Method for operating a computing device

Abstract

The invention relates to a method for operating a computing device (5) having at least two processors (10, 20) operating in parallel. According to the present invention, it is provided that the first and second processors (10, 20) of the computing device (5) are structurally identical and each have at least two processor cores, and the processor core of the first processor (10) and the processor core of the second processor (20) respectively operate securely, i.e., operate based on a secure operating system (SOS) that reaches or exceeds a predetermined security level, and respectively execute at least one application (APP1, APP2) securely, i.e., when a predetermined security level is reached, wherein the processor core of the first processor (10) and the processor core of the second processor (20) respectively securely execute the same application or multiple identical applications (APP1, APP2), wherein the remaining processor cores of the first processor (10) are either shut down or are also based on the secure operating system (SOS) or one or more other secure operating systems and operate securely while securely executing the same application and / or different applications, wherein in the second processor (20), at least one processor core operates unsafely, i.e., operates based on an unsafe operating system (OS) that does not reach a predetermined security level, and executes at least one application (APP3) unsafely, i.e., when the security level is below a predetermined security level.

Description

Technical Field

[0001] The invention relates to a method for operating a computing device having at least two processors which are operated in parallel. Background Art

[0002] Computing devices with processors running in parallel are used in particular for controlling and monitoring technical devices for which particularly safe device operation must be ensured, as is the case, for example, in the railway sector. For the railway sector, standards EN50128 and EN50129 are considered relevant here, for example. Summary of the invention

[0003] The object of the present invention is to specify a method for operating a computing device which can be carried out particularly securely and in the process also enables the execution of unsafe applications.

[0004] This object is achieved according to the invention by a method having the features of claim 1. Advantageous embodiments of the method according to the invention are specified in the dependent claims.

[0005] Accordingly, according to the present invention, it is provided that the first and second processors of the computing device are structurally identical and each have at least two processor cores, and that the processor cores of the first processor and the processor cores of the second processor each operate securely, i.e., based on a secure operating system that reaches or exceeds a predetermined security level, and each execute at least one application securely, i.e., while reaching a predetermined security level, wherein the mentioned processor cores of the first processor and the mentioned processor cores of the second processor each securely execute the same application or a plurality of identical applications, wherein the remaining processor cores of the first processor are either shut down or likewise operate securely based on the secure operating system or one or more further secure operating systems and while securely executing the same application and / or different applications, wherein in the second processor at least one processor core operates unsafely, i.e., based on an unsafe operating system that does not reach a predetermined security level, and executes at least one application unsafely, i.e., while below a predetermined security level.

[0006] The main advantage of the method according to the invention is that errors caused by unsafely running applications can be detected in a very simple manner. Since in the first processor, the unsafe application does not run at all, and therefore cannot cause errors there either; in the case of two processors, errors of unsafe applications or unsafe operating systems can in any case occur in the second processor, so that errors can be detected in a simple manner, for example, by comparing the operating modes of the two processors. The same applies to more than two processors, since according to the invention, at least only the first processor runs safely, and therefore a comparison with its operating mode can always be made.

[0007] It is considered advantageous to compare the memory contents of the two identically operating processor cores mentioned and to infer an erroneous reaction of the unsafely operating processor core of the second processor to the safely operating processor core of the second processor if all or part of the memory contents, in particular with regard to operating data of a safe application, deviate from one another in the two safely operating processor cores or deviate from one another by more than a predetermined measure.

[0008] In a variant that is considered particularly advantageous, it is provided that a first processor of the computing device has at least three processor cores, of which a selected first processor core runs with a secure operating system, i.e., an operating system that reaches or exceeds a predetermined security level, and executes a first application securely, i.e., while reaching a predetermined security level, a selected second processor core runs with the secure operating system or another secure operating system and securely executes a second application, and a selected third processor core is shut down.

[0009] The second processor preferably also has at least three processor cores, which are referred to as the fourth, fifth and sixth processor cores below, wherein the fourth processor core runs using the same secure operating system as the second processor core and securely executes the second application, the fifth processor core runs using the same secure operating system as the first processor core and securely executes the first application, and the sixth processor core runs using an insecure operating system, i.e., an operating system that does not reach a predetermined security level, and executes the third application insecurely, i.e., at a security level below a predetermined level.

