EP1639454A2 - Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante - Google Patents

Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante

Info

Publication number
EP1639454A2
EP1639454A2 EP04738748A EP04738748A EP1639454A2 EP 1639454 A2 EP1639454 A2 EP 1639454A2 EP 04738748 A EP04738748 A EP 04738748A EP 04738748 A EP04738748 A EP 04738748A EP 1639454 A2 EP1639454 A2 EP 1639454A2
Authority
EP
European Patent Office
Prior art keywords
operating mode
processor unit
execution units
memory area
programs
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
EP04738748A
Other languages
German (de)
English (en)
Inventor
Reinhard Weiberle
Bernd Mueller
Ralf Angerbauer
Rainer Gmehlich
Stefan Benz
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Robert Bosch GmbH
Original Assignee
Robert Bosch GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from DE10332700A external-priority patent/DE10332700A1/de
Application filed by Robert Bosch GmbH filed Critical Robert Bosch GmbH
Publication of EP1639454A2 publication Critical patent/EP1639454A2/fr
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/1629—Error detection by comparing the output of redundant processing systems
    • G06F11/1641—Error detection by comparing the output of redundant processing systems where the comparison is not performed by the redundant processing components
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30181—Instruction operation extension or modification
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/30181—Instruction operation extension or modification
    • G06F9/30189—Instruction operation extension or modification according to execution mode, e.g. mode flag
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
    • G06F9/3851—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution from multiple instruction streams, e.g. multistreaming
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
    • G06F9/38—Concurrent instruction execution, e.g. pipeline or look ahead
    • G06F9/3885—Concurrent instruction execution, e.g. pipeline or look ahead using a plurality of independent parallel functional units
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/1629—Error detection by comparing the output of redundant processing systems
    • G06F11/165—Error detection by comparing the output of redundant processing systems with continued operation after detection of the error
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/845—Systems in which the redundancy can be transformed in increased performance

