EP1807761A1

EP1807761A1 - Method and device for distributing data from at least one data source in a multiprocessor system

Info

Publication number: EP1807761A1
Application number: EP05801268A
Authority: EP
Inventors: Thomas Kottke
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2004-10-25
Filing date: 2005-10-25
Publication date: 2007-07-18
Also published as: WO2006045801A3; DE502005005284D1; JP2008518309A; WO2006045801A2; US20080126718A1; EP1810145A1; US20080209251A1; KR20070067168A; ATE407398T1; WO2006045800A1; WO2006045802A2; US20090164826A1; JP2008518310A; JP2008518308A; KR20070083772A; EP1812861A1; WO2006045802A3; US7853819B2; KR20070062579A; JP2008518311A

Abstract

A unit and method for distributing data from at least one data source in a system provided with at least two computer units, containing switching means which are used to switch between at least two operating modes of the system, wherein data distribution and/or selection of a data source is dependent upon the operating mode.

Description

METHOD AND DEVICE FOR DISTRIBUTING DATA FROM AT LEAST ONE DATA SOURCE IN A PROCESSOR SYSTEM

State of the art

In technical applications, such as in particular in the motor vehicle or in

Industrial goods sector, e.g. In the field of machines and in automation, more and more microprocessor-based or computer-based control and regulation systems are increasingly being used for safety-critical applications. Two-computer systems or dual-processor systems (dual cores) are now commonplace

Computer systems for safety-critical applications, in particular in the vehicle such as for anti-lock braking systems, the electronic stability program (ESP), X-by-wire systems such as drive-by-wire or steer-by-wire and break-by-wire, etc. or in other networked systems. In order to meet these high security requirements in future applications, powerful error detection mechanisms and error handling mechanisms are required, in particular to counteract transient errors that arise, for example, in miniaturization of the semiconductor structures of the computer systems. It is relatively difficult to protect the core itself, so the processor. One solution to this is, as mentioned, the use of a dual-computer system or dual core system for fault detection.

Such processor units with at least two integrated execution units are thus known as dual-core or multi-core architectures. Such dual-core or multi-core architectures are proposed according to the current state of the art mainly for two reasons: On the one hand, an increase in performance, ie a performance increase, can be achieved by considering and treating the two execution units or cores as two arithmetic units on a semiconductor component. In this configuration, the two execution units or cores process different

Programs respectively tasks. As a result, an increase in performance can be achieved, which is why this configuration is referred to as a power mode or performance mode.

The second reason to realize a dual-core or multi-core architecture is one

Increased security by the redundant execution of the same program by the two execution units. The results of the two execution units or CPUs, ie cores, are compared and an error can be recognized in the comparison for consistency. In the following, this configuration is referred to as safety mode or safety mode or error detection mode.

Nowadays, there are on the one hand two- or multi-processor systems that work redundantly to detect hardware errors (see dual-core or master-checker systems) and, on the other hand, two- or multi-processor systems that process different data on their processors. Combining these two modes in a two- or multi-processor system (the sake of simplicity is now only spoken by a two-processor system, the following invention is just as applicable to multiprocessor systems), so the two processors in the performance mode have received different data and in Error detection mode the same data.

The object of the invention is now to present a unit and a method which delivers the instructions / data redundantly or differently to the at least two processors depending on the mode and in particular divides the memory access rights in the performance mode.

Such a unit is not yet known. It enables the effective operation of a two-processor system so that the two modes of safety and performance can be switched during operation. In this case, processors will be discussed below, which also includes cores or computing units conceptually. Description of the embodiments and advantages of the invention

Thus, the invention advantageously proceeds from a data distribution unit comprising at least one data source in a system having at least two arithmetic units, wherein switching means (ModeSwitch) are included by which it is possible to switch between at least two operating modes of the system, the unit being designed such that the data distribution and / or the data source is dependent on the operating mode. Likewise, a system with such a unit is shown.

Likewise, the invention shows a corresponding method for data distribution from at least one data source in a system having at least two arithmetic units, wherein switching means are included by which at least two operating modes of the system can be switched, the data distribution and / or a selection of a data source (in particular Instr Memory, data memory, cache) is dependent on the operating mode.

