Monitoring processor operating in lockstep

Abstract

An integrated circuit (IC) chip includes a system circuit having a system memory, a main processor and a checker processor configured to operate in lockstep, and a monitoring circuit including an internal lockstep monitor, a main tracker, and a checker tracker. The internal lockstep monitor is configured to: observe states of internal signals of the main processor and the checker processor, compare the observed corresponding states of the main processor and the checker processor, and if the observed corresponding states are different: trigger the main tracker to output stored main track data recorded from an output of the main processor, and trigger the checker tracker to output stored checker track data recorded from an output of the checker processor.

Description

Technical Field

[0001] The present invention relates to a monitoring processor of a system-on-chip (SoC) or a multi-chip module (MCM). Background Art

[0002] In a highly integrated system, it is known to utilize two central processing units (CPUs) running in a lockstep manner on an SoC. The two CPUs run the same code at the same speed under a redundant backup configuration. One CPU acts as a master device and the other acts as a checker. The memory access request of the master device is propagated to the system memory, while the access request of the checker may not be propagated to the system memory. A lockstep monitor is provided to cross-check the memory access requests of the master device and the checker. Specifically, the lockstep monitor checks whether the master device and the checker request access to the same memory address in the same order. The lockstep monitor also checks whether the master device and the checker request to write the same data to the memory in the same order. The deviation of the corresponding memory access requests of the master device and the checker is identified.

[0003] Typically, the lockstep monitor is provided off-chip and does not perform cross-checking operations in real time. Therefore, there is a significant delay between the error that causes the two CPU memory access requests to deviate and the error being detected by the lockstep monitor.

[0004] It would be desirable to increase the speed at which CPUs operating in lockstep can be cross-checked, and it would also be desirable to increase the rate at which a lockstep monitor can identify deviant behavior of a CPU. Summary of the Invention

[0005] According to a first aspect, an integrated circuit (IC) chip is provided, comprising: a system circuit, the system circuit including a system memory, and a main processor and a checker processor configured to operate in a lockstep manner; and a monitoring circuit, the monitoring circuit including an inner lockstep monitor, a main tracker, and a checker tracker, the inner lockstep monitor being configured to: observe states of internal signals of the main processor and the checker processor, compare the observed corresponding states of the main processor and the checker processor, and if the observed corresponding states are different: trigger the main tracker to output stored main tracking data recorded from the output of the main processor, and trigger the checker tracker to output stored checker tracking data recorded from the output of the checker processor.

[0006] The inner lockstep monitor may also be configured to output the observed corresponding states if the observed corresponding states are different.

[0007] The internal lockstep monitor may include: an internal main buffer, the internal main buffer being configured to accumulate observed states of the main processor; an internal checker buffer, the internal checker buffer being configured to accumulate observed states of the checker processor; and a comparator, the comparator being configured to compare each observed state of the main processor from the internal main buffer with a corresponding observed state of the checker processor from the internal checker buffer.

[0008] The internal lockstep monitor may further include a timer configured to count the elapsed time between the observed state of the main processor accumulated in the internal main buffer and the observed state of the checker processor accumulated in the internal checker buffer, and to output an alarm if the elapsed time exceeds a timeout threshold.

[0009] The monitoring circuit may further include an output lockstep monitor configured to: observe memory accesses requested by the master processor and the checker processor, compare corresponding memory accesses requested by the master processor and the checker processor, and if the requested corresponding memory accesses differ: trigger the master tracker to output stored master trace data recorded from an output of the master processor, trigger the checker tracker to output stored checker trace data recorded from an output of the checker processor, and trigger the inner lockstep monitor to output observed states of the master processor and the checker processor.

[0010] The inner lockstep monitor may be configured to trigger the output lockstep monitor to output memory accesses requested by the master processor and the checker processor if the observed corresponding states are different.

[0011] The monitoring circuit may further include a lockstep access filter configured to: receive an output of the main processor; receive an output of the checker processor; prevent memory accesses requested by the checker processor from propagating to the system memory; and send messages intended for the main processor from the system memory to the checker processor.

[0012] The inner lockstep monitor may be configured to trigger the lockstep access filter to output memory accesses requested by the master processor and the checker processor if the observed corresponding states differ.

[0013] The system circuit may further include another checker processor configured to operate in lockstep with the main processor and the checker processor, and the internal lockstep monitor may be configured to observe states of internal signals of the other checker processor, compare the observed corresponding states of the other checker processor with those of the main processor and the checker processor, and if any observed corresponding states are different: trigger the main tracker to output stored main tracking data recorded from an output of the main processor, and trigger the checker tracker to output stored checker tracking data recorded from an output of the checker processor.

[0014] The internal lockstep monitor may be configured to perform observation, comparison, and triggering steps during operation of the main processor and the checker processor.

[0015] According to a second aspect, an IC chip is provided, comprising: a system circuit, the system circuit including a system memory, and a main processor and a checker processor configured to operate in a lockstep manner; and a monitoring circuit, the monitoring circuit including an output lockstep monitor and an analysis circuit, the output lockstep monitor being configured to: observe memory accesses requested by the main processor and the checker processor, compare corresponding memory accesses requested by the main processor and the checker processor, and if the corresponding memory accesses requested are different, trigger the analysis circuit to output the recorded observed states of internal signals of the main processor and the checker processor.

[0016] The monitoring circuit may further comprise a master tracker and a checker tracker, wherein, if the corresponding memory accesses requested are different, the output lockstep monitor may be configured to: trigger the master tracker to output stored master trace data recorded from the output of the master processor, and trigger the checker tracker to output stored checker trace data recorded from the output of the checker processor.

[0017] The analysis circuit may include a main analyzer configured to observe a state of an internal signal of the main processor, and a checker analyzer configured to observe a state of an internal signal of the checker processor.