Definitions

  • the invention is based on a method for switching between at least two
  • Such processor units with at least two integrated execution units are also known as dual-core or multi-core architectures.
  • dual-core or multi-core architectures are proposed according to the current state of the art for two main reasons:
  • an increase in performance that is to say an increase in performance
  • the two execution units or gores process different programs or tasks. This enables an increase in performance, which is why this configuration is referred to as performance mode.
  • the second reason for realizing a dual-core or multi-core architecture is an increase in security in that the two execution units redundantly process the same program.
  • the results of the two execution units or CPUs, that is Cores are compared and an error can be identified in the comparison for a match.
  • this configuration is referred to as safety mode.
  • Multi-core architecture included d. H. the computer with the at least two execution units is in principle only operated in one mode, the performance mode or the safety mode.
  • the object of the invention is to combine operation of such a dual or multi
  • the invention is based on a method for switching between at least two operating modes of a processor unit with at least two execution units and a corresponding processor unit.
  • the switchover from a first to a second operating mode is advantageously achieved by accessing a predetermined memory address which acts as a switch trigger.
  • Hardware components such as switching means (mode selector) or comparison means and a corresponding method are presented, such as in operation between safety-critical programs, which are therefore executed redundantly in safety mode, and non-safety-critical programs, which are executed independently of one another on both execution units in performance mode can.
  • the same programs are processed synchronously in the first operating mode by the at least two execution units and checked by means of comparison means provided that the states of the execution units which arise when the same programs are processed match.
  • Deviations in this regard are then conceivable different error reactions from an error display to an emergency operation to the shutdown of the faulty unit.
  • the first operating mode corresponds to
  • a switchover from the second operating mode to the first operating mode is expediently carried out by an interrupt request, in particular triggered by an interrupt means, the interrupt request being triggered on the one hand by a time condition or also by a condition condition, i.e. a certain condition of at least one of the two execution units or also the Corresponds to the occurrence of a certain event.
  • a special division into at least three separate memory areas advantageously takes place, the execution units depending on the respective one
  • Operating mode have access to a first memory area or a second memory area, or are connected to it.
  • each of the at least two execution units is expediently assigned a first memory area on the processor unit with which the latter is used in the first operating mode, that is to say in particular
  • both execution units In the second operating mode, both execution units only have access to or are connected to a second memory area assigned to both execution units.
  • Monitoring means in particular the switching means themselves, are expediently provided in such a way that monitoring is carried out so that only the corresponding memory areas are accessed in the respective operating mode or the corresponding connection to the memory areas exists. I.e. grab in the second operating mode the evaluation means only to the second memory area and not to the first memory areas, and in the first operating mode the access is only to the respective first memory areas and not to the second memory area, which is checked by the aforementioned monitoring means and possibly in corresponding error reactions such as error messages, emergency operation or shutdown is sanctioned.
  • Each of the three memory areas mentioned is provided in a separate memory module, so that at least three memory modules are available on the processor unit.
  • the safety-critical programs are expediently stored in a first memory area, and the non-safety-critical programs are stored in the second memory area, the predetermined memory address which has the aforementioned trigger function with regard to the switchover being expediently contained in the second memory area.
  • a further advantage is obtained if explicit comparison means are provided on the processor unit for comparing the states of the execution units in the first operating mode and these comparison means are only functional in the first operating mode and are deactivated during the transition to the second operating mode, so that in the non-redundant manner , non-safety-critical operation, no comparison and therefore no possibly provoked error reaction.
  • FIG. 1 shows a processor unit according to the invention with at least two execution units and the hardware components according to the invention.
  • Figure 2 discloses switching from safety mode to power mode, whereas
  • Figure 3 illustrates a switch from power mode to safety mode.
  • control applications in particular in the field of motor vehicle control, such as engine control, brake control or steering and transmission, etc., but also in industrial applications such as automation or in
  • the processor unit of the system according to the invention consists of a dual-core architecture according to FIG. 1, that is to say a processor unit 100 with at least two execution units 101 and 102 (CPU1 and CPU2).
  • the two execution units 101, 102, ie CPU1 and CPU2 are each assigned a working memory 110 or 111, also referred to as RAM1 and RAM2. Both execution units 101 and 102 are with one
  • Comparison means a comparator 170 connected.
  • Each execution unit also has a connection to a switching means, a mode selector 130 or 131, to which the comparison module, the comparison means 170, also has connections.
  • the respective volatile working memory is via a bus 140 or 141 110 and 111 as well as the switching means 130 and 131 are each connected to a first storage means 150 and 151 and a second storage means 180.
  • two operating systems are used, one for the safety-critical programs or tasks and one for the non-safety-critical ones
