Lock step method and device, vehicle and storage medium

Abstract

The embodiment of the invention discloses a lock step method and device, a vehicle and a storage medium. The method comprises the steps that a first core obtains a first operation result and a timestamp corresponding to an input instruction sent by a second core, wherein the first operation result is a result obtained after the second core processes the input instruction; the first core obtains a second operation result corresponding to an input instruction from a preset storage area based on a timestamp, and releases the storage area to which the timestamp belongs from the preset storage area; if the first core determines that the first operation result is different from the second operation result, determining that a fault occurs, and adding one to a fault count in a fault management module of the first core; and when the fault count exceeds a count threshold value, the first core performs energy forbidding processing on the output module, and the second core performs energy forbidding processing on the output module at the same time. According to the method, the performance requirement on the second core can be reduced through the lockstep system constructed by the first core and the second core.

Description

Technical Field

[0001] The present application belongs to the field of vehicle technology, and specifically relates to a locking method, device, vehicle and storage medium. Background Art

[0002] As the core of microcontrollers, processors are facing severe challenges in reliability and security due to the continuous updating of process nodes and the continuous development of attack technologies. In terms of reliability, one of the mainstream fault-tolerance methods for commercial processors is the dual-core lock-step fault-tolerance scheme. This technology uses two processors to make them a self-monitoring pair to detect the occurrence of faults. However, in the related lock-step construction method, the lock-step construction requires the high performance of the lock-step core. Summary of the invention

[0003] In view of the above problems, the present application proposes a lock-step method, device, vehicle and storage medium to improve the above problems.

[0004] In the first aspect, an embodiment of the present application provides a lock-step method, the method comprising: a first core obtains a first operation result and a timestamp corresponding to an input instruction sent by a second core, the first operation result being a result obtained after the second core processes the input instruction; the first core obtains a second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is a result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core; if the first core determines that the first operation result and the second operation result are different, it is determined that a fault has occurred, and the fault count in the fault management module of the first core is increased by one; when the fault count exceeds the count threshold, the first core disables the output module, and the second core disables the output module at the same time.

[0005] In a second aspect, an embodiment of the present application provides a lock-step system, comprising: a first core and a second core; the first core is used to obtain a first operation result and a timestamp corresponding to an input instruction sent by the second core, the first operation result being a result obtained after the second core processes the input instruction; the first core is used to obtain a second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and release the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is a result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core; the first core is used to determine that a fault has occurred if it is determined that the first operation result and the second operation result are different, and the fault count in the fault management module of the first core is increased by one; the first core is used to disable the output module when the fault count exceeds a count threshold; the second core is used to disable the output module.

[0006] In a third aspect, an embodiment of the present application provides a vehicle, comprising one or more processors and a memory; one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above-mentioned method.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored, wherein the above method is executed when the program code is run.

[0008] The embodiments of the present application provide a lock-step method, device, vehicle and storage medium. First, the first core obtains the first operation result and timestamp corresponding to the input instruction sent by the second core, the first operation result is the result obtained after the second core processes the input instruction, and then the first core obtains the second operation result corresponding to the input instruction from the preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area. If the first core determines that the first operation result and the second operation result are different, it is determined that a fault has occurred, and the fault count in the fault management module of the first core is increased by one. When the fault count exceeds the count threshold, the first core disables the output module, and the second core disables the output module at the same time. Through the above method, the lock-step system constructed by the first core and the second core can reduce the performance requirements for the second core. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A schematic diagram of an application scenario of a lockstep method provided by an embodiment of the present application is shown;

[0011] Figure 2 A flow chart of a lock-step method proposed in one embodiment of the present application is shown;

[0012] Figure 3 A flowchart of a lock-step method proposed in another embodiment of the present application is shown;

[0013] Figure 4 A structural block diagram of a lockstep system proposed in an embodiment of the present application is shown;

[0014] Figure 5 A structural block diagram of a vehicle for executing a lock-step method according to an embodiment of the present application is shown;