[0018] The analysis circuit may be an internal lockstep monitor and configured to: observe states of internal signals of the main processor and the checker processor, compare the observed corresponding states of the main processor and the checker processor, and if the observed corresponding states are different: trigger the main tracker to output stored main tracking data recorded from the output of the main processor, and trigger the checker tracker to output stored checker tracking data recorded from the output of the checker processor.

[0019] The inner lockstep monitor may be configured to trigger the output lockstep monitor output of the memory access requested by the master processor and the checker processor if the observed corresponding states are different.

[0020] The output lockstep monitor may also be configured to output the corresponding memory access of the request if the corresponding memory access of the request is different.

[0021] The output lockstep monitor may include: an output main buffer, the output main buffer being configured to accumulate memory access requests of the main processor; an output checker buffer, the output checker buffer being configured to accumulate memory access requests of the checker processor; and a comparator, the comparator being configured to compare each memory access request of the main processor from the output main buffer with a corresponding memory access request of the checker processor from the output checker buffer.

[0022] The output lockstep monitor may further include a timer configured to count an elapsed time between memory access requests of the main processor accumulated in the output main buffer and memory access requests of the checker processor accumulated in the output checker buffer, and output an alarm if the elapsed time exceeds a timeout threshold.

[0023] The monitoring circuit may further include a lockstep access filter configured to: receive an output of the main processor; receive an output of the checker processor; prevent memory accesses requested by the checker processor from propagating to the system memory; and send messages intended for the main processor from the system memory to the checker processor.

[0024] The output lockstep monitor may be configured to trigger a lockstep access filter to output memory accesses requested by the master processor and the checker processor if the requested corresponding memory accesses are different.

[0025] The system circuitry may further include another checker processor configured to operate in lockstep with the main processor and the checker processor, and the output lockstep monitor configured to observe memory accesses requested by the other checker processor, compare corresponding memory accesses requested by the other checker processor with those requested by the main processor and the checker processor, and trigger the analysis circuitry to output recorded observed states of internal signals of the main processor and the checker processor and the other checker processor if any of the requested corresponding memory accesses differ.

[0026] The output lockstep monitor may be configured to perform observation, comparison, and triggering steps during operation of the main processor and the checker processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will now be described by way of example with reference to the accompanying drawings. In the drawings:

[0028] Figure 1 is a schematic diagram of an exemplary integrated circuit chip device;

[0029] Figure 2 is a schematic diagram of an exemplary monitoring network and system circuit on an integrated circuit chip device;

[0030] Figure 3 is a schematic diagram of an exemplary output lockstep monitor;

[0031] Figure 4 is a flow chart of a method for detecting and responding to system access deviations of processors operating in lockstep;

[0032] Figure 5 is a schematic diagram of an exemplary monitoring network and system circuit on an integrated circuit chip device;

[0033] Figure 6 is a schematic diagram of an exemplary inner lockstep monitor; and

[0034] Figure 7 A flow chart of a method for detecting and responding to deviations in internal signal states of a processor operating in lockstep is provided. DETAILED DESCRIPTION

[0035] The following disclosure describes a monitoring architecture suitable for implementation on an integrated circuit chip. The integrated circuit chip can be a SoC or a multi-chip module (MCM).

[0036] Figure 1 、 Figure 2 、 Figure 3 、 Figure 5 and Figure 6 Schematic diagrams of exemplary system architectures and components within the system architectures. These diagrams present the structure in the form of functional blocks. Some functional blocks for performing functions known in the art have been omitted in these diagrams. Figure 4 and Figure 7 The present invention provides a flowchart of a method for responding to deviations in the behavior of a processor operating in lockstep. Each flowchart depicts a possible order for executing the method depicted in the flowchart. However, the flowcharts are not intended to limit the described methods to the order depicted. The steps of the methods may also be executed in an alternative order to the order depicted in the flowcharts.

[0037] Figure 1 The overall structure of an exemplary monitoring network for SoC 100 is shown. Monitoring circuit 101 is arranged to monitor system circuit 102, for example for the purpose of detecting improper operation of core devices of the system circuit related to safety or security issues.

[0038] Figure 2 An exemplary integrated circuit chip device including monitoring circuits and system circuits is shown. Figure 2In the embodiment, the system circuit includes a master device 201 and a checker device 202. The master device includes a processor 203 and a memory 204. The checker device includes a processor 205 and a memory 206. The processor 205 and the memory 206 of the checker device 202 are functionally identical to the processor 203 and the memory 204 of the master device 201. The processor 205 of the checker device is configured to operate in lockstep with the processor 203 of the master device. In other words, the processor 205 runs the same code as the processor 203. Suitably, the processor 205 runs the code at the same clock speed as the processor 203. The processors 203 and 205 can be time-synchronized so as to run the same code at the same time. Alternatively, the processors 203 and 205 can be offset in time by n clock cycles. For example, 0.5<n<32. This helps to mitigate the impact of transient errors in the SoC, which can cause the same error to occur when the two processors execute the code. The processors 203 and 205 can be clocked by the same clock. If processors 203 and 205 both receive the same clock signal directly from the same clock, then processors 203 and 205 are time synchronized. Alternatively, a delay can be introduced into the clock signal received by one processor relative to the other processor to achieve a time offset of n cycles. The processors can alternatively be clocked by different clocks. These different clocks can have the same clock frequency. In this case, the processors are offset in time by n clock cycles. The different clocks can have different clock frequencies. This results in the processors operating at different clock speeds.

[0039] Despite Figure 2 Only one checker device 202 is shown, but another checker device may also be integrated into the SoC. Each additional checker device includes a processor and memory that are functionally identical to the processor 203 and memory 204 of the master device 201, respectively, and operate in lockstep as described above. Thus, the master device 201 and one or more checker devices 202 form a redundant backup configuration.