In this case, the first operating mode corresponds to a safety mode in which the two arithmetic units execute the same programs and / or data and comparison means are provided which compare the states that arise during the execution of the same programs to match

The erfϊndungsgemäße unit or the inventive method allows the implementation of the two modes in a two-processor system.

If the two processors operate in error detection mode (F mode), the two processors receive the same data / instructions and operate in performance mode (P mode), so each processor can access the memory. Then, this unit manages the accesses to the just-existing memory or

Periphery.

In F mode, the unit takes over the data / addresses of a processor (called master here) and forwards them to the components such as memory, bus, etc. The second processor (here slave) wants to make the same access. The data distribution unit - A -

takes this on a second port, but does not forward the request to the other components. The data distribution unit gives the slave the same data as the master and compares the data of the two processors. If these are different, this indicates the data distribution unit (here DVE) by an error signal. Thus, only the master works on the bus / memory and the slave gets the same data (functioning as with a dual-core system).

In P mode, the two processors work on different parts of the program. The memory accesses are thus also different. The DVE thus accepts the request from the processors and returns the results / requested data to the processor that requested them. If both processors now want to access a component at the same time, one processor is put in a wait state until the other one has been operated.

Switching between the two modes and thus the different ones

Operation of the data distribution unit is performed by a control signal. This can either be generated by one of the two processors or externally.

Advantageously, the switching is triggered and / or displayed by a control signal, in particular a mode signal, which is related to the operating mode of at least one arithmetic unit, wherein the control signal is generated in particular externally relative to the arithmetic units.

Furthermore, it is expedient that the switching by a command, in particular a command that describes an illegal action (illOp) is triggered and / or displayed, the command of the switching means, in particular the mode switch unit, is generated.

Advantageously, input data of the two arithmetic units in an operation mode corresponding to a safety mode (F mode) counteract each other

Match compared and / or output data of the two arithmetic units in an operating mode corresponding to a safety mode (F-mode) compared to match compared. Expediently, the data to be distributed are forwarded to at least one further component, in particular a computing unit, wherein the data to be distributed are extended before forwarding by an error detection code. Likewise, the input data can be forwarded to at least one further component, in particular an arithmetic unit, wherein the input data is extended before forwarding by an error detection code. Likewise, the output data may be forwarded to at least one other component, with the output data being extended by an error detection code before being forwarded. For all these cases, an error signal is advantageously output upon detection of an error due to the error detection code. In one embodiment, an error signal is output only in the secure mode (F-mode).

In principle, a distinction can advantageously be made between a performance mode and a security mode, and a prioritization of the data of the two arithmetic units can be carried out in the performance mode, and these data can be received and / or forwarded sequentially as a function of the prioritization.

According to the invention, a delay component may be contained which, depending on a clock offset of the two arithmetic units in the respective operating mode, delays the leading data by precisely this clock offset.

Advantageously, the data to be distributed are read from a memory and then distributed to the computing units.

The data distribution is expediently controlled by state machines, two state machines being provided for each arithmetic unit. These are advantageously designed as a synchronous state machine and an asynchronous state machine.

According to the invention, a system is provided with such a device according to the invention, further provided with an external monitoring unit to the unit, which detects errors if an intended switching of the operating modes does not occur. If the two-processor system is operated with a clock offset in F mode and not in P mode, the DVE unit delays the data for the slave accordingly or stores the output data of the master until it is compared with the output data of the slave for error detection can be.

The clock offset will be explained in more detail with reference to FIG. 1:

FIG. 1 shows a dual-computer system with a first computer 100, in particular one

Master computer and a second computer 101, in particular a slave computer. The entire system is operated with a predeterminable clock or in predeterminable clock cycles (clock cycle) CLK. About the clock input CLKL of the computer 100 and the clock input CLK2 of the computer 101, the clock is supplied to this. In this dual-computer system is also an example of a special feature of

