AURIX architecture introduces additional protection against an unintended modification of selected critical registers through a so-called Safety Watchdog EndInit protection where the write access to these registers requires a particular Unlock-Modify-Lock sequence in the hardware Safety Watchdog module. This sequence represents a potential issue in a multicore environment.

The AURIX architecture contains the COMPAT register, allowing to disable the Safety Watchdog EndInit Protection of critical registers to keep backward compatibility with older TriCore architectures.

The compatibility mode has an impact on multicore PXROS-HR operating system because it controls the protection level for the core’s MPU enable-disable bit in SYSCON register that belongs among such critical registers.

MPU Compatibility ON (MPU-COMPAT=ON)

MPU Compatibility OFF (MPU-COMPAT=OFF)

The core in AURIX architecture can be in different states during the microcontroller runtime.

The PXROS-HR configuration requires a definition of MASTER_CORE symbol controlling:

The PXROS-HR kernel supports only a limited startup variant:

Other startup scenarios, like to start the PXROS-HR initialization from a different MASTER_CORE or to activate inactive cores being in IDLE mode, require user-specific implementation.

The inittcx library is part of the utility package distributed within the PXROS-HR install package and contains supportive hardware related routines to help the user with other startup variants than the one implemented in the PXROS-HR kernel.

The inittcx library routines:

NOTE: The underscore functions in the inittcx library override the default PXROS-HR kernel implementation to extend their default capability. The inittcx library must precede the PXROS_HR kernel library in the library link to make it work.

This mode is a default reset state on AURIX architecture, meaning that each core can enable/disable its core MPU protection without a need to access Safety Watchdog module.

In this case, the only task for the MASTER_CORE is to activate other cores and let the core MPU system enable as part of their duties.

MASTER_CORE activities

OTHER Core activities

Having disabled MPU compatibility, only one core shall enable the MPU system under Safety Watchdog EndInit Protection for all cores in the microcontroller to keep the module handling multicore safe.

In the PXROS-HR operating system, it is the kernel instance running on the MASTER_CORE that configures and enables the MPU system for inactive cores before activating them.

MASTER_CORE activities

OTHER Core activities

The case when MASTER_CORE != 0, the application code running on the reset core (CORE=0) must activate the desired MASTER_CORE first and switch the current core to IDLE. The reset core remains in IDLE mode until PxInit() running on MASTER_CORE activates it again. The inittcx library provides a supportive function PxuStartMasterCore to activate MASTER_CORE from the reset core. Part of the function is to switch the current core to IDLE mode.

PxInit() function handles other cores MPU protection in the same style as described above having two variants depending on MPU compatibility mode set.

The routine _PxInit_Start_Cores in the library supporting different startup variants provides an extension of the PXROS-HR kernel routine.

To replace the default kernel routine with the one from the library means to include the inittcx library before the PXROS-HR kernel library in the build command.

The MPU compatibility is active after the reset in AURIX architecture to keep backward compatibility with legacy SW running on older TriCore architecture.

However, the advice is to disable the compatibility mode to enhance safety robustness by adding another level of protection to critical registers.

There are three options for disabling the compatibility mode after the reset.

In case of a disabled MPU compatibility, the MPU regions in the PXROS-HR init structure must cover all access needs of the startup and application code running before PxInit() function call.

The reason is that the MASTER_CORE activates MPU protection for all cores even they are still in HALT mode. Once they start, they run under MPU protection from the very first instruction of the crt0 startup code.