Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F15/00—Digital computers in general; Data processing equipment in general
  • G06F15/76—Architectures of general purpose stored program computers
  • G06F15/80—Architectures of general purpose stored program computers comprising an array of processing units with common control, e.g. single instruction multiple data processors
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/30181—Instruction operation extension or modification
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/30003—Arrangements for executing specific machine instructions
  • G06F9/30076—Arrangements for executing specific machine instructions to perform miscellaneous control operations, e.g. NOP
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/30181—Instruction operation extension or modification
  • G06F9/30189—Instruction operation extension or modification according to execution mode, e.g. mode flag
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F9/00—Arrangements for program control, e.g. control units
  • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
  • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
  • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
  • G06F9/3885—Concurrent instruction execution, e.g. pipeline or look ahead using a plurality of independent parallel functional units
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
  • G06F2201/845—Systems in which the redundancy can be transformed in increased performance

Definitions

• the invention is based on a method and a device for switching between at least two operating modes of a processor unit and a corresponding processor unit with at least two execution units for processing programs in accordance with the preambles of the independent claims.
• Such processor units with at least two integrated execution units are also known as dual-core or multi-core architectures.
• dual-core or multi-core architectures are proposed according to the current state of the art for two main reasons:
• an increase in performance that is to say an increase in performance
• the two execution units or gores process different programs or tasks. This enables an increase in performance, which is why this configuration is referred to as performance mode.
• the second reason is to implement a dual-core or multi-core architecture, increasing security by both Execute execution units redundantly the same program. The results of the two execution units are compared and an error can then be identified in the comparison for agreement. In the following, this configuration is referred to as safety mode.
• the two configurations mentioned are included exclusively on the dual or multi-core architecture, i. H. the computer with the at least two execution units is in principle only operated in one mode: either the performance mode or the safety mode.
• the object of the invention is now to enable a combined operation of such a dual or multi-core processor unit with respect to at least two operating modes and to achieve an optimal switching strategy between at least two operating modes, that is to say in particular between the safety mode and the power mode.
• processor units can on the one hand be complete gores, that is to say complete CPUs, or else in a preferred exemplary embodiment only the arithmetic unit is duplicated.
• ALU arithmetic logic unit
• the circuit presented additionally requires less chip area than a complete dual-core architecture. Nevertheless, with the method according to the invention, that is to say equally for double CPU or double ALU, adequate fault coverage in the safety mode, and at calculations that are not relevant to safety, a significant increase in performance can be achieved in performance mode.
• the invention is therefore based on a method and a device for switching between at least two operating modes of a processor unit with at least two execution units for processing programs, with the programs advantageously being assigned at least one identifier which differentiates into the at least two operating modes, that is to say in particular Security mode and power mode are permitted and there is a switchover between the operating modes as a function of the identifier, so that the processor unit processes the programs in accordance with the assigned operating mode.
• programs also encompasses program parts, that is to say blocks of code, which extend over several programs in whole or in part, via task programs which are contained in the individual programs or are formed by the programs, up to individual program commands, each of which is assigned an identifier.
• Such an identifier assignment can be used to switch between the individual operating modes at the functional level, that is to say in particular to control operating processes in a vehicle.
• it can also be advantageous
• Programs or corresponding task programs, program parts or program commands that belong to an operating system of the processor unit or represent this operating system can be assigned to the corresponding operating mode by such identifiers.