[0015] Figure 6 A storage unit in an embodiment of the present application is shown for storing or carrying a program code for implementing a lockstep method according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0017] The embodiments of the present application propose a lock-step method, device, vehicle, and storage medium. First, the first core obtains the first operation result and timestamp corresponding to the input instruction sent by the second core, the first operation result being the result obtained after the second core processes the input instruction, and then the first core obtains the second operation result corresponding to the input instruction from the preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area. If the first core determines that the first operation result and the second operation result are different, it is determined that a fault has occurred, and the fault count in the fault management module of the first core is increased by one. When the fault count exceeds the count threshold, the first core disables the output module, and the second core disables the output module at the same time. Through the above method, the lock-step system constructed by the first core and the second core can reduce the performance requirements for the second core.

[0018] The following is an introduction to the application environment of the lockstep method provided by the present invention:

[0019] See also Figure 1 The lock-step method provided by the embodiment of the present invention can be applied to a lock-step system 100, and the lock-step system 100 may include a first core 110, a second core 120, an instruction input module 130, and an instruction output module 140. Among them, the first core 110 may run software I and fault management software E; the second core 120 may run software I' and fault management software F; the instruction input module 130 is shared by the first core 110 and the second core 120; the instruction output module 140 is exclusively used by the first core 110, but the second core 120 has the enabling authority of the output channel, and there is a communication link M between the first core 110 and the second core 120.

[0020] Furthermore, the software I and the software I' may be the same algorithm, but in order to reduce the probability of common mode failure, it is recommended to use different algorithms. Wherein, the software I and the software I' are both software for running the input instructions obtained from the instruction input module 130 to obtain output results.

[0021] Fault management software E, fault management software F and software I, software I' are differentiated in time and space, and there is no software-related failure.

[0022] Among them, the time from software I receiving input instructions to completing the calculation and output results is less than or equal to βs; β should be less than or equal to the design cycle τ s； The time from receiving the input command to completing the calculation and outputting the result of software I' is less than or equal to αs; the time difference between α and β is λ, N*λ≤design cycle τ. The design cycle can be understood as the instruction sending cycle, that is, the input command or calculation result is sent once every design cycle.

[0023] Optionally, a FIFO (First Input First Output) storage area is provided in the first core 110, and the depth of the FIFO in the first core 110 is N+X, wherein the selection of N should be subject to system verification and simulation, and the error threshold G should be less than or equal to N; X is a buffer area, and X can be selected according to the storage space of the first core 110 to avoid unexpected loss of results, but should not be too large so that the FIFO query time is longer than one output beat.

[0024] The bandwidth of the communication link M should meet the needs of all the data to be sent in the above cycle; the communication link M can be a single channel or a dual channel. It is recommended to use a dual channel, and it is further recommended to use a heterogeneous dual channel to reduce the error probability and common mode failure probability.

[0025] The instruction output module 140 may also be called an output module. The instruction output module has an output disabling interface. Both the first core 110 and the second core 120 may disable the output module.

[0026] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0027] See also Figure 2 , a lockstep method provided in an embodiment of the present application, the method comprising:

[0028] Step S110: the first core obtains a first operation result and a timestamp corresponding to an input instruction sent by the second core, where the first operation result is a result obtained after the second core processes the input instruction.

[0029] In the embodiment of the present application, the first core and the second core can be two cores or processor cores arranged in the same operating system or chip. Optionally, the advance of this solution is that even if the first core outputs wrong instructions N times in a row, it will not cause system failure; for systems with motion inertia, short-term errors are usually allowed, such as a running motor. Even if the speed gives an error signal once, the motor will not suddenly run away due to inertia. The first core and the second core already contain all the conditions required for the operation of the core, including but not limited to: power supply, processor, RAM, ROM, IO port, etc.

[0030] The input instruction can be understood as an instruction for operating and controlling the first core and the second core. The input instruction can be an instruction obtained by the second core from the instruction input module, or an instruction obtained by the second core from the first core, which is not specifically limited here. The timestamp can be understood as the generation time of the input instruction, and the timestamp can be 32 bits or above, such as 64 bits. Optionally, the input instruction can be understood as an instruction sent by other systems that requires a response from this system.