[0040] The master device 201 is a device that initiates a service such as a read / write request in a network. Examples of master devices are processors such as DSPs (digital signal processors), video processors, application processors, CPUs (central processing units), and GPUs (graphics processing units). Any programmable processor can be a master device. Other examples of master devices are devices with DMA (direct memory access) capabilities, such as traditional DMA for moving data from one location to another, autonomous coprocessors with DMA capabilities (such as encryption engines), and peripheral devices with DMA capabilities (such as Ethernet controllers).

[0041] Figure 2 The system circuitry of the system also includes a system memory 207. The system memory can be a single memory on the SoC. Alternatively, the system memory can be distributed between the SoCs. In the context of the method described below, the master device issues a read / write request to the system memory 207.

[0042] Figure 2 The system circuit also includes other component parts 208. Other component parts 208 may include other types of master devices listed above. Other component parts 208 may also include slave devices that respond to commands from the master devices. Examples of slave devices are on-chip memory, memory controllers for off-chip memory (such as DRAM), and peripheral units.

[0043] at last, Figure 2 The system circuit also includes interconnect circuitry 209. The interconnect circuitry forms the communication backbone for the SoC, through which the components of the system circuitry communicate with each other. These communications are bidirectional. The interconnect circuitry is communicatively connected to each of the master device 201, the checker device 202, the system memory 207, and the other component portions 208. The topology of the interconnect circuitry 209 is dependent on the SoC. For example, the topology of the interconnect circuitry 209 can include any one or a combination of the following types of networks to route communications around the system circuitry: a bus network, a ring network, a tree network, or a mesh network.

[0044] The monitoring circuit comprises a number of monitoring components, which are all connected to the communicator 210 via a monitoring interconnect circuit 211. Suitably, the connection between the monitoring components and the monitoring interconnect circuit 211 is bidirectional. Suitably, the connection between the monitoring interconnect circuit 211 and the communicator 210 is bidirectional. The communicator 210 may be an interface for communicating with off-chip entities. For example, the monitoring components may communicate with an off-chip analyzer via the communicator 210. Additionally or alternatively, the communicator 210 may be configured to communicate with other on-chip entities. For example, the monitoring components may communicate with an on-chip analyzer via the communicator 210. Although Figure 2 One communicator 210 is shown, but any number of communicators can be integrated on the SoC. The communicator used is selected based on the type of connection to be performed. Exemplary communicators include: JTAG, parallel trace input / output, Aurora-based high-speed serial interface; and reuse of system interfaces such as USB, Ethernet, RS232, PCIe, and CAN.

[0045] The topology of the monitoring interconnect circuit 211 may include any one or combination of the following types of networks to transmit communications around the monitoring circuit: a bus network, a ring network, a tree network, or a mesh network.The communication link between the monitoring component and the communicator 210 is bidirectional.

[0046] The monitoring circuit includes an output lock-step monitor 212. The output lock-step monitor 212 receives the output of the master device 201 and the output of the checker device 202 as input. The output lock-step monitor 212 observes the received outputs of the master device 201 and the checker device 202 and compares them. If the master processor and the checker processor are clocked at the same speed, the corresponding item compared by the output lock-step monitor 212 can be any length from a single bit to the entire transaction. If the master processor and the checker processor are clocked at different speeds, the corresponding item compared by the output lock-step monitor 212 is longer, namely the entire transaction. In other words, because the master processor and the checker processor are not time-synchronized, the output lock-step monitor 212 has to wait until both the master processor and the checker processor complete the entire transaction (which will be completed at different times) before comparing the outputs of the master processor and the checker processor. The output of the output lock-step monitor 212 is connected to the communicator 210 via the monitoring interconnect circuit 211.

[0047] Figure 3 An example internal structure of the output lockstep monitor 212 is shown. The output of the main processor 203 is provided as input to the output main buffer 301. The output of the checker processor 205 is provided as input to the output checker buffer 302. If at least one entry exists in each of buffers 301 and 302, the leading entry in each buffer is output to the comparator 303. The comparator 303 compares the two leading entries. The comparator output identifies whether the entries are identical or different. The comparator output is input to the message builder 305. The message builder 305 generates a message. If the comparator identifies that the leading entries in buffers 301 and 302 differ, the message builder 305 generates a message. This message may indicate that the corresponding outputs of the main processor 203 and the checker processor 205 differ. The message may also include the differing outputs of the main processor 203 and the checker processor 205. The message builder 305 then outputs the message from the output lockstep monitor to the monitoring interconnect circuit 211. As will be discussed further below, a variety of different actions may be taken in response to this message.

[0048] The entries in input buffers 301 and 302 may be requests from the master processor 203 and the checker processor 205 to access system memory 207. In this example, the output lockstep monitor 212 checks whether the same memory accesses commanded by the master processor 203 are also commanded by the checker processor 205 in the same order. For example, a read request from the master processor 203 may be extracted from the master device output and input to the output master buffer 301, and a read request from the checker processor 202 may be extracted from the checker device output and input to the output checker buffer 302. As another example, a write request from the master processor 203 may be extracted from the master device output and input to the output master buffer 301, and a write request from the checker processor 202 may be extracted from the checker device output and input to the output checker buffer 302. The output lockstep monitor 212 may include a group of output master buffers, each for storing a different output of the master processor 203. The output lockstep monitor 212 may also include a corresponding set of output checker buffers, each of which is used to store a different output of the checker processor 205 corresponding to an output of the main processor 203. The output lockstep monitor 212 may include one or a set of comparators for comparing corresponding processor output items from the corresponding output main buffer and output checker buffer. The comparator(s) output to the message builder 305, which constructs a message identifying a difference between any corresponding outputs of the main processor 203 and the checker processor 205.

[0049] Suitably, the output lockstep monitor operates during operation of processors 203 and 205. Thus, there is minimal delay between the main processor 203 and the checker processor 205 generating a different output, and this output being identified by the output lockstep monitor and passed to the monitor interconnect circuit 211.