• the processing of the programs expediently compares the resulting states or results for agreement, whereby errors are identified in the event of a deviation.
• the identifier is advantageously designed as at least one bit, such an identifier being expediently carried out by a program command, in particular by a Instruction provided in the instruction set of the processor unit, such as a write instruction is generated.
• this identifier can be assigned to the corresponding program, program part, execution program or program command, or else it can be or be written into a special, provided memory area.
• an optimized switchover between two operating modes in particular the power mode and the safety mode in the case of a dual-core architecture or an architecture with only a duplicated arithmetic value, that is to say a double ALU, can thus take place.
• FIG. 1 and 2 each show a processor unit with a duplicated arithmetic value, in which the switchover according to the invention can be carried out.
• Figure 3 shows the switch from the safety mode to the power mode and Figure 4 shows the switch from the power mode to the safety mode.
• FIG. 5 shows the assignment of the identifiers to the programs, program parts, task programs or commands using a number of code lines 500.
• FIGS. 1 and 2 of the drawing identical or functionally identical elements have been provided with the same reference numerals, unless stated otherwise.
• the program-controlled unit according to the invention and its components such as Microcontroller core (CPU), memory units, peripheral units etc. have not been shown directly in FIGS. 1 and 2 for the sake of clarity.
• the two arithmetic units ALU A and Alu B can also correspond to complete cores, that is to say CPUs in the context of the invention, so that the invention can also be used for complete dual-core architectures.
• reference numerals 1 and 2 each denote arithmetic logic units (ALU) as execution units.
• a respective ALU unit 1, 2 has two inputs and one output.
• the operands intended for execution can be coupled directly from the bus 3 into the inputs of the ALU units 1, 2 or previously stored in an operand register 8, 9 specially provided for this purpose.
• These operand registers 8, 9 are directly coupled to the data bus 3.
• the two ALU units 1, 2 are therefore the same
• Operand registers 8, 9 are supplied.
• the respective operands are already provided with an ECC coding via the bus, which are stored in the register areas 8a, 9a.
• ECC code Error Correction Code
• the data can be secured by using an ECC code (Error Correction Code).
• ECC code Error Correction Code
• Such methods for error detection are diverse, the basic requirement being security with an error detection or error correction code, ie a signature. In the simplest case, this signature can only consist of a signature bit, for example a parity bit.
• the protection can also be implemented by more complex ED codes (error detection) such as a Berger code or a Bose-Lin code etc.
• the safety-critical mode that is to say in the safety mode SM, the safety-critical programs are processed redundantly in both execution units, that is to say both here ALUs 1 and 2, as a result of which errors in these are revealed by comparison according to the invention.
• the non-security-relevant or non-security-critical programs or tasks, or program parts or code blocks or commands can be calculated distributed over both execution units in order to increase the performance, which increases the throughput and thus the performance. This takes place in the so-called performance mode or performance mode LM.
• the input data from registers 10, 11 can also be compared with that from source registers 8, 9. If there is a difference in the ECC coding or in the operands, this is interpreted as an error and an error signal is output, possibly displayed and possibly corrected.
• This comparison advantageously takes place during the processing of the operands in the ALU units 1, 2, so that they are input-side
• Error detection and error correction goes hand in hand with almost no loss of performance. If one of the comparison units 5, 6 detects an error, the calculation can be repeated within the next cycle.
• a shadow register can be used to always save the operands of the last calculation so that they are quickly available again in the event of an error. The provision of such a shadow register can, however, be dispensed with if the respective operand registers 10, 11 are only rewritten by an enable signal due to the absence of an error.
• the comparison units 5, 6 deliver an error signal, as a result of which the operand registers 10, 11 are not rewritten.
• the ALU units 1, 2 each produce a result on the output side.
• the result data provided by the ALU units 1, 2 or their ECC coding are stored in the result registers 12, 13, 12a, 13a. These result data and / or their coding are compared with one another in the comparison unit 14. In the absence of an error, an enable signal 16 is generated. This release signal 16 is coupled into the release device 15, which is caused to write the result data on a bus 4. This result data can then be processed again via bus 4.