Error detection include, in which namely the first computer 100 and the second computer 101 with a time offset, in particular a predetermined time offset or a predetermined clock offset work. In this case, any time can be predetermined for a time offset and also any desired clock with respect to an offset of the clock cycles. This may be an integer offset of the clock cycle, but just as shown in this example, for example, an offset of 1.5 clock cycles, in which case the first computer 100 just works 1.5 clock cycles before the second computer 101 respectively operated becomes. By this offset can be avoided that common mode failures, the computers or processors, so the cores of the dual-core system, disturbing similar and thus remain unrecognized. That is to say, such common-mode errors relate to the computers at different times in the program sequence due to the offset, and thus cause different effects with respect to the two computers, as a result of which errors become recognizable. Similar error effects without clock skew could not be detected in a comparison, this is avoided. In order to implement this offset with respect to time or clock, in particular 1.5 clock cycles in the dual-computer system, the offset modules 112 to 115 are implemented. In order to detect the said common mode errors, this system is just designed, for example, to operate in a predetermined time offset or clock cycle offset, in particular here 1.5 clock cycles, ie during the one computer, z. B. computer 100 directly the components, in particular the external components 103 and 104 responds, the second computer 101 operates with a delay of exactly 1.5 clock cycles to do so.

In order to produce in this case the desired one and a half cycle delay, ie of 1.5 clock cycles, computer 101 is fed with the inverted clock, that is to say the inverted clock at the clock input CLK2. As a result, but also the aforementioned connections of the computer so its data or commands on the buses to the clock cycles mentioned, so here in particular 1.5 clock cycles are delayed, including just as said the offset or delay blocks 112 to 115 are provided. In addition to the two computers or processors 100 and 101, components 103 and 104 are provided which are connected via buses 116, consisting of the bus lines 116A and 116B and 116C and 117, consisting of the bus lines 117A and 117B to the two computers 100 and 101 , 117 is a command bus in which 117A is a command address bus and 117B is the partial command (data) bus. Address bus 117A is connected to computer 100 via a command address connection IA1 (instruction address 1) and to computer 101 via an instruction address connection IA2 (instruction address 2). The instructions themselves are transmitted via the sub-command bus 117B, which is connected to computer 100 via a command terminal II (Instruction 1) and to computer 101 via a command terminal 12 (Instruction 2). In this command bus 117 consisting of 117A and 117B is a component 103 z. B. an instruction memory, in particular a secure instruction memory or the like interposed. This component, in particular as a command memory is operated in this example with the clock CLK. In addition, at 116, a data bus is shown which includes a data address bus or a data address line 116A and a data bus or a data line 116B. In this case, 116A, that is to say the data address line, is connected to the computer 100 via a data address connection DA1 (data address 1) and to the computer 101 via a data address connection DA2 (data address 2). Likewise, the data bus or data line 116B is via a

Data terminal DOl (Data Out 1) and a data terminal DO2 (Data Out 2) connected to computer 100 or computer 101. In addition to data bus 116, the data bus line 116C, which is connected to computer 100 or computer 101 via a data connection Dil (Data In 1) and a data connection DI2 (Data In 2), respectively is. In this data bus 116 consisting of the lines 116A, 116B and 116C, a component 104 is interposed, for example a data memory, in particular a secure data memory o. Ä. This component 104 is also supplied with the clock CLK in this example.

The components 103 and 104 are representative of any components which are connected via a data bus and / or command bus to the computers of the dual-computer system and corresponding to the accesses via data and / or commands of the dual-processor system with respect to write operations and / or read operations erroneous data and / or commands receive or give away. For error prevention are indeed

Error detection generators 105, 106 and 107 are provided which generate an error detection such as a parity bit or other error code such as an error correction code, so ECC, o. Ä .. are also provided the corresponding Fehlerkennungsprüfeinrichtungen or check Means 108 and 109 for checking the respective misrecognition, for example, the

Parity bit or other error code such as ECC.

