Patent Application
20080209170
The present invention relates to methods and devices for performing switchover operations and for signal comparison in a computer system having at least two processing units
A method for detecting errors in a compare mode is described in PCT International Published Patent Application No. WO 01/46806. In this case, the data are processed and compared in parallel in a processing unit having two ALU processing units. In the event of an error (soft error, transient error), both ALUs work independently of one another until the faulty data are removed and renewed (partially repeated) redundant processing can be undertaken. This requires that both ALUs be able to operate synchronously in relation to each other and that the results be comparable in a process that maintains clock accuracy.
Methods are conventional regarding the manner in which a switch between a compare mode for error detection, in which tasks are processed redundantly, and a performance mode for achieving higher performance can be implemented. This requires that the processing units be mutually synchronized for the compare mode. This requires that both processing units be able to be stopped and that they operate synchronously in a process that maintains clock accuracy, so that the result data are able to be compared with one another as they are written into the memory. This calls for interventions in the hardware, and individual design approaches are proposed.
On the other hand, European Published Patent Application No. 0 969 373 ensures a comparison of the results of redundantly operating processing units or processing units even if they are operating asynchronously in relation to one another, that is, in a process that does not maintain clock accuracy, or at an unknown clock pulse offset.
From the aircraft industry, voting systems are conventional, which are able to use inputs of standard computers and, by employing a majority decision, process these reliably, and on this basis trigger safety-relevant actions. One system that combines inter-processing unit and inter-control unit communication is the FME system, which, because of a high level of redundancy, remains operational even in the case of individual or even a plurality of errors, and which was developed by DASA for aerospace applications (Urban, et al.: A survivable avionics system for space applications, Int. Symposium on Fault-tolerant Computing, FTCS-28 (1998), pp. 372-381). This system can even tolerate Byzantine errors (that is, especially virulent errors where not all components receive the same information, but instead a schemer even “deliberately” distributes various erroneous information to different components). Because of its high cost, such a system is commercially feasible for especially critical systems, which are manufactured in very small numbers. A cost-effective approach that can be manufactured in large numbers and has switchover options in addition, is not known.
Example embodiments of the present invention provide a switchover and compare unit that will make it possible to switch the operating mode of two or more processing units, and which in the process is able to do so without intervening in the structure of these processing units and also does not require any additional signals for this purpose. In this context, it is intended that various digital or analog signals from different processing units be able to be compared to one another in a compare mode. Under certain circumstances, the intention is that this comparison even be possible if the processing units are operated using different clock signals, and do not operate in synchronism in relation to one another. Furthermore, example embodiments of the present invention provide methods and devices that allow the comparison of analog signals to be implemented with the aid of digital comparison devices.
A method for performing switchover operations and for signal comparison is used in a computer system having at least two processing units, and where switchover devices are provided and switchover operations are carried out between at least two operating modes, and comparison devices are provided, and a first operating mode corresponds to a compare mode, and a second operating mode corresponds to a performance mode, wherein at least two analog signals of the processing units are compared by converting at least one analog signal into at least one digital value.
At least two of the analog signals may be asynchronous.
The digital signal may be buffer-stored for a specifiable time, so that a direct comparison may take place.
The conversion of at least one signal may be implemented in at least one processing unit.
At least one analog signal may be digitally converted, stored for a specifiable time, and reconverted into an analog signal for the comparison.
Both analog signals may be digitally converted in order to then be available in digital form for a comparison at the same time, by buffer-storing at least the converted digital value.
The digital value of each signal may include a plurality of bits, and a correspondingly specifiable number of bits may be compared to each other as a function of a specifiable accuracy.
The analog signals and their digital values may be compared to each other in redundant manner.
The analog signal may be assigned an identifier during conversion into a digital value.
The identifiers of two signals to be compared may be able to be assigned, and only the particular signals and/or their digital values may be compared whose identifiers are assignable.
A device for performing switchover operations and for signal comparison may be employed in a computer system having at least two processing units, and switchover devices are provided and switchover operations take place between at least two operating modes, and comparison devices are provided, and a first operating mode corresponds to a compare mode, and a second operating mode corresponds to a performance mode, wherein at least two analog signals of the processing units are compared, and an analog-digital converter is provided, and at least one of the analog signals is converted into at least one digital value.
At least two of the analog signals may be asynchronous.