[0010] With regard to the two last-mentioned embodiments, it is considered advantageous if the fifth processor core is a processor core different from the first processor core in the first processor with respect to the processor structure and is located at a different position within the second processor than the first processor core in the first processor, and if the fourth processor core is a processor core different from the second processor core in the first processor with respect to the processor structure and is located at a different position within the second processor than the second processor core in the first processor.

[0011] By means of this different association of the processor core or the application program with the processor architecture of the processor, hardware errors or hardware deviations of the processor can be detected in a simple manner.

[0012] Advantageously, the operating results of one or more safely running applications of the first processor are compared with the operating results of one or more corresponding safely running applications of the second processor, and a warning signal is generated if the operating results deviate or the deviation from each other exceeds a predetermined measure.

[0013] Alternatively or additionally, it is advantageous to compare the memory contents of the first and fifth processor cores and the memory contents of the second and fourth processor cores with one another and, if all or part of the memory contents, in particular with regard to operating data of secure applications, deviate from one another or deviate from one another by more than a predetermined measure, then an erroneous reaction of an unsafely operating processor core of the second processor to a securely operating processor core of the second processor is inferred.

[0014] In another variant that is considered advantageous, it is provided that at least one processor core of the first processor is shut down and at least one processor core of the first processor is operated, wherein all operating processor cores of the first processor operate only securely, each operating processor core of the first processor is correspondingly associated with exactly one processor core of the second processor, which operates with the same secure operating system as the associated processor core of the first processor and executes the same one or more application programs as the associated processor core of the first processor, and at least one processor core of the second processor operates with an insecure operating system, i.e., an operating system that does not reach a predetermined security level, and executes application programs insecurely, i.e., at a security level below a predetermined level.

[0015] With regard to the processor architecture, the securely operating processor core of the second processor is preferably located spatially within the second processor at a different location than the associated processor core in the first processor.

[0016] Preferably, components of the technical system, in particular components of a rail vehicle on the track side or components of a track side, in particular a control station or a centralized control station, are operated using the computing device.

[0017] Furthermore, the invention relates to a computing device having at least two processors operating in parallel.

[0018] According to the present invention, with respect to such a computing device, a first and a second processor of the computing device are structurally identical and each have at least two processor cores, the processor core of the first processor and the processor core of the second processor each operate securely, i.e., operate based on a secure operating system that reaches or exceeds a predetermined security level, and each execute at least one application securely, i.e., while reaching a predetermined security level, wherein the mentioned processor core of the first processor and the mentioned processor core of the second processor each securely execute the same application or multiple identical applications, wherein the remaining processor cores of the first processor are either shut down or also operate securely based on the secure operating system or one or more additional secure operating systems and while securely executing the same application and / or different applications, and wherein, in the second processor, at least one processor core operates unsafely, i.e., operates based on an unsafe operating system that does not reach a predetermined security level, and executes at least one application unsafely, i.e., while below a predetermined security level.

[0019] With regard to the advantages of the computing device according to the invention, reference is made to the above description in conjunction with the method according to the invention.

[0020] The computing device preferably has a comparison device which compares the memory contents of the aforementioned identically operating processor cores with one another and infers an erroneous reaction of the unsafely operating processor core to a safe operating processor core of a second processor if all or part of the memory contents, in particular with regard to operating data of a safe application, deviate from one another in two safe operating processor cores or deviate by more than a predetermined measure.

[0021] The first processor of the computing device preferably has at least three processor cores, of which a selected first processor core runs with a secure operating system, i.e., an operating system that reaches or exceeds a predetermined security level, and executes a first application securely, i.e., while reaching a predetermined security level, a selected second processor core runs with a secure operating system or another secure operating system and securely executes a second application, and a selected third processor core is shut down.