The comparison of the data and / or commands with respect to the redundant embodiment in the dual-computer system takes place in the comparators or comparators 110 and 111 as shown in FIG. But now exists a time offset, especially a clock or

Clock cycle offset between the computers 100 and 101, either caused by a non-synchronous Zweiprozessorsystem or in a synchronous Zweiprozessorsystem by errors in the synchronization or as in this particular example by a desired error detection time or clock cycle offset, in particular here of 1.5 clock cycles, so may in this time or

Clock offset a computer here in particular computer 100 erroneous data and / or commands in components, in particular external components such. B. here in particular the memory 103 or 104, but also with respect to other participants or actuators or sensors write or read. Thus, it may also erroneously perform a write access instead of a designated read access by this clock offset. Of course, these scenarios lead to errors in the entire system, in particular without clear display possibility which data and / or commands have just been changed incorrectly, which also causes the recovery problem. In order to solve this problem, a delay unit 102 is now connected as shown in the lines of the data bus and / or in the command bus. For reasons of clarity, only the activation in the data bus is shown. Of course, this is just as possible and imaginable with regard to the command bus. This delay unit 102 or the delay unit delays the accesses, here in particular the memory accesses, in such a way that a possible time or clock offset is compensated, in particular for an error detection, for example via the comparators 110 and 111, for example at least until the error signal is generated in the dual-computer system. So the error detection is performed in the dual-computer system. Different variants can be implemented:

Delay the write and read operations, delay only the write operations, or, although not preferred, delay the read operations. It can be converted by a change signal, in particular the error signal, a delayed write operation in a read operation to prevent erroneous writing.

2, an exemplary implementation concerning the data distribution unit (DVE), which is preferably made of a device for detecting the switching request by IllOPDetect, since the IllOP command (IHOP = Illegal Operation) is used for switching in this example, the mode

Switch unit and the Iram and Dram Control module:

IllOpDetect: Switching between the two modes is detected by the "Switch-Detect" units located between the cache and the processor on the instruction bus and looking to load the IUOp command into the processor.

If the command is detected, this event is communicated to the Modeswitch unit. The Switch-Detect unit is unique to each processor, and the Switch-Detect unit does not need to be fault-tolerant because it is duplicated and redundant. On the other hand, it is conceivable to perform this unit fault-tolerant and thus singular, but preferred is the redundant design.

ModeSwitch: Switching between the two modes is triggered by the "Switch-Detect" unit.If switching from Lock to Split mode, both "Switch-Detect" units will detect switching as both processors are the same Execute program code in Lock mode. The "" switch Detect '"unit of processor 1 detects this 1.5 clocks before the" Switch-Detect "unit of processor 2. The""Modeswitch'" unit halts processor 2 by 2 clocks with the help of the wait signal 2 is also stopped 1.5 clocks later, but only half a clock to synchronize to the system clock, then the status signal is split for the other components, and the two processors continue to work To run tasks, they must diverge in program code, which is done by having read access to the processor ID immediately after switching to split mode This read processor ID is different for each of the two processors, and now becomes a target processor ID, you can then use a Conditional Jump command to move the corresponding processor to a different program location, or switch from split mode to Lo ck mode, this will notice a processor, or one of the two first. This processor will execute program code containing the switchover command. This is now registered by the "Switch-Detect" unit and shares the mode switch

Unit with. This stops the corresponding processor and informs the second of the desire for synchronization by an interrupt. The second processor receives an interrupt and can now execute a software routine to complete its task. Now he also jumps to the program location where the changeover command is located. His "Switch-Detect" unit now also signals the desire for

Mode change to the Modeswitch unit. For the next rising system clock edge, the wait signal for the processor 1 is now deactivated and 1.5 clocks later for the processor 2. Now both work synchronously again with a clock offset of 1.5 clocks.

If the system is in Lock mode, both "Switch-Detect" units must notify the Modeswitch unit that they want to switch to split mode, and if the changeover request is only from one unit, the error is detected by the comparison units These continue to receive data from one of the two processors and they do not match the stopped processors.

If the two processors are in split mode and one does not switch back to lock mode, this can be detected by an external watchdog. Upon a trigger signal for each processor, the watchdog notices that the waiting processor is no longer reporting. If there is only one watchdog signal for the processor system, then the triggering of the watchdog must only take place in lock mode. Thus, the Watchdog detect that the mode switch was not made. The mode signal is available as a dual-rail signal. Where "UO" is the lock mode and " ^Λ 01" is the split mode. Errors have occurred with "W and" ^Λ 11 "'.

IramControl: Access to the instruction memory of the two processors is controlled via the IRAM Control. This must be designed securely because it is a single point of failure. It consists of two state machines for each processor, an isochronous iramlclkreset and an asynchronous readiraml. In safety-critical mode, the state machines of the two processors monitor each other and in performance mode, they work separately.