The digital signal may be buffer-stored for a specifiable time, so that a direct comparison may be able to be performed.
At least one signal may be converted in at least one processing unit.
Other features and aspects of example embodiments of the present invention are described in more detail below with reference to the appended Figures.
a shows a generalized representation of a comparator.
c shows an expanded representation of a comparator.
b shows a generalized representation of a switchover and compare unit.
In the following text, an execution unit or processing unit may denote both a processor/core/CPU, as well as an FPU (floating point unit), a DSP (digital signal processor), a co-processor or an ALU (arithmetic logic unit).
A system having two or more processing units is considered. In principle, safety-relevant systems provide the option of using such resources either to enhance the performance by assigning different tasks to the various processing units to the greatest extent possible. Alternatively, some of the resources may also be used redundantly relative to one another, by assigning the same task to them and detecting an error in the case of a disparate result.
Depending on how many processing units there are, a plurality of modes is possible. A two-unit system has the two modes “comparison” and “performance”, as described above. In a three-unit system, besides the pure performance mode in which all three processing units work in parallel, and the pure compare mode in which all three processing units calculate redundantly and a comparison is made, it is also possible to realize a 2-out-of-3 voting mode, in which all three processing units calculate redundantly and a majority selection is made. In addition, a mixed mode may be realized as well in which, for instance, two of the processing units calculate redundantly in relation to one another and the results are compared, while the third processing unit executes a different, parallel task. In a system of four or more processing units, still further combinations are possible.
A goal to be achieved is to allow the available processing units in a system to be used in a variable manner during operation, without necessitating an intervention in the existing structure of these processing units (e.g., for synchronization purposes). Each processing unit may be able to operate at its own clock pulse, that is, be able to execute the same tasks for comparison purposes also asynchronously in relation to one another.
A universal, broadly utilizable IP is created, which allows a switchover of the operating modes (e.g., comparative mode, performance mode or voting mode) at any desired point in time without previous switching off of the processing units, and which manages the comparison or the voting of the data streams that are possibly asynchronous to one another. This IP may be arranged as chip, or it may be integrated on one chip together with one or more processing units. In addition, it is not required that this chip be made up of only one piece of silicon; it is entirely possible that it is made up of separate components.
In order to ensure synchronous operation among various processing units, signals are required that prevent execution of the programs of individual processing units from continuously advancing. To that end, a WAIT signal is typically provided. If an execution unit does not have a wait signal, it may also be synchronized via an interrupt. For this purpose, the synchronization signal (for example, M140 in
This procedure is continued until synchronous operation has been brought about (for example, other processing units deliver the expected comparative data). However, this method is able to only conditionally ensure a precise clock pulse synchronism, and, in particular, phase equality with other processing units. Thus, when using the interrupt signal for synchronization purposes, it is recommended that the data to be compared be buffer-stored in the SCU before being compared.
Any commercially available standard structures may be used, because no additional signals are required (no intervention in the hardware structure), and any desired output signals of these components are able to be monitored, which, for instance, are used directly to control actuators. This includes the checking of converter structures, such as DACs and PWMs, which, previously under conventional arrangements, are not been able to be directly checked in this manner by a comparison process.
However, if there is no need to check individual tasks or SW tasks, the switch may also be made to a performance mode in which different tasks are distributed among various processing units.
Another feature is that, in a compare or voting mode, there is no need for all of the data to be compared. Only the data to be compared or voted are synchronized with one another in the switchover and compare unit. The process of selecting these data may be variable (programmable) because of the selective response of the switchover and compare unit, and it may be adapted to the particular processing unit architecture, as well as to the application. Thus, diverse PCs or software components may also be used quite easily because only results that lend themselves to a meaningful comparison are also actually compared.
In addition, every access to a (for example, external) memory may be monitored in this manner or also only the control of external I/O modules. Internal signals may be checked via the software-controlled additional output to the switchover module on the external data and/or address bus.
All control signals for the comparative operations are generated in the, e.g., programmable switchover and voting unit, and the comparison takes place there as well. The processing units (for example, processors), whose outputs are to be compared with one another, may use the same program, a duplicated program (which additionally allows the detection of errors when accessing the memory), or also a diversified program for detecting software errors. In the process, there is no need to mutually compare all of the signals supplied by the processing units; instead, an identifier (address or control signal) may also be used to designate or not designate certain signals for the comparison. This identifier is evaluated in the switchover and compare device and the comparison operation is controlled thereby.
