Redundancy calculation system, redundancy calculation processing method and related equipment

Abstract

The invention discloses a redundancy calculation system, a redundancy calculation processing method and related equipment. The system comprises a first computing unit running in a first kernel in a software lock step mode, a second computing unit running in a second kernel in a software lock step mode, an arbitration unit running in a third kernel and a watchdog unit running in a fourth kernel. The second calculation unit monitors the operation condition of the controller according to a technical scheme different from that of the first calculation unit; the first kernel, the second kernel, the third kernel and the fourth kernel are respectively provided with first middleware used for coordinating time synchronization among the kernels, and second middleware used for scheduling the first calculation unit and the second calculation unit in an absolute time scheduling mode. According to the method, environmental interference in the same time space is avoided to a certain extent, a more reliable calculation result can be obtained, the security level is improved through software redundancy, the system failure rate is reduced, and the method has high software execution efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automobile and flying automobile safety, and more particularly to a redundant computing system, a redundant computing processing method and related equipment. BACKGROUND

[0002] In an automobile, especially an automatic driving automobile and a flying automobile, a safety monitoring system is a core guarantee for ensuring reliable operation. If the system fails, the controller is usually restarted to recover the system, but the controller will be temporarily disabled during the restart process, which may affect safety. Although this failure handling mechanism is simple and effective, it has a functional window period, which highlights the necessity of system redundancy design. SUMMARY

[0003] Therefore, the present application provides a redundant computing system, a redundant computing processing method and related equipment to improve the reliability of the system.

[0004] To achieve the above-mentioned purpose, the first aspect of the present application provides a redundant computing system, comprising:

[0005] a first computing unit, a second computing unit, an arbitration unit and a watchdog unit;

[0006] The first computing unit runs in a software lockstep manner in a first kernel, and is used to monitor the operating condition of the automobile to obtain a first computing result;

[0007] The second computing unit runs in a software lockstep manner in a second kernel, and is used to monitor the operating condition of the automobile in a technical solution different from the first computing unit to obtain a second computing result;

[0008] The arbitration unit runs in a third kernel, and is used to process the first computing result and the second computing result to obtain an arbitration result;

[0009] The watchdog unit runs in a fourth kernel, and is used to monitor the activity, program flow and running time of the first computing unit, the second computing unit and the arbitration unit;

[0010] The first kernel, the second kernel, the third kernel and the fourth kernel are respectively provided with a first middleware for synchronizing the time between the kernels, and a second middleware for scheduling the first computing unit and the second computing unit in an absolute time scheduling manner.

[0011] Preferably, the second middleware schedules the processes of the first computing unit and the second computing unit in an absolute time scheduling manner, comprising:

[0012] starting the first computing unit, after a delay of α seconds, starting the second computing unit;

[0013] wherein α is a preset first time length value.

[0014] Preferably, the running time of the second computing unit is less than the running time of the first computing unit.

[0015] The absolute value of the time difference between the end time of the running of the first computing unit and the end time of the running of the second computing unit is less than β seconds, and β is a preset second time length value.

[0016] Preferably, the watchdog unit monitors the running time length of the first computing unit, the second computing unit and the arbitration unit, including:

[0017] monitoring whether the starting time of the second computing unit is less than α seconds;

[0018] monitoring whether the absolute value of the time difference between the end time of the running of the first computing unit and the end time of the running of the second computing unit is less than β seconds;

[0019] monitoring whether the running time of the first computing unit is less than γ seconds, and γ is a preset third time length value;

[0020] monitoring whether the running time of the first computing unit is less than (γ-α-β) seconds;

[0021] monitoring whether the time length from when the arbitration unit receives the first computing result and the second computing result to when the arbitration result is outputted is less than δ seconds, and δ is a preset fourth time length value.

[0022] The second aspect of the present application provides a redundant computing processing method, including:

[0023] receiving a first computing result from a first computing unit, and receiving a second computing result from a second computing unit;

[0024] triggering a comparison logic to compare the first computing result and the second computing result to obtain a comparison result;

[0025] generating an arbitration result based on the comparison result, a failure state of a first core and a failure state of a second core.

