Highly reliable processor dual-core lockstep control and processing apparatus and method

Abstract

The application provides a high-reliability processor dual-core lockstep control and processing device and method, wherein the lockstep controller processing unit in the device receives a processor checkpoint operation request, a lockstep controller comparison unit output mismatch signal, outputs a checkpoint operation interrupt request and a rollback operation interrupt request for error control and processing; the lockstep controller register module is used for software configuration of the behavior of the dual-core lockstep control and processing device; the lockstep controller monitoring unit receives an operation request signal and a processing operation signal and is used for monitoring the behavior of the lockstep controller processing unit to ensure normal work of the lockstep controller processing unit. Through the technical scheme of the application, the high-reliability lockstep control and processing of the dual-core lockstep processor combining the checkpoint and rollback strategies are realized by the processor dual-core lockstep control and processing device, so that the system works in a safe state.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of dual-core lockstep processor, in particular to a high-reliability processor dual-core lockstep control and processing device and method. BACKGROUND

[0002] As the transistor size is reduced, microprocessors become more and more unreliable and more susceptible to soft errors. Lockstep is a method of detecting and mitigating soft errors based on processor redundancy. Dual-core lockstep requires running the same program on two identical processors, checking the mismatch of the processor running results by monitoring the outputs of the two processors, and achieving the purpose of detecting processor running faults in this way. Lockstep improves reliability by combining checkpointing and rollback operations. Checkpointing is a method of saving processor state in a safe memory, and rollback operation is to restore the processor state to the previously saved safe processor state.

[0003] Dual-core lockstep combined with checkpointing and rollback operation is a method of improving processor reliability by combining checkpointing and rollback strategy at the software level. When performing checkpointing and rollback operations at the software level, the influence of soft errors will cause the saving and restoration of the processor error state, resulting in processor deadlock or causing the processor to enter an error state. On the other hand, the processor is affected by soft errors and causes deadlock during running. Relying only on checkpointing and rollback operations at the software level cannot handle errors in the above-mentioned cases or guarantee the system to run in a safe state. A safe state is a state in which the system runs correctly and can correctly handle errors. Additional dual-core lockstep control and processing device and method are needed to ensure the correctness of checkpointing and rollback operations and the high reliability of the system and dual-core lockstep control and processing device. SUMMARY

[0004] To solve at least one of the technical problems existing in the prior art, the purpose of the present application is to provide a high-reliability lockstep control and processing device based on processor dual-core lockstep.

[0005] The present application discloses a high-reliability processor dual-core lockstep control and processing device, which is connected with a lockstep controller comparison unit, and comprises a lockstep controller processing unit.

[0006] The lockstep controller processing unit comprises a processing state timer.

[0007] After receiving the operation request, the output processing operation and monitoring the processing operation behavior, if the processing state timer reaches the threshold, the lockstep controller processing unit enters the failure state, the processing state timer is cleared and stops working, if the processing state timer does not reach the threshold, waiting for the processing operation to complete;

[0008] The operation request includes the master-slave processor comparison mismatch signal issued by the lockstep controller comparison unit and the periodic checkpoint request signal issued by the processor;

[0009] The processing operation includes the checkpoint interrupt request operation and the rollback interrupt request operation;

[0010] In the failure state, the lockstep controller processing unit outputs a system reset signal.

[0011] Further, the high-reliability processor dual-core lockstep control and processing device includes a lockstep controller register module;

[0012] The lockstep controller register module includes a processing state register, a lockstep enable register, and a processing state timer threshold register;

[0013] The processing state register is used to capture and save the operation request signal;

[0014] The lockstep enable register is used to control the behavior of the lockstep controller processing unit and the lockstep controller monitoring unit;

[0015] The processing state timer threshold register is the maximum working time of the processing unit in the processing state, and the threshold should be less than the timer threshold of the internal processing behavior monitoring logic of the lockstep processor monitoring unit.