Separate timers monitor deviations in the time response beyond a specifiable limit. Some or even all of the modules of the switchover and compare unit may be integrated on one chip, accommodated on one common board or even in a spatially separate manner. In the latter case, the data and the control signals are exchanged with one another via suitable bus systems. Local registers are then written to via the bus system and control the procedures by the data and/or addresses/control signals stored therein.
The switchover unit includes at least one control register B15, which has at least one memory element for a binary sign (bit) B16, which switches the mode of the compare unit. B16 is able to assume at least the two values 0 and 1, and may be set or reset by signals B20 or B21 of the processing units or by internal processes of the switchover unit.
If B16 is set to the first value, the switchover unit operates in compare mode. In this mode, all data signals incoming from B20 are compared to the data signals from B21, provided that certain specifiable comparison conditions of the control and/or address signals from signals B20 and B21 are met which signal the validity of the data and the comparison specified for these data.
If these comparison conditions are simultaneously met for both signals B20 and B21, then the data from these signals are compared directly and an error signal B17 is set in the case of disparity. If only the compare condition from either signals B20 or B21 is met, then the appropriate synchronization signal B40 or B41 is set. In the corresponding processing unit B10 or B11, this signal causes the processing to stop, and therewith prevents forward switching of the corresponding signals, which up to then could not be compared to one another. Signal B40 or B41 remains set until the corresponding compare condition of the other respective processing unit B21 or B20 is met. In this case, the comparison operation is performed, and the corresponding synchronization signal is reset.
To ensure the comparison in the case that the two processing units supply the data to be compared non-simultaneously, as described, it is either necessary that the data and comparison conditions of the respective processing unit be held to the corresponding values until the corresponding synchronization signal B40 or B41 has been reset, or that the data provided first be stored in the switchover unit until the comparison takes place.
The processing unit that is the first to make data available must wait before continuing to execute its program or its processes until the other processing unit supplies the corresponding comparison data.
An example embodiment of the switchover unit according to
If B16 is set to the second value, synchronization signals B20 and B21 as well as error signal B17 are always inactive and set to the value 0, for instance. Also, no comparison is carried out, and the two processing units operate independently of each other.
In the system according to an example embodiment of the present invention, the comparator is a component. It is shown in its simplest form in Figure la. Comparator component M500 is able to receive two input signals M510 and M511. It then compares them for parity, in the context described here, e.g., in the sense of a bit parity. If it detects disparity, error signal M530 is activated, and signal M520 is deactivated. In the case of parity, the value of input signals M510, M511 is applied to output signal M520, and fault signal M530 does not become active, i.e., it signals the status “good.” Using this basic system as a point of departure, a multiplicity of broadened example embodiments is possible. To begin with, component M500 may be designed as a so-called TSC component (totally self checking). In this case, error signal M530 is routed to the outside via at least two lines (“dual rail”), and internal design and fault detection measures ensure that this signal is present in a correct or identifiably incorrect form in every possible case involving a fault of the comparator component. An example embodiment for using the system according to the present invention provides for such a TSC comparator to be used.
An example embodiments may be distinguished by the degree of synchronism required of the two inputs M510, M511 (or M610, M611). One possible variant is characterized by clocked synchronism, i.e., the process of comparing the data may be carried out using one clock pulse. A slight variation arises when, given a fixed phase displacement between the inputs, a synchronous delay element is used, which delays the corresponding signals by whole numbered or even half clock pulse periods, for example. Such a phase displacement is utilized in avoiding common cause errors, i.e., errors which can simultaneously affect a plurality of processing units. Therefore, in
Moreover, in the comparator, example embodiments may be differentiated by the manner in which signal M520 (or M620) is generated. An example embodiment provides for applying input signals M510, M511 (or M610, M611) to the output and for the connection to be interruptible by switches. An aspect of this variant is that the same switches may be used for switching between the performance mode and possible different compare modes. Alternatively, the signals may also be generated from buffer memories that are internal to the comparator.
An example embodiments may be differentiated by how many inputs are present at the comparator and by how the comparator is to react. In the case of three inputs, a majority voting, a comparison of all three, or a comparison of only two signals may be undertaken. In the case of four or more inputs, an equal number of more variants is possible. For example, these variants are to be coupled to the various operating modes of the overall system.