  • OSEKtime OS for example, is used as the operating system for the safety-critical programs
  • OSEK OS for example, is used as the operating system for the non-safety-critical tasks.
  • the application software is divided into security-critical ones
  • the safety-relevant, that is to say the safety-critical, tasks or programs are executed redundantly on both execution units 101 and 102, that is to say both CPUs, CPU1 and CPU2. These programs are processed under the control of the first operating system, here OSEKtime OS.
  • the non-volatile memory area 150 and 151 shown in FIG. 1 is doubled in two parts, so that there are two first memory areas 150 and 151, corresponding to two execution devices.
  • the safety-critical programs or tasks are doubled in these first memory areas, ie redundant. I.e. each of the security-critical tasks is located on the one hand in the memory area 150 and on the other hand in the memory area 151.
  • the first operating system itself can be classified as security-critical and is therefore also stored in both memory areas.
  • the operating system OSEKtime OS is stored on the one hand in the memory area 150 and on the other hand in the memory area 151.
  • the first two memory areas are each in a special design as their own non-volatile Memory module ROM1 or ROM2 executed, which can be executed as ROM, PROM, EPROM, EEPROM, Flash-EPROM etc.
  • Double storage of the security-critical programs or tasks is not absolutely necessary. These can also be achieved by using an ECC code (Error Code and
  • Such methods for error detection in a memory are diverse, the basic requirement being security with an error detection or error correction code, ie a signature.
  • this signature can only consist of a signature bit, for example a parity bit.
  • protection can also be provided by more complex ED codes (error
  • Detection such as a Berger code or a Bose-Lin code, etc., or also by a more complex ECC code, such as a Hamming code, etc., in order to enable more reliable error detection using the corresponding number of bits.
  • a code generator for example a generator table (hard-wired or in software) to match certain input patterns
  • the programs or tasks which are not safety-relevant or safety-critical are calculated in a distributed manner on both execution units, that is to say CPUs, and are executed under the control of the respective sub-operating system, in this case the OSEK subsystem.
  • an independent operating system runs here on each of the two execution units, here an independent OSEK system.
  • the second memory area 180 in which the non-safety-critical programs or tasks are located, is simply present. He is from both
  • this second memory area can also be designed as a separate non-volatile memory module ROM3 and as a ROM, PROM, EPROM, EEPROM, Flash-EPROM etc.
  • the memory areas that is to say the first and second memory areas, can be designed such that the first memory areas or the first memory area (in the case of ECC protection), for example between 0 and X in relation to the addresses and the second memory area from X + 1 to Y also in relation to which addresses are trained.
  • a doubled first memory area is assumed, whereby, as previously explained, only a single first secured memory area can be used. Then, as already mentioned, the first memory area from 0 to X is present twice in a first memory area.
  • Each first memory area is specifically assigned to an execution unit.
  • the safety-critical programs or tasks run redundantly and in particular synchronously on both execution units, that is to say both CPUs 101 and 102.
  • the respective CPU states are compared with one another in the comparison means, the comparator 170.
  • Certain program phases can be assigned to certain program phases, which can then be compared in a time-uncritical manner, that is to say at any time, provided that these are stored temporarily and can be compared, for example, by an identifier.
  • the safety-critical programs or tasks are not only processed redundantly, but synchronously, so that a comparison of the respective states of the execution units can be carried out directly during operation.
  • the new commands and / or data are then correspondingly loaded and processed from the respectively assigned first memory area 150 or 151.
  • the CPU states are checked for agreement, and errors are identified if the states, which should correspond, deviate.
  • An error response is, on the one hand, an error display with regard to the respective system in which the processor unit is installed, and, on the other hand, error responses such as an emergency operation, i.e. the operation of the system in which the processor unit resides, in a secured emergency operation, for example with specially provided programs and / or data. It can also with a more extensive error evaluation, for. B.
  • n and m are natural numbers and n> 2 and m>n> m / 2 or also a 1 from k code, where k corresponds to a natural number> 1. If, for example, an execution unit is clearly identified as faulty by such a test, it can be used as a further fault reaction - 3 -
  • the execution units are only permitted access to addresses or data in the first memory areas. I.e. in the first operating mode, the respective execution unit may only access the first memory area, in particular its associated memory area. This is checked by monitoring means, in particular the switching means or mode selectors 130 or 131 or monitoring means in the mode selectors 130 and 131. If errors occur here, a comparable error reaction, as described above, is conceivable and foreseeable with regard to a comparison error when the CPU states match. I.e. but also that the switchover means, in this case the mode selectors 130 or 131 for this case of the first operating mode, establish a connection to the associated first memory area 150 or 151 via bus 140 or 141 or monitor a corresponding access violation.
  • the non-safety-critical programs or tasks are processed.
  • Various non-safety-critical programs run on both execution units, that is to say CPUs 1 and 2 (101, 102). This includes, for example, the operating system itself for the second operating mode, i.e. the OSEK subsystem.
  • the two execution units or CPUs thus share a non-volatile second memory area which, as described above, can be designed.
  • each CPU has its own volatile memory area RAM1 and RAM2, 110, respectively
  • the power mode according to our exemplary embodiment, no access to an address in the first memory area is permitted.