[0050] The output lockstep monitor may further include a timer 304. The timer 304 counts the elapsed time between the output of the master processor 203 accumulated in the output master buffer 301 and the corresponding output of the checker processor 205 accumulated in the output checker buffer 302. The timer 304 has a timeout threshold. If the count reaches the timeout threshold before the two corresponding outputs are in the buffers 301 and 302, the timer outputs an indication of the timeout threshold to the message builder 305. The message builder 305 generates an alarm message and outputs the alarm message from the output lockstep monitor 212 to the monitoring interconnect circuit 212.

[0051] Back to Figure 2, the monitoring circuit further includes a lockstep access filter 213. The lockstep access filter 213 receives as input the output of the master device 201 and the output of the checker device 202. The lockstep access filter 213 has a bidirectional connection to the master device 201 and the checker device 202. The lockstep access filter 213 also has a bidirectional connection to the interconnect circuit 209. The lockstep access filter 213 also outputs to the monitoring interconnect circuit 211 and has a bidirectional connection to the monitoring interconnect circuit 211. The lockstep access filter 213 can be provided inside the output lockstep monitor 212. Alternatively, as Figure 2 As shown, the lockstep access filter can be set outside the output lockstep monitor 212. The lockstep access filter 213 filters the outputs of the master device and the checker device and then sends them to the interconnect circuit 209 for routing to other system circuits. This operation is performed during the operation of the master processor 203 and the checker processor 205.

[0052] For example, the lockstep access filter 213 may receive system memory access requests from both the main processor 203 and the checker processor 205. The lockstep access filter 213 may prevent the system memory access requested by the checker processor from propagating to the system memory 207. For example, the lockstep access filter 213 may receive corresponding read requests from the main processor 203 and the checker processor 205. The lockstep access filter 213 forwards the read request from the main processor 203 to the system memory 207 via the interconnect circuit 209. The lockstep access filter 213 prevents the read request from the checker processor 203 from propagating to the system memory 207 via the interconnect circuit 209. The lockstep access filter 213 then receives a read response to the read request from the main processor 203 from the system memory 207 via the interconnect circuit 209. The lockstep access filter 213 forwards the read response from the system memory 207 to both the main processor 203 and the checker processor 205. In the event that there are several read responses, the lockstep access filter 213 forwards the read responses to both the master processor 203 and the checker processor 205 in the same order. The lockstep access filter 213 may include a counter that counts the read requests received from the checker processor 305. Only when the counter is greater than zero does the lockstep access filter 213 forward the next read response to the checker processor 305. This ensures that a read response is not sent to the checker processor 305 before a read request is sent from the checker processor 305.

[0053] As another example, the lockstep access filter 213 may receive corresponding write requests from the main processor 203 and the checker processor 205. The lockstep access filter 213 forwards the write request from the main processor 203 to the system memory 207 via the interconnect circuit 209. The lockstep access filter 213 terminates the write request from the checker processor 203. Thus, the write request from the checker processor 205 is prevented from propagating to the system memory 207 via the interconnect circuit 209. Once the requested data has been written to the system memory 207, the lockstep access filter 213 receives a write response from the system memory 207 via the interconnect circuit 209. The lockstep access filter 213 forwards the write response from the system memory 207 to both the main processor 203 and the checker processor 205. If there are multiple write responses, the lockstep access filter 213 forwards the write responses to both the main processor 203 and the checker processor 205 in the same order. The lockstep access filter 213 may include a counter that counts the write requests received from the checker processor 305. Only when the counter is greater than zero does the lockstep access filter 213 forward the next write response to the checker processor 305. This ensures that a write response is not sent to the checker processor 305 before a write request is sent from the checker processor 305.

[0054] The lockstep access filter 213 can filter read requests and write requests received from the master processor and the checker processor as described above. In this case, the lockstep access filter 213 has a read counter for counting read requests from the checker processor and a separate write counter for counting write requests from the checker processor.

[0055] Figure 2 The monitoring circuitry also includes a master tracker 214. Master tracker 214 receives the output of master processor 203. Master tracker 214 records the output of master processor 203 in a buffer. For example, master tracker 214 may include a circular buffer in which the output of master processor 203 is recorded. The buffer is arranged to overwrite earlier received data in a circular manner once its storage capacity is reached. When triggered, master tracker 214 outputs the contents of its buffer as master tracking data to communicator 210 via monitoring interconnect circuit 211. When triggered, master tracker 214 may also output additional master tracking data to communicator 210 as additional master tracking data is collected in its buffer.

[0056] Figure 2The monitoring circuit also includes a checker tracker 215. The checker tracker 215 receives the output of the checker processor 205. The checker tracker 215 records the output of the checker processor 205 in a buffer. For example, the checker tracker 215 may include a circular buffer in which the output of the checker processor 205 is recorded. The buffer is arranged to overwrite earlier received data in a circular manner once its storage capacity is reached. When triggered, the checker tracker 215 outputs the contents of its buffer as checker tracking data to the communicator 210 via the monitoring interconnect circuit 211. When triggered, the checker tracker 215 may also output another checker tracking data to the communicator 210 as another checker tracking data is collected in the buffer of the checker tracker 215.