To explain the general case,
This figure illustrates how the various possible modes may be produced. To this end, this figure includes the logical component of a switching logic N110. The component, as such, need not exist. It is merely important that its function be present. To begin with, it specifies how many output signals there actually are. Furthermore, switching logic N110 specifies which input signals contribute to what output signals. In this context, one input signal may contribute to precisely one output signal. Formulated mathematically, the switching logic thus defines a function that assigns one element of set {N160, . . . , N16n} to each element of set {N140, . . . , N14n}.
The function of processing logic N120 then specifies for each output N16i in which form the inputs contribute to this output signal. This component, as well, does not necessarily need to exist as a separate component. Decisive, again, is that the described functions be realized in the system. To describe the different variation possibilities by way of example, it may be assumed, without limiting universality, that output N160 is generated by signals N141, . . . , N14m. If m=1, this simply corresponds to switching of the signal; if m=2, signals N141, N142 are compared. This comparison may be implemented synchronously or asynchronously; it may be performed on a bit-by-bit basis, or only for significant bits or also using a tolerance range.
In the case that m>=3, a plurality of options is provided.
One first option provides for comparing all of the signals, and, in response to the presence of at least two different values, for an error to be detected, which may optionally be signaled.
A second option provides for making a k-out-of-m selection (k >m/2). This may be implemented through the use of comparators. An error signal may optionally be generated if one of the signals is determined to be deviant. A possibly differing error signal may be generated if all three signals are different.
A third option provides for supplying these values to an algorithm. This may take the form of generating an average value, a median value, or of using a fault-tolerant algorithm (FTA), for example. Such an FTA is based on deletion of the extreme values of the input values and on a type of averaging of the remaining values. This averaging may be performed for the entire set of the remaining values or, e.g., for a subset that is easily formed in HW. In such a case, it is not always necessary to actually compare the values. In the averaging operation, it is merely necessary to add and divide, for example; FTM, FTA or median generation require partial sorting. If appropriate, here, too, an error signal may optionally be output if the extreme values are sufficiently large.
These different mentioned options of processing a plurality of signals to form one signal are denoted as comparison operations for the sake of brevity.
Thus, the task of the processing logic is to establish the exact form of the comparison operation for each output signal, and thus also for the corresponding input signals. The combination of the information of switching logic N110 (i.e., the function named above) and of the processing logic (i.e., the establishment of the comparison operation per output signal, i.e., per functional value) is the mode information, and this determines the mode. Generally, this information is multi-valued, i.e., not representable by only one logic bit. Not all theoretically possible modes are practical in a given implementation; e.g., the number of permitted modes will be limited. It is important to note that, in the case of only two execution units, where there is only one compare mode, the entire information may be condensed onto only one logic bit.
A switch from a performance mode to a compare mode is generally characterized in that execution units, which are mapped to different outputs in the performance mode, are mapped to the same output in the compare mode. This may be implemented by providing a subsystem of execution units in which, in the performance mode, all input signals N14i to be considered in the subsystem are directly switched to corresponding output signals N16i, while, in the compare mode, they are all mapped to an output. Alternatively, such a switchover operation may also be implemented by altering pairings. This demonstrates that, generally, it is not possible to speak of the performance mode and the compare mode, although, in example embodiments, the number of permitted modes may be limited such that this general case does apply. However, it is always possible to speak of a switch from performance mode to compare mode (and vice versa).
Software-controlled switchover operations between these modes may be dynamically carried out during operation. In such a case, the switchover operation is triggered by the execution of special switchover instructions, special instruction sequences, explicitly identified instructions or in response to the accessing of specific addresses by at least one of the execution units of the multiprocessor system.
Output signals M180, M181, which are not directed into the SCU, and internal signals of a processing unit may also be compared, at least with respect to their calculated value, by outputting this value to outputs M120, M121 for the purpose of comparison. A similar procedure may also be carried out with input signals M190, M191, which do not arrive via M100.
In order to monitor unit M100, it may be possible for selected or even all signals M160, M161 to read them back via M170, M171 or even M190, M191. This makes it possible to ensure in the compare mode as well, that faulty signals from unit M100 are detected. With the aid of a suitable switch-off path, to which M100, M110, M111 have access (in an OR link), a fail-silence response of the entire system may be brought about.