  • the checking is carried out by checking means, in particular by the switching means, the mode selectors, or else the checking means are carried out separately in the mode selectors.
  • an incorrect access is detected in the second operating mode, a corresponding error reaction can also be initiated here.
  • an error response corresponding to the first operating mode is conceivable and can be predetermined. This is particularly useful because, in the event of incorrect access, security-critical memory areas may be accessed. On the one hand, this can be realized in that a connection to the second memory area is only established in the second operating mode and the connection to the first memory areas is capped in this operating mode or access to the first memory area is prevented in some other way and only allowed in the second memory area.
  • Address can appear in the first memory area during program execution or can be appropriately supplied from the outside. I.e. in the first operating mode or security mode, only addresses or a program in the first memory area may be accessed; if in this security mode to another address e.g. is accessed in the second memory area, there is an error with a possible corresponding error response, as described above. This is illustrated once again in FIG. In block 200, both execution units 101 and 102 are in the first operating mode, that is to say the safety mode. In query 210 it is checked whether the address of the next command is equal to the trigger address of the corresponding excellent changeover address. If not, both are
  • Processing units continue to be in the first operating mode and thus each access the first memory areas 150, 151. However, if the address of the next command and / or date corresponds to the trigger address, then in block 220 there is a switchover or change to the second operating mode, the performance or performance Fashion. Each execution unit also receives an address in the second memory area at which processing in the second operating mode is to be continued. In this case, the comparison unit or the comparison means 170 is switched off, ie deactivated (disabled). In block 230, the first processing unit 101 is thus in the second operating mode and in block 231 the second execution unit 102 is also in the second operating mode, the performance mode. I.e.
  • the safety mode to the performance mode is in the specific example, for example, to call a special OSEKtime task T r jgg er such as the ttidle task of the OSEKtime operating system or the one contained therein, as the trigger address, especially the address
  • the T ⁇ rj gg er task like ttidle is, for example, a call to the OSEK scheduler, which is located in the second memory area 180.
  • the switchover devices that is to say the mode selectors 130, 131
  • this corresponding address is set as the trigger address in order to switch to the power mode.
  • this is checked in block 210, that is to say the mode selectors, the switching means. This means that future address accesses may only take place in the ROM area 180, that is to say the non-volatile second memory area, until another change to the security mode.
  • FIG. 3 now shows the switchover or change from the power mode, that is to say the performance mode, in particular back to the first operating mode, the safety mode or safety mode.
  • execution unit 101 that is CPU 1 in the second operating mode, is the performance mode.
  • the performance mode is the performance mode.
  • an interrupt request an interrupt, is triggered for each execution unit, which causes a switchover in block 330 from both execution units 101 and 102 to the first operating mode, the safety mode.
  • the comparator 170 is switched on again, and in block 340 both execution units then run again in the safety mode, the first operating mode.
  • the interrupt request can be triggered on the one hand by a time condition, that is to say a timer interrupt, or by a condition or event condition be triggered. This means that in order to switch from performance mode to security mode, an interrupt request from the first operating system OSEKtime is generated.
  • This timer interrupt of the OSEKtime operating system which has higher priority than the OSEK operating system, is programmed in the same way in both CPUs, since the same OSEKtime system is running on both CPUs. Especially when OSEKtime-
  • Interrupt requests also put the comparison means 170 back into function, that is, switched to the first operating state, the safety mode, and the execution units in particular run again redundantly.
  • Event interrupt are used to accomplish the above-mentioned change of operating mode from the second to the first operating mode.
  • a certain state of the execution units can trigger a high-priority interrupt, for example, which is then valid for both execution units.
  • This can be, for example, a state generated by the processing of the programs in ROM 180 in a CPU, which triggers such a high-priority interrupt request, which also applies to the second CPU.
  • an event in particular also an event supplied externally to the processor unit, can trigger such an interrupt and thus the change in operating mode.
  • the first variant with the timer interrupt is preferred, but the status or event interrupt as described is also conceivable and is hereby disclosed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Quality & Reliability (AREA)
  • Hardware Redundancy (AREA)
  • Multi Processors (AREA)
  • Information Transfer Systems (AREA)
  • Debugging And Monitoring (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention concerne un procédé de commutation entre au moins deux modes de fonctionnement d'une unité centrale pourvue d'au moins deux unités d'exécution. L'invention est caractérisée en ce qu'un changement d'un premier mode de fonctionnement à un deuxième mode de fonctionnement est déclenché lorsque l'unité centrale accède à une adresse mémoire prédéterminée.
EP04738748A 2003-06-24 2004-06-22 Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante Ceased EP1639454A2 (fr)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
DE10328208 2003-06-24
DE10332700A DE10332700A1 (de) 2003-06-24 2003-07-18 Verfahren zur Umschaltung zwischen wenigstens zwei Betriebsmodi einer Prozessoreinheit sowie entsprechende Prozessoreinheit
PCT/DE2004/001299 WO2005003962A2 (fr) 2003-06-24 2004-06-22 Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante

Publications (1)

Publication Number Publication Date
EP1639454A2 true EP1639454A2 (fr) 2006-03-29

Family

ID=33566007

Family Applications (1)

Application Number Title Priority Date Filing Date
EP04738748A Ceased EP1639454A2 (fr) 2003-06-24 2004-06-22 Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante

Country Status (7)

Country Link
US (1) US20070277023A1 (fr)
EP (1) EP1639454A2 (fr)
JP (1) JP4232987B2 (fr)
KR (1) KR20060026884A (fr)
BR (1) BRPI0411824A (fr)
RU (1) RU2006101719A (fr)
WO (1) WO2005003962A2 (fr)

Families Citing this family (46)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10349581A1 (de) * 2003-10-24 2005-05-25 Robert Bosch Gmbh Verfahren und Vorrichtung zur Umschaltung zwischen wenigstens zwei Betriebsmodi einer Prozessoreinheit
JP5053854B2 (ja) * 2004-10-25 2012-10-24 ローベルト ボッシュ ゲゼルシャフト ミット ベシュレンクテル ハフツング 少なくとも２つの実施ユニットを有する計算機システムにおける切替え方法および装置
EP1807761A1 (fr) * 2004-10-25 2007-07-18 Robert Bosch Gmbh Procede et dispositif pour repartir des donnees d'au moins une source de donnees dans un systeme a plusieurs processeurs
DE102004051952A1 (de) * 2004-10-25 2006-04-27 Robert Bosch Gmbh Verfahren zur Datenverteilung und Datenverteilungseinheit in einem Mehrprozessorsystem
DE102005037213A1 (de) * 2004-10-25 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Umschaltung zwischen Betriebsmodi eines Multiprozessorsystems durch wenigstens ein externes Signal
US20070011513A1 (en) * 2005-06-13 2007-01-11 Intel Corporation Selective activation of error mitigation based on bit level error count
DE102005037230A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Überwachung von Funktionen eines Rechnersystems
DE102005037248A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Steuerung eines Speicherzugriffs bei einem Rechnersystem mit wenigsterns zwei Ausführungseinheiten
DE102005037226A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Festlegung eines Startzustandes bei einem Rechnersystem mit wenigstens zwei Ausführungseinheiten durch markieren von Registern
DE102005037233A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Datenverarbeitung
DE102005037244A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zur Steuerung eines Rechnersystems mit wenigstens zwei Ausführungseinheiten und mit wenigstens zwei Gruppen von internen Zuständen
DE102005037217A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren und Vorrichtung zum Vergleich von Daten bei einem Rechnersystem mit wenigstens zwei Ausführungseinheiten
DE102005037215A1 (de) * 2005-08-08 2007-02-15 Robert Bosch Gmbh Verfahren zur Speicherung von Daten und/oder Befehlen in einem Rechnersystem mit wenigstens zwei Verarbeitungseinheiten und wenigstens einem ersten Speicher oder Speicherbereich für Daten und/oder Befehle
DE102005055067A1 (de) * 2005-11-18 2007-05-24 Robert Bosch Gmbh Vorrichtung und Verfahren zum Beheben von Fehlern bei einem wenigstens zwei Ausführungseinheiten mit Registern aufweisenden System
JP4784827B2 (ja) * 2006-06-06 2011-10-05 学校法人早稲田大学 ヘテロジニアスマルチプロセッサ向けグローバルコンパイラ
DE102006048174A1 (de) 2006-10-10 2008-04-17 Robert Bosch Gmbh Einspritzsystem und Verfahren zum Betreiben eines Einspritzsystems
DE102006048173A1 (de) * 2006-10-10 2008-04-17 Robert Bosch Gmbh Verfahren zum Umschalten eines Systems mit mehreren Ausführungseinheiten
DE102006048172A1 (de) * 2006-10-10 2008-04-17 Robert Bosch Gmbh Elektronisches System