[0057] Figure 2 The monitoring circuitry also includes an analysis circuit consisting of a main analyzer 216 and a checker analyzer 217. Main analyzer 216 is connected to main processor 203. Main analyzer 216 outputs to monitoring interconnect circuit 211. Checker analyzer 217 is connected to checker processor 205. Checker analyzer 217 outputs to monitoring interconnect circuit 211. Each of these analyzers 216 and 217 observes the state of internal signals of the processor to which it is connected. These observed states can then be recorded in a buffer within the analyzer. The buffer can be, for example, a circular buffer. The circular buffer is arranged to overwrite earlier observed states in a cyclic manner once its storage capacity is reached. The observed internal signals can be one or more of the following: instructions executed by the processor, the state of a register connected to the processor's memory (such as a control status register), the value of a specific entry in a register connected to the processor's memory, a program counter interrupt state, or a processor halt signal. When triggered, each analyzer 216, 217 outputs the contents of its buffer to communicator 210 via monitoring interconnect circuit 211. When triggered, each analyzer 216, 217 may also output other observed states to the communicator 210, as these observed states are recorded in the analyzer's buffer.

[0058] Now refer to Figure 4 Methods for detecting and responding to deviating memory accesses performed by processors operating in lockstep are described.

[0059] In step 401, the output lockstep monitor 212 receives requested corresponding memory accesses from the master processor 203 and the checker processor 205. These requested memory accesses can be stored, for example, in buffers 301 and 302. In step 402, if at least one requested memory access has been received from both the master processor and the checker processor, it is determined whether the corresponding memory access executed by the checker processor is different for the memory access executed by the master processor. Step 402 can be implemented, for example, at the comparator 303. If the corresponding memory accesses executed by the checker processor are the same, the method returns to step 402 and repeats the above questions for the next memory access of the master device. If, in step 402, the corresponding memory accesses executed by the checker processor are different, the method proceeds to steps 403 and 404. In step 403, the output lockstep monitor 212 outputs different corresponding memory accesses.

[0060] In step 404, a trigger message is generated and sent to the monitoring interconnect circuit 211. For example, the trigger message may be generated and sent by the message builder 305. The monitoring interconnect circuit 211 routes the trigger message to other monitoring components. For example, in step 405, the monitoring interconnect circuit 211 may route the trigger message to the main analyzer 216 and the checker analyzer 217. In step 406, the main analyzer 216 responds to receiving the trigger by outputting the recorded observed states of the main processor's internal signals from its buffer to the communicator 210 via the monitoring interconnect circuit 211. The main analyzer 216 may also respond to receiving the trigger by outputting other observed states of the internal signals from the main processor while these internal signals are collected in the main analyzer 216 buffer. Similarly, in step 406, the checker analyzer 217 responds to receiving the trigger by outputting the recorded observed states of the checker processor's internal signals from its buffer to the communicator 210 via the monitoring interconnect circuit 211. Checker analyzer 217 can also respond to receipt of a trigger by outputting other observed states of internal signals from the checker processor as these internal signals are collected in the checker analyzer 217 buffer. Communicator 210 can then route the observed states to an off-chip or on-chip analyzer for subsequent analysis. This subsequent analysis can be performed offline. In other words, it is not performed while processors 203 and 205 are running.

[0061] In step 407, the monitoring interconnect circuit 211 may also route the trigger message to the master tracer 214 and the checker tracer 215. In step 408, the master tracer 214 responds to receiving the trigger by outputting the recorded output of the master processor 203 from its buffer to the communicator 210 via the monitoring interconnect circuit 211 as master trace data. As other master trace data is collected in the master tracer 214 buffer, the master tracer 214 may also respond to receiving the trigger by outputting other master trace data. Similarly, in step 408, the checker tracer 215 responds to receiving the trigger by outputting the recorded output of the checker processor 205 from its buffer to the communicator 210 via the monitoring interconnect circuit 211 as checker trace data. As other checker trace data is collected in the checker tracer 215 buffer, the checker tracer 215 may also respond to receiving the trigger by outputting other master trace data. The communicator 210 may then route the trace data to an off-chip or on-chip analyzer for subsequent analysis. The subsequent analysis described above can be performed off-line. In other words, it is not performed during the operation of processors 203 and 205.

[0062] At step 409, the monitoring interconnect circuit 211 may also route the trigger message to the lockstep access filter 213. At step 410, the lockstep access filter 213 responds to receipt of the trigger by outputting the memory accesses requested by the master processor and the checker processor to the communicator 210 via the monitoring interconnect circuit 211. The communicator 210 may then route the requested memory accesses to an off-chip or on-chip analyzer for subsequent analysis. This subsequent analysis may be performed offline, in other words, not during operation of processors 203 and 205.

[0063] In addition to triggering the monitoring components, the monitoring interconnect circuit can also send an alarm to the communicator 210, which then routes the alarm to an off-chip or on-chip analyzer. The monitoring interconnect circuit can cause the main processor 203 and the checker processor 205 to suspend processing. The monitoring interconnect circuit can cause the main processor 203 and the checker processor 205 (or the entire system circuit) to reset.

[0064] Figure 5 Another exemplary integrated circuit chip device including monitoring circuitry and system circuitry is shown. Figure 5 equipment and Figure 2 The device differs in that there is no separate main analyzer 216 and checker analyzer 217. Instead, Figure 5The device has an internal lock-step monitor 501 connected to both the main processor 203 and the checker processor 205. The internal lock-step monitor 501 outputs to the monitoring interconnect circuit 211. The internal lock-step monitor 501 observes the states of internal signals of both the main processor 203 and the checker processor 205. These observed states can then be recorded in a buffer within the analyzer. Each buffer can be, for example, a circular buffer. The observed internal signals can be one or more of the following: instructions executed by the processor, the state of a register (such as a control status register) connected to the memory of the processor, the value of a specific entry in a register of the memory connected to the processor, a program counter interrupt state, a halt signal of the processor. The analyzer can output the recorded observed states to the monitoring interconnect circuit 211. Figure 5 Other parts of the equipment and Figure 2 The same, so no further description is given here.