The reloading of the two caches of the processors are controlled by 2 state machines. A synchronous state machine iramclkreset and an asynchronous readiram. These two state machines also make the memory accesses in the

Distributed split mode. Here processor 1 has the higher priority. After a access to the main memory by processor 1 gets now - if both processors want to access the main memory again ~ processor2 assigned the memory access permission. These two state machines are implemented for each processor. In lock mode, the output signals of the machines are compared to detect any errors.

The data for updating the cache 2 in lock mode are delayed by 1.5 cycles in the IRAM control unit.

In bit 5 in register 0 of the SysControl is encoded which core is concerned. Core 1 is bit 0 and Core 2 is high. This register is mirrored in the memory area with the address 65528.

In a memory access of Core 2 is first checked in which mode is the

Computer is located. If it is in lock mode, its memory access is suppressed. This signal is available as a common-rail signal because it is safety-critical.

The program counter of the processor 1 is delayed by 1.5 clocks to be compared in lock mode with the program counter of the processor 2 can. In split mode, the caches of the two processors can be reloaded differently. When switching to lock mode, the two caches are not coherent. As a result, the two processors can diverge and the comparators thus signal an error. To avoid this is in the IRAM

Control a flag table built. This indicates whether a cache line was written in lock or split mode. In lock mode, the cache line entry value is set to 0 on a cache line reload, and in split mode, even if the cache line is cached from a single cache, to 1. If the processor now executes a memory access in lock mode, then checks if this cache line has been updated in lock mode, ie is the same in both caches. in the

Split mode allows the processor to always access the cache line regardless of the Vector flag. This table only has to be present once, since in the case of an error the two processors diverge and thus the errors are reliably detected at the comparators. Since the access times on the central table are relatively high, this table can also be copied to every cache.

DramControl: In this component, the parity is formed for each of the address, data, and memory control signals from each processor.

There is a process for both processors to lock the memory. This process does not have to be implemented safely because in Lock mode faulty memory accesses are detected by the comparators and no safety-relevant applications are executed in split mode. Here it is checked if the processor wants to lock the memory for the other processor. This data memory is locked by accessing the memory address $ FBFF $ = 64511. This signal should be present for exactly one cycle, even if a wait command is present at the processor at the time of the call. The state machine for managing the data storage access consists of 2 main states:

- Processor Status Lock: The two processors are in lock mode. That the functionality of the data storage icing is not necessary. Processor 1 coordinates the memory accesses.

- Processor status Split: An access conflict resolution to the data storage is now necessary and a storage lock must be possible. The state in split mode is again divided into 7 states, which resolve the access conflicts and the

Lock data storage for each other processor. At the same time request of the two processors in an access, the listed order is also the prioritization.

- Corel \ _Lock: Processor 1 has locked the data store. If processor 2 wants to access the memory in this state, it is stopped by a wait signal until processor 1 releases the data memory again. \

- Core2 \ _Lock: Is the same state as the previous one except that now processor 2 has locked the data memory and processor 1 is stopped during data storage operations.

- Lockl \ _wait: The data storage was locked by the processor 2 as processor 1 wanted him to reserve for himself. Processor 1 is thus for the next one

Memory lock marked.

- nex: The same for processor 2. The data store was locked during the attempted lock by processor 1. Processor 2 gets the memory pre-reserved. In the case of normal memory access without locks, processor 2 can access processor 1 before processor 1 if processor 1 was in front of it.

Memory access of processor 1: The memory is not locked in this case. Processor 1 is allowed to access the data store. If he wants to lock him, he can do so in this condition.

Memory access by processor 2. In the same clock processor 1 did not want to access the memory thus the memory is free for the processor 2.

- no processor wants to access the data store

As mentioned, the DVE consists of the detection of the switching request (IllOPDetect) of the ModeSwitch unit and the Iram and DramControl.

As stated above, the core of the invention is the general mode of operation of the data distribution unit DVE (different data allocation depending on the mode and thus also selection of the operating mode). In addition, however, the illustrated special implementation of the DVE solves the task mentioned at the beginning.

