A fault handling method based on a dual-core lockstep processor

Abstract

This invention discloses a fault handling method based on a dual-core lockstep processor. The dual-core lockstep processor includes a master processor and a slave processor. The dual-core lockstep processor receives data from the last four stages of the processor's pipeline via a fault detection module, outputting a fault flag signal and a fault program pointer. A front-end fault handling module receives the fault flag signal and the fault program pointer, performing a pipeline-level rollback. A back-end fault handling module controls the handshake and selection signals of the last four stages of the pipeline and executes a virtual write-back fault-tolerance mechanism, managing the operating status of the last four stages of the pipeline and the instruction fetch stage pipeline. This prevents data conflicts during superscalar processor fault handling, thereby achieving full coverage of fault handling while maintaining low time and area overhead, and simultaneously achieving high performance and high reliability. This invention can be widely applied in the field of dual-core lockstep processors.

Description

Technical Field

[0001] This invention relates to the field of dual-core lockstep processors, and in particular to a fault handling method based on a dual-core lockstep processor. Background Technology

[0002] Automotive chips are crucial hardware for realizing the core functions of automobiles. Against the backdrop of a chip shortage in the automotive industry and the rapid growth in the production and sales of new energy vehicles, the demand for automotive chips is increasing daily. Unlike mobile phone chips, the bottleneck in developing automotive chips lies not in the manufacturing process, but in reliability, security, and longevity. Automotive chips need to possess functional safety to mitigate the impact of soft errors caused by external environments or human operation on system reliability. Lockstep processors are a common solution for mitigating soft errors, improving system reliability, and ultimately achieving functional safety.

[0003] Meanwhile, automotive applications are placing increasingly higher demands on processor performance. Currently, the fine-grained fault handling of processors cannot simultaneously handle high-performance superscalar operations, and the need to save the state during lockstepping results in additional time and space overhead. Summary of the Invention

[0004] To address at least one of the technical problems existing in the prior art, the present invention aims to provide a fault handling method based on a dual-core lockstep processor, comprising:

[0005] The dual-core lockstep processor includes a master processor and a slave processor; the fault handling method based on the dual-core lockstep processor includes the following steps:

[0006] The fault detection module receives data from the last four stages of the pipeline and outputs a fault flag signal and a fault program pointer; the last four stages of the pipeline are the last four stages of the dual-core lockstep processor.

[0007] The front-end fault handling module receives the fault flag signal and the fault program pointer to complete the pipeline-level rollback.

[0008] The backend fault handling module controls the handshake and selection signals of the last four pipeline stages and executes a fault-tolerant mechanism for virtual write-back, thereby managing the operating status of the last four pipeline stages and the instruction fetch stage pipeline.

[0009] Furthermore, the latter four pipeline stages are, in sequence, a decoding pipeline, an execution pipeline, a memory access pipeline, and a write-back pipeline.

[0010] Furthermore, the fault program pointer is passed to the program pointer register through the front-end fault handling module;

[0011] Based on the value of the fault procedure pointer, the front-end fault handling module performs fault handling and refreshes the pipeline starting from the first-level pipeline.

[0012] Furthermore, the step of receiving the fault flag signal and the fault program pointer through the front-end fault handling module to complete the pipeline-level rollback also includes:

[0013] Fault information of different priorities is obtained based on the fault flag signals from different pipeline stages; the fault information includes the fault flag signals and the fault procedure pointer.

[0014] The fault flag signal is received by the multiplexer of the front-end fault processing module and the fault timer is started.

[0015] When the duration of the fault exceeds the tolerable threshold set by the fault timer, a reset signal is triggered to reset the system.

[0016] Furthermore, the front-end fault handling module includes a first front-end fault handling module and a second front-end fault handling module; the first front-end fault handling module is configured in the first-stage PC-level pipeline of the dual-core lockstep processor; the second front-end fault handling module is configured in the second-stage instruction fetch pipeline of the dual-core lockstep processor.

[0017] The step of receiving the fault flag signal and the fault program pointer through the front-end fault handling module to complete the pipeline-level rollback specifically includes:

[0018] Based on the fault program pointer, the corresponding fault instruction is obtained through the front-end fault processing module;

[0019] The first front-end fault handling module outputs the program pointer of the next instruction after the fault instruction and performs branch prediction.