[0065] Figure 6 An exemplary internal structure of the internal lockstep monitor 501 is shown. The states of the internal signals of the main processor 203 are provided as inputs to the internal main buffer 601. The states of the internal signals of the checker processor 205 are provided as inputs to the internal checker buffer 602. If at least one entry exists in each of buffers 601 and 602, the leading entry in each buffer is output to a comparator 603. Comparator 603 compares the two leading entries. The comparator output identifies whether the entries are identical or different. The comparator output is input to a message builder 605. The message builder 605 generates a message. If the comparator identifies that the leading entries in buffers 601 and 602 differ, the message builder 605 generates a message. This message may indicate that the corresponding states of the internal signals of the main processor 203 and the checker processor 205 differ. The message may also include the different states of the internal signals from the main processor 203 and the checker processor 205. The message builder 605 then outputs the message from the internal lockstep monitor to the monitoring interconnect circuit 211. As will be discussed further below, a variety of different actions may be taken in response to this message.

[0066] Suitably, the inter-lock monitor 501 operates during operation of the processors 203 and 205. Thus, there is minimal delay between the main processor 203 and the checker processor 205, with the minimum delay having different internal signal states, and these different states are recognized by the inter-lock monitor 501 and transmitted to the monitoring interconnect circuit 211.

[0067] The internal lockstep monitor may further include a timer 604. The timer 604 counts the elapsed time between the state of the internal signal of the master processor 203 accumulated in the internal master buffer 601 and the corresponding state of the internal signal of the checker processor 205 accumulated in the internal checker buffer 602. The timer 604 has a timeout threshold. If the count reaches the timeout threshold before the two corresponding outputs are in the buffers 601 and 602, the timer outputs this information to the message builder 605. The message builder 605 generates an alarm message and outputs the alarm message from the internal lockstep monitor 501 to the monitoring interconnect circuit 212.

[0068] Figure 4 The method can be Figure 5 The method is implemented on an integrated circuit chip device. All steps of the method are identical except for steps 405 and 406. Instead of step 405, the trigger is routed to the internal lockstep monitor 501. The internal lockstep monitor 501 responds to receipt of the trigger by outputting the recorded observed states of the corresponding internal signals of the main processor and the checker processor from its buffer to the communicator 210 via the monitoring interconnect circuit 211. The communicator 210 can then route the observed states to an off-chip or on-chip analyzer for subsequent analysis. The subsequent analysis can be performed offline. In other words, it is not performed while processors 203 and 205 are running.

[0069] Now refer to Figure 7 Methods for detecting and responding to deviation conditions of internal signals of a processor operating in lockstep are described.

[0070] In step 701, the internal lockstep monitor 501 observes the corresponding states of internal signals from the main processor 203 and the checker processor 205. These states of the internal signals can be stored, for example, in buffers 601 and 602. In step 702, if at least one state of the internal signal has been received from both the main processor and the checker processor, it is determined whether the corresponding states of the internal signal of the checker processor are different for the state of the internal signal of the main processor. Step 702 can be implemented, for example, at the comparator 603. If the corresponding states of the internal signal of the checker processor are the same, the method returns to step 702 and repeats the above questions for the next state of the internal signal of the main processor. If, in step 702, the corresponding states of the internal signal of the checker processor are different, the method proceeds to steps 703 and 704. In step 703, the internal lockstep monitor 501 outputs the different corresponding internal signal states.

[0071] In step 704, a trigger message is generated and sent to the monitoring interconnect circuit 211. For example, the trigger message may be generated and sent by the message builder 605. The monitoring interconnect circuit 211 routes the trigger message to other monitoring components. For example, in step 705, the monitoring interconnect circuit 211 may route the trigger message to the master tracker 214 and the checker tracker 215. In step 706, the master tracker 214 responds to receiving the trigger by outputting the recorded output of the master processor 203 from its buffer to the communicator 210 as master trace data via the monitoring interconnect circuit 211. As other master trace data is collected in the master tracker 214 buffer, the master tracker 214 may also respond to receiving the trigger by outputting other master trace data. Similarly, in step 706, the checker tracker 215 responds to receiving the trigger by outputting the recorded output of the checker processor 205 from its buffer to the communicator 210 as checker trace data via the monitoring interconnect circuit 211. As other checker trace data is collected in the checker tracer 215 buffer, the checker tracer 215 can also respond to the receipt of the trigger by outputting other master trace data. The communicator 210 can then route the trace data to an off-chip or on-chip analyzer for subsequent analysis. This subsequent analysis can be performed offline. In other words, it is not performed while processors 203 and 205 are running.

[0072] In step 707, the monitoring interconnect circuit 211 may also route the trigger message to the output lockstep monitor 212. In step 708, the output lockstep monitor 212 responds to receipt of the trigger by outputting the memory accesses requested by the master processor and the checker processor to the communicator 210 via the monitoring interconnect circuit 211. The communicator 210 may then route the requested memory accesses to an off-chip or on-chip analyzer for subsequent analysis. This subsequent analysis may be performed offline, in other words, not during operation of processors 203 and 205.

[0073] At step 709, the monitoring interconnect circuit 211 may also route the trigger message to the lockstep access filter 213. At step 710, the lockstep access filter 213 responds to receipt of the trigger by outputting the memory accesses requested by the master processor and the checker processor to the communicator 210 via the monitoring interconnect circuit 211. The communicator 210 may then route the requested memory accesses to an off-chip or on-chip analyzer for subsequent analysis. This subsequent analysis may be performed offline, in other words, not during operation of processors 203 and 205.

[0074] In addition to triggering the monitoring components, the monitoring interconnect circuit can also send an alarm to the communicator 210, which then routes the alarm to an off-chip or on-chip analyzer. The monitoring interconnect circuit can cause the main processor 203 and the checker processor 205 to suspend processing. The monitoring interconnect circuit can cause the main processor 203 and the checker processor 205 (or the entire system circuit) to reset.

