High-reliability processor dual-core lock step control and processing device and method

Abstract

The invention provides a high-reliability processor dual-core lockstep control and processing device and method.A lockstep controller processing unit in the device receives a processor check point operation request, a lockstep controller comparison unit outputs a mismatching signal, outputs a check point operation interruption request and a rollback operation interruption request; the error control module is used for controlling and processing errors; the lockstep controller register module is used for configuring behaviors of the dual-core lockstep control and processing device by software; and the lock step controller monitoring unit is used for receiving the operation request signal and processing the operation signal, and is used for monitoring the behavior of the lock step controller processing unit and ensuring the normal work of the lock step controller processing unit. According to the technical scheme, high-reliability lock step control and processing of the dual-core lock step processor combining the check point and the rollback strategy are achieved through the dual-core lock step control and processing device of the processor, so that the system works in a safe state.

Description

Technical Field

[0001] The present invention relates to the technical field of dual-core lock-step processors, and in particular to a high-reliability processor dual-core lock-step control and processing device and method. Background Art

[0002] As transistor size decreases, microprocessors become less reliable and more susceptible to soft errors. Lockstep is a method to detect and mitigate soft errors based on processor redundancy. Dual-core lockstep requires running the same program on two identical processors, monitoring the outputs of the two processors to check for mismatches in processor results, and detecting processor failures in this way. Lockstep improves reliability by combining checkpoint and rollback operations. Checkpoint is a method of saving the processor state in a secure memory, and rollback is a method of restoring the processor state to a previously saved secure processor state.

[0003] Dual-core lockstep combined with checkpoint and rollback operations is a method of improving processor reliability by combining lockstep with checkpoint and rollback strategies at the software level. Currently, when performing checkpoint and rollback operations at the software level, they are affected by soft errors, which will lead to the preservation and recovery of the processor error state, thereby causing the processor to deadlock or cause the processor to enter an erroneous operating state; on the other hand, the processor is affected by soft errors and causes deadlock during operation; relying solely on checkpoint and rollback operations at the software level cannot handle errors in the above situations or ensure that the system runs in a safe state, that is, a state in which the system runs correctly and can correctly handle errors. Additional dual-core lockstep control and processing devices and methods are required to ensure the correctness of checkpoint and rollback operations and the high reliability of the system and dual-core lockstep control and processing devices. Summary of the invention

[0004] In order to solve at least one of the above technical problems existing in the prior art, an object of the present invention is to provide a high-reliability lockstep control and processing device based on dual-core lockstep of a processor.

[0005] The present invention discloses a high-reliability processor dual-core lock-step control and processing device, wherein the high-reliability processor dual-core lock-step control and processing device is connected to a lock-step controller comparison unit, and the high-reliability processor dual-core lock-step control and processing device comprises a lock-step controller processing unit;

[0006] The lockstep controller processing unit includes a processing state timer;

[0007] After receiving the operation request, the processing operation is output and the processing operation behavior is monitored. If the processing state timer reaches the threshold, the lock-step controller processing unit enters the failure state, the processing state timer is reset and stops working. If the processing state timer does not reach the threshold, wait for the processing operation to be completed;

[0008] The operation request includes a master-slave processor comparison mismatch signal issued by a lockstep controller comparison unit and a periodic checkpoint request signal issued by the processor;

[0009] The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation;

[0010] In the failed state, the lockstep controller processing unit outputs a system reset signal.

[0011] Furthermore, the high reliability processor dual core lockstep control and processing device includes a lockstep controller register module;

[0012] The lockstep controller register module includes a processing status register, a lockstep enable register and a processing status timer threshold register;

[0013] The processing status register is used to capture and store the operation request signal;

[0014] The lockstep enable register is used to control the behavior of the lockstep controller processing unit and the lockstep controller monitoring unit;

[0015] The processing state timer threshold register is the longest working time of the processing unit in the processing state, and the threshold should be smaller than the processing behavior monitoring logic timer threshold of the lock-step processor monitoring unit.

[0016] Furthermore, the lock-step controller processing unit includes a lock-step controller state control unit, a configuration state timer, and a lock-step controller command operation state machine;

[0017] The lockstep controller state control unit includes a configuration state, an idle state, a processing state, and a failure state;

[0018] The configuration state timer starts counting when entering the configuration state. When the count reaches the threshold, the processing state timer, the lockstep enable register and the processing state timer threshold register are all set to the initial value and enter the processing state. When the idle state is entered before the count reaches the threshold, the count is cleared.

