WO2004097642A1

WO2004097642A1 - Embedded digital processing system with self-configured operation

Info

Publication number: WO2004097642A1
Application number: PCT/EP2003/050133
Authority: WO
Inventors: Eberhard Amann; Andreas Arnez; Walter Pietschmann; Jürgen SAALMÜLLER
Original assignee: International Business Machines Corporation; Ibm Deutschland Gmbh
Priority date: 2003-04-29
Filing date: 2003-04-29
Publication date: 2004-11-11
Also published as: TW200517860A; AU2003233799A1

Abstract

Disclosed is an embedded digital processing device or system that provides multiple sets of configuration information stored in a configuration unit, these configuration sets being checked autonomously in order the system or device to operate correctly together with an external environment. This check is done by means of a sensing mechanism. In particular, a configuration set that fits with a given environment is selected by means of a mismatch and time-out mechanism where the available configuration sets are loaded and checked for interoperability of the underlying device or system with the given environment and where a resulting mismatch and corresponding time-out for a particular configuration set does not reveal a system stop but moreover an automatic loading of another configuration set until an appropriate configuration of the device or system is achieved.

Description

D E S C R I P T I O N

Embedded Digital Processing System with Self -Configured

Operation

BACKGROUND OF THE INVENTION

The present invention generally concerns digital processing devices and systems that have to be configured for operation and more particularly to an embedded digital processing device or system and an according method for self-configured operation.

Data processing devices like Application Specific ^Integrated Circuits (ASICs) , field programmable Gate Arrays and embedded controllers are often used as data processing systems "embedded" in another device like a mobile phone or a washing machine have to be configured to solve certain tasks.

Whilst those systems can provide some flexible behaviour in giving certain responses to external stimuli, they are mostly implemented in a fixed configuration lacking in flexibility to adapt to different configurations or fault tolerant behaviour. The configuration is conducted during an initial boot-up processing sequence by means of a boot list. An according method for self-configuring a computer network comprising a plurality of removable interface circuits is disclosed in USP 4,622,633 where hardware descriptors are utilized to obtain lists of components of each interface circuit from a data base. But such a boot list disadvantageously requires a dedicated computer program for its read and execution. Further, USP 4,870,302 discloses a configurable logic array comprising a plurality of configurable logic elements variably interconnected in response to control signals to perform a selected logic function. Hereby each configurable logic element in the array itself is capable of performing any one of a plurality of logic functions depending upon control information placed in the configurable logic element. Each configurable logic element can have its function varied even after it is installed in a system, only by changing the control information placed in that element. In particular, it is provided access to the stored control information to allow each configurable logic element to be properly configured prior to the initiation of operation of the system (environment) of which the array is a part.

It is therefore desirable to provide an above mentioned embedded device or system that allows for loading flexible configurations thus making the device or system flexible to adapt to different applications and environments as well as to become fault tolerant.

SUMMARY OF THE INVENTION

According to the underlying concept of the invention, there are provided at least two sets of configuration information stored in a configuration unit. The underlying device or system finds autonomously one configuration set out of these multiple sets which allows the device or system to operate correctly together with an external environment. The required properties of that environment are gathered by means of a sensing mechanism preferably implemented in an operating unit of the device or system or a corresponding sensor interface interoperating with the operating unit. In particular, a set of configuration which fits with a given environment is selected by means of a mismatch mechanism, in particular a time-out mechanism, where the available configuration sets are loaded and checked for interoperability of the underlying device or system with the given environment and where a resulting mismatch and corresponding time-out for a particular configuration set does not reveal a system stop but moreover an automatic loading of another configuration set until an appropriate configuration of the device or system is achieved.

The invention enables devices and systems herein addressed to self-configure during initial boot-up so that they can adapt to different hardware and/or software environments or interface applications. A side effect of the present solution is that those devices or systems can even be made more reliable in their start-up and operational state. The proposed mechanism of self-configuration eliminates the requirement of human interaction or interaction by an external device, as required in state of the art solutions and thus is much more flexible as the prior art solutions and suitable for autonomous applications. BRIEF DESCRIPTION OF THE DRAWINGS

Referring to the accompanied drawings, the invention is described in more detail by way of preferred embodiments from which further features and advantages become evident . In the drawings ,

Fig. 1 is a block diagram illustrating the basic features of a digital processing device according to the present invention;

Fig. 2 is a block diagram illustrating an embedded controller device in accordance with the present invention;