[0031] As a method, after the second core obtains the input instruction and the timestamp corresponding to the input instruction, the software I' in the second core can calculate the input instruction to obtain the first operation result. After the second core obtains the first operation result, the first operation result and the timestamp corresponding to the input instruction can be sent to the first core. The first operation result can be understood as the result output after the software I' in the second core executes the input instruction.

[0032] Step S120: The first core obtains the second operation result corresponding to the input instruction from the preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is the result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core.

[0033] In an embodiment of the present application, the preset storage area is a software FIFO space set in the first core, and the software FIFO space is used to store the operation result generated after the first core executes the input instruction in a first-in-first-out manner, that is, to store the second operation result. The second operation result can be understood as the result output after the software I in the first core executes the input instruction. When the second operation result is stored in the preset storage area, its corresponding timestamp can also be stored, so that when the corresponding second operation result needs to be found, the corresponding second operation result can be found according to the corresponding timestamp.

[0034] After the first core obtains the first operation result and timestamp sent by the second core, it can query the first operation result corresponding to the timestamp from the preset storage area according to the timestamp; when the first core queries the first operation result corresponding to the timestamp in the preset storage area, it can directly release the FIFO space to which the timestamp belongs, that is, release the storage area of ​​the first operation result corresponding to the timestamp.

[0035] Step S130: If the first core determines that the first operation result is different from the second operation result, it is determined that a fault has occurred, and the fault count in the fault management module of the first core is increased by one.

[0036] In the embodiment of the present application, the fault management module of the first core refers to the aforementioned fault management software E. The fault count refers to the number of times a fault occurs.

[0037] After obtaining the first operation result and the second operation result corresponding to the same timestamp, the first core can determine whether the values ​​of the first operation result and the second operation result are the same to determine whether a fault occurs. If the values ​​of the first operation result and the second operation result are different, it is determined that a fault occurs, and the error is sent to the fault management software E in the first core, and the error result is sent to the fault management software F of the second core through the communication link M.

[0038] When the fault management software E receives the error, it counts the number of fault occurrences and increases the fault count by 1. Similarly, when the fault management software F receives the error result sent by the first core, it counts the number of fault occurrences and increases the fault count by 1.

[0039] Step S140: When the fault count exceeds a count threshold, the first core disables the output module, and the second core disables the output module.

[0040] In the embodiment of the present application, the count threshold is a preset maximum number of times that a fault can occur. When the first core detects that the current fault count exceeds the count threshold, the output module can be disabled, and the second core can also disable the output module. The output module refers to the aforementioned instruction output module.

[0041] Optionally, since the output module has an output disabling module, the first core and the second core can both disable the output module through the output disabling interface. Specifically, the first core can disable the output module through the output disabling interface through the fault management software E; the second core can disable the output module through the output disabling interface through the fault management software F. Disabling can be understood as preventing the fault from spreading outside the system, that is, the first operation result and the second operation result cannot be sent out of the system.

[0042] The present application provides a lockstep method, firstly, the first core obtains the first operation result and timestamp corresponding to the input instruction sent by the second core, the first operation result is the result obtained after the second core processes the input instruction, then the first core obtains the second operation result corresponding to the input instruction from the preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area, if the first core determines that the first operation result and the second operation result are different, it is determined that a fault has occurred, the fault count in the fault management module of the first core increases by one, when the fault count exceeds the count threshold, the first core disables the output module, and the second core disables the output module at the same time. Through the above method, the lockstep system constructed by the first core and the second core can reduce the performance requirements for the second core.

[0043] See also Figure 3, a lockstep method provided in an embodiment of the present application, the method comprising:

[0044] Step S210: The first core obtains the input instruction and the timestamp of the input instruction from the instruction input module, and sends the input instruction and the timestamp to the second core through a preset communication link.