[0016] Further, the lockstep controller processing unit includes a lockstep controller state control unit, a configuration state timer, and a lockstep controller command operation state machine;

[0017] The lockstep controller state control unit includes a configuration state, an idle state, a processing state, and a failure state;

[0018] The configuration state timer starts counting when entering the configuration state, and when the count reaches the threshold, the processing state timer, the lockstep enable register, and the processing state timer threshold register are all set to initial values, enter the processing state, and enter the idle state before the count reaches the threshold, then the count is cleared.

[0019] Further, the initial state of the internal state control unit of the lockstep controller state control unit is the idle state;

[0020] In the idle state, the processing unit can receive the idle state configuration state request of the register module and enter the configuration state;

[0021] In the configuration state, the lockstep control and the determination of the behavior of the processing device are completed by receiving the read and write operations of the processor to the lockstep controller register module, including the configuration of the processing state timer enable register and the configuration of the processing state timer threshold register;

[0022] In the configuration state, the processing unit cannot configure the configuration state timer threshold register;

[0023] In the configuration state, if the processing unit does not complete the operation within the configuration state timer threshold, the processing unit enters the idle state, and the processing state timer enable register and the processing state timer threshold register are set to the initial values;

[0024] In the configuration state, if an operation request is received, the behavior of the lockstep controller processing unit is determined by the behavior of the lockstep controller processing unit after the configuration is completed;

[0025] In the idle state, if the processing state register stores an operation request, i.e., a non-zero value, and the processing state timer is enabled, the processing unit enters the processing state; if the processing state timer is not enabled, the processing unit enters the invalid state;

[0026] In the processing state, the checkpoint interrupt operation request and the rollback interrupt operation request are initiated, the checkpoint interrupt operation or the rollback interrupt operation is completed, the processor initiates a command to clear the processing state register, and the processing unit enters the idle state;

[0027] In the processing state, if the processing operation is not completed within the processing state timer threshold time, the processing unit enters the invalid state;

[0028] In the invalid state, the processing unit initiates a system reset.

[0029] Further, the high-reliability processor dual-core lockstep control and processing device further includes a lockstep controller monitoring unit; the lockstep controller monitoring unit includes an internal processing behavior monitoring logic timer, receives an operation request signal and a processing operation signal, and monitors the behavior of the lockstep controller processing unit; if the monitoring logic timer reaches a timing threshold, a system reset signal is sent.

[0030] A high-reliability processor dual-core lockstep control and processing method is also provided, which includes the following steps:

[0031] Step 1: The processor dual-core lockstep control and processing device enters the configuration state from the idle state, and the behavior of the lockstep controller processing unit is determined;

[0032] The behavior of the lockstep controller processing unit includes lockstep enable, processing state timer enable, and processing state timer threshold;

[0033] Step 2, in the configuration state, if the configuration state timer reaches the threshold, the lockstep controller processing unit enters the idle state; if the configuration state timer does not reach the threshold, the processor completes the configuration operation, and then the lockstep controller processing unit enters the idle state through software operation;

[0034] Step 3, in the idle state, the dual-core lockstep control and processing device waits for an operation request signal, after the lockstep control register module captures and saves the operation request, the lockstep controller processing unit performs state transition, and the lockstep controller monitoring unit internal processing behavior monitoring logic timer starts working;

[0035] The operation request includes a master-slave processor comparison mismatch signal sent by the lockstep controller comparison unit and a periodic checkpoint request signal sent by the processor;

[0036] Step 4, when the lockstep is enabled, if the processing state timer is not enabled, the lockstep controller processing unit enters the invalid state; if the lockstep is enabled and the processing state timer is enabled, the lockstep controller processing unit enters the processing state;

[0037] Step 5, in the processing state, the lockstep controller processing unit outputs a processing operation signal, and the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped;

[0038] The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation;

