Dual-core fault-tolerant system based on risc-v architecture

Abstract

The application discloses a dual-core fault-tolerant system based on a RISC-V architecture, which comprises a first processor core, a second processor core, an instruction tightly coupled memory, a data tightly coupled memory, a plurality of bus matrix modules, an interrupt controller, external equipment and a bus, and a plurality of error checking and correction modules; the first processor core and the second processor core are connected with the same bus matrix module, at least one bus matrix module is connected with the instruction tightly coupled memory, at least one bus matrix module is connected with the data tightly coupled memory, at least one bus matrix module is connected with the bus, at least one bus matrix module is connected with the interrupt controller, the interrupt controller and the external equipment are connected with the bus, and the instruction tightly coupled memory and the data tightly coupled memory are each provided with an error checking and correction module.

Description

Technical Field

[0001] This invention belongs to the field of digital integrated circuit technology, specifically relating to a dual-core fault-tolerant system based on the RISC-V architecture. Background Technology

[0002] With the rapid development of the new energy vehicle industry, the electrification and intelligence of automobiles have been greatly accelerated. Among them, the control system, power system and almost all driver assistance systems of automobiles integrate a large number of semiconductor chips. However, environmental radiation and other factors can cause momentary failures in the chips, known as soft errors, which pose a challenge to the reliability of the chips.

[0003] In related technologies, fault-tolerant technology, as a safety-critical computer technology, ensures the normal operation of the processor through dual-mode or multi-mode redundancy. Compared with triple-mode redundancy, dual-mode redundancy makes fault detection and handling more difficult, but due to its smaller size and relatively lower cost, it is currently widely used in the field of automotive safety control. Dual-mode redundancy refers to a processor consisting of two cores that execute the same program in unison, also known as a dual-core lockstep system. The dual-core lockstep structure improves reliability from a circuit design perspective by comparing the outputs of the two cores to determine if a circuit fault has occurred. Different responses are made based on the fault type to restore the system to a normal state, typically used in safety-critical fields. Currently, common dual-core lockstep structures usually compare the core outputs and periodically save the context to memory by adding checkpoints. Its disadvantage is that the fault may have already occurred within the core; reducing fault recovery time requires increasing the number of checkpoints and frequently saving context information, leading to high memory overhead and reduced performance, making it unsuitable for applications with high real-time requirements.

[0004] Therefore, it is urgent to improve the defects existing in the current technology. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a dual-core fault-tolerant system based on the RISC-V architecture. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] In a first aspect, the present invention provides a dual-core fault-tolerant system based on a RISC-V architecture, comprising:

[0007] The system includes a first processor core, a second processor core, instruction tightly coupled memory, data tightly coupled memory, multiple bus matrix modules, an interrupt controller, external devices and buses, and multiple error checking and correction modules.

[0008] Both the first processor core and the second processor core are connected to the same bus matrix module. At least one bus matrix module is connected to the instruction tightly coupled memory, at least one bus matrix module is connected to the data tightly coupled memory, at least one bus matrix module is connected to the bus, and at least one bus matrix module is connected to the interrupt controller. The interrupt controller and external devices are all connected to the bus. Both the instruction tightly coupled memory and the data tightly coupled memory are equipped with an error checking and correction module.

[0009] When the first processor core and the second processor core write data to an external device through the bus, the corresponding bus matrix module compares the output data of the first processor core and the output data of the second processor core to ensure that the output data of the first processor core and the output data of the second processor core are the same before writing to the external device; when the first processor core and the second processor core read data from an external device through the bus, the corresponding bus matrix module divides the external device data into two parts and inputs them into the first processor core and the second processor core respectively.

[0010] The beneficial effects of this invention are:

[0011] This invention provides a dual-core fault-tolerant system based on the RISC-V architecture, including pipeline-level fault detection capabilities and a register file ECC hardening strategy. It eliminates the need for context saving and recovery of register resources, which not only greatly reduces fault detection and recovery time but also makes the impact on performance negligible. In addition, due to the tightly coupled fault-tolerant structure, the memory, interrupt controller, and peripherals are shared by both cores, resulting in a small area overhead for the entire fault-tolerant system and a significant cost advantage.