[0075] Figure 2 The main analyzer 216 and the checker analyzer 217 can be configured during operation to change the state of the internal signals they observe. For example, an on-chip or off-chip analyzer can send configuration commands to the main analyzer and the checker analyzer via the monitoring interconnect circuit 211, instructing the main analyzer and the checker analyzer to observe specific internal signals of the main processor 203 and the checker processor 205. Similarly, Figure 5 The internal lock-step monitor 501 can be configured to change the state of the internal signals it observes during operation. For example, an on-chip or off-chip analyzer can send a configuration command to the internal lock-step monitor 501 via the monitoring interconnect circuit 211, instructing the internal lock-step monitor 501 to observe specific internal signals of the main processor 203 and the checker processor 205. Upon detecting a trigger, the on-chip or off-chip analyzer can send a configuration command to the internal lock-step monitor 501, instructing the internal lock-step monitor 501 to change the specific internal signals of the main processor 203 and the checker processor 205 being observed.

[0076] As mentioned above, ( Figure 2 or Figure 5 The integrated circuit chip device may include more than one checker device 202. Each other checker device includes another checker processor and another checker memory. Each other checker processor operates in lockstep with the main processor and the checker processor. The output lockstep monitor 212 may include an additional output checker buffer for each additional other checker processor. The comparator 303 may be configured to compare the corresponding outputs of all main processors, checker processors, and each other checker processor. If any corresponding outputs are different, the message builder 305 generates a trigger and sends it to the monitoring interconnect circuit. As described above, the monitoring interconnect circuit 211 responds to the trigger. The lockstep access filter 213 performs the same action on each other checker processor as on the checker processor.

[0077] exist Figure 2 In the case of an integrated circuit chip device, another checker analyzer and another checker tracker are provided for each other checker device. Each other checker analyzer and another checker tracker operate as the aforementioned checker analyzer and checker tracker, respectively. Figure 4In steps 405 and 407 , each of the other checker analyzer and the other checker tracker receives the trigger message from the monitoring interconnect circuit and responds in the same manner as the checker analyzer and the checker tracker.

[0078] exist Figure 5 In the case of an integrated circuit chip device, the internal lockstep monitor 501 may include an additional internal checker buffer for each additional checker processor. The comparator 603 may be configured to compare the corresponding states of the internal signals of all the main processors, the checker processor, and each additional checker processor. If the corresponding states of any internal signals are different, the message builder 605 generates a trigger and sends it to the monitoring interconnect circuit. As described above, the monitoring interconnect circuit 211 responds to the trigger.

[0079] All checker processors and the further checker processor can operate simultaneously with the main processor. Alternatively, the checker processor and the further checker processor can use voting or another redundancy scheme. In a voting system, more than m checker devices with different corresponding outputs to the main device may be required to enable the message builder to generate a trigger and send it to the monitoring interconnect circuit. m>1. For example, m can be 2. The checker processor and the further checker processor can alternatively operate in a split / locked mode, in which the lockstep function of each checker processor can be dynamically engaged and disengaged with the main processor. This allows the processors to run in redundant mode when there is capacity, and also execute different code separately when needed to achieve a higher performance SoC.

[0080] The devices and methods described herein assist in the functional safety of SoCs by verifying that the main processor operates reliably and safely.

[0081] Figure 1 、 Figure 2 、 Figure 3 、 Figure 5 and Figure 6 Each component of the SoCs shown in can be implemented with dedicated hardware. Doing so allows the methods described herein to be implemented at line speed, thereby not increasing the execution overhead of the SoC. Alternatively, Figure 1 、 Figure 2 、 Figure 3 、 Figure 5 and Figure 6 Each component of the SoCs shown in can be implemented in software. Some components can be implemented in software, while other components can be implemented in dedicated hardware.

[0082] The described SoC is suitably incorporated into a computing-based device. The computing-based device may be an electronic device. Suitably, the computing-based device includes one or more processors for processing computer-executable instructions to control the operation of the device, thereby implementing the methods described herein. The computer-executable instructions may be provided using any computer-readable medium, such as a memory. The methods described herein may be performed by software in a machine-readable form on a tangible storage medium. Software may be provided at the computing-based device to implement the methods described herein.

[0083] The above description describes the system circuitry and monitoring circuitry as being contained on the same SoC. In an alternative embodiment, the system circuitry and monitoring circuitry are contained on two or more integrated circuit chips in an MCM. In an MCM, the integrated circuit chips are typically stacked or arranged adjacently on an interposer substrate. Some system circuitry may be located on one integrated circuit chip, while other system circuitry may be located on different integrated circuit chips in the MCM. Similarly, the monitoring circuitry may be distributed across more than one integrated circuit chip in the MCM. Therefore, the methods and apparatus described in the context of an SoC are also applicable in the context of an MCM.

[0084] Applicants hereby disclose each individual feature herein in isolation, as well as any combination of two or more such features, to the extent that such feature or combination can be implemented according to the common general knowledge of a person skilled in the art based on the present specification as a whole, without limiting the scope of the claims. Applicants indicate that various aspects of the present invention may consist of any such individual feature or combination of features. In view of the foregoing description, it will be apparent to a person skilled in the art that various modifications may be made within the scope of the present invention.

Claims

1. An IC chip comprising: a system circuit comprising a system memory, and a main processor and a checker processor configured to operate in lockstep; as well as A monitoring circuit, the monitoring circuit comprising an inner lock-step monitor, a master tracker, and a checker tracker, the inner lock-step monitor being configured to: observing the status of internal signals of the main processor and the checker processor, comparing the observed corresponding states of the master processor and the checker processor, and If the observed corresponding states are different: triggering the master tracker to output stored master tracking data recorded from the output of the master processor, and triggering the checker tracer to output stored checker trace data recorded from the output of the checker processor, Wherein, the inner lock step monitor includes: an internal primary buffer configured to accumulate an observed state of the primary processor; an internal checker buffer configured to accumulate observed states of the checker processor; a comparator configured to compare each observed state of the main processor from the internal main buffer with a corresponding observed state of the checker processor from the internal checker buffer; and A timer configured to: counting the elapsed time between the observed state of the main processor accumulated in the internal main buffer and the observed state of the checker processor accumulated in the internal checker buffer; and If the elapsed time exceeds a timeout threshold, an alarm is output.