[0022] The second processor of the computing device preferably also has at least three processor cores, which are referred to as the fourth, fifth and sixth processor cores below, wherein the fourth processor core runs using the same secure operating system as the second processor core and securely executes the second application, the fifth processor core runs using the same secure operating system as the first processor core and securely executes the first application, and the sixth processor core runs using an insecure operating system, i.e., an operating system that does not reach a predetermined security level, and executes the third application insecurely, i.e., at a security level below a predetermined level.

[0023] The fourth processor core is preferably a processor core that is different from the second processor core in the first processor with respect to the processor structure, and is located in a different position within the second processor than the second processor core in the first processor.

[0024] The fifth processor core is preferably a processor core different from the first processor core in the first processor with respect to processor structure, and is located in a different position in the second processor than the first processor core in the first processor.

[0025] It is considered particularly advantageous that at least one processor core of the first processor is shut down and at least one processor core of the first processor is operated, wherein all operating processor cores of the first processor operate only securely, each operating processor core of the first processor is correspondingly associated with exactly one processor core of the second processor, which operates identically, i.e. works with the same secure operating system as the associated processor core of the first processor and executes the same one or more application programs as the associated processor core of the first processor, at least one processor core in the second processor operates with an insecure operating system, i.e. an operating system that does not reach a predetermined security level, and executes at least one application program insecurely, i.e. at a security level below a predetermined level, and the securely operating processor core of the second processor is spatially located within the second processor at a different position than the associated processor core in the first processor with respect to the processor structure.

[0026] The invention also relates to a component for a technical device. According to the invention, the component is equipped with a computing device as described above.

[0027] Advantageously, the component is a vehicle-side component, in particular a control device of a vehicle, preferably a rail vehicle, or the component is a track-side component, in particular a control station computer of a control center of a railway track system or a central control station computer of a central control station of a railway track system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The present invention will be described in detail below with reference to embodiments;

[0029] Figure 1 An exemplary embodiment of a computing device according to the invention is shown in which two processors each have three processor cores, wherein Figure 1 An embodiment of the method according to the present invention is described by way of example.

[0030] Figure 2 A further embodiment of a computing device according to the invention is shown by way of example, in which two processors each have four processor cores, wherein Figure 2 Another embodiment of the method according to the present invention is described by way of example, and

[0031] Figure 3 An embodiment of a railway track device and an embodiment of a rail vehicle equipped with a computing device according to the invention are shown by way of example.

[0032] In the drawings, for the sake of clarity, the same reference numbers are used throughout for the same or similar components. DETAILED DESCRIPTION

[0033] Figure 1 A computing device 5 is shown that includes six processor cores, namely a first processor core 11 , a second processor core 12 , a third processor core 13 , a fourth processor core 14 , a fifth processor core 15 , and a sixth processor core 16 .

[0034] Three processor cores 11 , 12 and 13 are located in a first processor 10 of computing device 5 , and processor cores 14 , 15 and 16 are located in a second processor 20 of computing device 5 .

[0035] The two processors 10 and 20 are identical in structure and each have a semiconductor chip 100. The semiconductor chip 100 comprises chip sections K1, K2 and K3, in which processor cores are respectively arranged.

[0036] In accordance with Figure 1 In the embodiment of the present invention, the chip segment K1 is located at the same position with respect to the processor structure and with respect to the semiconductor chip 100 as the chip segment K1 in the second processor 20. In a corresponding manner, the chip segments K2 and K3 in the semiconductor chip 100 of the first processor 10 are located at the same position as the corresponding chip segments K2 and K3 in the semiconductor chip 100 of the second processor 20, respectively.

[0037] The two processors 10 and 20 respectively use a secure operating system SOS to securely execute a first application APP1 and a second application APP2. Here, the "secure" execution of the application should be understood as meeting the standards EN50128 and EN50129. Here, the "secure" operating system SOS should also be understood as an operating system that meets the standards EN50128 and EN50129.

[0038] In the two processors 10 and 20, the applications APP1 and APP2 are executed in different chip segments or in different processor cores. Figure 1 As can be seen in the figure, the first application APP1 is executed in the first processor core 11, that is, in the first chip segment K1 of the first processor, and the first application APP1 is executed by the fifth processor core 15, that is, in the second chip segment K2, in the second processor 20. In other words, the first application APP1 is executed in different chip segments K1 and K2 of the semiconductor chips 100 of the two processors 10 and 20.