[0020] The fault program pointer is output to the instruction buffer through the second front-end fault handling module;

[0021] Based on the output of the first front-end fault handling module, branch jump is executed through the first-level PC-level pipeline;

[0022] Based on the output of the second front-end fault handling module, the branch jump is executed through the second-level instruction fetch pipeline.

[0023] Furthermore, the first-stage PC-level pipeline and the second-stage instruction fetching pipeline also include a branch prediction module;

[0024] The branch prediction function is executed through the branch prediction module.

[0025] Furthermore, the front-end fault handling module includes a priority arbitrator;

[0026] Before the step of obtaining the corresponding fault instruction through the front-end fault processing module according to the fault procedure pointer, the priority of the fault procedure pointer is determined according to the arbitration rules of the priority arbitrator.

[0027] Furthermore, the arbitration rules of the priority arbitrator include:

[0028] Different branch jump priorities are corresponding to fault handling at different stages of the pipeline.

[0029] The faulty program pointer corresponding to the faulty instruction has a higher priority than the program pointer corresponding to the program branch jump instruction.

[0030] The program pointer of a subsequent pipeline failure has a higher priority than that of the preceding pipeline.

[0031] System reset has a higher priority than pipeline-level rollback.

[0032] Furthermore, the handshake signal is controlled using sequential logic; the selection signal is controlled using combinational logic.

[0033] The step of controlling the handshake and selection signals of the last four pipeline stages and managing the operating status of the instruction fetch stage pipeline through the back-end fault handling module specifically includes:

[0034] In response to the handshake signal, control the data transmission during the instruction fetching and decoding phases;

[0035] In response to the selection signal, data transmission in the subsequent three stages of the pipeline is controlled.

[0036] Furthermore, the virtual write-back fault-tolerant mechanism allows the processor to send data into a read-only register without interrupting the pipeline or saving the context when a fault occurs.

[0037] The beneficial effects of this invention are as follows: It utilizes a superscalar, high-performance dual-core lockstep processor. A fault detection module detects faults in the last four stages of the processor's pipeline. A front-end fault handling module receives the fault information output by the fault detection module and performs pipeline-level rollback. A back-end fault handling module controls handshake and selection signals and implements a virtual write-back fault tolerance mechanism to manage the operational status of the last four pipeline stages. The fault handling method in this embodiment combines the advantages of high performance and high reliability. It utilizes pipeline-level rollback for rapid fault handling at the front end and prevents data conflicts during processor fault handling by implementing a virtual write-back fault tolerance mechanism at the back end, thereby achieving full coverage of fault handling while maintaining low time and area overhead. Attached Figure Description

[0038] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0039] Figure 1 This is a schematic diagram of a superscalar dual-core lockstep processor architecture according to an embodiment of the present invention;

[0040] Figure 2 This is a schematic diagram of a fault detection data path according to an embodiment of the present invention;

[0041] Figure 3 This is a schematic diagram of a front-end fault handling module according to an embodiment of the present invention;

[0042] Figure 4 This is a schematic diagram of the back-end control signal data path according to an embodiment of the present invention;

[0043] Figure 5 This is a timing diagram illustrating the fault handling of a decoding-level pipeline according to an embodiment of the present invention;

[0044] Figure 6 This is a schematic diagram illustrating a data conflict example and a "virtual write-back" fault tolerance mechanism according to an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the invention.

[0046] Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the invention, and should not be construed as limiting the invention.

[0047] The following describes a fault handling method based on a dual-core lockstep processor according to an embodiment of the present invention, with reference to the accompanying drawings.

[0048] Figure 1 This is a schematic diagram of a superscalar dual-core lockstep processor architecture according to an embodiment of the present invention.

[0049] like Figure 1 As shown, the superscalar dual-core lockstep processor architecture includes: master and slave processor prototypes (corresponding to the master and slave modules in the figure), a fault detection module, a front-end fault handling module, and a back-end fault handling module based on "virtual write-back".

[0050] In the aforementioned superscalar dual-core lockstep processor architecture, the master and slave processor prototypes function to receive the same input, execute the same computational processes, and produce their respective outputs at each stage of the pipeline. This invention does not directly copy the entire processor core, but rather copies the modules within the processor core, while keeping the external interfaces unchanged. This feature helps support inter-core interconnects, core-bus interconnects, and interconnects with peripherals, supporting system configurability and portability. Furthermore, not all modules need to be copied; the purpose of copying is for fault detection. Modules with a very low probability of being affected by soft errors do not need to be copied, thus reducing area overhead.