[0039] Step 6, in the processing state, the processing operation behavior is monitored by the processing state timer, if the processing state timer reaches the threshold, the lockstep controller processing unit enters the invalid state, the processing state timer is cleared and stopped, and step 8 is executed; if the processing state timer does not reach the threshold, the processing state timer continues to work, and step 7 is executed;

[0040] Step 7, waiting for the processing operation to be completed, the processor clears the processing state register state through software operation, enters the idle state, the processing state timer is cleared and stopped, and step 3 is executed;

[0041] Step 8, in the invalid state, the lockstep controller processing unit outputs a system reset signal, and the lockstep controller internal processing behavior monitoring logic timer is cleared and stopped.

[0042] Further, in step 1, the following steps are further included:

[0043] Step 11, in the idle state, write corresponding operation number into the operation access register, which indicates the idle state entering configuration state command; after writing corresponding operation number into the operation access register, write idle state jump to configuration state command into the lockstep control register; the lockstep controller processing unit internal state machine jumps to the configuration state;

[0044] Step 12, in the configuration state, configure the register to determine the lockstep controller processing unit behavior to adapt to the specific application requirements of the system; lockstep enable is used to determine whether the dual-core lockstep control and processing unit works; processing state timer enable is used to determine that the lockstep controller processing unit internal state machine jumps to the processing state to initiate processing operation after receiving operation request; processing state timer threshold is used to determine the maximum time of processing operation.

[0045] Further, in step 2, in the configuration state, if an operation request is received, the processing state register captures and saves the operation request, and after the lockstep controller processing unit enters the idle state, the lockstep controller processing unit performs state conversion according to the operation request captured by the processing state register and the behavior of the lockstep controller processing unit.

[0046] Further, in step 5, if the processing state register captures and saves the periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs the checkpoint interrupt operation request signal to save the running data of the processor core at the checkpoint into the ECC protected memory after entering the processing state; the running data includes the register data of the processor core and the processor core running state data; the processor core running state data includes the processor stack space data and the memory data segment data;

[0047] If the processing state register captures and saves the master-slave processor comparison mismatch signal issued by the lockstep controller comparison unit, the lockstep controller processing unit outputs the rollback interrupt operation request signal to restore the running data of the processor core to the running data at the checkpoint before the rollback interrupt, so as to restore the processor to the correct running state saved before; at the same time, after the lockstep controller monitoring unit receives the processing operation signal issued by the lockstep controller processing unit, the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped.

[0048] Further, in step 8, in the failure state, the lockstep controller processing unit outputs a system reset signal, so that the system is reset, the internal error of the processor is cleared, the situation of incorrect operation or deadlock of the processor caused by the internal error is solved, the system returns to the initial running state after power-on, and the system runs in the safe state, that is, the system runs correctly and can correctly handle errors, and meanwhile, the lockstep controller receives the system reset signal output by the lockstep controller processing unit, the internal processing behavior monitoring logic of the lockstep controller monitoring unit is cleared and timing is stopped.

[0049] The present application has the following beneficial effects:

[0050] The present application realizes a dual-core lockstep processor combined with checkpoint and rollback strategies, and realizes lockstep control and processing through a dual-core lockstep processor control and processing device, so that the system runs in a safe state. Specifically, the beneficial effects are as follows: periodic checkpoint request operations sent by the processor are received and saved, and a comparison mismatch signal output by the processor is received and saved, the system is controlled and processed in a system manner to run in a safe state; the normal operation of configuration operations and processing operations is ensured through an internal configuration state timer and a processing state timer of the lockstep controller processing unit; the normal operation of the lockstep controller processing unit is ensured through a lockstep controller monitoring unit. On the basis of the dual-core lockstep processor combined with checkpoint and rollback operations, the dual-core lockstep processor is implemented with high reliability. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a structural schematic diagram of a high-reliability lockstep control and processing device provided by an embodiment of the present application;

[0052] Figure 2 is a structural schematic diagram of a dual-core lockstep processor provided by an embodiment of the present application.

