Reconfiguration control device

In the invention, a problem is solved in which, in order to achieve high performance and high reliability with the conventional multi-core and lockstep core, a redundant lockstep core is necessarily prepared to execute a multi-core program in which an error has occurred, a circuit area increases, and a cost and a power consumption increase. In the invention, a safe operation of a control system is secured by operating a software program operating on a multi-core in which an error has occurred as degenerate software on a core switched from a lockstep operation to a multi-core operation.

TECHNICAL FIELD

The present invention relates to a reconfiguration control device.

BACKGROUND ART

With miniaturization of semiconductor processes, it is possible to integrate a plurality of CPU (Central Processing Unit) cores in one device.

For industrial and embedded applications, a multi-core configuration may be adopted which obtains high processing performance while reducing power consumption by multi-processing multiple CPU cores, and a lock-step (LS) core configuration may be adopted which obtains high reliability by collating the result obtained by operating the same software program (software) on multiple CPU cores. For industrial and embedded applications, restrictions on mounting area, power consumption, cost, and the like are significant. In order to realize high performance and high reliability under such restrictions, it is considered to use multi-core or lockstep core. For example, PTL 1 describes an example of an information processing apparatus that includes a plurality of cores and a small number of lockstep cores and executes a program at a level that cannot tolerate errors in synchronization with the lockstep core. In the example of PTL 2, an example of a reconfigurable signal processing system in which electronic control units (ECUs) are distributed is described.

CITATION LIST

Patent Literature

SUMMARY OF INVENTION

Technical Problem

Incidentally, as a result of examining the technology executed by the conventional multi-core and lockstep core, the following has been clarified.

In the example of PTL 1, it is necessary to prepare redundant lockstep cores for executing multi-core programs in which errors occur. In a case where multi-cores are implemented with high-performance CPUs such as 32-bit and 64-bit, similarly, the lockstep core needs to have high performance. Thus, there is a problem that the circuit area increases and the cost and power consumption increase.

In the example of PTL 2, a redundant ECU is required for reconfiguration, and configuration data for reconfiguration is held two by two, so that the cost becomes high, and control of reconfiguration also becomes complicated. Thus, there was a problem that it was difficult to apply to embedded applications requiring real-time performance.

Herein, the invention provides a mechanism capable of realizing high performance and high reliability at a low cost even when a multi-core or lockstep core is applied to industrial and embedded applications.

Solution to Problem

In order to solve the above problems, for example, the configuration described in the claims is adopted. The present application includes a plurality of means for solving the above-described problems. In an example thereof, a reconfiguration control device includes: a multi-core; a lockstep core; and a system control part that dynamically switches the lockstep core to a first core and a second core. The system control part dynamically switches the lockstep core to a multi-core operation when an error occurs in the multi-core, and the system control part instructs restart and diagnosis of the multi-core while the software operating on the multi-core is operating on the first core.

Advantageous Effects of Invention

According to the invention, high performance and high reliability can be realized at a low cost even when a multi-core or lockstep core is applied to industrial and embedded applications.

Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

DESCRIPTION OF EMBODIMENTS

Hereinafter, embodiments of the invention will be described using the drawings.

First Embodiment

An example of an embodiment of the invention will be described with reference toFIGS. 1 to 5.

FIG. 1illustrates an example of a reconfiguration control device of the invention.

In the reconfiguration control device illustrated inFIG. 1, four cores10,11,12, and13are configured to be a multi-core. The core10is connected to a memory50, and the software of the core10is arranged in the memory50and performs processing. Similarly, the core11is connected to a memory51, the core12is connected to a memory52, and the core13is connected to a memory53, and each software is arranged in the memory and performs processing. In the example ofFIG. 1, software A (30) is arranged in the memories50and51, and multi-core operation is performed in the cores10and11. On the other hand, the software B (31) is arranged only in the memory52and operates on the core12, and similarly the software C (32) is arranged only in the memory53and operates on the core13. These cores10,11,12,13, memories50,51,52,53, software A (30), software B (31), and software C (32) are collectively referred to as a multi-core system2here. Cores20and21configure a lockstep (LS). That is, the cores20and21share a memory60, the core20operates software P (33), the core21operates the same software P (34) as the software P (33), and occurrence of an error is detected by collating during the operation. These cores20and21, memory60, software P (33), and software P (34) are collectively referred to as a lockstep core system3here.