[0051] The fault handling method based on a dual-core lockstep processor of the present invention includes the following steps:

[0052] S1. Receive data from the last four stages of the pipeline through the fault detection module, and output a fault flag signal and a fault program pointer; the last four stages of the pipeline are the last four stages of the pipeline of the dual-core lockstep processor;

[0053] S2. Receive the fault flag signal and the fault program pointer through the front-end fault handling module, and complete the pipeline-level rollback;

[0054] S3. The backend fault handling module controls the handshake signals and selection signals of the last four pipeline stages, and executes the fault tolerance mechanism of virtual write-back, to manage the operating status of the last four pipeline stages and the instruction fetch stage pipeline.

[0055] Furthermore, in the above steps, the last four pipeline stages are, in sequence, a decoding pipeline, an execution pipeline, a memory access pipeline, and a write-back pipeline, and the instruction fetch stage pipeline is a second-stage instruction fetch pipeline.

[0056] In a preferred embodiment of this fault handling method, the fault detection module in step S1 is configured to receive data output from the master and slave processors in the last four stages of the pipeline and perform fault detection. The data output from the last four stages of the master and slave processor pipelines will enter the corresponding fault detection modules for each stage of the pipeline. If all outputs from the last four stages of the master and slave processor pipeline registers are the same, the master processor pipeline register data will be directly output to the next stage pipeline; otherwise, when the fault detection module detects a fault, it will cause the processor front-end and back-end to perform fault handling processes separately, and the data from the last four stages of the master and slave processor pipeline registers will not be output to the next stage. The comparison of the last four stages of the master and slave processor pipeline data and the output of the fault flag signal are completed in the same timing sequence, thus allowing the fault handling process to begin without waiting for an instruction to be executed to the write-back stage.

[0057] More specifically, the goal of fault detection circuits is to achieve rapid fault detection with a shorter critical path. For example... Figure 2 As shown, Figure 2 In the system, the faulty PC corresponds to the fault program pointer, and the checker corresponds to the fault detection module. Key signals related to functional safety from the last four pipeline stages of the master and slave processors are input into a set of XOR gates for bit-by-bit comparison. The output of the XOR gates is a fault flag signal, which controls the branch jump of the control instruction and the transmission of data to the next pipeline stage. Simultaneously, it outputs the fault program pointer, which points to the address where the fault occurred in the last four pipeline stages of the master and slave processors.

[0058] Furthermore, fault flag signals from different pipeline stages, carrying fault information with different priorities, enter the multiplexer in the front-end fault handling module. The fault information includes fault flag signals and fault program pointers. These fault flag signals are also fed into the fault counter in the multiplexer of the front-end fault handling module, and the fault counter is activated. If the fault duration exceeds the tolerable threshold set by the fault counter, it will trigger a reset signal to reset the system.

[0059] As a preferred embodiment of this fault handling method, the function of the front-end fault handling module in step S2 is to pass the value of the fault program pointer corresponding to the faulty pipeline into the program pointer register, so that the pipeline can start to execute fault handling from the first stage pipeline according to the value of the fault program pointer, and refresh the pipeline at the same time to ensure that the faulty instruction and the instructions after the fault will not run to the stage that requires writing to registers, storage and peripherals.

[0060] In the aforementioned front-end fault handling module, besides the functions described above, this invention does not construct a dedicated circuit module for implementing rollback. Instead, it combines rollback with branch jumps and branch prediction, treating rollback as a "pseudo" branch jump instruction. The comparison of data in the last four stages of the master and slave processor pipelines and the program rollback are completed in the same timing sequence. However, unlike conventional branch jump (J-type) instructions, faults caused by soft errors are random and unpredictable. Therefore, rollback must be implemented through forced branch jumps and pipeline flushing. Flushing is achieved by outputting a missing flag signal through the branch target buffer (BTB). This design scheme can meet the requirements of fast rollback at the pipeline level while also saving area overhead.

[0061] Furthermore, as a preferred embodiment of this fault handling method, the front-end fault handling module in step S2 includes a first front-end fault handling module and a second front-end fault handling module. The first front-end fault handling module is configured in the first-stage PC-level pipeline of the dual-core lockstep processor, and the second front-end fault handling module is configured in the second-stage instruction fetch pipeline of the dual-core lockstep processor.