[0045] In the embodiment of the present application, the preset communication link refers to the aforementioned communication link M. When the first core and the second core need to obtain an input instruction, the first core can first obtain the input instruction and the timestamp of the input instruction from the instruction input module, and then the first core sends the input instruction and the timestamp of the input instruction to the second core through the communication link M.

[0046] As another way, the first core obtains the input instruction and the timestamp of the input instruction from the instruction input module; the second core obtains the input instruction and the timestamp of the input instruction from the instruction input module.

[0047] Alternatively, the first core and the second core may directly obtain the input instruction and the timestamp of the input instruction from the instruction input module, which is not specifically limited here.

[0048] Optionally, when the first core and the second core obtain the same input instruction from the instruction input module, they may or may not obtain it at the same time, which is not specifically limited here.

[0049] In an embodiment of the present application, the input instruction can be sent by the instruction input module according to a preset period.

[0050] Step S220: the first core executes the input instruction to obtain the second operation result, and stores the second operation result and the timestamp in the preset storage area.

[0051] In the embodiment of the present application, the first core has a FIFO for storing calculation results, and the depth of the FIFO is N+X.

[0052] After the first core obtains the input instruction and the timestamp of the input instruction, it can run software I to execute the input instruction to obtain the second operation result; then the first core can write the timestamp of the input instruction and the second operation result into the FIFO of the first core.

[0053] As a method, after the first core executes the input instruction and obtains the second operation result, the method further includes: the first core outputs the second operation result through the output module.

[0054] In an embodiment of the present application, after the first core runs software I to execute an input instruction to obtain a second operation result, the first core can output the second operation result through an output module.

[0055] Step S230: the second core executes the input instruction to obtain the first operation result, and sends the first operation result and the timestamp to the first core through the preset communication link.

[0056] In an embodiment of the present application, after the second core receives the input instruction, it runs software I' to execute the input instruction and obtain a first operation result; after the second core obtains the first operation result, the second core can send the timestamp of the input instruction and the first operation result to the first core through the communication link M.

[0057] As a mode, the method also includes: the fault management module of the second core outputs a fault flag; the second core sends the first operation result, the timestamp and the fault flag to the first core; if the first core receives the fault flag a preset number of times, the fault management module of the first core disables the output module.

[0058] The fault flag is used to indicate that a fault has occurred in the second core, and the fault can be understood as an operation fault.

[0059] When the second core running software I' executes the input instruction, the fault management software F in the second core runs continuously and outputs the fault flag R; then when the second core sends the timestamp and the first operation result of the input instruction to the first core through the communication link M, the fault flag R can be sent to the first core together.

[0060] Step S240: the first core obtains a first operation result and a timestamp corresponding to the input instruction sent by the second core, where the first operation result is a result obtained after the second core processes the input instruction.

[0061] Step S250: the first core obtains the second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area.

[0062] Step S260: If the first core determines that the first operation result is different from the second operation result, it is determined that a fault has occurred, and the fault count in the fault management module of the first core is increased by one.

[0063] As a method, after step S260, the method further includes: the first core sends fault information to the second core through a preset communication link; based on the fault information, the fault count in the fault management module of the second core increases by one.

[0064] In the embodiment of the present application, the fault information may be information indicating that the first operation result and the second operation result are different.

[0065] After determining that a fault has occurred, the first core may send fault information to the second core via the communication link M, so that the fault management software F of the second core may count the number of fault occurrences based on the fault information.

[0066] Step S270: When the fault count exceeds a count threshold, the first core disables the output module, and the second core disables the output module.

[0067] In the embodiment of the present application, the second core disables the output module. When the fault management software F of the second core detects that the fault count exceeds the count threshold, the fault management software F of the second core disables the output module.

[0068] Optionally, the second core disables the output module. When the first core continuously receives a preset number of fault flags sent by the second core, the fault management software F of the second core disables the output module.

[0069] The first core disables the output module. When the first core continuously receives the fault flag sent by the second core for a preset number of times, the fault management software E of the first core disables the output module.

