16, characterized in that that in the first mode of operation of the execution units only on each execution unit associated first memory area is accessed. The method of claim 16, comprising at least two separate memory areas, wherein in the first mode of operation both execution units only to a two execution units associated first memory area access. Method according to claims 16 and 23, characterized that the given memory address as a trigger address in the first Memory area is included and the following address is accessed should be included in the second memory area. Method according to claim 16, characterized in that that in the second mode of operation of both execution units only one, two execution units associated second memory area is accessed. Method according to claims 16 and 25, characterized that monitors is that the evaluation means in the second operating mode only to the second Memory area access. The method of claim 16 and 22 or 23, characterized characterized in that monitors is that the evaluation in the first mode only on the access the first memory area. Method according to claim 16, characterized in that that a switch from the second mode of operation to the first Operation mode is performed by an interrupt request, wherein the interrupt request by a time condition or a Condition condition is triggered.