• the enable signal 16 can also be used to enable the registers 8 to 11 again, so that the next operands can be read from the bus 3 and can be processed in the ALU units 1, 2.
• the result is not checked with the arrangement in FIG. 1. Only the result data in the comparison unit 14 are compared here.
• the ECC coding of the result data can only be checked by the arrangement in FIG. 2, in which both the result data and its ECC coding are compared with one another in the comparison unit 14.
• a switch is used to switch between the aforementioned safety mode, in which redundant processing and testing takes place, and the performance mode, in which an increase in performance is achieved by separate program processing
• Switching device UE 17 By means of this switching device 17, the elements 8, 9 and 1, 2 are switched so that in one case, that is to say in the safety mode SM, redundant program processing, in particular synchronous program processing, and in the second operating mode, the performance mode LM a parallel processing different programs can be carried out.
• switches or switching means can be provided, which can be located on the one hand in the elements 8, 9 or 1, 2 or also in the switching device 17 or additionally contained in the circuit separately from the elements 8, 9, 1, 2 or 17 are.
• the programs or task programs or program parts that is to say code blocks or also the commands, are identified by an identifier which can be used to identify whether they are safety-relevant, that is to say they must be processed in the safety mode SM or can be made accessible to the performance mode LM. This can be done by a bit in the command, or the subsequent sequence can be identified by a special command. This will be described in more detail using the different labeling options in FIG. 5.
• the programs can include application functions on the one hand. B. to control operations in a vehicle, or switch to programs in which the
• Marking is done at the operating system level, e.g. B. an assignment of entire operating system tasks.
• the switchover device 17 can now recognize whether the calculation that follows is safety-relevant, that is to say should be carried out in safety mode or not. If this is the case, the data are transferred to both execution units 1 and 2. If this is not the case, so if work continues in performance mode, an execution unit receives the data and at the same time the next instruction, if this is also not security-related, can be given to the second execution unit, so that the programs are processed in parallel with a higher throughput ,
• FIGS. 3 and 4 shows the switchover from the safety mode to the power mode and
• FIG. 4 shows the switchover from the power mode to the
• execution unit 1 is in the second operating mode, the performance mode.
• the second execution unit 2 is also in the performance mode.
• the switching device 17, which is designed, for example, as a decoder module, or contains one, the elements 8 and 9 controlled or switched.
• block 320 or block 321 at least one identifier is determined in accordance with the program flow of the respective execution unit 1 or 2, by means of which a switchover in block 330 from both execution units to the first operating mode, the security mode SM, takes place. As a result, both branches run over the
• Blocks 8 and 9 and the execution units 1 and 2 are again redundant and in particular synchronous with respect to the security-relevant programs identified by the identifier, so that the security mode SM is again present. It is sufficient that in a program run in the performance mode, that is to say in a branch, such an identifier for switching is available in order to lead both execution units into the safety mode. In some cases, the processing of the program code already started by the other execution unit may have to be processed so that both can then continue to work in the safety mode. On the other hand, it can also be provided to switch immediately to the safety mode and, in the case of a subsequent performance mode, to start the program starting from
• query block 210 it is now checked whether there is a switchover identifier or whether an existing identifier makes it possible to switch to the power mode. If this is not the case, that is to say if there is no identifier or if the identifier continues to indicate the security mode, block 200 is reached again and the programs are further processed in the security mode. If an identifier is present or if this indicates the switchover, the switchover or change to the second operating mode, the power or performance mode LM, takes place in block 220.
• FIG. 5 shows the programs P1 from line ZI to line Z6, P2 from line Z7 to line Z15 and P3 from line Z16 to line Z19.
• AP is a
• Task program for example, shown as part of a program P1, with several programs, eg. B. Pl and P2, together can form a task program.
• CB represents a code block, that is to say a program part which comprises, for example, lines of two programs, here Z14 to ZI 8 of programs P2 and P3.