As a core error detection unit, a technology such as parity, ECC (Error Correction Code), and watchdog timer are known. Further, a technology described in JP 3175896 B2 (PTL 3) is known as a collation method during the lockstep operation.

Further, in a system control part6illustrated inFIG. 1, a control output100, a control output101, a control output102, a control output103, a control output111, and a control output110are input from the core10, the core11, the core12, the core13, the core20, and the core21, respectively. A reset signal70, a reset signal71, a reset signal72, a reset signal73, a switching control signal81, and a switching control signal80are output to the core10, the core11, the core12, the core13, the core20, and the core21, respectively. Control outputs104,105,106,107, and113are output to the outside of a control unit1.

FIG. 2illustrates an example of a detailed configuration method of the system control part6illustrated inFIG. 1.

In a reconfiguration control part8inside the system control part6, the control signals100,101,102,103, and110are input, the reset signals70,71,72, and73and the switching control signals81and80are output, and further the selection signal120is output.

The multiplexer90selects one control output of the control outputs100,101,102,103,111, and110according to the value of the selection signal120and outputs the selected control output as a control output104. The same applies to multiplexers91,92,93, and94.

FIG. 3illustrates an example of a detailed configuration method of the reconfiguration control part8illustrated inFIG. 2.

In a nonvolatile memory200illustrated inFIG. 3, software that operates in a multi-core system and a lockstep core system is arranged.

A control output selection part201receives the control outputs100,101,102, and103and the control output110and outputs a memory access signal211to the nonvolatile memory200. The memory access signal211is a signal for reading binary data210of the software from the nonvolatile memory200. For example, when an error occurs in the core13inFIG. 1, the error information in the core13is input to the control output selection part201by the control output103, and the control output selection part201outputs the memory access signal211so as to read the binary data210of the degenerate software corresponding to the software C (32) from the nonvolatile memory200.

The binary data210read from the nonvolatile memory200is combined with a core enable signal212output from the control output selection part201by the signal combining circuit202and output to the cores20and21as the switching control signals81and80.

The control output selection part201outputs a selection signal120. The selection signal120is a signal for selecting the respective control outputs104,105,106,107, and113output from the multiplexers90,91,92,93, and94illustrated inFIG. 2. For example, when an error occurs in the core13inFIG. 1, the control output111is selected and output to the control output107illustrated inFIG. 2by the selection signal120described inFIG. 3. The other multiplexer90selects the control output100and outputs the control output as the control output104, the multiplexer91selects the control output101and outputs the control output as the control output105, the multiplexer92selects the control output102and outputs the control output as the control output106, and the multiplexer94selects the control output110and outputs the control output as the control output113.

FIG. 4is an example illustrating a configuration of a case where the lockstep operation is switched to the multi-core operation in the reconfiguration control device of the invention in the first embodiment and is different in that the lockstep core is switched from the lockstep operation to the multi-core operation mode, and the software arranged on the memory is replaced compared with the reconfiguration control device illustrated inFIG. 1.

In the control unit1ofFIG. 4, an example is illustrated in which an error occurs in the core13in the multi-core system2and the software C (32) becomes inoperable.

According to the control output103from the core13in which an error has occurred, the cores20and21are switched from the lockstep operation mode to the multicore operation mode by the switching control signals81and80from the system control part6by the reconfiguration control part8described inFIG. 3, and the degenerate software C (35) corresponding to the software C (32) is arranged in the memory60.

At this time, the selection signal120is output from the reconfiguration control part8described with reference toFIG. 2such that the control output103from the core13in which an error has occurred is not output to the outside of the control unit1as the control output107, and the control output111of the core20in which the degenerate software C (35) is operating is output as the control output107.