Fig. 3 is a schematic illustration of an initial boot operation in accordance with the present invention; and

Fig. 4 is another block diagram illustrating a communication hub device as an exemplary ASIC having implemented a self-configuring mechanism and according hardware features in accordance with the present invention.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

The basic principles of the present invention are illustrated in the block diagram of Fig. 1. Beneath the shown digital processing device 100 an external environment 105 is depicted by the dotted line 110. The shown digital processing device 100 is an adaptive system in regard of its self-configuring ability. This self-configuring ability will be well-understood by the following functional description. The device 100 particularly consists of an operating unit 115, a timer 120, a counter 125 and a configuration unit 130 which altogether interact with each other. The operating unit 115, in the present embodiment, shares a set of actor interfaces 135 - 145 and sensor interfaces 150 - 160 with the external environment 105. These interfaces 135 - 160 principally can be any type of communication interfaces to interact with the external environment 105, the present device 100 is part of.

The shown processing device 100 is only illustrative and thus can be any embedded controller, hardware-driven state-machine, field-programmable and configurable Gate Arrays or the like which require a shown configuration unit 130 that contains structured information (data) to set up the operating unit 115 at the initial start-up phase of the device to a defined state corresponding to the task the operating unit 115 has to fulfil.

In a preferred embodiment, the configuration unit 130 does provide not only one set of configuration information for the operating unit 115 but rather multiple of those sets. Those multiple configuration sets can consist of the same or variable content. More particularly, for the different application scenarios mentioned above, a preferred configuration set for an embedded controller is a boot image stored in a persistent memory device that will be executed after power-on or reset. For a hardware-driven state-machine, a preferred configuration set is a register set that influences the sequence such state-machine will execute in response to sensor signals it receives via the sensor interfaces 150 - 160, which sensors to value and what actors to activate via the actor interfaces 135 - 145 with what attributes (e.g. high, low level signal, pulse etc.) . For a programmable Gate Array, a preferred configuration set describes in which way the functional elements in the Gate Array will interact with each other to obtain a higher level of operation or operation performance out of the Gate Array. Those functional elements of the Gate Array can be a configurable microprocessor core, a communication adapter or the like.

The above device set-up allows for self-configuration of the shown hardware device in order to run applications with different requirements. For this self-configuration of the device, several sets of configurations are provided in the configuration unit 130 that are loaded one after the other and tested for matching criteria for successfully running the application.

A 'Configuration Start' signal transmitted via line 165 to the timer 120 triggers start of the timer 120 and thus of the following procedural steps. Via a splitting line 170 the 'Configuration Start' signal is also transferred to an 'OR' gate 175 as a trigger signal to start the operating unit via line 190. The output of the timer 120 is attached to the counter 125 and, in parallel, to the mentioned 'OR' gate 175 via line 180, as a second trigger signal. The counter 125 gets incremented each time the timer 120 expires. By means of the 'OR' gate 175 it is guaranteed that the operating unit 115 and configuration unit are only triggered via lines 190, 195 for the following operational steps if the timer 120 reaches its final value and restarts which means it stays 'active' . This active state of the timer 120 can only be stopped by means of a 'Stop Timer' signal transferred via line 185 to the timer 120. Via lines 200 - 215, the timer 120 and the counter 125 step through the set of configurations provided by the configuration unit 130. While the number of different configurations to address in the configuration unit 130 determines the number of lines 200 - 215, in the present case of e.g. sixteen different sets of configuration, the counter 125 provides a 4 bit counter signal via the lines 200 - 215 to the configuration unit 130 wherein each set is addressed by the possible values of the counter signal. The operating unit 115 gets loaded with a configuration set currently selected by means of the counter signal 200 - 215 via line 220. Having loaded that current configuration, the operating unit 115 tries to run the application based on such configuration within the external environment 105 in order to check if certain criteria are met to keep the actual configuration. If these criteria are met, the timer 120 gets stopped by means of the 'Stop Timer' signal delivered via line 185 and the processing device 100 stays in the current mode of operation selected. If the criteria are not met the timer reaches its final value (exhausts) , wraps and restarts with an initial setting. At the same time it generates the trigger for the counter 125 to step the configuration set as well as by means of the 'OR' function 175 to restart the operating unit 115 and bringing the configuration unit 130 to an operational state if necessary.