2. The IC chip according to claim 1, wherein The inner lock-step monitor is further configured to output the observed corresponding states if the observed corresponding states are different.

3. The IC chip according to claim 1, wherein The monitoring circuit further includes an output lockstep monitor, wherein the output lockstep monitor is configured to: observing memory accesses requested by the main processor and the checker processor, comparing corresponding memory accesses requested by the host processor and the checker processor, and If the corresponding memory access for the request is different: triggering the master tracker to output stored master tracking data recorded from the output of the master processor, triggering the checker tracer to output stored checker trace data recorded from the output of the checker processor, and The inner lockstep monitor is triggered to output observed states of the main processor and the checker processor.

4. The IC chip according to claim 3, wherein The internal lockstep monitor is configured to trigger the output lockstep monitor to output memory accesses requested by the master processor and the checker processor if the observed corresponding states are different.

5. The IC chip according to claim 1, wherein The monitoring circuit further includes a lockstep access filter configured to: receiving an output of the main processor; receiving an output of the checker processor; preventing memory accesses requested by the checker processor from propagating to the system memory; and A message intended for the host processor is sent from the system memory to the checker processor.

6. The IC chip according to claim 5, wherein The inner lockstep monitor is configured to trigger the lockstep access filter to output memory accesses requested by the master processor and the checker processor if the observed corresponding states are different.

7. The IC chip according to claim 1, wherein The system circuit further includes another checker processor configured to operate in lockstep with the main processor and the checker processor, and the inner lockstep monitor is configured to: observing the state of internal signals of said other checker processor, comparing the observed states of the further checker processor with corresponding states of the main processor and the checker processor, and If any of the observed corresponding states are different: triggering the master tracker to output stored master tracking data recorded from the output of the master processor, and The checker tracer is triggered to output stored checker trace data recorded from the output of the checker processor.

8. The IC chip according to claim 1, wherein The inner lockstep monitor is configured to perform the observing, comparing, and triggering steps of claim 1 during operation of the main processor and the checker processor.

9. An IC chip comprising: a system circuit comprising a system memory, and a main processor and a checker processor configured to operate in lockstep; as well as A monitoring circuit, the monitoring circuit comprising an output lockstep monitor and an analysis circuit, wherein the output lockstep monitor is configured to: observing memory accesses requested by the main processor and the checker processor, comparing corresponding memory accesses requested by the host processor and the checker processor, and triggering the analysis circuit to output recorded observed states of internal signals of the main processor and the checker processor if the corresponding memory accesses of the requests are different, Wherein, the output lockstep monitor comprises: an output main buffer configured to accumulate memory access requests of the main processor; an output checker buffer configured to accumulate memory access requests of the checker processor; a comparator configured to compare each memory access request of the master processor from the output master buffer with a corresponding memory access request of the checker processor from the output checker buffer; and A timer configured to: counting an elapsed time between memory access requests of the main processor accumulated in the output main buffer and memory access requests of the checker processor accumulated in the output checker buffer; and If the elapsed time exceeds a timeout threshold, an alarm is output.

10. The IC chip according to claim 9, wherein The monitoring circuit further includes a master tracker and a checker tracker, wherein if the corresponding memory accesses of the requests are different, the output lockstep monitor is configured to: triggering the master tracker to output stored master tracking data recorded from the output of the master processor, and The checker tracer is triggered to output stored checker trace data recorded from the output of the checker processor.

11. The IC chip according to claim 9, wherein The analysis circuit includes a main analyzer configured to observe a state of an internal signal of the main processor, and a checker analyzer configured to observe a state of an internal signal of the checker processor.

12. The IC chip according to claim 10, wherein The analysis circuit is an internal lockstep monitor and is configured to: observing the status of internal signals of the main processor and the checker processor, comparing the observed corresponding states of the master processor and the checker processor, and If the observed corresponding states are different: triggering the master tracker to output stored master tracking data recorded from the output of the master processor, and The checker tracer is triggered to output stored checker trace data recorded from the output of the checker processor.

13. The IC chip according to claim 12, wherein: If the observed corresponding states are different, the internal lockstep monitor is configured to trigger the output lockstep monitor to output the memory accesses requested by the master processor and the checker processor.

14. The IC chip according to claim 9, wherein The output lockstep monitor is further configured to output the corresponding memory access of the request if the corresponding memory access of the request is different.

15. The IC chip according to claim 9, wherein The monitoring circuit further includes a lockstep access filter configured to: receiving an output of the main processor; receiving an output of the checker processor; preventing memory accesses requested by the checker processor from propagating to the system memory; and A message intended for the host processor is sent from the system memory to the checker processor.

16. The IC chip according to claim 15, wherein The output lockstep monitor is configured to trigger the lockstep access filter to output the memory accesses requested by the master processor and the checker processor if the corresponding memory accesses of the requests are different.

17. The IC chip according to claim 9, wherein The system circuit further includes another checker processor configured to operate in lockstep with the main processor and the checker processor, and the output lockstep monitor is configured to: observing a memory access requested by said another checker processor, comparing corresponding memory accesses requested by the further checker processor with those requested by the host processor and the checker processor, and If the corresponding memory accesses of any of the requests are different, the analysis circuit is triggered to output recorded observed states of internal signals of the main processor and the checker processor and the further checker processor.

18. The IC chip according to claim 9, wherein The output lockstep monitor is configured to perform the observing, comparing and triggering steps of claim 9 during operation of the main processor and the checker processor.

Images