[0012] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of a dual-core fault-tolerant system based on the RISC-V architecture provided in an embodiment of the present invention;

[0014] Figure 2 This is a schematic diagram of the internal structure of the first processor core and the second processor core provided in an embodiment of the present invention;

[0015] Figure 3 This is a schematic diagram illustrating the principle of the error checking and correction module provided in an embodiment of the present invention;

[0016] Figure 4 This is a schematic diagram of the fault tolerance parameters provided in an embodiment of the present invention;

[0017] Figure 5 This is a schematic diagram of a pipeline-level fault detection provided in an embodiment of the present invention;

[0018] Figure 6 This is a schematic diagram of a production line flushing provided in an embodiment of the present invention;

[0019] Figure 7 This is a schematic diagram of a fatal fault detection method provided in an embodiment of the present invention. Detailed Implementation

[0020] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0021] Please see Figure 1 As shown, Figure 1 This is a schematic diagram of a dual-core fault-tolerant system based on the RISC-V architecture provided in an embodiment of the present invention. The dual-core fault-tolerant system based on the RISC-V architecture provided by the present invention includes: a first processor core, a second processor core, an instruction tightly coupled memory, a data tightly coupled memory, multiple bus matrix modules, an interrupt controller, external devices and buses, and multiple error checking and correction modules.

[0022] Both the first processor core and the second processor core are connected to the same bus matrix module. At least one bus matrix module is connected to the instruction tightly coupled memory, at least one bus matrix module is connected to the data tightly coupled memory, at least one bus matrix module is connected to the bus, and at least one bus matrix module is connected to the interrupt controller. The interrupt controller and external devices are all connected to the bus. Both the instruction tightly coupled memory and the data tightly coupled memory are equipped with an error checking and correction module.

[0023] When the first processor core and the second processor core write data to an external device through the bus, the corresponding bus matrix module compares the output data of the first processor core and the output data of the second processor core to ensure that the output data of the first processor core and the output data of the second processor core are the same before writing to the external device; when the first processor core and the second processor core read data from an external device through the bus, the corresponding bus matrix module divides the external device data into two parts and inputs them into the first processor core and the second processor core respectively.

[0024] For details, please continue to see Figure 1As shown, this embodiment provides a dual-core fault-tolerant system based on the RISC-V architecture, including two 32-bit, 5-stage pipelined RISC-V processor cores, namely the first processor core and the second processor core. The first and second processor cores have the same structure, and the second processor core is a redundant core of the first processor core, namely the Redundant CPU. It also includes an instruction tightly coupled memory (ITCM) with a data width of 64 bits and a data tightly coupled memory (DTCM) with a data width of 32 bits. Both the instruction tightly coupled memory and the data tightly coupled memory are equipped with error checking and correction modules (ECC). The first and second processor cores share the instruction tightly coupled memory and the data tightly coupled memory. It also includes multiple bus matrix modules. The first and second processor cores access the shared memory, interrupt controller (PLIC, CLIC), and external devices through the System Bus. This configuration can minimize the area consumption of the dual-core fault-tolerant system, and the first and second processor cores execute strictly synchronously, with both cores accessing external devices through the bus matrix modules.

[0025] In this embodiment, when the two processor cores write data to an external device via the bus, the bus matrix module can constantly compare the output data of the two processor cores to determine if there are any errors. If there are no errors, the output data is written as a set. When the two processor cores read data from an external device via the bus, the module determines if there are any errors. If there are no errors, the bus matrix module can divide the read data into two parts and send them to the two processor cores. Thus, the dual-core fault-tolerant system provided in this embodiment only copies the processor cores and not the memory, interrupt controller, and external devices, minimizing area consumption. Furthermore, the two processor cores execute strictly synchronously, allowing for different constraints to be applied to the two processor cores during synthesis and layout design, reducing the probability of common-cause failures and improving the fault detection rate.

[0026] It should be noted that, Figure 1 The embodiments shown are merely schematic representations of the positions and connections of modules in a dual-core fault-tolerant system and do not represent their actual positions and connections.

[0027] In an optional embodiment of the present invention, please refer to Figure 2 As shown, Figure 2 This is a schematic diagram of the internal structure of the first processor core and the second processor core provided in an embodiment of the present invention. The first processor core includes a first register file group, and the first register file group is correspondingly configured with a first error checking and correction module.

[0028] The second processor core includes a second register file group, which corresponds to the second error checking and correction module.

[0029] For details, please continue to see Figure 2 As shown in this embodiment, considering that the first processor core and the second processor core need to constantly compare whether the pipeline time data is the same, a first error checking and correction module is provided for the first register file group, and a second error checking and correction module is provided for the second register file group. The ECC module can correct any single-bit error and detect any double-bit error, which can greatly improve the reliability of the memory.