[0062] As a preferred embodiment of this fault handling method, step S2, which is the step of receiving the fault flag signal and the fault program pointer through the front-end fault handling module and completing the pipeline-level rollback, specifically includes:

[0063] S201. Obtain the corresponding fault instruction through the front-end fault processing module according to the fault program pointer;

[0064] S202. The program pointer of the next instruction of the fault instruction is output through the first front-end fault processing module and branch prediction is performed;

[0065] S203. The fault program pointer is output to the instruction buffer through the second front-end fault handling module;

[0066] S204. Based on the output of the first front-end fault handling module, perform a branch jump through the first-level PC-level pipeline;

[0067] S205. Based on the output of the second front-end fault handling module, perform a branch jump through the second-level instruction fetch pipeline.

[0068] Furthermore, in this embodiment, the first-stage PC-level pipeline and the second-stage instruction fetch pipeline of the dual-core lockstep processor also include a branch prediction module, which performs the branch prediction function.

[0069] Furthermore, in step S202, the front-end fault handling module requires the processor's first-stage PC-level pipeline to output the program pointer of the instruction following the faulty instruction and perform branch prediction. The PC-level pipeline's Branch Target Buffer (BTB) outputs two signals: a branch prediction hit flag and the predicted program pointer. To achieve the required pipeline-level rollback, it is necessary to provide the fault flag signal with a higher priority than the jump flag and hit flag. To avoid affecting the branch prediction module's judgment, the refresh flag signal generation module is configured outside the BTB, rather than participating in the generation of the hit flag signal.

[0070] Furthermore, in step S203, the front-end fault handling module also needs the fault program pointer of the faulty instruction output from the processor's second-stage fetch pipeline to the instruction buffer. Therefore, if a fault occurs, it is necessary to immediately jump to the fault program pointer of the faulty instruction. Thus, the fault flag signal output by the fault detection module and the value of the fault program pointer are sent to the multiplexer of the front-end fault handling module in the second-stage fetch pipeline. Due to the characteristics of a dual-issue processor, the jump PC here will be processed as a one-byte aligned PC value. In the event of a fault, the fault program pointer from the fault detection module will have a higher priority than the branch PC and the sequential execution PC. In this way, the processor can quickly update the state of the first two pipeline stages each time a fault is encountered. The front-end fault handling module designed based on the above design principles is as follows: Figure 3 As shown.

[0071] In this embodiment, the front-end fault handling module includes a priority arbitrator. Before executing step S201, the priority of the fault procedure pointer must be determined according to the arbitration rules of the priority arbitrator. The arbitration rules of the priority arbitrator include:

[0072] Different branch jump priorities are corresponding to fault handling at different stages of the pipeline.

[0073] The faulty program pointer corresponding to the faulty instruction has a higher priority than the program pointer corresponding to the program branch jump instruction.

[0074] The program pointer of a subsequent pipeline failure has a higher priority than that of the preceding pipeline.

[0075] System reset has a higher priority than pipeline-level rollback.

[0076] In a preferred embodiment of this fault handling method, the back-end fault handling module described in step S3 ensures that the fault does not propagate to registers, memory, and peripherals, preventing the use of incorrect registers or stored information in subsequent instructions, thus avoiding indirect secondary propagation of the fault. This module uses handshake and selection signals to manage data transmission in the decoding, execution, memory access, write-back, and instruction fetch pipelines, simulating the processor's operating state during branch jump instruction execution.

[0077] As a preferred embodiment of this fault handling method, step S3, which is the step of controlling the handshake signals and selection signals of the last four pipeline stages and implementing the virtual write-back fault tolerance mechanism through the backend fault handling module to manage the operating status of the last four pipeline stages and the instruction fetch stage pipeline, specifically includes:

[0078] S301. In response to the handshake signal, control the data transmission during the instruction fetching and decoding stages;

[0079] S302. In response to the selection signal, control the data transmission of the subsequent three pipeline stages.

[0080] In steps S301 and S302 above, the handshake signal and the selection signal are communicated via, as follows: Figure 4 The data path shown is transmitted such that when the handshake signal and the select signal are low, the two pipeline stages affected by the signals will repeatedly execute the instructions executed in the previous clock cycle. This implementation process is actually equivalent to simulating the operation mode of branch jump instructions.