[0019] Furthermore, the initial state of the internal state control unit of the lock-step controller state control unit is an idle state;

[0020] In the idle state, the processing unit may receive an idle state entry configuration state request from the register module and enter the configuration state;

[0021] In the configuration state, the lock-step control and determination of the processing device behavior are completed by receiving the read and write operations of the processor on the lock-step controller register module, including the configuration of the processing state timer enable register and the configuration of the processing state timer threshold register;

[0022] In the configuration state, the processing unit cannot configure the configuration state timer threshold register;

[0023] In the configuration state, if the processing unit does not complete the operation within the configuration state timer threshold, it enters the idle state, and the processing state timer enable register and the processing state timer threshold register are set to the initial value;

[0024] In the configuration state, if an operation request is received, the behavior of the lock-step controller processing unit is determined by the behavior of the lock-step controller processing unit after configuration is completed;

[0025] In the idle state, if the processing state register stores an operation request, i.e., a non-zero value, and the processing state timer is enabled, the processing state is entered; if the processing state timer is not enabled, the invalid state is entered;

[0026] In the processing state, a checkpoint interruption operation request and a rollback interruption operation request are initiated. After the checkpoint interruption operation or the rollback interruption operation is completed, the processor initiates a clear processing status register command and enters the idle state.

[0027] In the processing state, if the processing operation is not completed within the processing state timing threshold time, it enters the invalid state;

[0028] In the failed state, the processing unit initiates a system reset.

[0029] Furthermore, the high-reliability processor dual-core lock-step control and processing device includes a lock-step controller monitoring unit; the lock-step controller monitoring unit includes an internal processing behavior monitoring logic timer, receives an operation request signal and a processing operation signal, and monitors the behavior of the lock-step controller processing unit. If the monitoring logic timer reaches a timing threshold, a system reset signal is issued.

[0030] A high-reliability processor dual-core lock-step control and processing method is also provided, and the high-reliability processor dual-core lock-step control and processing method comprises the following steps:

[0031] Step 1, the processor dual-core lock-step control and processing device enters the configuration state from the idle state, and determines the lock-step controller processing unit behavior;

[0032] The lockstep controller processing unit behavior includes lockstep enable, processing state timer enable, and processing state timer threshold;

[0033] Step 2: In the configuration state, if the configuration state timer reaches a threshold, the lock-step controller processing unit enters an idle state; if the configuration state timer does not reach the threshold, after the processor completes the configuration operation, the lock-step controller processing unit enters an idle state through software operation;

[0034] Step 3, in the idle state, the dual-core lock-step control and processing device waits for an operation request signal, after the lock-step control register module captures and saves the operation request, the lock-step controller processing unit performs a state transition, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit starts working;

[0035] The operation request includes a master-slave processor comparison mismatch signal issued by a lockstep controller comparison unit and a periodic checkpoint request signal issued by the processor;

[0036] Step 4: when the lock-step is enabled, if the processing state timer is not enabled, the lock-step controller processing unit enters a failure state; if the lock-step enabled processing state timer is enabled, the lock-step controller processing unit enters a processing state;

[0037] Step 5: In the processing state, the lock-step controller processing unit outputs a processing operation signal, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is reset and stops timing;

[0038] The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation;

[0039] Step 6, in the processing state, the processing operation behavior is monitored by the processing state timer. If the processing state timer reaches a threshold, the lock-step controller processing unit enters a failure state, the processing state timer is reset and stops working, and step 8 is executed; if the processing state timer does not reach the threshold, the processing state timer continues to work, and step 7 is executed;

[0040] Step 7, wait for the processing operation to be completed, the processor clears the processing status register state through software operation, enters the idle state, the processing status timer is reset and stops working, and executes step 3;

[0041] Step 8: In the failure state, the lock-step controller processing unit outputs a system reset signal, and the internal processing behavior monitoring logic timer of the lock-step controller is cleared and stops timing.

[0042] Furthermore, in step 1, the following steps are also included:

[0043] Step 11, in the idle state, write a corresponding operand to the operation access register, wherein the operand indicates that an idle state to configuration state command is to be executed; after writing the corresponding operand to the operation access register, write an idle state to configuration state command to the lockstep control register; the internal state machine of the lockstep controller processing unit jumps to the configuration state;

[0044] Step 12, in the configuration state, configure the registers to determine the behavior of the lock-step controller processing unit to adapt to the specific application requirements of the system; the lock-step enable is used to determine whether the dual-core lock-step control and processing unit are working; the processing state timer enable is used to determine that after receiving an operation request, the internal state machine of the lock-step controller processing unit jumps to the processing state and initiates the processing operation; the processing state timer threshold is used to determine the maximum time of the processing operation.

[0045] Furthermore, in step 2, in the configuration state, if an operation request is received, the processing status register captures and saves the operation request, and after the lock-step controller processing unit enters the idle state, the lock-step controller processing unit performs a state transition based on the operation request captured by the processing status register and the behavior of the lock-step controller processing unit.