FIG. 5is an example illustrating a timing chart of the software operating in the multi-core system and the lockstep core system in the reconfiguration control device illustrated inFIG. 4.

In control cycle S1, the software A (30) operates on the cores10and11of the multi-core system2, the software B (31) operates on the core12following the software A (30), and further the software C (32) subsequently operates on the core13.

In the same control cycle S1, the software P (33) operates on the core20of lockstep core system3, the software P (34) operates on the core21, and the software P (33) and software P (34) perform a collation process during operation.

Control cycle S2inFIG. 5is the same operation as control cycle S1.

In control cycle S3inFIG. 5, when an error occurs in the core13, and the software C (32) becomes inoperable, the degenerate operation described inFIG. 4causes the core20to operate the degenerate software C (35), and the core13performs a return process by a reset signal73from the system control part6.

As described above, even if an error occurs in the core13, the software A (30), software B (31), degenerate software C (35), and software P (34) can operate in the control cycle S3, and thus a process can continue as a whole system while degenerating without stopping.

FIG. 5illustrates an example in which the return process is performed to the control cycle S4and a return is made at the control cycle S5. Therefore, in the control cycle S5, the software C (32) operates again in the core13, and the software P (33) that operates in the core20of the lockstep core system3and the software P (34) that operates in the core21perform a collation process. By adopting such a configuration, even if an error occurs in the multi-core, the degenerate software can be operated by switching the already mounted lockstep core to the multi-core operation, and thus the operation of the control system can continue without requiring additional hardware cost.

In the first embodiment, the number of cores of the multi-core system is described as four. However, the number of cores is not limited to four and may be implemented with various numbers of cores.

Second Embodiment

Next, an example of another embodiment of the invention will be described with reference toFIGS. 6 to 10.

Compared toFIG. 1of the first embodiment in the reconfiguration control device of the present invention,FIG. 6is different in that one lockstep core system is added to form a dual lockstep core system configuration. InFIG. 6, a lockstep core system4including the cores22and23, the memory61, the software P (36), and the software P (37) is provided in addition to the lockstep core system3including the cores20and21, the memory60, the software P (33), and the software P (34). Similarly to the lockstep core system3, in the lockstep core system4, the cores22and23shares the memory61, and the software P (36) operates on the core22, the same software P (37) as the software P (36) operates on the core23, and the collation is performed during operation to detect the occurrence of an error. Furthermore, compared to the system control part6described inFIG. 1, the system control part7illustrated inFIG. 6has an addition in that the control output115and the control output112are input from the core22and the core23, respectively, the switching control signal83and the switching control signal82are output to the core22and the core23, respectively, and further the control output114is output to the outside of a control unit5.

FIG. 7illustrates an example of a detailed configuration method of the system control part7illustrated inFIG. 6and is different in that the multiplexer and the control signal corresponding to the dual lockstep core system configuration are added compared to the system control part6described inFIG. 2.

The multiplexer90selects one control output of the control outputs100,101,102,103,111,110,115, and112according to the value of the selection signal120and outputs the selected control output as a control output104. The same applies to the multiplexers91,92,93, and94and the newly added multiplexer95.

FIG. 8illustrates an example of a detailed configuration method of the reconfiguration control part9illustrated inFIG. 7and is different in that the control output and the switching control signal corresponding to the dual lockstep core system configuration are added compared to the reconfiguration control part8described inFIG. 3.

A control output selection part203inFIG. 8receives the control outputs100,101,102, and103and the control outputs110and112and outputs a memory access signal211to the nonvolatile memory200. Thus, the same operation as that of the control output selection part201described inFIG. 3is performed.

The binary data210read from the nonvolatile memory200is combined with the core enable signal212output from the control output selection part203by the signal combining circuit202, the switching control signals81and80are output to the cores20and21, and the switching signals83and82are output to the cores22and23.

