JP7809934B2 - Processor - Google Patents

Description

The present invention relates to a processor having multiple cores.

Processor systems equipped with a fault detection mechanism (dual-core lockstep) have been known for some time (Patent Document 1). In dual-core lockstep, two cores execute the exact same calculations and the outputs are compared to detect processor faults, resulting in actual performance equivalent to that of a single core.

For this reason, processors have been developed that can dynamically switch between dual-core lockstep mode and multi-core mode depending on the required level of functional safety. For example, such processors can be controlled to operate in dual-core lockstep mode when running applications with strict safety requirements such as Automotive Safety Integrity Level (ASIL) C or D, and to operate in multi-core mode for safety requirements of ASIL B or lower.

International Publication No. 2018/198184

Detecting processor failures when operating in multi-core mode requires software diagnosis on each processor (performing diagnostic calculations on the processor), but this increases the time required to perform the diagnosis, making it difficult to obtain the benefits of multi-core mode. Furthermore, since expected value data for the calculation results must be stored in ROM or RAM in advance for diagnosis, this also puts a strain on memory resources.

The present invention aims to provide a processor that accelerates processing in multi-core mode and meets both performance and functional safety requirements.

The present invention employs the following technical means to solve the above problems.
The processor of the present invention is a processor equipped with a dual-core lockstep mechanism and has a dynamic switching mode that switches so that core fault diagnosis is performed in dual-core lockstep mode and functions other than fault diagnosis are performed in multi-core mode.

In another aspect of the present invention, the processor is a processor with multiple cores, and includes a comparator that compares the calculation results of the multiple cores, and a control unit that diagnoses core faults by having the multiple cores execute the same calculation and compares the results, and that performs functions other than fault diagnosis by having the multiple cores execute different calculations in parallel.

The configuration of the present invention reduces the time required for core fault diagnosis, thereby increasing the execution time in multi-core systems while ensuring safety.

FIG. 1 illustrates a configuration of a processor according to an embodiment. 1A is a schematic diagram showing an example of an externally controlled processor, and FIG. 1B is a schematic diagram showing an example of a self-contained processor. FIG. 2 is a diagram illustrating a specific example of a core. FIG. 2 is a diagram illustrating execution modes of a processor according to an embodiment. 10 is a flowchart showing a method for determining an execution mode of a processor according to the present embodiment. 10 is a flowchart showing mode switching in a dynamic switching mode. 1A is a diagram illustrating a conventional fault diagnosis process, and FIG. 1B is a diagram illustrating a fault diagnosis process according to the present embodiment. 10 is a schematic diagram comparing the processing time for fault diagnosis between the conventional technique and the present embodiment; FIG. 1 is a diagram illustrating an example of a processor equipped with an FPU having a homogeneous multi-core configuration. FIG. 1 illustrates an example of a processor having two AD conversion units.

Hereinafter, a processor according to an embodiment of the present invention will be described with reference to the drawings.
1 is a diagram illustrating the configuration of a processor according to an embodiment. The processor includes a first core 1 and a second core 2 as arithmetic units, a comparator 3 that compares the outputs of the first core 1 and the second core 2, a multiplexer MUX 4 for changing the processor's execution mode, a gate 5, and a control unit 6 that controls mode switching. The first core 1 and the second core 2 have the same configuration and output the same arithmetic result when the same data is input. The processor has a dual-core lockstep mechanism that detects faults by comparing the arithmetic results of the first core 1 and the second core 2.

The processor has a first line L1 that inputs data to the first core 1 and a second line L2 that inputs data to the second core 2. The first line L1 branches, one connected to the first core 1 and the other connected to the multiplexer 4. The second line L2 is connected to the multiplexer 4. The processor also has a third line L3 that inputs a mode switching signal. The third line L3 is connected to the control unit 6.

Based on the mode switching signal, the control unit 6 switches whether the processor operates in dual-core lockstep (hereinafter referred to as "DCLS") mode or multi-core mode. Based on the mode switching signal, the control unit 6 controls the first core 1, the second core 2, the comparator 3, the multiplexer 4, and the gate 5. Specifically, the control unit 6 performs synchronization control for the first core 1 and the second core 2 when switching modes. The control unit 6 also controls the activation of the comparator 3 when in DCLS mode.

The control unit 6 controls the multiplexer 4 to switch the input data to the second core 2. In DCLS mode, the multiplexer 4 controls the data input from the first line L1 to input to the second core 2. As a result, the same data is input to the first and second cores, and the first core 1 and second core 2 perform the same calculation. The outputs of the first core 1 and second core 2 are then compared by the comparator 3. If the two outputs match, it is determined that there is no abnormality, but if the outputs do not match, it is determined that there is an abnormality and an error is output. Furthermore, in DCLS mode, the control unit 6 controls the gate 5 to stop the output from the second core 2.