[0046] Furthermore, in step 5, if the processing state register captures and saves the periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs a checkpoint interrupt operation request signal after entering the processing state to save the operation data of the processor core at the checkpoint into the memory protected by ECC; the operation data includes the register data of the processor core and the processor core operation state data; the processor core operation state data includes the processor stack space data and the memory data segment data;

[0047] If the processing status register captures and saves the master-slave processor comparison mismatch signal issued by the lock-step controller comparison unit, the lock-step controller processing unit outputs a rollback interrupt operation request signal after entering the processing state, and restores the operating data of the processor core to the operating data at the checkpoint before the rollback interrupt, so that the processor is restored to the correct operating state saved previously; at the same time, after the lock-step controller monitoring unit receives the processing operation signal issued by the lock-step controller processing unit, the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is cleared and stops timing.

[0048] Furthermore, in step 8, in the failure state, the lock-step controller processing unit outputs a system reset signal to reset the system, clear the internal error of the processor, and resolve the processor error operation or deadlock caused by the internal error. The system is restored to the initial operation state after power-on, so that the system runs in a safe state. The safe state is a state in which the system runs correctly and can handle errors correctly. At the same time, the lock-step controller receives the system reset signal output by the lock-step controller processing unit, and the internal processing behavior monitoring logic of the lock-step controller monitoring unit is cleared and the timing is stopped.

[0049] The beneficial effects achieved by the present invention are:

[0050] The present invention realizes a dual-core lock-step processor that combines checkpoint and rollback strategies, and realizes lock-step control and processing through a dual-core lock-step processor control and processing device to ensure that the system operates in a safe state. Specifically, its beneficial effects are as follows: receiving and saving periodic checkpoint request operations sent by the processor, receiving and saving processor output comparison mismatch signals, controlling and processing errors in a systematic manner, and making the system operate in a safe state; by configuring a state timer and a processing state timer inside the lock-step controller processing unit, the normal operation of the configuration operation and the processing operation is ensured; by the lock-step controller monitoring unit, the normal operation of the lock-step controller processing unit is ensured. The lock-step control and processing device ensures the high reliability of the implementation of the dual-core lock-step of the processor on the basis of completing the dual-core lock-step of the processor combined with the checkpoint and rollback operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a structural schematic diagram of a high-reliability lock-step control and processing device provided by an embodiment of the present invention;

[0052] Figure 2 It is a schematic diagram of the structure of a dual-core lock-step processor provided by an embodiment of the present invention.

[0053] Figure 3 It is a schematic diagram of the state transition of a processing unit of a high-reliability lock-step control and processing device provided by an embodiment of the present invention;

[0054] Figure 4 It is a command operation handshake diagram of a register module command operation state machine and a lock-step controller command operation state machine of a high-reliability lock-step control and processing device provided by an embodiment of the present invention;

[0055] Figure 5 The present invention provides an operation flow chart of a monitoring unit of a high-reliability lock-step control and processing device.

[0056] Figure 6 It is a schematic flow chart of a method of a high-reliability lock-step control and processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further described below in conjunction with specific embodiments, and the advantages and features of the present invention will become clearer as the description proceeds. However, these embodiments are exemplary only and do not constitute any limitation to the scope of the present invention. It should be understood by those skilled in the art that the details and forms of the technical solution of the present invention may be modified or replaced without departing from the spirit and scope of the present invention, but these modifications and replacements all fall within the scope of protection of the present invention.

[0058] As attached Figure 1 As shown, a dual-core lock-step control and processing device is expected to perform error handling operations at the software level to ensure the correctness of the software error handling operations and the correct operation of the system; a high-reliability dual-core lock-step control and processing device is designed, while ensuring the correct operation of the device; and the dual-core lock-step of the processor is completed under the premise that the system is running in a safe state.

[0059] The device comprises: a lock-step controller processing unit, a lock-step controller monitoring unit and a lock-step controller register module.

[0060] The lock-step controller processing unit is respectively connected to the lock-step controller comparison unit, the lock-step controller register module, and the lock-step controller monitoring unit, and the lock-step controller processing unit is used to receive an operation request signal; wherein the operation request signal includes a master-slave processor comparison mismatch signal issued by the lock-step controller comparison unit and a periodic checkpoint request signal issued by the processor, and a processing operation signal is issued according to the configuration information of the lock-step controller register module, and the processing operation signal includes a checkpoint interrupt processing operation request and a rollback interrupt processing operation request.

[0061] The lock-step controller register module is connected to the lock-step controller comparison unit and the lock-step controller processing unit respectively, and the lock-step controller register module is used to receive configuration information of the processor and determine the behavior of the lock-step controller comparison unit and the lock-step controller processing unit.

[0062] The lock-step controller monitoring unit is connected to the lock-step controller comparison unit and the lock-step controller processing unit respectively. The lock-step controller monitoring unit includes an internal processing behavior monitoring logic timer, receives an operation request signal, a processing line number and a processing operation signal, and monitors the behavior of the lock-step controller processing unit. If the monitoring logic timer reaches a timing threshold, a system reset signal is issued.