FIG. 9is an example illustrating a configuration of a case where the lockstep operation is switched to the multi-core operation in the reconfiguration control device of the invention in the second embodiment and is different in that the lockstep core is switched from the lockstep operation to the multi-core operation mode, and the software arranged on the memory is replaced compared with the reconfiguration control device illustrated inFIG. 6.

In the control unit5ofFIG. 9, an example is illustrated in which an error occurs in the core13in the multi-core system2, and the software C (32) becomes inoperable.

According to the control output103from the core13in which an error has occurred, the cores20and21are switched from the lockstep operation mode to the multicore operation mode by the switching control signals81and80from the system control part7by the reconfiguration control part8described inFIG. 3, and the degenerate software C (35) corresponding to the software C (32) is arranged in the memory60.

At this time, the selection signal120is output from the reconfiguration control part9described with reference toFIG. 7such that the control output103from the core13in which an error has occurred is not output to the outside of the control unit5as the control output107, and the control output111of the core20in which the degenerate software C (35) is operating is output as the control output107.

FIG. 10is an example illustrating a timing chart of the software operating in the multi-core system and the lockstep core system in the reconfiguration control device illustrated inFIG. 9and is different in that the lockstep core system4is added compared to the timing chart described inFIG. 5.

In control cycle S3inFIG. 10, when an error occurs in the core13, and the software C (32) becomes inoperable, the degenerate operation described inFIG. 9causes the core20to operate the degenerate software C (35), and in the core13, a return process is performed by a reset signal73from the system control part7.

As described above, even if an error occurs in the core13, the software A (30), software B (31), degenerate software C (35), and software P (34) can operate in the control cycle S3, and thus a process can continue as a whole system while degenerating without stopping.

InFIG. 10, the software P (36) operates on the core22of the lockstep core system4, the software P (37) operates on the core23, and the software P (36) and the software P (37) perform a collation process during operation.

As described above, by configuring the reconfiguration control device of the invention as a dual lockstep core system, even if an error occurs in one lockstep core system and the operation is switched to the multi-core operation, another lockstep core system can continue the lockstep operation. Thus, for example, the invention can be applied to a system that requires high reliability, for example, that requires compliance with functional safety standards.

In the second embodiment, the number of cores of the multi-core system is described as four. However, the number of cores is not limited to four and may be implemented with various numbers of cores.

Third Embodiment

Next, an example of another embodiment of the invention will be described with reference toFIGS. 11 and 12.

FIG. 11is different fromFIG. 1of the first embodiment in the reconfiguration control device of the invention in that the multi-core system and the lockstep core system are separated to be connected by a bus.

The system control part16inFIG. 11corresponds to the multi-core system2, the system control part17corresponds to the lockstep core system3, the system control parts16and17are connected by the control bus301and the memory bus302, and the nonvolatile memory300is connected to the memory bus302. Similarly to the internal configuration of the system control part6described with reference toFIG. 2, the internal configuration of the system control parts16and17includes a multiplexer and a reconfiguration control part.FIG. 12is an example illustrating a configuration of a case where the lockstep operation is switched to the multi-core operation in the reconfiguration control device of the invention in the third embodiment and is different in that the lockstep core is switched from the lockstep operation to the multi-core operation mode, and the software arranged on the memory is replaced compared with the reconfiguration control device illustrated inFIG. 11.

In the control units14and15ofFIG. 12, an example is illustrated in which an error occurs in the core13in the multi-core system2, and the software C (32) becomes inoperable.

According to the control output103from the core13in which an error has occurred, the cores20and21are switched from the lockstep operation mode to the multicore operation mode by the switching control signals81and80from the system control part17by the reconfiguration control part16, and the degenerate software C (35) corresponding to the software C (32) is arranged in the memory60from the nonvolatile memory300via the memory bus302.

At this time, the reconfiguration control parts16and17output selection signals such that the control output103from the core13in which an error has occurred is not output to the outside of the control unit14as the control output107, and the control output111of the core20in which the degenerate software C (35) is operating is output as the control output107. By adopting such a configuration, even when the control system must be configured by a plurality of control units, between a control unit having only a multi-core configuration and a control unit having only a lockstep core configuration, the lockstep core can be switched to the multi-core operation to operate the degenerate software. Thus, the operation of the control system can continue without requiring redundant additional hardware costs.