If the mode switching signal specifies multi-core mode, the control unit 6 controls the multiplexer 4 to input the data input from the second line L2 to the second core 2. As a result, different data is input to the first core 1 and the second core 2, and the first core 1 and the second core 2 perform calculations independently. In this case, the comparator 3 disables its comparison operation and stops outputting an error. Furthermore, if the signal specifies multi-core mode, the control unit 6 controls the gate 5 to output the output from the second core 2 to the outside.

If the mode switching signal specifies dynamic switching mode, the control unit 6 switches so that core fault diagnosis is performed in DCLS mode and main functions other than fault diagnosis are performed in multi-core mode. This operation will be described later with reference to Figure 6.

As described above, in DCLS mode, the second core 2 performs the same calculations as the first core 1 for comparison purposes, so the first core 1 is sometimes called the "master" and the second core 2 is sometimes called the "checker."

So far, we have explained an example of an "externally controlled" type in which the control unit 6 switches the processor mode in response to a mode switching signal from the outside, but the control unit 6 may also perform mode switching independently. Figure 2(a) is a schematic diagram showing an example of an externally controlled processor, and Figure 2(b) is a schematic diagram showing an example of a self-contained processor. In the externally controlled type, the processor's operating mode is switched by receiving a mode switching signal from an external host or external CPU 7. In contrast, in the self-contained type, the control unit 6 switches between DCLS mode and multi-core mode in response to instructions from the master core (first core 1). The self-contained switching mechanism is suitable for dynamic switching between DCLS mode and multi-core mode within a specified execution cycle.

Next, the configuration of the first core 1 and the second core 2 will be described. Figure 3 is a diagram showing a specific example of cores 1 and 2. As shown in Figure 3, cores 1 and 2 may be a CPU (Central Processing Unit) equipped with a control register, a status register, a GPR (General Purpose Register), and a PC (Program Counter), an ALU (Arithmetic and Logic Unit), an FPU (Floating Point Unit), a DSP (Digital Signal Processor), a VPU (Vector Processing Unit), a GPU (Graphics Processing Unit), an AI processor, or a combination of these. Note that the configuration shown in Figure 3 is just one example, and cores 1 and 2 can be implemented in various forms depending on the application. In this way, cores 1 and 2 are not limited to CPUs, but may be arithmetic units in the broad sense.

Figure 4 is a diagram explaining the execution modes of the processor in this embodiment. The right column of the table lists the three modes that the processor can execute, and the left column shows examples of safety requirement levels at which the execution modes are used.

The processor has three modes: DCLS mode, dynamic switching mode, and multi-core mode. In DCLS mode, paired cores always execute the same calculation, and the outputs are compared to detect processor faults. DCLS mode is used, for example, when running applications with strict safety requirements such as ASIL C or D.

In multi-core mode, two cores perform separate calculations, and failure detection is not performed by comparing the calculation results. Multi-core mode is used when running QM (Quality Management) level applications that do not have an ASIL assigned but require appropriate quality control mechanisms.

Dynamic switching mode switches so that core fault diagnosis is performed in DCLS mode and functions other than fault diagnosis are performed in multi-core mode. Dynamic switching mode switches between DCLS mode and multi-core mode within a specified execution cycle. Dynamic switching mode is used when running applications that require safety requirements such as ASIL A and B.

Figure 5 is a flowchart showing how the execution mode of the processor in this embodiment is determined. First, it is determined whether the safety requirement level required by the application is ASIL C or higher (S10). If the required safety requirement level is ASIL C or higher (YES in S10), DCLS mode is selected (S12). The DCLS mode selected here is a mode in which the system always runs in DCLS mode, and both the main functions and fault diagnosis are performed in DCLS mode. In DCLS mode, fault diagnosis is performed by hardware, so software-based fault diagnosis is not required.

If the required safety requirement level is not ASIL C or higher (NO in S10), it is determined whether the required safety requirement level is ASIL A or higher (S11). If the required safety requirement level is ASIL A or higher (YES in S11), dynamic switching mode is selected (S13). If the required safety requirement level is not ASIL A or higher (NO in S11), multi-core mode is selected (S14). The multi-core mode selected here is a mode in which the system is always run in multi-core mode, and both the main function and fault diagnosis are run in multi-core mode.

Figure 6 is a flowchart showing mode switching in dynamic switching mode. The processor executes a main function other than fault diagnosis in multi-core mode (S20). The processor determines whether the diagnosis time has arrived while the main function is being executed (S21). The diagnosis time is set to arrive at least once within a predetermined execution cycle.