US7941698B1 (en) * 2008-04-30 2011-05-10 Hewlett-Packard Development Company, L.P. Selective availability in processor systems
DE102008062594A1 (de) * 2008-12-16 2010-07-01 Diehl Aerospace Gmbh Mehrkanal-Kontrollermodul
US9081688B2 (en) * 2008-12-30 2015-07-14 Intel Corporation Obtaining data for redundant multithreading (RMT) execution
US9594648B2 (en) * 2008-12-30 2017-03-14 Intel Corporation Controlling non-redundant execution in a redundant multithreading (RMT) processor
JP2010198131A (ja) * 2009-02-23 2010-09-09 Renesas Electronics Corp プロセッサシステム、及びプロセッサシステムの動作モード切り替え方法
US8375250B2 (en) * 2009-03-04 2013-02-12 Infineon Technologies Ag System and method for testing a module
WO2011101707A1 (fr) * 2010-02-16 2011-08-25 Freescale Semiconductor, Inc. Procédé de traitement de données, processeur de données et appareil comprenant un processeur de données
US9405637B2 (en) * 2011-01-18 2016-08-02 Texas Instruments Incorporated Locking/unlocking CPUs to operate in safety mode or performance mode without rebooting
US9367438B2 (en) 2011-04-21 2016-06-14 Renesas Electronics Corporation Semiconductor integrated circuit and method for operating same
WO2014080245A1 (fr) 2012-11-22 2014-05-30 Freescale Semiconductor, Inc. Dispositif de traitement de données, procédé de détection d'erreurs d'exécution et circuit intégré
DE102013218814A1 (de) 2013-09-19 2015-03-19 Siemens Aktiengesellschaft Verfahren zum Betreiben eines sicherheitskritischen Systems
JP6090094B2 (ja) * 2013-10-02 2017-03-08 トヨタ自動車株式会社 情報処理装置
US9760446B2 (en) * 2014-06-11 2017-09-12 Micron Technology, Inc. Conveying value of implementing an integrated data management and protection system
US9823983B2 (en) 2014-09-25 2017-11-21 Nxp Usa, Inc. Electronic fault detection unit
US9658793B2 (en) * 2015-02-20 2017-05-23 Qualcomm Incorporated Adaptive mode translation lookaside buffer search and access fault
US9858201B2 (en) 2015-02-20 2018-01-02 Qualcomm Incorporated Selective translation lookaside buffer search and page fault
JP6378119B2 (ja) * 2015-03-16 2018-08-22 日立建機株式会社 制御コントローラ、ステアバイワイヤシステムおよび機械
US10063569B2 (en) * 2015-03-24 2018-08-28 Intel Corporation Custom protection against side channel attacks
US10002056B2 (en) * 2015-09-15 2018-06-19 Texas Instruments Incorporated Integrated circuit chip with cores asymmetrically oriented with respect to each other
US9734006B2 (en) * 2015-09-18 2017-08-15 Nxp Usa, Inc. System and method for error detection in a critical system
RU2623883C1 (ru) * 2016-02-18 2017-06-29 Акционерное общество "Лаборатория Касперского" Способ выполнения инструкций в системной памяти
RU2634172C1 (ru) * 2016-06-02 2017-10-24 Акционерное общество "Лаборатория Касперского" Способ передачи управления между адресными пространствами
JP6356736B2 (ja) * 2016-06-29 2018-07-11 ファナック株式会社 コントローラシステムおよび制御方法
US11535266B2 (en) * 2017-07-13 2022-12-27 Danfoss Power Solutions Ii Technology A/S Electromechanical controller for vehicles having a main processing module and a safety processing module
GB2579591B (en) 2018-12-04 2022-10-26 Imagination Tech Ltd Buffer checker
GB2579590B (en) 2018-12-04 2021-10-13 Imagination Tech Ltd Workload repetition redundancy
EP4078434A2 (fr) * 2019-12-20 2022-10-26 ZF Friedrichshafen AG Appareil de commande pour système d'aide à la conduite et système d'aide à la conduite
US20240118901A1 (en) * 2022-10-07 2024-04-11 Xilinx, Inc. Switching between redundant and non-redundant modes of software execution