[0063] The lock-step controller comparison unit compares the output of the master processor after a fixed delay and the output of the slave processor after the input is fixedly delayed in each clock cycle.

[0064] As attached Figure 2As shown, in one embodiment, the output of the master processor after a fixed delay and the output of the slave processor after the input is fixedly delayed compared by the lock-step controller comparison unit include the output of the processor core without internal cache, the processor bus interface output, the processor local storage interface output, and the processor cache interface output;

[0065] The lock-step controller comparison unit compares the output of the master processor after a fixed delay and the output of the slave processor after a fixed delay in each clock cycle, and outputs a mismatch signal.

[0066] The lockstep controller register module includes a register operation state machine and an internal register unit;

[0067] The internal register unit includes an operation control register, an operation access register, a processing status register, a lockstep enable register, a configuration status timer threshold register, a processing status timer enable register, a processing status timer threshold register, and a processing unit operation status register;

[0068] The operation control register receives corresponding commands through processor read and write control, including a command for the internal state machine of the lockstep controller processing unit to jump from the configuration state to the idle state, a command for jumping from the idle state to the configuration state, a command for clearing the lockstep control unit processing state register, a command for setting the lockstep enable register, and a command for reading the processing unit operation state;

[0069] The operation access register is the register into which the corresponding operand needs to be written before the processor sends a command. Different operands correspond to different commands.

[0070] After writing the corresponding operand to the operation access register, the next step must be to write to the operation controller to execute the corresponding operation command;

[0071] The processing status register is used to capture and save the operation request signal. To clear the processing status register, the corresponding operand must be written to the access operation register first, and then the corresponding command must be written to the operation control register;

[0072] The lockstep enable register is used to control the behavior of the comparison unit, processing unit, and monitoring unit. To set the lockstep enable register, the corresponding operand must be written into the access operation register first, and then the corresponding command must be written into the operation control register.

[0073] When the lockstep enable register value is 0, the lockstep control and processing device is not enabled;

[0074] The configuration state timer threshold register is the maximum working time of the processing unit in the configuration state, and the threshold should be less than the timer threshold of the internal processing behavior monitoring logic of the lock-step processor monitoring unit;

[0075] The processing state timer enable register is used to control the enable of the timer of the processing unit in the processing state;

[0076] The processing state timer threshold register is the maximum working time of the processing unit in the processing state, and the threshold should be less than the processing behavior monitoring logic timer threshold of the lock-step processor monitoring unit;

[0077] The processing unit operation status register stores the operation status of the current processing unit state machine;

[0078] The register operation state machine is a register module that requests the lock-step controller processing unit to initiate an operation after receiving the register read and write operation of the processor, and performs a handshake operation with the lock-step controller processing unit operation state machine;

[0079] As attached Figure 4 , in the IDLE state of the register operation state machine, the request command of the processor is received, and the operation request and command are sent to the lock-step controller processing unit, and then the PH1 state is entered to wait for the response of the lock-step controller processing unit. When the response signal of the lock-step controller processing unit is received, the PH2 state is entered and the request is canceled at the same time, and the IDLE state is entered after the response of the lock-step controller processing unit is completed;

[0080] The lock-step controller processing unit further includes a lock-step controller state control unit, a configuration state timer, a processing state timer, and a lock-step controller command operation state machine;

[0081] As attached Figure 3 ,The state machine state of the lock-step controller control unit includes configuration state, idle state, processing state, and failure state;

[0082] The initial state of the internal state control unit of the lock-step controller state control unit is an idle state;

[0083] In the idle state, the processing unit may receive an idle state entry configuration state request from the register module and enter the configuration state;

[0084] In the configuration state, the lock-step control and determination of the processing device behavior are completed by receiving the read and write operations of the processor on the lock-step controller register module, including the configuration of the processing state timer enable register and the configuration of the processing state timer threshold register;

[0085] In the configuration state, the processing unit cannot configure the configuration state timer threshold register;

[0086] In the configuration state, if the processing unit does not complete the operation within the configuration state timer threshold, it enters the idle state, and the processing state timer enable register and the processing state timer threshold register are set to the initial value;

[0087] In the configuration state, if an operation request is received, the behavior of the lock-step controller processing unit is determined by the behavior of the lock-step controller processing unit after configuration is completed;

[0088] In the idle state, if the processing state register stores an operation request, i.e., a non-zero value, and the processing state timer is enabled, the processing state is entered; if the processing state timer is not enabled, the invalid state is entered;

[0089] In the processing state, a checkpoint interruption operation request and a rollback interruption operation request are initiated. After the checkpoint interruption operation or the rollback interruption operation is completed, the processor initiates a clear processing status register command and enters the idle state.