If the diagnostic time has not yet arrived (NO in S21), the main function is executed until the diagnostic time arrives (S20). If the diagnostic time arrives (YES in S21), the processor switches from multi-core mode to DCLS mode (S22) and executes diagnostic code in the processor being diagnosed (S23). Specifically, the same calculation is executed in the paired cores, and a determination is made as to whether a fault has occurred based on whether the calculation results match (S24).

If it is determined that a fault exists (YES in S24), the processor issues a DCLS error fault notification and terminates abnormally (S27). If the fault determination determines that no fault exists (NO in S24), a normality determination is made (S25), and the processor switches from DCLS mode to multi-core mode (S26) and executes its main function (S20).

As described above, in this embodiment, the main function is executed in multi-core mode, and when the time for diagnosis arrives, the system switches to DCLS mode to perform fault diagnosis, thereby ensuring safety while increasing the execution time in multi-core mode.

Figure 7 is a diagram illustrating the differences between conventional fault diagnosis processing and the fault diagnosis processing of this embodiment. Figure 7(a) shows conventional fault diagnosis processing, and Figure 7(b) shows the fault diagnosis processing of this embodiment. Conventionally, when the main function is executed in multi-core mode, fault diagnosis is also performed in multi-core mode. As shown in Figure 7(a), a diagnostic command is executed (S30), the execution result of the diagnostic command is compared with an expected value (S31), and it is determined whether the core is normal or abnormal (S32). For this reason, it is necessary to store the expected value in memory and to perform the comparison process.

In this embodiment, the main functions are executed in multi-core mode, but when fault diagnosis is performed, the mode is switched to DCLS mode (S40), and the same diagnostic command is executed on two cores (S41) to perform fault diagnosis. Comparison with expected values is not required, and any abnormalities can be detected by DCLS. This means that no memory resources are required and diagnosis can be performed quickly.

Figure 8 is a schematic diagram comparing the processing time for fault diagnosis in the conventional technology and this embodiment. As shown in Figure 8, in this embodiment, fault diagnosis is performed in DCLS mode, which shortens the diagnosis time and increases the time allocated to executing the main function.

The above describes a processor according to an embodiment of the present invention, but the processor of the present invention is not limited to the above embodiment. In the above embodiment, a processor equipped with a mechanism for performing DCLS mode was described as an example, but by incorporating a hardware comparator that compares the outputs of cores in a general homogeneous multi-core configuration, it is also possible to significantly reduce fault diagnosis time.

Figure 9 shows an example of a processor equipped with an FPU with a homogeneous multi-core configuration. As shown in Figure 9(a), under normal circumstances, it operates as a 128-bit arithmetic unit (32 bits x 4), with the comparator disabled. During fault diagnosis, as shown in Figure 9(b), the same data is input to the upper and lower bits. The same 32-bit x 2 data is input to the FPU, and a 64-bit operation is performed. The upper and lower operation results are compared using a comparator to detect errors.

Figure 10 shows an example of a processor with two AD conversion units. The combination of AD conversion units and registers forms the core. As shown in Figure 10(a), under normal circumstances, different input signals are input and AD conversion is performed by each AD conversion unit, with the conversion results stored in the register. The comparator is disabled. During fault diagnosis, as shown in Figure 10(b), the same input signal is input to the two AD conversion units, and the conversion results of each AD conversion unit are stored in the register. In this case, the comparator is enabled, and reads and compares the data in the register to detect errors.

As shown in the examples above, the processor of the present invention may be a processor with multiple cores, and may include a comparator that compares the calculation results of the multiple cores, and a control unit that performs core fault diagnosis by having the multiple cores execute the same calculation and compares the results, and that performs functions other than fault diagnosis by having the multiple cores execute different calculations in parallel.

1...first core, 2...second core, 3...comparator,
4: Multiplexer; 5: Gate; 6: Control unit;
7...External host or CPU.

Claims (3)

A processor with a dual-core lockstep mechanism,
A dynamic switching mode is provided in which core fault diagnosis is performed in dual-core lockstep mode and functions other than fault diagnosis are performed in multi-core mode;
A processor that operates in one of a mode that always executes dual-core lockstep mode, a mode that always executes multi-core mode, and the dynamic switching mode, depending on the application being executed. The processor of claim 1, wherein the dynamic switching mode switches between dual-core lockstep mode and multi-core mode within a predetermined execution cycle. A processor having multiple cores,
a comparator for comparing calculation results of the multiple cores;
a control unit having a dynamic switching mode in which the core fault diagnosis is performed by making the multiple cores execute the same operation and comparing the operation results, and in which the multiple cores execute different operations in parallel for functions other than the fault diagnosis;
Equipped with
A processor that operates in one of a mode that always executes dual-core lockstep mode, a mode that always executes multi-core mode, and the dynamic switching mode, depending on the application being executed.