• a code block that is to say a program part, can only be part of a program.
• a program command is also shown with PB3 corresponding to line ZI 9.
• Lines ZS1 and ZS2 represent a special memory area SSB which can contain such an identifier, here KB, as a predetermined memory area.
• different identifiers are shown with K1, K2, K3 and K4 and KB, which take into account the different possibilities of the method according to the invention.
• the security mode SM can be provided as the basic processing mode, that is to say as the default mode (likewise, of course, the performance mode). If an identifier is present, the system then switches to the power mode accordingly (or vice versa to the Security Mode).
• an identifier must be present in principle and that the corresponding mode is inferred from the content of the identifier, that is to say in particular its bit values. In this case, for example, a binary value 1 (or also another value, in particular the dominant value) is assigned to the safety mode SM and the binary value 0 (or also another value in particular the recessive value) to the power mode LM.
• identifiers K1, K2 and K3 can be of different lengths, so that, for example, in the case of identifier K2 according to line Z7, 3 bits, B1 to B3 make up the identifier, so that on the one hand with bit B1 in K2 security mode SM or power mode LM is decided and, for example, bits B2 and B3 indicate the number of lines to which this mode, for example the safety mode, applies, so that the entire program P2 or only a part thereof is processed in the safety mode.
• code blocks that is to say program parts which, for example, do not comprise an overall task, that is to say do not represent a task program
• CB code blocks
• K3 identifier
• a start line or address with bits B2 and B3 at K3 and an end line or end address with bits B4 and B5 at K3 can also be specified here, so that a special area is processed in a correspondingly assigned operating mode becomes.
• K4 such an identification assignment can also take place for individual commands PB3 in ZI 9 or • also for each command.
• these identifiers can thus be assigned to complete programs or task programs AP or program parts CB, or also to individual program instructions PB, here PB3, which then triggers a corresponding switchover by the switchover device 17.
• the query in block 210 or in blocks 320 and 321 then checks for the presence of such an identifier K1 to K4 or KB or switches its content.
• the identifier as shown here, can be designed as at least one bit, but can also comprise several bits, on the one hand depending on the different number of operating modes, on the other hand due to additional information such as the number of lines or a start or end address.
• At least one program command can be provided, here PB1, PB2 or even PB3, which first generates an identifier which indicates whether the first or second operating mode is to be processed.
• the identifier can be written into a specific memory area SSB, as shown here with KB in ZS2.
• This area SSB can be located in a register, in a memory integrated in the CPU, but also in an external memory.
• a special command e.g. B. PB3 may be provided or a command that is already present in the command set of the processor unit.
• a command "generated identifier" can thus be implemented as a special command, for example, or a command that is already present in the processor command set, in particular a write command, can be used, as represented here by PB 1 and PB2, so that the write command WR in Z9 in FIG
• Memory area KB writes the binary value 0, represented by WR (KB: 0) and thus all subsequent lines as long as the identifier is KBO, e.g. B. processed in security mode. With the same command, the value 1 can then be entered in Z12 at PB2 by WR (KB: 1) in the memory area for the identifier KB, so that from this point on the following lines, e.g. B. in performance mode, can be processed. I.e.
• simple identifier-generating commands in particular a simple write command WR, a corresponding switchover identifier KB can then be generated, for example, in a special memory area which is queried regularly.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• Hardware Redundancy (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34484989

Family Applications (1)

Country Status (7)

Families Citing this family (26)

Family Cites Families (6)

• 2003
  • 2003-10-24 DE DE10349581A patent/DE10349581A1/de not_active Withdrawn
• 2004
  • 2004-08-20 JP JP2006534568A patent/JP2007508626A/ja active Pending
  • 2004-08-20 KR KR1020067007679A patent/KR20060103317A/ko not_active Application Discontinuation
  • 2004-08-20 EP EP04762699A patent/EP1680736A2/de not_active Withdrawn
  • 2004-08-20 US US10/577,009 patent/US20070245133A1/en not_active Abandoned
  • 2004-08-20 WO PCT/DE2004/001859 patent/WO2005045664A2/de active Application Filing
  • 2004-08-20 CN CNA2004800312544A patent/CN1871581A/zh active Pending

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events