[0026] Preferably, the process of generating an arbitration result based on the comparison result, a failure state of a first core and a failure state of a second core includes:

[0027] if both the first core and the second core are not faulty, generating an arbitration result based on the comparison result;

[0028] If any of the cores has a transient fault, an empty arbitration result is generated;

[0029] If any of the cores has a permanent fault, an arbitration result corresponding to a degraded mode is generated.

[0030] Preferably, based on the comparison result, the process of generating an arbitration result comprises:

[0031] If the comparison result indicates that the first calculation result is consistent with the second calculation result, the first calculation result or the second calculation result is set as the arbitration result.

[0032] If the comparison result indicates that the first calculation result is inconsistent with the second calculation result, the calculation result with higher confidence in the first calculation result and the second calculation result is set as the arbitration result, and an alarm notification is issued.

[0033] The third aspect of the present application provides a redundant calculation processing device, comprising:

[0034] a data receiving unit configured to receive a first calculation result from a first calculation unit and receive a second calculation result from a second calculation unit;

[0035] a comparison triggering unit configured to trigger a comparison logic to compare the first calculation result and the second calculation result to obtain a comparison result;

[0036] a result arbitration unit configured to generate an arbitration result based on the comparison result, a fault state of the first core and a fault state of the second core.

[0037] The fourth aspect of the present application provides a redundant calculation processing device, comprising a memory and a processor;

[0038] The memory is configured to store a program.

[0039] The processor is configured to execute the program to implement each step of the redundant calculation processing method.

[0040] The fifth aspect of the present application provides a storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement each step of the redundant calculation processing method.

[0041] Via the technical solution, the application comprises a first computing unit, a second computing unit, an arbitration unit and a watchdog unit. The first computing unit runs in a software lockstep manner in a first kernel, and is configured to monitor the running state of the vehicle and obtain a first computing result. The second computing unit runs in a software lockstep manner in a second kernel, and is configured to monitor the running state of the vehicle by using a technical solution different from that of the first computing unit, and obtain a second computing result. It can be understood that the first computing unit and the second computing unit constitute software redundancy, and the software redundancy improves the security level of the system. The software lockstep is added to ensure the consistency of the execution between the redundant processes. The arbitration unit runs in a third kernel, and is configured to process the first computing result and the second computing result to obtain an arbitration result. The watchdog unit runs in a fourth kernel, and is configured to monitor the activity, program flow and running time of the first computing unit, the second computing unit and the arbitration unit. By using a separate kernel to execute the computing task of each function body, the computing resources are not occupied between each other, the software execution time is shortened, and the execution efficiency is improved. The first kernel, the second kernel, the third kernel and the fourth kernel are respectively provided with a first middleware for synchronizing the time between the kernels, and a second middleware for scheduling the first computing unit and the second computing unit in an absolute time scheduling manner. By calling the first computing unit and the second computing unit in an absolute time scheduling manner, different kernels and different tasks can be overlapped or overlapped as needed in time, strict time partitioning is achieved, environmental interference in the same time and space is avoided to a certain extent, and the failure rate is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the application, and those skilled in the art can obtain other drawings according to the provided drawings without creative labor.

[0043] Figure 1 A schematic diagram of the redundant computing system disclosed in the embodiments of the application;

[0044] Figure 2 A schematic diagram of the redundant computing processing method disclosed in the embodiments of the application;

[0045] Figure 3 A schematic diagram of the redundant computing processing device disclosed in the embodiments of the application;

[0046] Figure 4 A schematic diagram of the redundant computing processing device disclosed in the embodiments of the application. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0048] The redundant computing system provided by the embodiments of the present application will be introduced below. Please refer to Figure 1 The redundant computing system provided by the embodiments of the present application can include a first computing unit, a second computing unit, an arbitration unit and a watchdog unit.

[0049] The first computing unit runs in a software lockstep manner in the first core, and is configured to monitor the running state of the automobile and obtain a first computing result.

[0050] The second computing unit runs in a software lockstep manner in the second core, and is configured to monitor the running state of the automobile by using a technical solution different from that of the first computing unit, and obtain a second computing result.

