Microprocessor system having fault-tolerant architecture

Abstract

The invention relates to a microprocessor system (MCUSA) for executing software modules, at least some of which are security-critical, within the scope of controlling functions or tasks assigned to the software modules, comprising an intrinsically safe microprocessor module (HWSAi) having at least two microprocessor cores (CPUi). According to the invention, at least one further intrinsically safe microprocessor module (HWSAi i=1,... n) having at least two microprocessor cores (CPU1, CPU2; CPU3, CPU4) is provided, wherein the at least two microprocessor modules (HWSA1, HWSA2) are connected via a bus system (B), at least two software modules are provided which execute functions, at least some of which overlap, said software modules having at least partially overlapping functions are distributed on a microprocessor module (HWSA1, HWSA2) or on at least two microprocessor modules (HWSA1, HWSA2), and means for comparing and / or arbitrating events generated with the software modules for the identical functions are provided in order to detect software and / or hardware faults.

Description

technical field [0001] The invention relates to a microprocessor system according to the preambles of the patent claims for, as part of the control and / or regulation of functions or tasks associated with at least some safety-critical software modules, to perform the software modules. Background technique [0002] The prior art discloses intrinsically safe microcontroller and microprocessor systems for safety-related motor vehicle controllers. [0003] In this context, the term "intrinsic safety" is considered to be the ability of an electronic system to remain in a safe state upon the occurrence of a particular fault or to immediately change to another safe state, or to shut down when a fault occurs. A subset of this property is the fault-quiet property of a component in a system that communicates with other components and that once a fault within that component is identified no further information is transmitted and no further action is performed by itself. [0004] By wa...

AI Technical Summary

Problems solved by technology

Since the boundaries of software components are no longer clearly defined, it is increasingly difficult to consider such an overall system from the point of view of the FSM, and the introduction of the concept of multi-level inefficient run levels is very complicated,

[0019] - Ultimately, due to this monolithic structure, the manageability, care and maintenance of the software components themselves are lost

Images