[0090] In the processing state, if the processing operation is not completed within the processing state timing threshold time, it enters the invalid state;

[0091] In the failure state, the processing unit initiates a system reset;

[0092] Among them, the configuration state timer starts counting when entering the configuration state. When the count reaches the threshold, the processing state timer, the enable register and the processing state timer threshold register are all set to the initial value and enter the processing state. When entering the idle state before the count reaches the threshold, the count is cleared;

[0093] Wherein, the processing state timer starts counting when entering the processing state and receiving the periodic checkpoint operation request and the processor output comparison mismatch signal, and enters the failure state when the count reaches the threshold;

[0094] As attached Figure 4 As shown, the lock-step controller commands the operation state machine, which is used to receive and execute the processor operation command obtained by decoding the register module. In the IDLE state, an operation request is received, and the PH1 state is entered. The command after the cross-clock domain operation is received, the PH2 state is entered, the command is decoded, the PH3 stage is entered, the command is executed, the PH4 stage is entered, a response signal is initiated, the PH5 stage is entered, the operation request ends, and the IDLE state is entered;

[0095] As attached Figure 5 ,The working status flow of the lock-step controller monitoring unit, when the lock-step is enabled, that is, the lock-step control and processing device are working, when an operation request is received, the internal processing behavior monitoring logic timer starts timing, and no processing operation signal is detected within the timer threshold.

[0096] A lockstep control and processing method, the method comprising:

[0097] Step 1: After the system is powered on, it enters an idle state, and the processor causes the lock-step controller processing unit to enter a configuration state through software operation;

[0098] Specifically, step 1 also includes the following steps:

[0099] Step 11, the configuration state can only be accessed in the idle state. In the idle state, the processor writes a corresponding operand to the operation access register through software operation, wherein the operand indicates that an idle state to enter the configuration state command is to be performed; after the processor writes the corresponding operand to the operation access register, the processor writes an idle state to configure state command to the lockstep control register through software operation; the internal state machine of the lockstep controller processing unit jumps to the configuration state;

[0100] By writing the corresponding operands first and then the corresponding commands, it is ensured that the commands will not be incorrectly initiated or executed due to soft errors, thereby ensuring the reliability of the dual-core lock-step control and processing device;

[0101] Step 12, in the configuration state, the processor performs configuration operations on registers that can be written only in the configuration state, wherein the configuration operation determines the behavior of the lockstep controller processing unit to adapt to the specific application requirements of the system; the behavior of the lockstep controller processing unit includes lockstep enable, processing state timer enable and processing state timer threshold;

[0102] Step 2: In the configuration state, determine whether the configuration state timer reaches a threshold value. If so, the lock-step controller processing unit enters an idle state; if not, after the processor completes the configuration operation, the lock-step controller processing unit enters an idle state through software operation;

[0103] Specifically, if the configuration state timer does not reach the threshold, the processor writes a corresponding operand to the operation access register through software operation, wherein the operand indicates that a configuration state entry idle state command is to be performed. After the processor writes the corresponding operand to the operation access register, the processor writes a configuration state jump to idle state command to the lockstep control register through software operation, and the internal state machine of the lockstep controller processing unit jumps to the idle state.

[0104] Specifically, if the configuration state timer reaches the threshold, the internal state machine of the lock-step controller processing unit directly enters the idle state, and at the same time, the lock-step controller processing unit sends a configuration timeout signal, and the lock-step controller register module receives the configuration timeout signal sent by the lock-step controller processing unit. In order to ensure that the lock-step controller processing unit behaves correctly, after receiving the configuration timeout signal, the lock-step controller register module sets the lock-step enable register to a zero value, that is, the lock-step is not enabled, sets the processing state timer enable register to a zero value, that is, the processing state timing is not enabled, and sets the processing state timer threshold register value to zero;

[0105] In the configuration state, if the device receives an operation request, the processing state register captures and saves the operation request, wherein the operation request includes a master-slave processor comparison mismatch signal issued by the lock-step controller comparison unit and a periodic checkpoint request signal issued by the processor; after the lock-step controller processing unit enters the idle state, the lock-step controller processing unit performs a state transition according to the operation request captured by the processing state register and the behavior of the lock-step controller processing unit;

[0106] Step 3, in the idle state, the dual-core lock-step control and processing device waits for an operation request signal, after the lock-step control register module captures and saves the operation request, the lock-step controller processing unit performs a state transition, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit starts working;