[0051] It can be understood that the first computing unit and the second computing unit constitute software redundancy with each other. In program execution, the first computing unit constitutes one user process, and the second computing unit constitutes another user process. When there is one user process, another user process (redundant execution process) is also needed. The content executed by the redundant execution process and the user process needs to be kept the same, and at this time, the software lockstep needs to be used to guarantee the consistency of the execution between the user process and the redundant process.

[0052] Exemplarily, the first core can be an MCU, such as ARMv7-M7; the second core can be a CPU, such as ARMv8-A; the third core can be an ASIC or an FPGA; and the fourth core can be a RISC-V or other heterogeneous core. By using separate cores to execute the computing tasks of each function body, the computing resources are not occupied between each other, the software execution time can be shortened, and the execution efficiency can be improved.

[0053] The arbitration unit runs in the third core, and is configured to process the first computing result and the second computing result, and obtain an arbitration result.

[0054] The watchdog unit runs in the fourth core, and is configured to monitor the activity, program flow and running time length of the first computing unit, the second computing unit and the arbitration unit.

[0055] The watchdog can periodically check the internal status of the chip, and send a restart signal to the circuit of the chip once an error occurs. The watchdog command has the highest priority in the interruption of the program. It prevents the program from running away. It can also prevent the program from running in a dead loop

[0056] The first, second, third and fourth cores are respectively provided with first middleware for coordinating time synchronization between the cores, and second middleware for scheduling the first and second computing units in an absolute time scheduling manner.

[0057] The four cores are deployed with time synchronization through the first middleware, and absolute time scheduling through the second middleware. Compared with the traditional beat-based scheduling, the absolute time-based scheduling schedules the start of tasks between different cores in absolute time, which can arrange the execution of different tasks on the time axis as needed, and can realize strict time partitioning.

[0058] The application includes a first computing unit, a second computing unit, an arbitration unit and a watchdog unit. The first computing unit runs in a software lockstep manner in the first core, monitors the running status of the vehicle, and obtains a first calculation result. The second computing unit runs in a software lockstep manner in the second core, monitors the running status of the vehicle in a technical solution different from the first computing unit, and obtains a second calculation result. It can be understood that the first and second computing units constitute software redundancy, which improves the safety level of the system, and the software lockstep ensures the consistency of the execution between the redundant processes. The arbitration unit runs in the third core, processes the first and second calculation results, and obtains an arbitration result. The watchdog unit runs in the fourth core, monitors the activity, program flow and running time of the first and second computing units and the arbitration unit. By using a separate core to execute the calculation task of each function body, the calculation resources are not occupied between each other, the software execution time is shortened, and the execution efficiency is improved. The first, second, third and fourth cores are respectively provided with first middleware for coordinating time synchronization between the cores, and second middleware for scheduling the first and second computing units in an absolute time scheduling manner. By calling the first and second computing units in an absolute time scheduling manner, different tasks of different cores can be overlapped or overlapped as needed in time, strict time partitioning is realized, environmental interference in the same time and space is avoided to a certain extent, failure rate is reduced, and more reliable calculation results can be obtained.

[0059] In some embodiments of the present application, the second middleware schedules the processes of the first computing unit and the second computing unit in an absolute time scheduling manner, which can include:

[0060] The first computing unit is started, and after a delay of α seconds, the second computing unit is started, where α is a preset first time length value.

[0061] For example, the first computing unit deployed on the first core starts running at absolute time T, and the second computing unit deployed on the second core starts running at absolute time (T+α). The purpose of the delay of α is to avoid spatial interference within α time, which affects the calculation results of the first core and the second core.

[0062] In some embodiments of the present application, the running time of the second computing unit is less than the running time of the first computing unit, and the absolute value of the time difference between the running end time of the first computing unit and the running end time of the second computing unit is less than β seconds, where β is a preset second time length value.

[0063] For example, assuming that the running time of the first computing unit is γ, the first computing unit ends calculation at (T+γ). The performance of the second core is significantly stronger than that of the first core, and the running time of the second computing unit deployed on the second core is designed as (γ-α-β). Since the second computing unit is started with a delay of α, the second computing unit ends calculation at (T+α+γ-α-β), that is, (T+γ-β).

[0064] Since the fourth core where the arbitration unit is located can be implemented by ASIC, the control is completed in a short time, and the calculation time of the second computing unit is less than that of the first computing unit, the introduction of the second computing unit does not affect the time consumed by the first computing unit for outputting results.