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5754762A (en) * 1997-01-13 1998-05-19 Kuo; Chih-Cheng Secure multiple application IC card using interrupt instruction issued by operating system or application program to control operation flag that determines the operational mode of bi-modal CPU
DE19713192C2 (de) * 1997-03-27 2000-02-24 Rheinmetall Ind Ag Trägerfahrzeug für eine Rohrwaffe mit einer Abstützvorrichtung
US6615366B1 (en) * 1999-12-21 2003-09-02 Intel Corporation Microprocessor with dual execution core operable in high reliability mode
US6772368B2 (en) * 2000-12-11 2004-08-03 International Business Machines Corporation Multiprocessor with pair-wise high reliability mode, and method therefore
DE10136335B4 (de) * 2001-07-26 2007-03-22 Infineon Technologies Ag Prozessor mit mehreren Rechenwerken

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See references of WO2005003962A2 *

Also Published As

Publication number Publication date
KR20060026884A (ko) 2006-03-24
WO2005003962A2 (fr) 2005-01-13
JP2007507015A (ja) 2007-03-22
WO2005003962A3 (fr) 2006-01-26
JP4232987B2 (ja) 2009-03-04
RU2006101719A (ru) 2007-07-27
BRPI0411824A (pt) 2006-08-08
US20070277023A1 (en) 2007-11-29

Similar Documents

Publication Publication Date Title
EP1639454A2 (fr) Procede de commutation entre au moins deux modes de fonctionnement d'une unite centrale et unite centrale correspondante
DE10332700A1 (de) Verfahren zur Umschaltung zwischen wenigstens zwei Betriebsmodi einer Prozessoreinheit sowie entsprechende Prozessoreinheit
EP2550599B1 (fr) Système d'ordinateur de commande, procédé de commande d'un système d'ordinateur de commande, et utilisation d'un système d'ordinateur de commande
DE60019038T2 (de) Intelligente Fehlerverwaltung
EP2193408B1 (fr) Système microprocesseur intégré pour des régulations critiques pour la sécurité
EP1917592B1 (fr) Systeme informatique comprenant au moins deux unites d'execution et une unite de comparaison et son procede de commande
EP0976012B1 (fr) Systeme de microprocesseur pour systemes de regulation a securite critique
EP1323039B1 (fr) Procede pour faire fonctionner un systeme commande par un processeur
EP2079917B1 (fr) Procédé et dispositif de surveillance du bon fonctionnement de la commande d'un moteur à combustion interne
DE10349581A1 (de) Verfahren und Vorrichtung zur Umschaltung zwischen wenigstens zwei Betriebsmodi einer Prozessoreinheit
EP2641176A1 (fr) Système de microprocesseur doté d'une architecture tolérante aux erreurs
WO1998053374A1 (fr) Systeme de microprocesseur pour systemes de regulation de vehicules automobiles
EP1046088A1 (fr) Dispositif numerique electronique
DE19509150C2 (de) Verfahren zum Steuern und Regeln von Fahrzeug-Bremsanlagen sowie Fahrzeug-Bremsanlage
EP1043641A2 (fr) Système d'automatisation à sécurité intrinsèque avec un processeur standard et méthode pour un système d'automatisation à sécurité intrinsèque
DE102007056218A1 (de) Verfahren zur Behandlung von transienten Fehlern in Echtzeitsystemen, insbesondere in Steuergeräten von Kraftfahrzeugen
EP1680737A1 (fr) Procede et dispositif de traitement d'operandes dans un processeur
DE102014011665A1 (de) System und Verfahren für DMA-Betrieb mit hoher Integrität
WO2017080793A2 (fr) Procédé de fonctionnement d'un processeur multicœur
EP2228723B1 (fr) Procédé de gestion des erreurs d'un système de calcul
EP3841439B1 (fr) Système d'automatisation de la surveillance d'un processus critique en matière de sécurité
DE102011007467A1 (de) Mehrkernige integrierte Mikroprozessorschaltung mit Prüfeinrichtung, Prüfverfahren und Verwendung
DE102017100119A1 (de) Steuersystem für ein Kraftfahrzeug mit Hardware-Ausfallsicherung
EP1649373A2 (fr) Procede et dispositif pour la surveillance d'un systeme reparti
EP3245591B1 (fr) Systeme ordinateur securisé

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

PUAK Availability of information related to the publication of the international search report

Free format text: ORIGINAL CODE: 0009015

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL HR LT LV MK

17P Request for examination filed

Effective date: 20060726

RBV Designated contracting states (corrected)

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PL PT RO SE SI SK TR

DAX Request for extension of the european patent (deleted)
17Q First examination report despatched

Effective date: 20120711

REG Reference to a national code

Ref country code: DE

Ref legal event code: R003

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN REFUSED

18R Application refused

Effective date: 20130309