[0107] Specifically, in the idle state, after the processing state register captures and saves the operation request signal, the dual-core lock-step control and processing device works according to the lock-step controller processing unit behavior determined in the configuration state, including lock-step enable, processing state timer start, and processing state timer threshold; lock-step enable is used to determine whether the dual-core lock-step control and processing unit is working; if lock-step is enabled, the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit starts counting, and the lock-step controller monitoring unit receives the output of the lock-step controller processing unit to ensure that the lock-step controller processing unit works normally, that is, to ensure that the system runs in a safe state, and the safe state is a state in which the system runs correctly and can handle errors correctly;

[0108] Step 4: When lock-step is enabled, determine whether the processing state timer is enabled;

[0109] Specifically, the processing state timer is enabled to determine that after receiving the operation request, the internal state machine of the lock-step controller processing unit jumps to the processing state and initiates the processing operation; if the processing state timer is not enabled, that is, the system does not process the operation request, the lock-step controller processing unit enters the failure state and executes step 8; if the lock-step enable processing state timer is enabled, that is, the lock-step controller processing unit processes the operation request, the lock-step controller processing unit enters the processing state and executes step 5;

[0110] Step 5: In the processing state, the lock-step controller processing unit outputs a processing operation signal, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is reset and stops timing;

[0111] Wherein, the processing operation is one of a checkpoint interruption request operation and a rollback interruption request operation;

[0112] Specifically, if the processing state register captures and saves the periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs a checkpoint interrupt operation request signal after entering the processing state to save the running data of the processor core at the checkpoint into the memory protected by ECC; wherein the running data includes the register data of the processor core and the processor core running state data; the processor core running state data includes the processor stack space data and the memory data segment data;

[0113] If the processing status register captures and saves the master-slave processor comparison mismatch signal issued by the lock-step controller comparison unit, the lock-step controller processing unit outputs a rollback interrupt operation request signal after entering the processing state, and restores the operating data of the processor core to the operating data at the checkpoint before the rollback interrupt, so that the processor is restored to the correct operating state saved previously; at the same time, after the lock-step controller monitoring unit receives the processing operation signal issued by the lock-step controller processing unit, the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is cleared and stops timing.

[0114] Step 6, in the processing state, the lock-step controller processing unit determines whether the processing state timer reaches a threshold;

[0115] Specifically, in the processing state, the processing operation behavior is monitored by the processing state timer, and the processing state timer threshold is used to determine the maximum time of the processing operation; when the lock-step controller processing unit enters the processing state, the processing state timer starts to work, and it is determined whether the processing state timer reaches the threshold. If so, the system fails to process the error, that is, the processor enters an erroneous operating state or deadlocks, the lock-step controller processing unit enters a failure state, the processing state timer is reset and stops working, and step 8 is executed; if not, the processing state timer continues to work, and step 7 is executed;

[0116] Step 7, wait for the processing operation to be completed, and the processor clears the processing status register status through software operation;

[0117] Specifically, wait for the processing operation to be completed, the processor clears the processing status register state through software, the processor clears the processing status register state through software, that is, handles the error in a software manner, the dual-core lock-step control and processing device controls and handles the error in a systematic manner, so that the system works in a safe state and enters an idle state, the processing state timer is cleared and stops working, and step 3 is executed;

[0118] Step 8: In the failure state, the lock-step controller processing unit outputs a system reset signal, and the lock-step controller internal processing behavior monitoring logic timer is reset and stops timing;

[0119] Specifically, in a failure state, the lock-step controller processing unit outputs a system reset signal to reset the system, clear the internal error of the processor, resolve the processor error operation or deadlock caused by the internal error, and restore the system to the initial operation state after power-on, so that the system runs in a safe state. The safe state is a state in which the system runs correctly and can handle errors correctly. At the same time, the lock-step controller receives the system reset signal output by the lock-step controller processing unit, and the internal processing behavior monitoring logic of the lock-step controller monitoring unit is cleared and the timing is stopped.

[0120] In a microcontroller with dual-core lock-step processors, a master-slave processor comparison mismatch error issued by a comparison unit is processed in combination with a checkpoint and rollback interrupt operation. In practical applications of this embodiment, the microcontroller with dual-core lock-step processors adopts the high-reliability lock-step control and processing device proposed by the present invention to process the checkpoint operation request and the master-slave processor comparison mismatch error issued by the comparison unit; in order to verify the effectiveness of the technical solution in this embodiment, a simulated fault injection method is used to simulate the actual soft error occurrence situation. The fault inside the processor is flipped for two clock cycles at a random moment when the processor is running correctly; at the same time, the same register and the same bit inside the processor of the microcontroller using the high-reliability lock-step control and processor device and the microcontroller not using the device are fault-injected at the same time, so that when the internal register is flipped, the processor output structure of the two microcontrollers executing the same test case The results are the same; FIR operation benchmark program and Matrix operation benchmark program are used as test cases respectively. At the same time, the test cases are made to include read-write storage, read-write peripherals, read-write cache, data operation and conditional branch instructions, so as to cover the fault-tolerant functional points more comprehensively, and the number of errors after the randomly injected faults are detected as errors, the number of errors using rollback processing to complete error processing, the number of errors using reset processing due to failure to complete error processing using rollback processing, the ratio of the number of errors using reset processing due to failure to complete error processing using rollback processing to the total number of errors, and the ratio of the number of unrecovered errors to the total number of errors are recorded, as shown in Table 1; when the microcontroller uses a high-reliability lockstep control and processor device, it can be seen from Table 1 that when the present device is used, the problem that the checkpoint and rollback processing operations cannot handle errors when the internal error processor enters the error operation state and the deadlock state can be effectively solved, which proves that the present device can solve the problems of processor error operation and deadlock state errors, and ensure the normal operation of the system in a safe state.