[0070] As a method, the method also includes: the fault management module of the first core detects the storage status of the preset storage area; if the storage status is an overflow state, the fault management module of the first core records the storage status and disables the output module.

[0071] The storage state of the preset storage area may refer to the state of the FIFO, including an overflow state and a non-overflow state. The overflow state indicates that the second core has not sent the first operation result to the first core for N+X consecutive times. The fault management software E of the first core records the occurrence of the fault and disables the output module.

[0072] The present application provides a lockstep method, and a software lockstep system constructed by the above method can reduce the performance requirements for the second core and the performance requirements for the preset communication link, thereby reducing the hardware cost of the system. At the same time, a system without lockstep can be transformed into a system with lockstep at a minimum cost.

[0073] See also Figure 4 , an embodiment of the present application provides a lockstep system 300, the system 300 comprising a first core 310 and a second core 320;

[0074] The first core 310 is used to obtain a first operation result and a timestamp corresponding to the input instruction sent by the second core, where the first operation result is a result obtained after the second core processes the input instruction.

[0075] The first core 310 is used to obtain a second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and release the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is a result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core.

[0076] The first core 310 is configured to increase a fault count in a fault management module of the first core by one if it is determined that the first operation result and the second operation result are different, thereby determining that a fault has occurred.

[0077] The first core 310 is configured to disable the output module when the fault count exceeds a count threshold.

[0078] The second core 320 is used to disable the output module.

[0079] It should be noted that the device embodiment in the present application corresponds to the aforementioned method embodiment. The specific principles in the device embodiment can be found in the contents of the aforementioned method embodiment and will not be repeated here.

[0080] The following will be combined Figure 5 A vehicle provided in the present application is described.

[0081] See also Figure 5 Based on the above-mentioned locking method and device, the embodiment of the present application also provides another vehicle 800 that can execute the above-mentioned locking method. The vehicle 800 includes one or more (only one is shown in the figure) processors 802, a memory 804 and a network module 806 that are coupled to each other. Among them, the memory 804 stores a program that can execute the content of the above-mentioned embodiment, and the processor 802 can execute the program stored in the memory 804.

[0082] Among them, the processor 802 may include one or more processing cores. The processor 802 uses various interfaces and lines to connect various parts of the entire vehicle 800, and executes various functions and processes data of the vehicle 800 by running or executing instructions, programs, code sets or instruction sets stored in the memory 804, and calling data stored in the memory 804. Optionally, the processor 802 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 802 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 802, but may be implemented separately through a communication chip.

[0083] The memory 804 may include a random access memory (RAM) or a read-only memory (ROM). The memory 804 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 804 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the vehicle 800 during use (such as a phone book, audio and video data, chat record data), etc.

[0084] The network module 806 is used to receive and send electromagnetic waves, realize the mutual conversion between electromagnetic waves and electrical signals, and thus communicate with a communication network or other devices, such as communicating with a vehicle. The network module 806 may include various existing circuit elements for performing these functions, such as antennas, radio frequency nodes, digital signal processors, encryption / decryption chips, user identity module (SIM) cards, memories, etc. The network module 806 can communicate with various networks such as the Internet, corporate intranets, wireless networks, or communicate with other devices through wireless networks. The above-mentioned wireless networks may include cellular telephone networks, wireless local area networks, or metropolitan area networks. For example, the network module 806 can exchange information with a base station.

[0085] Please refer to Figure 6 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 900 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0086] The computer-readable storage medium 900 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 900 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 900 has storage space for program code 910 that performs any method step in the above method. These program codes can be read from or written to one or more computer program products. The program code 910 can be compressed, for example, in an appropriate form.