[0065] In some embodiments of the present application, the watchdog unit monitors the running time of the first computing unit, the second computing unit, and the arbitration unit, which can include:

[0066] S1, monitoring whether the start time of the first computing unit and the start time of the second computing unit are both less than α seconds.

[0067] S2, monitoring whether the absolute value of the time difference between the running end time of the first computing unit and the running end time of the second computing unit is less than β seconds.

[0068] S3, monitoring whether the running time of the first computing unit is less than γ seconds.

[0069] Where γ is a preset third time length value.

[0070] S4, monitoring whether the running time of the first computing unit is less than (γ-α-β) seconds.

[0071] S5, monitoring whether the time length from when the arbitration unit receives the first computing result and the second computing result to when the arbitration result is output is less than δ seconds.

[0072] Wherein, δ is a fourth preset time length value.

[0073] In some embodiments of the present application, the process of monitoring the running time of the first computing unit, the second computing unit and the arbitration unit by the watchdog unit can also include:

[0074] S6, the total time from when the first computing unit completes starting to when the arbitration unit outputs the arbitration result does not exceed ε seconds.

[0075] Wherein, ε is a fifth preset time length value.

[0076] S7, the computing period fluctuation of the first computing unit and the second computing unit does not exceed θ seconds.

[0077] Wherein, θ is a sixth preset time length value.

[0078] The following describes a redundant computing processing method provided by an embodiment of the present application. Please refer to Figure 2 The redundant computing processing method provided by the embodiment of the present application applied to the redundant computing system provided by any of the above embodiments can include the following steps:

[0079] Step S101, receiving the first computing result from the first computing unit and receiving the second computing result from the second computing unit.

[0080] Step S102, triggering the comparison logic to compare the first computing result and the second computing result to obtain a comparison result.

[0081] Step S103, generating an arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core.

[0082] In some embodiments of the present application, the process of generating an arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core in step S103 can include:

[0083] S1, if neither the first core nor the second core has a failure, generating an arbitration result based on the comparison result.

[0084] S2, if any core has a transient failure, generating an empty arbitration result.

[0085] S3, if any core has a permanent failure, generating an arbitration result corresponding to a degradation mode.

[0086] In particular, if it is required that the system does not degrade and the number of instruction output clock cycles does not change when a fault occurs, another product is designed according to the application, which constitutes hardware isomorphic redundancy.

[0087] If further common cause failure is still required, another backup scheme is designed, which uses the technology described in the application, but the selected basic components are not similar to the application, which constitutes hardware dissimilar redundancy, that is, 2 isomorphic controllers + 1 dissimilar controller are used.

[0088] If the failure rate of the 2+1 configuration still does not meet the design index, an N isomorphic controller + X dissimilar controller system scheme is used. The communication between the above controllers follows the inter-core communication scheme described in the application; the time synchronization between the controllers follows the time synchronization scheme described in the application; and the absolute time scheduling of the controller follows the inter-core communication scheme described in the application.

[0089] In some embodiments of the application, the process of generating an arbitration result based on the comparison result described above can include:

[0090] S11, if the comparison result shows that the first calculation result is consistent with the second calculation result, the first calculation result or the second calculation result is set as the arbitration result.

[0091] S12, if the comparison result shows that the first calculation result is inconsistent with the second calculation result, the calculation result with higher confidence in the first calculation result and the second calculation result is set as the arbitration result, and an alarm notification is sent out.

[0092] Exemplarily, the alarm notification can inform the driver to immediately seek the nearest safe zone to park.

[0093] The redundant computing processing device provided in the embodiments of the application is described below. The redundant computing processing device described below can be referred to each other corresponding to the redundant computing processing method described above.

[0094] Referring to Figure 3 The redundant computing processing device provided in the embodiments of the application can be applied to the redundant computing system provided in any of the above embodiments, and can include:

[0095] The data receiving unit 21 is configured to receive the first calculation result from the first calculation unit and receive the second calculation result from the second calculation unit.

[0096] The comparison triggering unit 22 is configured to trigger the comparison logic to compare the first calculation result and the second calculation result to obtain a comparison result.