[0121] Table 1

[0122]

[0123] The above are only specific steps of the present invention and do not constitute any limitation to the protection scope of the present invention; any technical solutions formed by equivalent transformation or equivalent replacement shall fall within the protection scope of the present invention; some parts not elaborated in detail in the present invention belong to the known technologies of those skilled in the art.

Claims

1. A high-reliability processor dual-core lock-step control and processing device, wherein the high-reliability processor dual-core lock-step control and processing device is connected to a lock-step controller comparison unit, characterized in that: The high-reliability processor dual-core lockstep control and processing device includes a lockstep controller processing unit; The lockstep controller processing unit includes a processing state timer; After receiving the operation request, the processing operation is output and the processing operation behavior is monitored. If the processing state timer reaches the threshold, the lock-step controller processing unit enters the failure state, the processing state timer is reset and stops working. If the processing state timer does not reach the threshold, wait for the processing operation to be completed; The operation request includes a master-slave processor comparison mismatch signal issued by a lockstep controller comparison unit and a periodic checkpoint request signal issued by the processor; The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation; In the failed state, the lockstep controller processing unit outputs a system reset signal.

2. The high-reliability processor dual-core lock-step control and processing device according to claim 1, characterized in that: The high-reliability processor dual-core lockstep control and processing device includes a lockstep controller register module; The lockstep controller register module includes a processing status register, a lockstep enable register and a processing status timer threshold register; The processing status register is used to capture and store the operation request signal; The lockstep enable register is used to control the behavior of the lockstep controller processing unit and the lockstep controller monitoring unit; The processing state timer threshold register is the longest working time of the processing unit in the processing state, and the threshold should be smaller than the processing behavior monitoring logic timer threshold of the lock-step processor monitoring unit.

3. The high-reliability processor dual-core lock-step control and processing device according to claim 2, characterized in that: The lock-step controller processing unit includes a lock-step controller state control unit, a configuration state timer, and a lock-step controller command operation state machine; The lockstep controller state control unit includes a configuration state, an idle state, a processing state, and a failure state; The configuration state timer starts counting when entering the configuration state. When the count reaches the threshold, the processing state timer, the lockstep enable register and the processing state timer threshold register are all set to the initial value and enter the idle state. If the count does not reach the threshold, the processor enters the idle state through software operation after completing the configuration operation, and the count is cleared.

4. The high-reliability processor dual-core lock-step control and processing device according to claim 3, characterized in that: The initial state of the internal state control unit of the lock-step controller state processing unit is an idle state; In the idle state, the processing unit may receive an idle state entry configuration state request from the register module and enter the configuration state; In the configuration state, the lock-step control and determination of the processing device behavior are completed by receiving the read and write operations of the processor on the lock-step controller register module, including the configuration of the processing state timer enable register and the configuration of the processing state timer threshold register; In the configuration state, the processing unit cannot configure the configuration state timer threshold register; In the configuration state, if the processing unit does not complete the operation within the configuration state timer threshold, it enters the idle state, and the processing state timer enable register and the processing state timer threshold register are set to the initial value; In the configuration state, if an operation request is received, the behavior of the lock-step controller processing unit is determined by the behavior of the lock-step controller processing unit after configuration is completed; In the idle state, if the processing state register stores an operation request, i.e., a non-zero value, and the processing state timer is enabled, the processing state is entered; if the processing state timer is not enabled, the invalid state is entered; In the processing state, a checkpoint interruption operation request and a rollback interruption operation request are initiated. After the checkpoint interruption operation or the rollback interruption operation is completed, the processor initiates a clear processing status register command and enters the idle state. In the processing state, if the processing operation is not completed within the processing state timing threshold time, it enters the invalid state; In the failed state, the processing unit initiates a system reset.

5. The high-reliability processor dual-core lock-step control and processing device according to claim 4, characterized in that: The high-reliability processor dual-core lock-step control and processing device includes a lock-step controller monitoring unit; the lock-step controller monitoring unit includes an internal processing behavior monitoring logic timer, receives an operation request signal and a processing operation signal, and monitors the behavior of the lock-step controller processing unit. If the monitoring logic timer reaches a timing threshold, a system reset signal is issued.