It is to be mentioned that the above described concept also applies to high reliability requirements to get a shown digital processing device 100 to an operational state or keep it in such a state even if parts of the configuration information are corrupted. Fig. 2 illustrates a more detailed embodiment of the present invention in an embedded controller 300 with an above described self-configuring functionality.

An embedded controller is based typically on a system on a chip device that includes a microprocessor core and several peripheral control elements for communication, sense and control like UART, I²C busses, digital I/O signals. Depending on application and integration the embedded controller device may also include integrated memory in type of fast read/writeable memory (RAM) and persistent memory (ROM, Flash- ROM) . Both types of memory can typically also be attached external to those controller devices. For the initial boot phase of such an embedded controller after a power-on or system reset the embedded processor core starts to fetch a first instruction from a defined address out of the persistent storage either internal or external attached to the processor bus .

Following this first program execution, the processor core continues normally in executing further instructions called "bootstrap load" from this persistent storage. It is state of the art that such program for bootstrap contained in the persistent storage either initializes the system in a way that it can fetch a further control program via a communication path (e.g. Local Area Network) or loads a real time operating system (RTOS) or similar multitasking operating system (e.g. Linux) from further persistent storage and starts it up. For high reliability applications as well as stand-alone applications without human interfacing (console, keyboard, mouse, display) it is important that the bootstrap of the processor core always takes place even if the original bootstrap code got corrupted e.g. during a code update procedure or defective storage device.

In other scenarios, the embedded controller should depending on the application boot different control programs / applications specific for an actual configuration. It is state of the art to have different configurable load images for such bootstrap by switching the memory range of the persistent storage to a different image either by a manually activated jumper or by use of an external controller put in charge by a human interface to emulate such jumper.

The mechanism and device described herein gives a solution for those scenarios where an embedded controller gets autonomous by an improved boot mechanism so it operates more reliable in high availability and stand alone applications as well as allows for adaptation of the bootstrap to different configurations. That mechanism allows for an automated switching between different boot images without any direct or indirect manual interaction.

As the pre-described processing device 100, the controller 300 depicted in Fig. 2 also includes a timer 305 and a counter 310 function that get attached to the embedded controller 300 either internally, as in the present embodiment, or externally. As in the above described embodiment, the combination of the timer 305 and the counter 310 influences the boot behaviour of an operating unit 315 ("processor core" in the present embodiment) that is implemented in the embedded controller 300. The timer 305 is attached to the counter 310 via signal line 320. As in the above embodiment, the counter 310 gets incremented each time the timer expires. The output of the counter 310 is connected to a logic element 325, in the present embodiment a logical AND and/or OR and/or XOR function, via lines 330 - 345. Whether the logic element 325 is an AND gate, an OR gate or a XOR gate depends on other facts discussed hereinafter in more detail referring to Fig. 2. As in the above embodiment, the lines 330 - 345 define a counter signal of arbitrary bit width depending on the number of configuration sets that may be selected.

The processor core 315 is attached to a memory controller 350 via a system memory bus 355. The memory controller 350 is attached to an, in the present embodiment externally arranged, storage device 360, e.g. a Flash ROM. It is emphasized that the storage device 360, in the present embodiment, serves as configuration unit including multiple configuration sets for the operation of the processor core 315. The memory controller 350 is connected to the storage device 360 via two different buses: An address bus 365, 370, 375 interconnecting the memory controller 350 with the external storage device 360, a part of which via the mentioned logic element 325, and a data bus 380 that also serves for transfer of certain control signals as discussed hereinafter.

On the address bus 370, set by the processor core 315, causes the logical function of the logic element 325 an address translation mechanism on one or several of the shown address lines 370 to the address lines 375, depending on the actual value of the counter 310 imposed on these address lines 370 via the logic element 325. The amount or number of address lines 375 to be influenced by the counter 310 is determined by the size of memory that shall be moved to a different location in address range. The timer 305, when expiring, causes a configurable reset to the processor core 315 and the embedded controller 300. If the timer 305 gets not stopped by execution of an underlying application by the processor core 315, it continues its operation thus generating multiple time-outs and counter increments .

The actual counter value acts on the selection of a configuration set in the storage device 360 by the logic element 325 which, in the present embodiment, is implemented as AND and/or OR and/or XOR function. The logic element 325 operates as an address translation function between the addresses applied by the processor core 315 and the location selected in the storage device 360 under control of the counter 310.