[0097] The result arbitration unit 23 is configured to generate an arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core.

[0098] In some embodiments of the present application, the result arbitration unit 23 generates the arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core, which can include:

[0099] If neither the first core nor the second core has a failure, the arbitration result is generated based on the comparison result;

[0100] If either core has a transient failure, an empty arbitration result is generated;

[0101] If either core has a permanent failure, an arbitration result corresponding to a degraded mode is generated.

[0102] In some embodiments of the present application, the result arbitration unit 23 generates the arbitration result based on the comparison result, which can include:

[0103] If the comparison result indicates that the first calculation result is consistent with the second calculation result, the first calculation result or the second calculation result is set as the arbitration result;

[0104] If the comparison result indicates that the first calculation result is inconsistent with the second calculation result, the calculation result with higher confidence is set as the arbitration result, and an alarm notification is sent.

[0105] The redundant calculation processing device provided by the embodiments of the present application can be applied to a redundant calculation processing device, such as a computer, etc. Figure 4 The hardware structure block diagram of the redundant calculation processing device is shown, which is described with reference to Figure 4 The hardware structure of the redundant calculation processing device can include at least one processor 31, at least one communication interface 32, at least one memory 33 and at least one communication bus 34.

[0106] In the embodiments of the present application, the number of processors 31, communication interfaces 32, memories 33 and communication buses 34 is at least one, and the processors 31, communication interfaces 32 and memories 33 communicate with each other through the communication bus 34;

[0107] The processor 31 can be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application, etc.

[0108] The memory 33 can include a high-speed RAM memory, and can also include a non-volatile memory, such as at least one disk memory;

[0109] The memory 33 stores a program, and the processor 31 can call the program stored in the memory 33, and the program is used for:

[0110] receiving a first calculation result from the first calculation unit, and receiving a second calculation result from the second calculation unit;

[0111] triggering comparison logic to compare the first calculation result and the second calculation result to obtain a comparison result;

[0112] generating an arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core.

[0113] Optionally, the refinement function and the extension function of the program can refer to the description above.

[0114] The embodiments of the present application also provide a storage medium, which can store a program suitable for a processor to execute, and the program is used for:

[0115] receiving a first calculation result from the first calculation unit, and receiving a second calculation result from the second calculation unit;

[0116] triggering comparison logic to compare the first calculation result and the second calculation result to obtain a comparison result;

[0117] generating an arbitration result based on the comparison result, the failure state of the first core and the failure state of the second core.

[0118] Optionally, the refinement function and the extension function of the program can refer to the description above.

[0119] In summary:

[0120] The application comprises a first computing unit, a second computing unit, an arbitration unit and a watchdog unit. The first computing unit runs in a software lockstep manner in a first core, and is configured to monitor the running state of the vehicle and obtain a first computing result. The second computing unit runs in a software lockstep manner in a second core, and is configured to monitor the running state of the vehicle by using a technical solution different from that of the first computing unit, and obtain a second computing result. It can be understood that the first computing unit and the second computing unit constitute software redundancy, and the software lockstep is added to ensure the consistency of the execution between the redundant processes. The arbitration unit runs in a third core, and is configured to process the first computing result and the second computing result to obtain an arbitration result. The watchdog unit runs in a fourth core, and is configured to monitor the activity, program flow and running time of the first computing unit, the second computing unit and the arbitration unit. By using a separate core to execute the computing task of each function body, the computing resources are not occupied between each other, the software execution time can be shortened, and the execution efficiency can be improved. The first core, the second core, the third core and the fourth core are respectively provided with a first middleware for synchronizing the time between the cores, and a second middleware for scheduling the first computing unit and the second computing unit in an absolute time scheduling manner. By calling the first computing unit and the second computing unit in an absolute time scheduling manner, different kernels and different tasks can be overlapped or overlapped as needed in time, strict time partitioning is achieved, environmental interference in the same time and space is avoided to a certain extent, failure rate is reduced, and more reliable computing results can be obtained.

[0121] Finally, it should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0122] The various embodiments in the specification are described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the various embodiments can be combined as needed, and the same and similar parts refer to each other.