[0039] In a corresponding manner, the second application APP2 is also executed in different chip segments. Thus, it can be seen that the first processor 10 executes the second application APP2 in the second chip segment K2, and thus by the second processor core 12; the second processor 20 executes the second application APP2 in the first chip segment K1, and thus by the fourth processor core 14.

[0040] By executing applications APP1 and APP2 in corresponding different chip segments K1 and K2 of processors 10 and 20, it is possible to simply identify possible hardware errors or hardware deviations in semiconductor chip 100 by, for example, comparing working results and / or storage contents of applications APP1 and APP2 across processors.

[0041] In addition, from Figure 1 As can be seen in FIG. 1 , the second processor 20 can use an unsafe operating system OS to execute an unsafe application APP3 in its chip segment K3, i.e., by the sixth processor core 16. The first processor 10 does not execute such an unsafe application APP3; therefore, the first processor 10 does not operate the third chip segment K3, and the third chip segment K3 is safely shut down (or cut off).

[0042] By providing a division of labor in the two processors 10 and 20, so that the first processor 10 runs only with secure applications APP1 and APP2, and only allows the unsecure application (here APP3) in the second processor 20, it is possible to determine possible errors in a simple manner through the unsecure application APP3, or also through the unsecure operating system OS. That is, if the unsecure application APP3 in the second processor 20 works incorrectly and affects the working mode of the processor cores 14 and 15 running securely, this can be determined by comparing the storage content and / or work results of the processor cores 14 and 15 running securely of the second processor 20 with the storage content and / or work results of the processor cores 12 and 11 running securely of the first processor 10 running only securely.

[0043] In accordance with Figure 1 In the embodiment, a memory 50 is allocated to each processor 10 accordingly, and the memory 50 can be integrated in the corresponding semiconductor chip 100 of the corresponding processor 10 or 20, or alternatively, can be formed by a separate component associated with the corresponding semiconductor chip 100 or the corresponding processor.

[0044] The two memories 50 of the two processors 10 and 20 each have storage areas that are individually associated with the processor cores. Thus, the storage area SP11 of the memory 50 of the first processor 10 is associated with the first processor core 11, and thus with the chip segment K1 of the first processor 10; the storage areas SP12 and SP13 are associated with the second processor core 12 and the third processor core 13.

[0045] In a corresponding manner, storage areas SP14 , SP15 and SP16 of memory 50 in second processor 20 are associated with fourth processor core 14 , fifth processor core 15 and sixth processor core 16 .

[0046] The work results of the application programs of the corresponding processor cores, for example, the operating data of the technical equipment controlled or managed by the application programs APP1 to APP3, can be stored in the storage areas SP11 to SP16. Figure 3 ), then the corresponding railway technical operation data, such as occupancy report, release information, train number, train speed, timetable data, etc., can be stored as storage content in the storage areas SP11 to SP16.

[0047] Advantageously, the computing device 5 has a comparison device that enables the storage contents of the storage areas to be compared. Such a comparison device can, for example, compare the storage contents of the storage area SP11, which is associated with the first processor core 11 and therefore with the first application APP1, with the storage area SP15, which is associated with the fifth processor core 15 and therefore also with the first application APP1 in the second processor 20, and output a warning or error signal in the event of a deviation in the storage contents.

[0048] In a corresponding manner, such a comparison device can compare the memory contents SP12 and SP14 with one another and store the work results, for example the operating data, of the second application program APP2 in the two processors 10 and 20 in the memory contents SP12 and SP14 .

[0049] Such a comparison means may be implemented by a separate hardware component or by a comparison function implemented in software which is executed by the securely running processor core itself.