One possible implementation of switchover and compare unit M100 of
Optionally, there may be additional control registers, such as M240, which includes the maximum allowable time difference (in number of clock pulses) between the processing units for triggering an internal or external watchdog, as well as M241, which has the time difference value (number of clock periods) above which the fastest processor is to be stopped intermittently or delayed by WAIT or interrupt signals, in order, for example, to prevent data registers from overflowing.
Also stored in status register M220, for example, besides the error bit, is the magnitude of the current clock pulse offset between the processing units. To that end, at least one timer M230 is always started by a processing unit, for example, whenever a data value specially marked (by address and control signals, such as a specific address region) is first made available, and the value of the timer is clocked into the status register whenever the data value in question is made available by the second processing unit. Beyond that, the timer may be set such that even at different program sequences corresponding to the WCET (worst case execution time) it is guaranteed that all processing units have to supply one datum. In the case that the specified value is exceeded by the timer, an error signal is output.
Outputs M120, M121 of the processing units are to be stored in a buffer memory M250, M251 in M100, especially for the compare mode, if digital data are involved and they are not able to be made available with clock accuracy. This memory may be designed as a FIFO. If this memory has a depth of only one (register), then it must be ensured through the use of wait signals, for example, that the outputting of additional values is delayed until the comparison process has taken place, in order to avoid a loss of data.
Furthermore, there is a compare unit M210, which compares the digital data from input memories M250, M251, direct inputs M120, M121 or M170, M171 to each other. This compare unit is also able to compare serial digital data (for example, PWM signals) with one another, when, for example, the serial data are able to be received in memory unit M250, M251 and converted into parallel data, which are then compared in M210. It is possible to synchronize asynchronous digital input signals M170, M171 via additional memory units M270, M271. As is also the case for input signals 120, 121, these may be buffered-stored in a FIFO. The switchover between performance mode and compare mode takes place by setting or resetting the mode bits in the control register, whereby, for instance, corresponding interrupts are caused in the two processing units. The comparison itself is induced by supplied data M120, M121 and the associated address and control signals M130, M131. Certain signals from M120 and M130 or M121 and M131 may act as identification, which indicates whether a comparison of the associated data should take place.
This example embodiment is a continuation of the simple switchover configuration in
In this compare unit, analog data may be compared with one another in an analog compare unit M211 specially suited for this purpose. However, this presupposes that the analog signals are output synchronously enough relative to one another, or that provision is made for storing in the analog compare unit the data digitized by an ADC implemented there (in this regard, see further explanations regarding
Different example embodiments in the control register are possible. Suitable bit combinations may be used to describe whether an error detection pattern or an error tolerance pattern should be used. Depending on the degree of complexity of unit M300, the type of error tolerance pattern (2 out of 3, median, 2 out of 4, 3 out of 4, FTA, FTM . . . ) to be used, may be specified in addition. Moreover, a configurable design is possible with regard to which output is to be switched through. Accordingly, one may also devise example embodiments as to which components may influence this configuration for which piece of data.
The output signals from the processing units involved are compared to one another in the switchover unit. Since the signals are not necessarily processed in a process that maintains clock accuracy, the data must be buffer-stored. In the process, in the switchover unit, data may also be compared that are transmitted by the various processing units to the switchover unit at a greater time difference. Using a buffer store (in the form of a FIFO memory, for instance: first in—first out, or in a different buffer form as well), a plurality of data may also initially be received by one processing unit, while other processing units are not making any data available yet. In this context, a measure of the synchronous operation of the two processing units is the occupancy level of the FIFO memory. If a specific, predefinable occupancy level is exceeded, then the processing unit that is the furthest advanced in the processing is intermittently stopped, either by an available WAIT signal or by suitable interrupt routines, in order to wait for the processing units that are not advancing as quickly in the processing. In the process, the monitoring should be extended to encompass all externally available signals of a processing unit; this includes analog signals or PWM signals as well. This requires that structures that permit a comparison of such signals be provided in the switchover unit. Moreover, it is provided that a maximum time deviation be specified among the data to be compared and that it be monitored using at least one timer.