[0030] In this embodiment, please continue to refer to Figure 2 As shown, if the data between the pipelines of the first and second processor cores are different, it indicates a fault. Simply re-execute the current pipeline's Program Counter (PC) value, as soft faults typically only cause bit flips in registers, and re-executing the instruction will overwrite the previous error. If multiple levels of faults exist, an arbitration mechanism is needed to determine the priority and thus the final flush PC value. Furthermore, this embodiment provides a checkpoint-based rollback mechanism for recovering from CSR register faults. Undetected faults will cause program errors, and a watchdog timeout reset can be performed in the final step.

[0031] Please see Figure 3 As shown, Figure 3 This is a schematic diagram illustrating the principle of the error checking and correction module provided in this embodiment of the invention. The error checking and correction module includes an encoder and a decoder. The encoder is placed at the data input port of the memory, and the decoder is placed at the data output port of the memory. When the processor needs to write data, the input data `data_in` is encoded by the encoder to generate a check bit `code`, and then the input data and the check bit are written together into the memory. When the processor needs to read data, it simultaneously reads the check bit, and the decoder determines whether a bit flip has occurred during data storage. The ECC module can correct any single-bit error and detect any double-bit error. For more errors, ECC cannot detect them, but in most cases, memory devices typically only experience a single-bit error. The ECC module can significantly improve the reliability of on-chip memory.

[0032] In the above embodiments, the ECC protection mechanism is used for the register file, which can determine whether a soft error has occurred in the register file. When only one multi-bit error occurs, the value read from another core can be selected, which greatly improves the fault tolerance of the processor and avoids the disadvantage of long fault detection time caused by the use of checkpoint and rollback mechanisms.

[0033] In an optional embodiment of the present invention, please continue to refer to Figure 2 As shown, both the first register file group and the second register file group include a data width of 39 bits, of which 39 bits of data width includes 7 bits of error correction code.

[0034] In an optional embodiment of the present invention, please continue to refer to Figure 2 As shown, both the first error checking and correction module and the second error checking and correction module include an encoder and two decoders;

[0035] When writing data back, both the first and second processor cores use an encoder for encoding. When reading data, they use two decoders for decoding. For more details, please refer to [link to relevant documentation]. Figure 2 As shown in this embodiment, for a RISC-V architecture processor with the instruction set RV32IMAC, a 32-bit register file is required. This register file includes two read ports and one write port, where register 0 is fixed at 0. Unlike the registers in the pipeline, the register file contains 32 registers, and a maximum of two registers are read per cycle. If soft errors occur in other registers during operation, they cannot be detected in time, ultimately leading to unrecoverable failures. The conventional approach is to periodically save the data in the register file to memory and recover it when errors occur, but this method has excessive time overhead. In view of this, this embodiment implements ECC error correction for the register file, setting a data width of 39 bits, including 7 bits of error correction code. Encoding is performed during write-back, and decoding is performed on the two read ports during read-out, achieving one-to-two correction and two-to-correction. If there are no multi-bit errors, each processor core uses the read data; if only one processor core has an error, the value read from the other processor core is used. The probability of simultaneous errors is small and can be ignored. In this way, by using the ECC protection mechanism on the register file, it is possible to determine whether a soft error has occurred in the register file. When only one multi-bit error occurs, the value read from another core can be selected, which greatly improves the fault tolerance of the processor and avoids the disadvantage of long fault detection time caused by the use of checkpoint and rollback mechanisms.

[0036] In an optional embodiment of the present invention, please refer to Figure 4 and Figure 5 As shown, Figure 4This is a schematic diagram of the fault tolerance parameters provided in an embodiment of the present invention. Figure 5 This is a schematic diagram of pipeline-level fault detection provided in an embodiment of the present invention. Both the first processor core and the second processor core are 5-stage pipeline architectures. Both the first processor core and the second processor core include instruction fetch, decode, execute, memory access and write-back stages. Pipeline registers are set in adjacent stages, including 4-stage pipeline registers. Each stage pipeline register stores the current pipeline value corresponding to the current instruction.

[0037] In each clock cycle, the valid information of the pipeline register in the first processor core and the pipeline register in the second processor core are compared. If they are different, a corresponding pipeline error flag is generated and a pipeline flushing operation is performed.