[0050] In short, according to Figure 1 In the embodiment of the present invention, when the unsafe application APP3 exerts a counteraction on the applications APP1 and APP2 running safely in the second processor 20, the error disclosure of the erroneous working mode of the unsafe application APP3 can be realized in a very simple manner, because this erroneous counteraction can be identified by comparing with the working results and working modes of the corresponding applications APP1 and APP2 running safely in the first processor 10. Specifically, this error disclosure is based on the following concept, that is, in the first processor 10, the processor core is either running safely or not running at all, and the unsafe application is allowed only in the second processor 20, so that the error of the unsafe application will not appear in the first processor 10 at all.

[0051] Here, the association of the first processor core 11 executing the first application APP1 with the chip segment K1 of the first processor 10, the association of the second processor core 12 executing the second application APP2 with the chip segment K2 of the first processor 10, the association of the fourth processor core 14 executing the second application APP2 with the chip segment K1 of the second processor 20, and the association of the fifth processor core 15 executing the first application APP1 with the chip segment K2 of the second processor 20 should be understood as merely exemplary; the mentioned processor cores or applications may also be associated with other chip segments and distributed on the semiconductor chip in different ways; this will be described below according to Figure 2 Explain by way of example.

[0052] Figure 2 A second embodiment of a computing device 5 is shown which is equipped with two processors 10 and 20. Figure 1 In the embodiment of the present invention, each of the processors 10 and 20 has four processor cores, that is, Figure 1 In the embodiment of the invention, there are two more. Figure 2 The two additional processor cores are denoted by reference numerals 17 and 18 .

[0053] The second processor 20 runs with two unsafe applications APP3 and APP4 executed in the processor cores 16 and 18. Therefore, in the first processor 10, two of the processor cores, for example the processor cores 13 and 17, remain unused.

[0054] exist Figure 2 The association with the chip segments is, for example, as follows: the so-called first processor core 11 executing the first application APP1 is associated with the chip segment K4 of the first processor 10, the so-called second processor core 12 executing the second application APP2 is associated with the chip segment K2 of the first processor 10, the so-called fourth processor core 14 executing the second application APP2 is associated with the chip segment K1 of the second processor 20, and the so-called fifth processor core 15 executing the first application APP1 is associated with the chip segment K3 of the second processor 20. The unsafe applications APP3 and APP4 run in the chip segments K2 and K4 of the second processor 20.

[0055] In addition, the above combined Figure 1 The descriptions apply accordingly.

[0056] Figure 3 An embodiment of a railway track installation 300 is shown, on which a rail vehicle 310 travels.

[0057] The rail vehicle 310 has a control device 310a, which includes a Figure 1 and 2 computing device 5.

[0058] The railway track equipment 300 includes a track-side component in the form of a centralized control station computer 320a of a centralized control station 320. The centralized control station computer 320a has a Figure 1 and 2 computing device 5.

[0059] Regarding the working mode of the control device 310a and the centralized control station computer 320a, refer to the above combined with the Figure 1 and 2 Description of the computing device 5.

[0060] Although the present invention has been described in detail through preferred embodiments, the present invention is not limited to the disclosed examples, and those skilled in the art may derive other variations therefrom without departing from the scope of protection of the present invention.

Claims

1. A method for operating a computing device (5) having at least two processors (10, 20) operating in parallel, It is characterized in that - the first and second processors (10, 20) of the computing device (5) are identical in structure and each has at least two processor cores, and - a processor core of the first processor (10) and a processor core of the second processor (20) are each operated securely, i.e. based on a secure operating system (SOS) that reaches or exceeds a predetermined security level, and at least one application is each executed securely, i.e. at a predetermined security level, - wherein the one processor core of the first processor (10) and the one processor core of the second processor (20) respectively securely execute the same application or multiple identical applications, - wherein the remaining processor cores of the first processor (10) are either switched off or are also based on the secure operating system (SOS) or one or more further secure operating systems and run securely while securely executing the same application and / or different applications, - wherein at least one of the remaining processor cores of the second processor (20) operates insecurely, i.e. based on an insecure operating system (OS) that does not reach a predetermined security level, and executes at least one application insecurely, i.e. below a predetermined security level.