If, generally, more than two processing units are linked to one another by one shared switchover unit, then one control register is required for each of these processing units. One particular arrangement of these control registers is elucidated in
The (n+1) lower bits B 500x to B50nx of the respective control register Cx are unequivocally assigned to the n+1 processors/processing units. Bit B514x of control register Cx switches between comparison/voting on the one hand and parallel processing on the other hand, and corresponds to the value of B16 in
If B50ik and B50kk of control register Ck are set to one, (0≦i, k≦n), this means in this example embodiment that the outputs of processing unit i are to be compared to those of processing unit k. If, in addition, B50jk is also equal to 1, then voting is to take place among i, j and k, and the voting result is output at output k of the SCU (0≦i, j, k≦n). To this end, for each group of processing units, a special type of voting or also of only a majority comparison, may be established, as explained previously with respect to illustration M4. In general, all bits B50ik for processing units i to be compared/voted must be set (in control register Ck) if the voting result is to be output at output k of the SCU. A parallel outputting to other outputs is possible.
A one in B50ii of control register i (0≦i, ≦n) indicates that output i of the compare unit is to be active. If all control registers Ci carry a one (i=0, 1, . . . n) only in the corresponding memory areas B50ii, then all processing units are working in performance mode using arbitrarily different programs and their own output signals. If all of the n+1 low-order bits B50ik are equal to one (i =0, 1, . . . n), and, moreover, B514k is set, then the output signals of all processing units are selected by majority decision (voting) and output to output k of the SCU; in the case of n=1, only a comparison is made.
The following describes exemplarily how a sequence might appear when the transition is made to a comparison/voting in a system having a plurality of processing units.
Bit B514i in control register Ci is set in order to activate the comparison or the voting process. This bit may be set by the processing unit itself, as well as by the switchover and compare unit, as a function of specific system states, time conditions or other conditions (such as accesses to certain memory areas, errors or implausibilities). If bits B50ii and B50ki are set with B514i, then bits B511i and B511k are automatically set by the SCU and interrupts are thereby triggered in processing units i and k. These interrupts cause the processing units to jump to a certain program location, to carry out certain initialization steps for the transition to the comparison mode, and then to output an acknowledgment (ready) to the switchover and compare unit. The ready signal causes an automatic resetting of interrupt bit B511i in the corresponding control register Ci of the processing unit and, at the same time, the setting of wait bit B512i. When all of the wait bits of the processing units taking part have been set, they are simultaneously reset by the switchover and compare unit. The processing units then begin with the process of executing the program parts to be monitored. In an example embodiment, writing into a control register Ci having a set bit B514i is prevented by locking (HW or SW). This has the practical effect of ensuring that the configuration of the comparison cannot be changed during execution. A change in control register Ci is possible only after bit B514i has been reset. This resetting effects interrupts in the respective processing units by setting bits B510x in the control registers of all participating processing units for the transition to normal mode (parallel method of operation).
The consistency of all control registers with respect to one another is monitored in accordance with user specifications, and, in the case of an error, an error signal will be generated, which constitutes part of the status information. Thus, for example, a processing unit must not be used simultaneously for a plurality of independent comparison or voting processes because synchronization will not be ensured in such a case. Possible, however, is a comparison of even a plurality of processing units, without outputting of the data signals, but rather only for the purpose of generating an error signal in the case of disparity.
An example embodiment provides that the entry in a plurality of, or all, control registers of the processing units participating in a comparison or a voting operation be made in a substantially identical fashion, i.e., the corresponding bits of these processing units are to be set there in a substantially identical fashion, in some instances with the exception of their own bit i, which controls the output.
If an error occurs in the comparison, the error bit is set in the respective control register. In a voting process, the piece of data of the respective processing unit is ignored; in a simple comparison, the output is blocked.
All data that are not available in time before expiration of the programmed time are treated as errors. Resetting of the error bits is implemented in a system-dependent manner and, if appropriate, allows a reintegration of the respective processing unit.
If the processing units and/or the voter are/is not disposed in a spatially concentrated manner, decentralized voting in conjunction with a suitable bus system according to
The resetting of the compare and voting bit in a control register having an active output bit produces an interrupt in the participating processing units, which are then returned to a parallel mode of operation again. Each processing unit may have a different vector address, which is administered separately. The program processing may then also be implemented via the same program memory. However, the accesses are separate and, typically, to different addresses. If the security-relevant part is negligible in comparison to the parallel modes, it should be considered whether a dedicated program memory having a duplicated security part would perhaps require less expenditure.
The data memory, as well, may be shared in the performance mode. The accesses then take place sequentially, using the AHB/ABP bus, for example.