In the example of the third embodiment, the number of cores of the multi-core system is described as four. However, the number of cores is not limited to four and may be implemented with various numbers of cores.

Fourth Embodiment

Next, an example of another embodiment of the invention will be described with reference toFIG. 13.FIG. 13illustrates an example when the reconfiguration control device of the invention is applied to an in-vehicle system.

The interior of the automobile500is configured by connecting a plurality of electronic control units (Electronic Control Unit, ECU). In this automobile500, a camera501is connected to a camera ECU (511), a steer502is connected to a steer ECU (512), a motor503is connected to a motor ECU (513), and each ECU of the camera ECU (511), the steer ECU (512), and the motor ECU (513) is connected to an integrated ECU (514) and performs control as an automobile by operating in a coordinated manner.

In this configuration, for example, in a case where an error occurs in the steer ECU (512), in the reconfiguration control device of the invention, when the software40operating in the steer ECU (512) is operated as the degenerate software41in the integrated ECU (514), the minimum operation for which the steer ECU (512) is responsible is continued, and when the rotation of the front wheels504and the rear wheels505is continued or stopped depending on the surrounding conditions, a safe operation is secured as the whole automobile500.

As described above, by applying the reconfiguration control device of the invention, even in a case where an error occurs in a part of the ECUs configuring the automobile, a safety can be maintained as a whole automobile while performing a degenerate operation.

Fifth Embodiment

Next, an example of another embodiment of the invention will be described with reference toFIG. 14.FIG. 14illustrates an example when the reconfiguration control device of the invention is applied to an industrial control system.

This industrial control system includes a computer600that controls the system as a whole, a control controller601that is controlled by the computer600, a programmable logic controller602that controls a control equipment604, and a programmable logic controller603that controls a control equipment605. The control controller601and the programmable logic controllers602and603are each connected via a control network606.

In this configuration, for example, in a case where an error occurs in the programmable logic controller602, when the reconfiguration control device of the invention causes the software42operating in the programmable logic controller602to operate as the degenerate software43in the control controller601via the control network606, the minimum operation for which the programmable logic controller602is responsible is continued, and when the operation of the control equipment604is continued or stopped safely, a safe operation is secured as the whole industrial control system.

As described above, the reconfiguration control device of each embodiment includes a multi-core, a lockstep core, and a system control part that dynamically switches the lockstep core to a first core and a second core. The system control part dynamically switches the lockstep core to a multi-core operation when an error occurs in the multi-core, and the system control part instructs restart and diagnosis of the multi-core while the software operating on the multi-core is operating on the first core.

The system control part includes a reconfiguration control part that outputs a selection signal based on values of a control output from the multi-core and a control output from the lockstep core, and a multiplexer that selects a control output from the multi-core and a control output from the lockstep core according to a value of the selection signal.

The reconfiguration control part includes a nonvolatile memory in which the software is arranged, and reads binary data of degenerate software from the nonvolatile memory based the values of the control output from the multi-core and the control output from the lockstep core.

The system control part selects and outputs a control output from the first core instead of the control output from the multi-core when an error occurs in the multi-core.

A multi-core, a first lockstep core, a second lockstep core, and a system control part which dynamically switches the first lockstep core to the first core and the second core are provided. The system control part dynamically switches the first lockstep core to the multi-core operation when an error occurs in the multi-core, and the system control part instructs restart and diagnosis of the multi-core while the software operating on the multi-core is operating on the first core.

As described above, by applying the reconfiguration control device of each embodiment, even in a case where an error occurs in a part of the controllers constituting the industrial control system, a safety can be maintained as a whole system while performing a degenerate operation.

Incidentally, the invention is not limited to the embodiments described above but includes various modifications. For example, the above-described embodiments have been described in detail for easy understanding of the invention, and are not necessarily limited to those having all the described configurations. Also, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

REFERENCE SIGNS LIST