As in the embodiment shown in Fig. 1, the present timer 305 and the subsequent counter 310 are driving the sequence of the self-configuration. The timer 305 preferably is implemented as count down timer that causes the counter 310 to change its state each time the timer 305 expires and reaches a value of zero. The timer 305 may wrap each time it expires and restart with its initial value until a timer stop signal is generated by the processor core 315 and transmitted to the timer 305 by means of a timer control register 385 via transmission lines 390 and 395. The counter 310, in the preferred embodiment, comprises an arbitrary number n of stages which fit together with the number of configuration sets contained in the storage device 360 (=configuration unit) . The counter 310 interacts with the storage device 360 in such a way that, depending on the actual value of the counter 310 and the respective address generated by the logic element 325, one specific set from n available sets is selected for configuring the processor core 315. The self-configuration mechanism of the embedded controller 300 gets started by a trigger signal ('Configuration Start') that activates a first configuration sequence. Such signal can be generated by applying power-on reset 400 to the embedded controller 300 or by some external event 405 or by some internal event 410 via an 'OR' gate 415. Caused by such a trigger signal, the processor core 315 is triggered too via transmission line 420, 425 and another 'OR' gate 430. As a consequence, the processor core 315 interacts with the external storage device 360 (configuration unit) to get a configuration set stored therein to be executed. Which set of the multiple sets stored in the storage device 360 gets applied is determined by the actual setting of the counter, as described beforehand. By the same trigger signal 400, 405 or 410 the timer 305 gets started from an initial value input via lines 435 to count down. If the processor core 315 accomplishes to reach a certain state interacting with the external environment 105 (shown in Fig. 1 and not depicted in Fig. 2) by the actor interface 135 - 145 and sensor interface 150 - 160, it generates the above mentioned 'Timer Stop' signal and stays in operation with this configuration set. If the processor core 315 does not reach this state of operation, e.g. due to a wrong configuration set for a task or failure of a selected configuration set or wrong settings for the actor/sensor interfaces etc. to set the 'Timer Stop' signal, the timer 305 will expire and generate a signal to move the counter 310 forward one step as well as restart the configuration sequence by passing a reset signal through the delay element 445 and the "OR" function 430 to the processor core 315. This process of stepping through different sets of configurations takes place until a configuration is executed successfully to generate the mentioned 'Timer Stop' signal. The above described timer 305 required for getting the timeout signal to step through the different configuration sets may be implemented in hardware or software and may be controllable in software by the timer control register 385. The initial value 435 of the timer 305 is either loaded by a hard-coded internal or external setting at power-on or by a register programmable value while other types of reset do not influence setting of the register carrying the timer setting.

The timer control register 385 is read/writeable by the processor core 315 to stop, restart the timer 305 as well as setting and changing a delay the timer 305 lasts. Furthermore the setting of the counter 310 which counts for the time-outs and which may have an initial value 440 of zero after power-on can get changed by the timer control register 385 too. In the present embodiment, the timer control register 385, in addition, allows for reading back the actual state of the counter 310 to allow for the software to determine which configuration set is actually selected. But the timer control register 385 may not be affected by any type of reset except power-on reset.

After a power-on reset 400 or selectable type of system reset 410 the timer 305 gets activated. While the timer 305 is counting down, the processor core 315 will start with typical bootstrap-specific program execution from persistent storage. If bootstrap executes successfully so far there will be a point in program execution where the timer 305 gets stopped by setting the deactivation signal through the timer control register 385. While the timer 305 is deactivated, no further action takes place from the timer 305 and program execution continues with the configuration set currently selected. For cases where a special guard is required during program execution to prevent the processor core 315 from a fault condition, the timer 305 can also get reactivated by software.

In case the initial boot after a reset fails due to a bad bootstrap code, a wrong configuration, a hardware failure of the persistent storage device containing the boot code etc., the timer 305 expires after the above mentioned preset value. In this case, the timer 305 generates a 'Time-Out' signal which, in turn, generates a certain type of reset which may be a system reset or only a partial reset to the processor core 315 to restart. Also this type of initiated reset may be programmable by the timer control register 385 or any equivalent register. Furthermore, this reset may be split into several reset signals with different timings 445 (Delay 1, 2) to allow for certain functions like Flash-ROM or network devices to recover from a non-accessable state (e.g. Flash-ROM in write state) before the processor starts to fetch first instructions from such a device.