As a special feature, it also should be mentioned that the error bits must be analyzed by the system. To ensure reliable deactivation in the case of an error, the security-relevant signals should be implemented redundantly in a suitable form (for instance, in the one-of-two code).
In the existing SCUs in accordance with
Moreover, a handshake interface is required (
In an example embodiment, memory elements M800 are designed as FIFO memories (first in, first out).
In the case of the circuits used to compare analog signals of
In this context, B100 is an operational amplifier to whose negative input B101 a signal B141 is applied, which is connected, via a resistor B110 having the value Rin, to input signal B111 at which voltage value V1 is present. Positive input B102 is connected to signal B142 which, via resistor B120 having the value Rin, is connected to input B121 at which voltage value V2 is present. Output B103 of this operational amplifier is connected to output signal B190, which has voltage value Vout. Signal B190 is connected, via resistor B140 having value Rf, to signal B141, and signal B142 is connected, via resistor B130 having value Rf, to signal B131, which has the voltage value of analog reference point Vagnd. The output voltage may be calculated according to the following formula using the voltage and resistance values indicated above:
Vout=Rf/Rin(V2-V1) (1)
If the differential amplifier is operated only at a positive operating voltage, as is typically the case for a CMOS, then a voltage between operating voltage and digital ground is selected as analog ground Vagnd, typically the mean potential. If the two analog input voltages V1 and V2 are only slightly different, then output voltage Vout will have only a slight difference Vdiff from the analog ground (positive or negative).
With the aid of two comparators, it is then tested whether the output voltage lies above Vagnd+Vdiff (
In
This is achieved by dimensioning resistors B150, B160, B170 and B180 with their respective values R1, R2, R3 and R4 in relation to fixed reference voltage Vref present at signals B211 and B311, as follows:
Vref=(Vagnd+Vdiff) *R2/(R1+R2) (2)
Vref=(Vagnd−Vdiff) *R4/(R3+R4) (3)
Vdiff=((V2max−V1min) *Rf/Rin)−Vagnd (4)
In this context, V2max denotes the maximum tolerated voltage value of V2 at signal B121, and V1min denotes the minimum tolerated voltage value of V1 at signal B111. The reference voltage source may be made available externally, or implemented by an internally realized band gap (temperature-compensated and operating voltage-independent reference voltage). In equation (4), the maximum tolerated difference Vdiff is determined from the maximum positive deviation V2max and the associated maximum negative deviation V1min, that is, (V2max−V1min) is the maximum tolerated mutual voltage deviation of redundant analog signals that are to be compared to one another.
If one of the voltage values at the two signals B290 or B390 (Vhigh or Vlow) is positive, then there is a greater deviation of the analog signals than should be tolerated. In the case that the processors that supply these analog signals are synchronized, then an error exists which must be stored and, if indicated, results in the output signals being switched off.
Synchronous operation is given when, for example, the ready signal in the control register of the processing units in question is active, or when specific digital signals that signal a certain state of the analog signal in question and thus also the value to be compared in the sense of an identifier, are sent to the SCU. A circuit that stores the error is shown in
ADC B600 in
To compare the buffer-stored digital and analog signals, the storing sequence and, in some instances, the A bit (B730 or B830) , as well as identifier B720 or B820 are checked in connection with converted digital value B710 or digital value B810. It is likewise possible to accommodate the analog and the digital signals in separate memories (two FIFOs), for example, due to the difference in bit width. The comparison then takes place in an event-controlled manner; whenever a value of a processor is transmitted to the SCU, it is checked whether the other participating processors have already provided such a value. If this is not the case, the value is stored in the corresponding FIFO or memory; otherwise, the comparison operation is carried out directly, it being possible for the FIFO to be used as a memory here as well. A comparison operation is always carried out, for example, when the participating FIFOs are not empty. In the case of more than two participating processors or compare signals, voting may be used to ascertain whether all signals are admitted for distribution (fail silent behavior) or whether perhaps only the error state is signaled by an error signal.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102004051937.4 | Oct 2004 | DE | national |
| 102004051950.1 | Oct 2004 | DE | national |
| 102004051952.8 | Oct 2004 | DE | national |
| 102004051964.1 | Oct 2004 | DE | national |
| 102004051992.7 | Oct 2004 | DE | national |
| 102005037242.2 | Aug 2005 | DE | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/EP05/55517 | 10/25/2005 | WO | 00 | 3/18/2008 |