[0081] Furthermore, the handshake signal described in step S301 controls the data transmission during the instruction fetch and decoding stages in the form of timing logic. For example, the fault handling timing diagram occurring during the decoding stage is as follows: Figure 5 As shown, Figure 5In this system, the master module corresponds to the master processor, and the slave module corresponds to the slave processor. "Channel 0_pc" and "Channel 1_pc" represent the PC values ​​corresponding to a pair of instructions executed in parallel, which can also be considered as the instructions themselves. "Read master module register data" and "Read slave module register data" refer to data from the same register read simultaneously by the master and slave cores during the decoding phase. In clock cycle T0, the instruction executed during the decoding phase is the PC. A discrepancy between "Read master module register data" and "Read slave module register data" indicates a system fault. Within the same cycle, the fault flag signal is set high, and the instruction fetch pipeline jumps to the faulty instruction PC. Assuming the instruction PC is not a branch instruction, the PC-level pipeline will jump to the next instruction PC corresponding to the faulty instruction PC. To prevent secondary faults, the system sets the handshake signal low when jumping to the faulty instruction PC. When the handshake signal is active in clock cycle T1, the same instruction will be executed repeatedly during the decoding phase. Assuming the fault has been successfully corrected ("Read Master Module Register Data" = "Read Slave Module Register Data"), the "Select 1" signal is active in the decode and execute pipelines, executing the same instructions as in the previous cycle. In clock cycle T2, the "Select 1" signal is active during memory access and execution. Simultaneously, the corrected data is transferred from the decode stage to the execute stage, and the processor returns to its correct state. In this way, the processor can correct the fault within a few clock cycles.

[0082] Furthermore, the selection signals described in step S302 control data transfer in the latter three pipeline stages using combinational logic. Fault handling in the execution, memory access, or write-back pipeline stages at the processor backend is more complex. Although the "select 1" and "select 2" signals help latch data and addresses in the memory management unit (MMU) without polluting memory for memory access instructions, these signals do not prevent data from being written back to registers, which can lead to data conflicts. In this embodiment, a common conflict is as follows: Figure 6 The data transfer process is shown on the left. In the initial stage, a fault occurred in the execution-level pipeline. 0x80000588+4 was written to the ra register, overwriting the data originally stored there. This was because the store word (sw) instruction and the jump and link (jal) instruction were executed in parallel. Simultaneously, due to a pipeline-level rollback by the processor, the decode stage was executing sw, and the value read from the ra register by this instruction was exactly the data written back to the register by the jal instruction. Therefore, the final data written to memory was 80000588+4, which is another fault resulting from the conflict.

[0083] In a preferred embodiment of this fault handling method, the backend fault handling module in step S3 executes a "virtual write-back" fault tolerance mechanism, which is used to resolve faults arising from conflicts. Unlike traditional solutions that prevent faults from arising by saving the current state, the "virtual write-back" fault tolerance mechanism avoids the significant area and time overhead caused by saving the current state.

[0084] In this embodiment, the virtual write-back fault-tolerance mechanism executed by the backend fault handling module is a method of sending data into a read-only register without pausing the processor. This virtual write-back fault-tolerance mechanism allows the processor to send data into a read-only register without interrupting the pipeline or saving the context when a fault occurs. As is well known, the RISC-V instruction set architecture (RISC-V ISA) specifies that the register at address 0 is a read-only register and always stores 0. In the event of a fault, both the address and data of both channels are directly set to 0. In this way, the decode-level pipeline will be able to read the correct value stored in the overwritten register. In fact, writing any data to the register at address 0 is feasible, but writing 0 is the most power-efficient method. Therefore, fault handling is equivalent to... Figure 6 The three instructions in the code are highlighted in gray. Fault handling during memory access and write-back phases also utilizes virtual write-back to prevent the cascading of faults. However, the scope of virtual write-back is expanded to extend from the faulty pipeline stage to the execution-level pipeline. Based on the virtual write-back fault-tolerance mechanism, the processor does not need to interrupt the pipeline, nor does it need to save the register context to another copy of the register file during fault handling, significantly reducing the time and area overhead of the dual-core lockstep architecture.

[0085] In summary, the fault handling method based on a dual-core lockstep processor of the present invention has the following advantages and beneficial effects compared with the prior art:

[0086] (1) Compared with traditional processor-based fault handling methods, the dual-core lockstep processor based on pipeline level rollback proposed in this invention is superscalar. Currently, there is no design that can implement a dual-core lockstep architecture with pipeline level rollback based on a superscalar processor.

[0087] (2) Compared with traditional processor-based fault handling methods, the present invention does not require interruption or suspension of the pipeline during fault handling. Instead, it treats the fault as a mandatory branch jump instruction, thereby achieving fast and fine-grained pipeline-level rollback.