The 'Time-Out' signal also applies to the counter 310 insofar as the counter 310 is incremented. Since the output of the counter 310 is logically interconnected with some addresses of the address bus 365/370, the actual setting of the counter 310 operates like an aforementioned address translation. So by leaving the reset state, the processor core 315, after each time-out, addresses a different address range in the same or a different persistent storage element attached to the address bus 365. Which addresses need to become influenced by the counter 310 through the logic element 325 is determined by the code size of the bootstrap loader and/or the size of the operating system to be loaded. For instance, if a boot image has an image size of close to but less than 1 MByte and should get a back-up or alternate image faded in with the same size, that address line needs to get toggled by the counter 310 in case the timer 305 expires which switches the address range on the 1 MByte boundary. Whether the logic element- 325 is realized as AND gate, OR gate or XOR gate depends on the type of relocation that should take place in respect to the start address the processor core 315 applies after 'Reset' .

It is noteworthy that the concept of the counter 310 to be driven by the time-outs of the timer 305 may not be limited to two stages, as described beforehand. It may support an arbitrary number of count stages that get logically connected to appropriate address lines. This results in providing multiple boot images the processor core 315 can start from. With such feature each image may be suitable to support just a certain configuration of the embedded controller device 300 as well as the peripheral hardware application (= above mentioned "external environment") 105. If the first boot image does not fit the controller configuration as well as the external interconnection, the boot process does not complete and therefore the timer 305 will expire. The processor core 315 then restarts by a reset initiated by the timer 305 with a second image that supports now a different boot image and/or configuration. If this one still does not fit the controller configuration, the timer 305 expires again and a third image gets loaded and so forth until a configuration is found that fits and the software stops the timer 305.

This is illustrated in greater detail in Fig. 3 where four different configuration sets consisting of four different boot images 545, 550, 555 and 560 are depicted. The four possible time-outs of the timer 305 are designated by reference numerals 520, 525, 530 and 535 wherein the last time-out - 1 (

condition 535 reveals the first boot image to be reloaded again. In other words, the counter 310 also may wrap when the highest value is reached so that the sequence starts over and continues with the very first image to start with. By doing so the controller can get synchronized to external dependencies e.g. a network that is temporarily not or not yet available but come up at a later time. The different boot images contained in one configuration set 545, 550, 555, 560 are addressed by using a schematically depicted "address range" 540. The view of the storage layout by the processor core 315 influenced by the logic element 325 is shown in the layouts 500 - 515 where the toggling of the counter 310 'moves' each time a different boot image 545 - 560 to the start address of the processor.

Fig. 4 shows another embodiment of the present invention implemented in an Application Specific Integrated Circuit (ASIC) . The shown ASIC, in particular, is a communication Hub device 600 that, in the present embodiment, provides protocol conversion and interface distribution in a switch-like manner. The Hub device 600 therefore includes a number of different input/output (I/O) links, in the present example two Peripheral Component Interconnection (PCI) -Express links 605, 610, two Universal Serial Bus (USB) links 615, 620 and two InfiniBand links 625, 630, the latter being a communication architecture and specification for data flow between processors and I/O devices with enhanced bandwidth an almost unlimited expandability which, in the next few years, is expected to gradually replace the existing PCI shared-bus approach used in most of today's personal computers and servers . The present Hub device 600 is developed too for usage in various application environments 105. Therefore different settings for the I/O links 605 - 630 may be required by an internal register set 640 located in a switch matrix 635 to fit these requirements. The Hub device may also execute protocol conversion between links of different type.

By means of the pre-described self-configuring functionality, also the shown I/O Hub device 600 is able to run as an autonomous unit without need for receiving control information and/or configuration settings from a supervisory control instance. The self-configuring behaviour, in the present embodiment, is applied to configure the Hub device 600 for the different pre-mentioned applications.

The Hub device 600, as in the previous embodiment depicted in Fig. 2, receives a set of configuration information from an externally arranged persistent storage 660 after power is applied to the Hub device 600 and an external or internal reset signal is executed via an 'OR' gate 655. If a first configuration set does not configure the Hub device 600 correctly for a certain application, as in the other two embodiments, a timer 645 and counter 650 apply for a next set of configuration information to be delivered from the persistent storage 660 to the Hub device 600 and so forth. A protocol converter can be included in the switch matrix 635 which is capable to detect certain control information in the data stream transferred via an active communication link 605 - 630 and thereby can also generate an internal reset to the Hub device 600 for reconfiguration.

It should be mentioned that the above described configuration sets may also comprise some level of redundancy in order to provide higher reliability of the entire configuration process .