[0038] Specifically, in this embodiment, please continue to refer to Figure 4 As shown, fault tolerance parameters include fault detection time and fault recovery time. Fault-tolerant systems need to minimize these two parameters to achieve high real-time performance. Most faults do not actually affect the processor's execution results. Premature detection and handling can lead to reduced processor performance, but the probability of a fault occurring is very small. For the pipeline-level sensitive fault detection mechanism proposed in this embodiment, the impact of premature detection on performance is negligible because its fault recovery time is very fast, generally not exceeding a few clock cycles.

[0039] In this embodiment, please refer to Figure 5As shown, both the first and second processor cores are classic 5-stage pipelined architectures, including five stages: instruction fetch, decode, execute, memory access, and write-back. Pipeline registers are set up in adjacent data processing stages. The four pipeline registers are represented by stages followed by numbers, namely stage1, stage2, stage3, and stage4. Each pipeline register stores the current pipeline value corresponding to the current instruction. At each clock cycle, the valid information of the current pipeline register is compared by the pipeline checker. If a difference is found, a corresponding pipeline error flag is generated. It is only necessary to re-execute the instruction corresponding to the current pipeline PC. This is called pipeline flush. Since soft faults usually only cause bit flips in the register, re-execution of the instruction will overwrite the previous error. For instructions with single-cycle execution and write-back, if a failure occurs during the write-back phase, re-execution requires 5 cycles. Soft faults are immediately exposed in the pipeline stage, while fault recovery only requires approximately a few clock cycles, depending on the specific instruction. If multiple faults and jump instructions cause pipeline flushing, their priorities need to be considered. In the above embodiment, the use of pipeline-level fault detection methods combined with a pipeline flushing mechanism significantly reduces fault detection and recovery time. The entire process generally does not exceed 10 clock cycles, improving the reliability of dual-core fault-tolerant systems.

[0040] It should be noted that, please continue to refer to... Figure 5 As shown, pipelines in the first and second processor cores are a technique used to improve instruction execution efficiency by dividing the instruction execution process into multiple stages, each of which can execute different instructions. In this way, the first and second processor cores can execute multiple instructions in the same clock cycle, thereby improving overall throughput and performance.

[0041] 1. Instruction Fetch (IF): Fetch the next instruction from the instruction memory.

[0042] 2. Instruction Decode (ID): Decode the instruction to determine its type and operands.

[0043] 3. Execution (EX): The operation of executing instructions, which may include arithmetic and logical operations, memory access, etc.

[0044] 4. Memory Access (MEM): If an instruction needs to access memory, perform a memory read / write operation.

[0045] 5. Write Back (WB): Writes the execution result back to the register file or memory.

[0046] Each stage has its own function and task. Through a pipeline approach, different instructions can be executed simultaneously in different stages. When an instruction moves to the next stage, the previous stage can begin executing the next instruction, thus achieving instruction-level parallelism.

[0047] In an optional embodiment of the present invention, please refer to Figure 6 As shown, Figure 6 This is a schematic diagram of pipeline flushing provided in an embodiment of the present invention. When the valid information of the pipeline registers in multiple first processor cores and pipeline registers in the second processor cores are different, an arbitration mechanism is used to determine the priority and determine the current pipeline PC value corresponding to the current instruction to be jumped to.

[0048] For details, please continue to see Figure 6 As shown, this embodiment addresses the pipeline flushing problem when multiple pipeline stages have errors. Considering the extreme case where several pipeline stages have errors simultaneously, an arbitration mechanism (FaultArbiter) is used to determine priority. The PC value flushed should be from the later pipeline stage, as the later pipeline stage is the first instruction executed. This processor employs a static branch prediction strategy, predicting that a jump is needed for a subsequent jump, otherwise it is predicted not to jump. Conditional jump instructions calculate their jump results during execution. If the result differs from the prediction, pipeline flushing is required. Therefore, if a jump instruction exists and pipeline flushing is required, and if the st1_error signal also occurs, the flushed PC should be the PC value calculated by the jump instruction; otherwise, the instruction will jump to an incorrect address, causing a program error. If the st2_error signal also occurs, the jump instruction's calculation result comes from the stage 2 register, and the jump instruction itself is executed again. For the other two cases, the PC value registered in the current stage is executed. Based on the description of the above embodiments, soft errors existing in pipeline registers can be quickly detected and resolved.

[0049] In an optional embodiment of the present invention, please refer to Figure 7 As shown, Figure 7 This is a schematic diagram of a fatal fault detection provided in an embodiment of the present invention, and also includes: a hash operation module, with the same hash operation module set for each pipeline register;

[0050] During the first pipeline flushing operation, the current pipeline PC value flushed is processed by the hash operation module to compress the bit width and then saved to the register.