[0087] The present application provides a lock-step method, device, vehicle and storage medium. First, the first core obtains the first operation result and timestamp corresponding to the input instruction sent by the second core. The first operation result is the result obtained after the second core processes the input instruction. Then, based on the timestamp, the first core obtains the second operation result corresponding to the input instruction from the preset storage area, and releases the storage area to which the timestamp belongs from the preset storage area. If the first core determines that the first operation result and the second operation result are different, it is determined that a fault has occurred, and the fault count in the fault management module of the first core increases by one. When the fault count exceeds the count threshold, the first core disables the output module, and the second core disables the output module at the same time. Through the above method, the lock-step system constructed by the first core and the second core can reduce the performance requirements for the second core.

[0088] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the enlightenment of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. A lockstep method, characterized in that: The method comprises: The first core obtains a first operation result and a timestamp corresponding to an input instruction sent by the second core, where the first operation result is a result obtained after the second core processes the input instruction; The first core obtains a second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and releases the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is a result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core; If the first core determines that the first operation result and the second operation result are different, it is determined that a fault occurs, and a fault count in the fault management module of the first core is increased by one; When the fault count exceeds a count threshold, the first core disables the output module, and the second core disables the output module.

2. The method according to claim 1, characterized in that Before the first core obtains the operation result and timestamp corresponding to the first input instruction sent by the second core, the following further includes: The first core obtains the input instruction and the timestamp of the input instruction from the instruction input module, and sends the input instruction and the timestamp to the second core through a preset communication link; The first core executes the input instruction to obtain the second operation result, and stores the second operation result and the timestamp in the preset storage area; The second core executes the input instruction to obtain the first operation result, and sends the first operation result and the timestamp to the first core through the preset communication link.

3. The method according to claim 1, characterized in that Before the first core obtains the operation result and timestamp corresponding to the first input instruction sent by the second core, the following further includes: The first core obtains the input instruction and the timestamp of the input instruction from the instruction input module; The second core obtains the input instruction and the timestamp of the input instruction from the instruction input module; The first core executes the input instruction to obtain the second operation result, and stores the second operation result and the timestamp in the preset storage area; The second core executes the input instruction to obtain the first operation result, and sends the first operation result and the timestamp to the first core through the preset communication link.

4. The method according to claim 2 or 3, characterized in that: After the first core executes the input instruction and obtains the second operation result, the following further comprises: The first core outputs the second operation result through the output module.

5. The method according to claim 2 or 3, characterized in that: The method further comprises: The fault management module of the second core outputs a fault flag bit; The second core sends the first operation result, the timestamp, and the fault flag to the first core; If the number of times the first core receives the fault flag is a preset number, the fault management module of the first core disables the output module.

6. The method according to claim 1, characterized in that If the first core determines that the first operation result and the second operation result are different, it is determined that a fault occurs, and after the fault count in the fault management module of the first core is increased by one, the method further includes: The first core sends fault information to the second core via a preset communication link; Based on the fault information, a fault count in a fault management module of the second core is increased by one.

7. The method according to claim 1, characterized in that The method further comprises: The fault management module of the first core detects the storage status of the preset storage area; If the storage state is an overflow state, the fault management module of the first core records the storage state and disables the output module.

8. A lockstep system, characterized in that: The lockstep system includes a first core and a second core; The first core is used to obtain a first operation result and a timestamp corresponding to an input instruction sent by the second core, where the first operation result is a result obtained after the second core processes the input instruction; The first core is used to obtain a second operation result corresponding to the input instruction from a preset storage area based on the timestamp, and release the storage area to which the timestamp belongs from the preset storage area, wherein the second operation result is a result obtained after the first core processes the input instruction, and the preset storage area is a first-in-first-out space set in the first core; the first core is configured to, if it is determined that the first operation result and the second operation result are different, determine that a fault has occurred, and increase a fault count in a fault management module of the first core by one; The first core is configured to disable the output module when the fault count exceeds a count threshold; The second core is used to disable the output module.

9. A vehicle, characterized in that: The method comprises one or more processors; one or more programs are stored in a memory and configured to execute the method according to any one of claims 1 to 6 by the one or more processors.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program code, wherein when the program code is executed by a processor, the method according to any one of claims 1 to 6 is executed.

Images