Claims

C L A I M S

1. A digital processing device including an operating unit and a configuration unit connected with the operating unit, wherein said configuration unit comprises at least two sets of configuration information used to configure said operating unit, wherein said digital processing device comprises logic means for checking, if the operating unit is operating correctly with a currently loaded set of configuration information and for loading at least a second set of configuration information, if the operating unit is not operating correctly with the currently loaded set of configuration information.

2. Processing device according to claim 1 wherein said operating unit includes or is connected to an actor interface and/or a sensor interface for interacting with an external environment in order to check whether the external environment matches the current configuration of the operating unit or not.

3. Processing device according to claim 2 comprising a timer and a counter wherein said mismatch check is performed by means of a time-out status of the timer, wherein the counter is incremented each time the timer expires.

4. Processing device according to claim 3 wherein the counter provides a counter signal to the configuration unit and wherein a set of configuration information is addressed by this counter signal.

5. Processing device according to claim 4 wherein the counter is connected to a logic element that operates as an address translator between addresses applied by the operating unit to the configuration unit.

6. Processing device according to claim 5 wherein said logic element consists of logical AND gates and/or logical OR gates and/or logical XOR gates .

7. Processing device according to any of the preceding claims, further comprising a control register readable and/or writeable by the operating unit, for controlling the timer and the counter.

8. Processing device according to claim 7 wherein said control register allows for starting and stopping the timer, setting a time-out value and/or a delay value for the timer and/or a current count for the counter.

9. Processing device according to claim 8 wherein said control register allows for the operating unit to read the actual state of the counter.

10. Processing device according to any of claims 6 to 9 wherein the stepping of the counter allows to address different program parts in a persistent or non-persistent storage device attached to the processing device for loading of a bootstrap code and/or an operating system.

11. An Application Specific Integrated Circuit (ASIC) or programmable Logic Device including a timer and a counter according to any of claims 3 to 10 wherein the ASIC or Logic Device interacts with a second processing or storage device containing said at least two sets of configuration information by means of said timer and counter.

12.ASIC or Logic Device according to claim 11 wherein said second processing or storage device is physically included in the ASIC or Logic Device.

13.A method for operating a digital processing device that includes an operating unit and a configuration unit connected with the operating unit, wherein said configuration unit comprises at least two sets of configuration information used to configure said operating unit, wherein it is checked during power-on and/or initial boot-up of the processing device, if the operating unit is operating correctly with a currently loaded set of configuration information and for loading at least a second set of configuration information, if the operating unit is not operating correctly with the currently loaded set of configuration information.

14. Method according to claim 13 wherein said at least second set of configuration information is loaded dependent on a time-out signal provided by a timer co-operating with a counter .

15. Method according to claim 13 or 14 wherein stepping the counter to address different program parts in a persistent or non-persistent storage device attached to processing device for loading of a bootstrap code and/or an operating system.

16. Method according to any of claims 14 or 15 wherein said time-out signal generated by the timer after an expiration generates a stepping of the counter.

17. Method according to any of claims 14 - 16 wherein said time-out signal generated by the timer after an expiration causes a first reset that brings certain devices in or attached to the digital processing device to a recovered and/or operational state while, at the same time, a second reset is active for a longer period of time that prevents the operating unit of the processing device from execution wherein the second reset releases the operating unit after the first reset has completed and the recovery time for the devices attached to this reset is over.

18. Method according to any of claims 13 to 17 wherein providing the capability for a failsave autonomous boot mechanism by multiple sets of same boot images that get stepped through until a set allows for successful boot.

19. Method according to any of claims 13 to 18 wherein providing the capability for starting a specific operating system and/or application set depending on sense and control information or network connection information, the digital processing device shares with an external environment .

20. Method according to any of claims 13 to 19 wherein guarding the execution of a critical application, preferably a code update in a persistent storage, by enabling said timer through a control register wherein a failure of the critical application is covered by a timeout and reboot of the processing device by a second valid set so that the critical application can be retrieved even if the critical application left a corrupted code part.

21.A computer program product for execution in a digital processing device according to any of claims 1 to 12 comprising software code portions for performing a method according to any of claims 13 to 20 when said program is run on said processing device.

22.A computer usable medium having stored a computer program comprising computer readable program means for causing a digital processing device according to any of claims 1 to 12 to perform a method according to any of claims 13 to 20 when said computer program is run on said processing device.