[0088] (3) Compared with traditional processor-based fault handling methods, this invention proposes a virtual write-back fault tolerance mechanism to replace saving the context. During program execution, there is no need to continuously save the context, and there is no need to restore the context when a fault occurs, which greatly saves area overhead.

[0089] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0090] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0091] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A fault handling method based on a dual-core lockstep processor, wherein the dual-core lockstep processor comprises a master processor and a slave processor, characterized in that, The fault handling method based on a dual-core lockstep processor includes the following steps: The fault detection module receives data from the last four stages of the pipeline and outputs a fault flag signal and a fault program pointer; the last four stages of the pipeline are the last four stages of the pipeline of the dual-core lockstep processor. The front-end fault handling module receives the fault flag signal and the fault program pointer to complete the pipeline-level rollback. The backend fault handling module controls the handshake and selection signals of the last four pipeline stages and executes the fault tolerance mechanism of virtual write-back, thereby managing the operating status of the last four pipeline stages and the instruction fetch stage pipeline. The front-end fault handling module includes a first front-end fault handling module and a second front-end fault handling module; the first front-end fault handling module is configured in the first-stage PC-level pipeline of the dual-core lockstep processor; the second front-end fault handling module is configured in the second-stage instruction fetch pipeline of the dual-core lockstep processor. The step of receiving the fault flag signal and the fault program pointer through the front-end fault handling module to complete the pipeline-level rollback specifically includes: Based on the fault program pointer, the corresponding fault instruction is obtained through the front-end fault processing module; The first front-end fault handling module outputs the program pointer of the next instruction after the fault instruction and performs branch prediction. The fault program pointer is output to the instruction buffer through the second front-end fault handling module; Based on the output of the first front-end fault handling module, branch jump is executed through the first-level PC-level pipeline; Based on the output of the second front-end fault handling module, branch jump is executed through the second-level instruction fetch pipeline; The handshake signal is controlled using sequential logic; the selection signal is controlled using combinational logic. The step of managing the operational status of the last four pipeline stages and the instruction fetch stage pipeline by controlling the handshake and selection signals of the backend fault handling module and executing the virtual write-back fault tolerance mechanism specifically includes: In response to the handshake signal, control the data transmission during the instruction fetching and decoding phases; In response to the selection signal, data transmission in the subsequent three stages of the pipeline is controlled.

2. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, The last four stages of the pipeline are, in order, the decoding stage pipeline, the execution stage pipeline, the memory access stage pipeline, and the write-back stage pipeline.

3. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, Also includes: The fault program pointer is passed to the program pointer register through the front-end fault handling module. Based on the value of the fault procedure pointer, the front-end fault handling module performs fault handling and refreshes the pipeline starting from the first-level pipeline.

4. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, The step of receiving the fault flag signal and the fault program pointer through the front-end fault handling module to complete the pipeline-level rollback also includes: Fault information of different priorities is obtained based on the fault flag signals from different pipeline stages; the fault information includes the fault flag signals and the fault procedure pointer. The fault flag signal is received by the multiplexer of the front-end fault processing module and the fault timer is started. When the duration of the fault exceeds the tolerable threshold set by the fault timer, a reset signal is triggered to reset the system.

5. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, The first-stage PC-level pipeline and the second-stage instruction fetching pipeline also include a branch prediction module; The branch prediction function is executed through the branch prediction module.

6. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, The front-end fault handling module includes a priority arbitrator; Before the step of obtaining the corresponding fault instruction through the front-end fault processing module according to the fault procedure pointer, the priority of the fault procedure pointer is determined according to the arbitration rules of the priority arbitrator.

7. A fault handling method based on a dual-core lockstep processor according to claim 6, characterized in that, The arbitration rules of the priority arbitrator include: Different branch jump priorities are corresponding to fault handling at different stages of the pipeline. The faulty program pointer corresponding to the faulty instruction has a higher priority than the program pointer corresponding to the program branch jump instruction. The program pointer of a subsequent pipeline failure has a higher priority than that of the preceding pipeline. System reset has a higher priority than pipeline-level rollback.

8. The fault handling method based on a dual-core lockstep processor according to claim 1, characterized in that, The virtual write-back fault-tolerance mechanism allows the processor to send data into a read-only register without interrupting the pipeline or saving the context when a fault occurs.

Images