[0051] During the second pipeline flushing operation, the current pipeline PC value is compared with the pipeline PC value stored in the register from the previous flush. If they are the same, the counter is incremented by 1. When the counter value reaches the threshold, it is determined to be a fatal fault.

[0052] For details, please continue to see Figure 7 As shown, in this embodiment, for each pipeline flush caused by a pipeline fault, the PC value is hashed and compressed in bit width before being stored in a register. This method can reduce memory resources. When a new fault occurs, the results are compared. If the two PC values ​​are the same, the counter is incremented by 1; otherwise, it is set to 0. When a certain threshold is reached, it indicates a fatal fault. If a fatal fault exists in the pipeline stage, repeated flushing will not mask the fault, and the system will repeatedly execute the same instructions. This embodiment can detect this situation, and for fatal faults, the system decides whether to reset the system or execute specific safety code.

[0053] In this embodiment, a pipeline-level fault detection method is adopted in conjunction with a pipeline flushing mechanism, which greatly reduces the fault detection time and fault recovery time. The entire process generally does not exceed 10 clock cycles, which can meet the requirements of a high-reliability critical real-time system.

[0054] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0055] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0056] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A dual-core fault-tolerant system based on RISC-V architecture, characterized in that, include: The system includes a first processor core, a second processor core, instruction tightly coupled memory, data tightly coupled memory, multiple bus matrix modules, an interrupt controller, external devices and buses, and multiple error checking and correction modules. The first processor core and the second processor core are both connected to the same bus matrix module. At least one bus matrix module is connected to the instruction tightly coupled memory. At least one bus matrix module is connected to the data tightly coupled memory. At least one bus matrix module is connected to the bus. At least one bus matrix module is connected to the interrupt controller. The interrupt controller and the external device are both connected to the bus. Each instruction tightly coupled memory and the data tightly coupled memory is provided with an error checking and correction module. When the first processor core and the second processor core write data to the external device through the bus, the corresponding bus matrix module compares the output data of the first processor core and the output data of the second processor core to ensure that the output data of the first processor core and the output data of the second processor core are the same before writing to the external device; when the first processor core and the second processor core read data from the external device through the bus, the corresponding bus matrix module divides the external device data into two parts and inputs them into the first processor core and the second processor core respectively. The first processor core includes a first register file group, and the first register file group is configured with a first error checking and correction module; the second processor core includes a second register file group, and the second register file group is configured with a second error checking and correction module. Both the first processor core and the second processor core are 5-stage pipelined architectures. Both the first processor core and the second processor core include fetch, decode, execute, memory access, and write-back stages. Pipeline registers are set in adjacent stages, including 4-stage pipeline registers. Each stage pipeline register stores the current pipeline PC value corresponding to the current instruction. In each clock cycle, the valid information of the pipeline registers in the first processor core and the pipeline registers in the second processor core are compared. If they are different, a corresponding pipeline error flag is generated, and a pipeline flushing operation is performed. When the valid information of the pipeline registers in the first processor core and the pipeline registers in the second processor core are different, and there are multiple differences, an arbitration mechanism is used to determine the priority and to determine the current pipeline PC value corresponding to the current instruction to be jumped to.

2. The dual-core fault-tolerant system based on RISC-V architecture according to claim 1, characterized in that, Both the first register file group and the second register file group include a data width of 39 bits, of which 39 bits include 7 bits of error correction code.

3. The dual-core fault-tolerant system based on RISC-V architecture according to claim 1, characterized in that, Both the first error checking and correction module and the second error checking and correction module include an encoder and two decoders; When writing back data, the first processor core and the second processor core perform encoding operations through the encoder; when reading back data, the first processor core and the second processor core perform decoding operations through the two decoders.

4. The dual-core fault-tolerant system based on RISC-V architecture according to claim 1, characterized in that, Also includes: The hash operation module is configured in each pipeline register. During the first pipeline flushing operation, the current pipeline PC value flushed is processed by the hash operation module to compress the bit width and then saved to the register. During the second pipeline flushing operation, the current pipeline PC value is compared with the pipeline PC value stored in the register from the previous flush. If they are the same, the counter is incremented by 1; otherwise, it is set to 0. When the counter value reaches the threshold, it is determined to be a fatal fault.

Images