[0123] The foregoing description of the disclosed embodiments enables a person skilled in the art to make or use the application. Modifications of these embodiments will occur to persons of skill in the art, and that the generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Therefore, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A redundant computing system, comprising: The application relates to a controller, comprising: a first computing unit, a second computing unit, an arbitration unit and a watchdog unit; the first computing unit runs in a software lockstep mode in a first core, is used for monitoring the running state of the controller, and obtains a first computing result; the second computing unit runs in a software lockstep mode in a second core, is used for monitoring the running state of the controller by using a technical solution different from that of the first computing unit, and obtains a second computing result; the arbitration unit runs in a third core, is used for processing the first computing result and the second computing result, and obtains an arbitration result; the watchdog unit runs in a fourth core, is used for monitoring the activity, program flow and running time length of the first computing unit, the second computing unit and the arbitration unit; the first core, the second core, the third core and the fourth core are respectively provided with a first middleware used for synchronizing the time between the cores and a second middleware used for scheduling the first computing unit and the second computing unit in an absolute time scheduling mode.

2. The system of claim 1, wherein, The second middleware schedules the processes of the first computing unit and the second computing unit in an absolute time scheduling mode, and the method comprises the following steps: starting the first computing unit, and starting the second computing unit after a delay of alpha seconds; wherein alpha is a preset first time length value.

3. The system of claim 2, wherein, The application further relates to a controller, comprising: the running time of the second computing unit is less than the running time of the first computing unit; the absolute value of the time difference between the running end time of the first computing unit and the running end time of the second computing unit is less than beta seconds, and beta is a preset second time length value.

4. The system of claim 3, wherein, The watchdog unit monitors the running time length of the first computing unit, the second computing unit and the arbitration unit, and the method comprises the following steps: monitoring whether the starting time of the second computing unit is less than alpha seconds; monitoring whether the absolute value of the time difference between the running end time of the first computing unit and the running end time of the second computing unit is less than beta seconds; monitoring whether the running time of the first computing unit is less than gamma seconds, and gamma is a preset third time length value; monitoring whether the running time of the first computing unit is less than (gamma-alpha-beta) seconds; monitoring whether the time length from the time when the arbitration unit receives the first computing result and the second computing result to the time when the arbitration result is output is less than delta seconds, and delta is a preset fourth time length value.

5. A redundant computing process method, the method being applied to the redundant computing system according to any one of claims 1 to 4, characterized by, The application further relates to a controller, comprising: receiving the first computing result from the first computing unit and receiving the second computing result from the second computing unit; triggering a comparison logic to compare the first computing result and the second computing result, and obtaining a comparison result; generating an arbitration result based on the comparison result, the fault state of the first core and the fault state of the second core.

6. The method of claim 5, wherein, The process of generating an arbitration result based on the comparison result, the fault state of the first core and the fault state of the second core comprises the following steps: if neither the first core nor the second core has a fault, generating an arbitration result based on the comparison result; if any core has a transient fault, generating an empty arbitration result; if any core has a permanent fault, generating an arbitration result corresponding to a degradation mode.

7. The method of claim 5, wherein, Based on the comparison result, a process of generating an arbitration result comprises: if the comparison result indicates that the first calculation result is consistent with the second calculation result, setting the first calculation result or the second calculation result as the arbitration result; if the comparison result indicates that the first calculation result is inconsistent with the second calculation result, setting the calculation result with higher confidence among the first calculation result and the second calculation result as the arbitration result, and issuing an alarm notification.

8. A redundant computing processing device applied to the redundant computing system according to any one of claims 1 to 4, characterized by, comprise: a data receiving unit configured to receive a first calculation result from a first calculation unit and receive a second calculation result from a second calculation unit; a comparison triggering unit configured to trigger a comparison logic to compare the first calculation result and the second calculation result to obtain a comparison result; a result arbitration unit configured to generate an arbitration result based on the comparison result, a failure state of the first core and a failure state of the second core.

9. A redundant computing processing device, comprising: comprise: a memory and a processor; the memory is configured to store a program; the processor is configured to execute the program to implement each step of the redundant calculation processing method according to any one of claims 5-7.

10. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement each step of the redundant calculation processing method according to any one of claims 5-7.

Images