2. The method according to claim 1, It is characterized in that The memory contents of the one processor core of the first processor (10) and the one processor core of the second processor (20) which are operated identically are compared, and if all or part of the memory contents, taking into account the operating data of the secure application, deviate from each other in the two securely operating processor cores or deviate from each other by more than a predetermined measure, it is inferred that the unsecurely operating processor core of the second processor (20) has an erroneous reaction to the securely operating processor core of the second processor (20).

3. The method according to claim 1, It is characterized in that The first processor (10) of the computing device (5) has at least three processor cores (11, 12, 13), wherein a selected first processor core (11) runs with a secure operating system (SOS), i.e., an operating system that reaches or exceeds a predetermined security level, and executes a first application program securely, i.e., when a predetermined security level is reached, - the selected second processor core (12) runs using the secure operating system or another secure operating system (SOS) and securely executes a second application, and - the selected third processor core (13) is shut down, - the second processor (20) also has at least three processor cores (14, 15, 16), which are referred to as the fourth, fifth and sixth processor cores below, wherein - the fourth processor core (14) runs using the same secure operating system (SOS) as the second processor core (12) and securely executes the second application program, - the fifth processor core (15) runs using the same secure operating system (SOS) as the first processor core (11) and securely executes the first application, and The sixth processor core (16) runs with an insecure operating system, ie, an operating system that does not reach a predefined security level, and executes the third application program in an insecure manner, ie, at a security level below a predefined security level.

4. The method according to claim 3, It is characterized in that - the fifth processor core (15) is a processor core different from the first processor core (11) in the first processor (10) with respect to the processor structure, and is located in a different position in the second processor (20) than the first processor core (11) in the first processor (10), and - The fourth processor core (14) is a processor core different from the second processor core (12) in the first processor (10) with respect to the processor structure, and is located in a different position in the second processor (20) than the second processor core (12) in the first processor.

5. The method according to claim 1, It is characterized in that The operating results of one or more securely executed applications of the first processor (10) are compared with the operating results of one or more corresponding securely executed applications of the second processor (20), and a warning signal is generated when the operating results deviate or the deviation relative to each other exceeds a predetermined measure.

6. The method according to claim 3, It is characterized in that The memory contents of the first (11) and fifth processor cores (15) and the memory contents of the second (12) and fourth processor cores (14) are compared with one another and if all or part of the memory contents deviate from one another with regard to operating data of a secure application program or deviate from one another by more than a predetermined measure, an erroneous reaction of an unsafely operating processor core (16) of a second processor (20) to a securely operating processor core (14, 15) of the second processor (20) is inferred.

7. The method according to claim 1, It is characterized in that - at least one processor core of the first processor (10) is shut down and at least one processor core of the first processor (10) is running, wherein all running processor cores of the first processor (10) are running only securely, - each operating processor core of the first processor (10) is respectively associated with exactly one processor core of the second processor (20), wherein the exactly one processor core of the second processor (20) operates using the same secure operating system (SOS) as the following processor core of the first processor (10), which is associated with the exactly one processor core of the second processor (20), and executes the same one or more application programs as the following processor core of the first processor (10), which is associated with the exactly one processor core of the second processor (20), and At least one processor core in the second processor (20) runs with an insecure operating system (OS), ie an operating system that does not reach a predefined security level, and executes application programs insecurely, ie below a predefined security level.

8. The method according to any one of claims 1 to 7, It is characterized in that The securely executed processor core of the second processor (20) is spatially located within the second processor (20) at a different location than the associated processor core in the first processor (10) with respect to the processor architecture.

9. The method according to any one of claims 1 to 7, It is characterized in that Components of the technical system are operated using the computing device (5).

10. The method according to any one of claims 1 to 7, It is characterized in that Rail vehicle-side components or track-side components of a rail vehicle (310) are operated using the computing device (5).

11. The method according to any one of claims 1 to 7, It is characterized in that The control station or centralized control station (320) is operated by using the computing device (5).