6. A high-reliability processor dual-core lock-step control and processing method, characterized in that: The high-reliability processor dual-core lock-step control and processing method comprises the following steps: Step 1, the processor dual-core lock-step control and processing device enters the configuration state from the idle state, and determines the lock-step controller processing unit behavior; The lockstep controller processing unit behavior includes lockstep enable, processing state timer enable, and processing state timer threshold; Step 2: In the configuration state, if the configuration state timer reaches a threshold, the lock-step controller processing unit enters an idle state; if the configuration state timer does not reach the threshold, after the processor completes the configuration operation, the lock-step controller processing unit enters an idle state through software operation; Step 3, in the idle state, the dual-core lock-step control and processing device waits for an operation request signal, after the lock-step control register module captures and saves the operation request, the lock-step controller processing unit performs a state transition, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit starts working; The operation request includes a master-slave processor comparison mismatch signal issued by a lockstep controller comparison unit and a periodic checkpoint request signal issued by the processor; Step 4: when the lock-step is enabled, if the processing state timer is not enabled, the lock-step controller processing unit enters a failure state; if the lock-step enabled processing state timer is enabled, the lock-step controller processing unit enters a processing state; Step 5: In the processing state, the lock-step controller processing unit outputs a processing operation signal, and the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is reset and stops timing; The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation; Step 6, in the processing state, the processing operation behavior is monitored by the processing state timer. If the processing state timer reaches a threshold, the lock-step controller processing unit enters a failure state, the processing state timer is reset and stops working, and step 8 is executed; if the processing state timer does not reach the threshold, the processing state timer continues to work, and step 7 is executed; Step 7, wait for the processing operation to be completed, the processor clears the processing status register state through software operation, enters the idle state, the processing status timer is reset and stops working, and executes step 3; Step 8: In the failure state, the lock-step controller processing unit outputs a system reset signal, and the internal processing behavior monitoring logic timer of the lock-step controller is cleared and stops timing.

7. The high-reliability processor dual-core lock-step control and processing method according to claim 6, characterized in that: In step 1, the following steps are also included: Step 11, in the idle state, write a corresponding operand to the operation access register, wherein the operand indicates that an idle state to configuration state command is to be executed; after writing the corresponding operand to the operation access register, write an idle state to configuration state command to the lockstep control register; the internal state machine of the lockstep controller processing unit jumps to the configuration state; Step 12, in the configuration state, configure the registers to determine the behavior of the lock-step controller processing unit to adapt to the specific application requirements of the system; the lock-step enable is used to determine whether the dual-core lock-step control and processing unit are working; the processing state timer enable is used to determine that after receiving an operation request, the internal state machine of the lock-step controller processing unit jumps to the processing state and initiates the processing operation; the processing state timer threshold is used to determine the maximum time of the processing operation.

8. The high-reliability processor dual-core lock-step control and processing method according to claim 6, characterized in that: In step 2, in the configuration state, if an operation request is received, the processing status register captures and saves the operation request. After the lock-step controller processing unit enters the idle state, the lock-step controller processing unit performs a state transition based on the operation request captured by the processing status register and the behavior of the lock-step controller processing unit.

9. The high-reliability processor dual-core lock-step control and processing method according to claim 6, characterized in that: In step 5, if the processing state register captures and saves the periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs a checkpoint interrupt operation request signal after entering the processing state to save the running data of the processor core at the checkpoint into the memory protected by ECC; the running data includes the register data of the processor core and the processor core running state data; the processor core running state data includes the processor stack space data and the memory data segment data; If the processing status register captures and saves the master-slave processor comparison mismatch signal issued by the lock-step controller comparison unit, the lock-step controller processing unit outputs a rollback interrupt operation request signal after entering the processing state, and restores the operating data of the processor core to the operating data at the checkpoint before the rollback interrupt, so that the processor is restored to the correct operating state saved previously; at the same time, after the lock-step controller monitoring unit receives the processing operation signal issued by the lock-step controller processing unit, the internal processing behavior monitoring logic timer of the lock-step controller monitoring unit is cleared and stops timing.

10. The high-reliability processor dual-core lock-step control and processing method according to claim 6, characterized in that: In step 8, in the failure state, the lock-step controller processing unit outputs a system reset signal to reset the system, clear the internal error of the processor, resolve the processor error operation or deadlock caused by the internal error, and restore the system to the initial operation state after power-on, so that the system runs in a safe state. The safe state is a state in which the system runs correctly and can handle errors correctly. At the same time, the lock-step controller receives the system reset signal output by the lock-step controller processing unit, and the internal processing behavior monitoring logic of the lock-step controller monitoring unit is cleared and the timing is stopped.

Images