Claims

claims

A method for distributing data from at least one data source in a system having at least two arithmetic units, wherein switching means are provided by which can be switched between at least two operating modes of the system, wherein the data distribution and / or a selection of a data source is dependent on the operating mode.

2. The method according to claim 1, characterized in that the switching by a control signal, in particular a mode signal, which is based on the operating mode of at least one arithmetic unit, triggered and / or displayed.

3. The method according to claim 2, characterized in that the control signal is generated externally based on the arithmetic units.

4. The method according to claim 1, characterized in that the switching by a command, in particular a command which describes an illegal action (illOp) is triggered and / or displayed.

5. The method according to claim 4, characterized in that the command of the

Switching means, in particular the mode switch unit, is generated.

6. The method according to claim 1, characterized in that input data of the two arithmetic units in an operating mode which corresponds to a safety mode (F-mode) are compared against coincidence.

7. The method according to claim 1, characterized in that output data of the two arithmetic units in an operating mode, which corresponds to a safety mode (F-mode) are compared against coincidence.

8. The method according to claim 1, characterized in that the data to be distributed to at least one further component, in particular a computing unit, forwarded, wherein the data to be distributed are extended before forwarding to a fault detection code.

9. The method according to claim 6, characterized in that the input data to at least one further component, in particular a computing unit, are forwarded, wherein the input data are extended before forwarding to an error detection code.

10. The method according to claim 7, characterized in that the output data are forwarded to at least one further component, wherein the output data are extended before forwarding to an error detection code.

11. The method according to claim 6 or 7, characterized in that when missing

Match an error signal is output.

12. The method according to any one of claims 8 to 10, characterized in that upon detection of an error due to the error detection code, an error signal is output.

13. The method according to claim 11 or 12, characterized in that an error signal is output only in the safety mode (F-mode).

14. The method according to claim 1, characterized in that between a

Performance mode and a security mode is distinguished and in the performance mode, a prioritization of the data of the two arithmetic units is made and these data are received and / or forwarded sequentially in dependence on the prioritization.

15. Unit for data distribution from at least one data source in a system having at least two arithmetic units, wherein switching means are provided by which can be switched between at least two operating modes of the system, wherein the unit is configured such that the data distribution and / or the data source depends on the operating mode

16. Data distribution unit according to claim 15, characterized in that the first operating mode corresponds to a security mode in which the two arithmetic units execute identical programs and comparison means are provided which compare the states resulting from the execution of the same programs for agreement.

The data distribution unit according to claim 15, characterized in that the unit is configured to compare input data of the two arithmetic units in an operation mode corresponding to a safety mode (F mode) against coincidence.

The data distribution unit according to claim 15, characterized in that the unit is configured to compare output data of the two arithmetic units in an operation mode corresponding to a safety mode (F mode) against coincidence.

19. Unit for data distribution according to claim 15 or 17 or 18, characterized in that the unit is designed such that the data to be distributed to at least one further component, in particular a computing unit, forwarded, wherein the data to be distributed before forwarding by a Error detection code to be extended.

20. Unit for data distribution according to claim 15, characterized in that the unit is designed in such a way that, in the performance mode, it prioritizes the data of the two arithmetic units and receives and / or forwards these data sequentially as a function of the prioritization.

21 unit for data distribution according to claim 15, dadruch in that a delay component is included, which delays the leading data by just this clock offset depending on a clock offset of the two arithmetic units in the respective operating mode.

22 unit for data distribution according to claim 15, characterized gekennuzeichnet that the unit is designed such that it reads the data to be distributed from a memory and then distributed to the arithmetic units.

23. Data distribution unit according to claim 15, characterized in that the unit is designed such that the distribution of the data is controlled by state machines.

24. Unit for data distribution according to claim 23, characterized gekennuzeichnet that the unit is designed such that two state machines are provided for each arithmetic unit.

The data distribution unit according to claim 23, characterized in that the unit is configured such that a synchronous state machine and an asynchronous state machine.

26. A data distribution unit system according to any one of claims 15 to 25.

27. The system according to claim 26, characterized in that an external monitoring unit is provided to the unit, which detects errors if an intended switching of the operating modes does not occur.