12. A computing device (5) having at least two processors (10, 20) operating in parallel, It is characterized in that - the first (10) and second processor (20) of the computing device (5) are identical in structure and each has at least two processor cores, - a processor core of the first processor (10) and a processor core of the second processor (20) are each operated securely, i.e. based on a secure operating system (SOS) that reaches or exceeds a predetermined security level, and at least one application is each executed securely, i.e. at a predetermined security level, - wherein the one processor core of the first processor (10) and the one processor core of the second processor (20) respectively securely execute the same application or multiple identical applications, - wherein the remaining processor cores of the first processor (10) are either switched off or are also based on the secure operating system (SOS) or one or more further secure operating systems and run securely while securely executing the same application and / or different applications, and - wherein at least one of the remaining processor cores of the second processor (20) operates insecurely, i.e. based on an insecure operating system (OS) that does not reach a predetermined security level, and executes at least one application insecurely, i.e. below a predetermined security level.

13. The computing device (5) according to claim 12, It is characterized in that The computing device (5) has a comparison device which compares the storage contents of the one processor core of the first processor (10) and the one processor core of the second processor (20) which are operated identically, and if all or part of the storage contents, taking into account the operating data of a secure application, deviate from each other in the two securely operating processor cores, or the deviation exceeds a predetermined measure, then it is inferred that the processor core which is operated unsafely has an erroneous reaction on the securely operating processor core of the second processor (20).

14. The computing device (5) according to claim 12, It is characterized in that The first processor (10) of the computing device (5) has at least three processor cores (11, 12, 13), wherein a selected first processor core (11) runs with a secure operating system (SOS), i.e., an operating system that reaches or exceeds a predetermined security level, and executes a first application program securely, i.e., when a predetermined security level is reached, - the selected second processor core (12) runs using the secure operating system or another secure operating system and securely executes a second application, and - the selected third processor core (13) is shut down, The second processor (20) of the computing device (5) also has at least three processor cores (14, 15, 16), which are referred to as the fourth, fifth and sixth processor cores below, wherein the fourth processor core (14) runs using the same secure operating system (SOS) as the second processor core (12) and securely executes the second application program, - a fifth processor core (15) runs using the same secure operating system (SOS) as the first processor core (11) and securely executes the first application, a sixth processor core (16) is running with an insecure operating system (OS), i.e. an operating system that does not reach a predetermined security level, and executes a third application program in an insecure manner, i.e. at a security level below a predetermined security level, - the fourth processor core (14) is a processor core different from the second processor core (12) in the first processor (10) with respect to the processor structure, and is located in a different position in the second processor (20) than the second processor core (12) in the first processor (10), - The fifth processor core (15) is a processor core different from the first processor core (11) in the first processor (10) with respect to the processor structure, and is located in a different position in the second processor (20) than the first processor core (11) in the first processor (10).

15. The computing device (5) according to claim 12, It is characterized in that - at least one processor core of the first processor (10) is shut down and at least one processor core of the first processor (10) is running, wherein all running processor cores of the first processor (10) are running only securely, - each operating processor core of the first processor (10) is respectively associated with exactly one processor core of the second processor (20), which operates identically, i.e., the exactly one processor core of the second processor (20) operates using the same secure operating system (SOS) as the following processor core of the first processor (10), which is associated with the exactly one processor core of the second processor (20), and executes the same one or more application programs as the following processor core of the first processor (10), which is associated with the exactly one processor core of the second processor (20), - at least one processor core in the second processor (20) runs with an insecure operating system (OS), i.e. an operating system that does not reach a predetermined security level, and executes at least one application in an insecure manner, i.e. below a predetermined security level, and The securely operating processor core of the second processor (20) is located spatially within the second processor (20) at a different location than the associated processor core in the first processor (10) with respect to the processor architecture.

16. A component for a technical device, It is characterized in that The component is provided with a computing device (5) according to any of the preceding claims 12 to 13.

17. The component according to claim 16, It is characterized in that - the component is a vehicle-side component, or - The components are line-side components.

18. The component according to claim 16, It is characterized in that - the component is a control device (310a) of a vehicle, or - The component is a control station computer of a control center of the railway track equipment (300) or a centralized control station computer of a centralized control station (320) of the railway track equipment (300).

19. The component according to claim 18, It is characterized in that The vehicle is a rail vehicle.

Images