[0053] Figure 3 is a processing unit state transition schematic diagram of a high-reliability lockstep control and processing device provided by an embodiment of the present application;

[0054] Figure 4 is a command operation handshake schematic diagram of a register module command operation state machine and a lockstep controller command operation state machine of a high-reliability lockstep control and processing device provided by an embodiment of the present application;

[0055] Figure 5 is an operation flowchart of a monitoring unit of a high-reliability lockstep control and processing device provided by an embodiment of the present application.

[0056] Figure 6 is a method schematic flowchart of a high-reliability lockstep control and processing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0057] The present application will be further described below in connection with specific embodiments, and its advantages and characteristics will become more apparent from the description. However, these embodiments are only exemplary, and do not constitute any limitation on the scope of the present application. Those skilled in the art should understand that the details and forms of the technical solutions of the present application can be modified or replaced without departing from the spirit and scope of the present application, and such modifications and replacements fall within the protection scope of the present application.

[0058] As shown in the accompanying drawings, Figure 1 A dual-core lockstep control and processing device is provided to perform error handling operations at a software level, to ensure the correctness of software processing error operations and correct operation of the system, and to design a high-reliability dual-core lockstep control and processing device while ensuring correct operation of the device. The dual-core lockstep is completed under the premise that the system is running in a safe state.

[0059] The device comprises a lockstep controller processing unit, a lockstep controller monitoring unit and a lockstep controller register module.

[0060] The lockstep controller processing unit is connected with the lockstep controller comparison unit, the lockstep controller register module and the lockstep controller monitoring unit, and is configured to receive an operation request signal. The operation request signal comprises a master-slave processor comparison mismatch signal sent by the lockstep controller comparison unit and a periodic checkpoint request signal sent by the processor, and a processing operation signal is sent according to configuration information of the lockstep controller register module. The processing operation signal comprises a checkpoint interrupt processing operation request and a rollback interrupt processing operation request.

[0061] The lockstep controller register module is connected with the lockstep controller comparison unit and the lockstep controller processing unit, and is configured to receive configuration information of the processor, and determine behaviors of the lockstep controller comparison unit and the lockstep controller processing unit.

[0062] The lockstep controller monitoring unit is connected with the lockstep controller comparison unit and the lockstep controller processing unit, and comprises an internal processing behavior monitoring logic timer. The lockstep controller monitoring unit receives an operation request signal and a processing operation signal, and monitors behaviors of the lockstep controller processing unit. If the monitoring logic timer reaches a timing threshold, a system reset signal is sent.

[0063] The lockstep controller comparison unit compares an output of the master processor after a fixed delay with an output of the slave processor after a fixed delay at each clock cycle.

[0064] As shown in the accompanying drawings, Figure 2As shown, in one embodiment, the lockstep controller comparison unit compares the fixed delayed output of the master processor and the fixed delayed output of the slave processor, which includes the output of the processor core without internal cache, the output of the processor bus interface, the output of the processor local memory interface, and the output of the processor cache interface.

[0065] The lockstep controller comparison unit compares the fixed delayed output of the master processor and the fixed delayed output of the slave processor at each clock cycle and outputs a mismatch signal.

[0066] The lockstep controller register module includes a register operation state machine and an internal register unit.

[0067] The internal register unit includes an operation control register, an operation access register, a processing state register, a lockstep enable register, a configuration state timer threshold register, a processing state timer enable register, a processing state timer threshold register, and a processing unit running state register.

[0068] The operation control register receives corresponding commands through processor read-write control, which include the command for the lockstep controller processing unit internal state machine to jump from the configuration state to the idle state, the command for the idle state to jump to the configuration state, the command for clearing the lockstep control unit processing state register, the command for setting the lockstep enable register, and the command for reading the processing unit running state.

[0069] The operation access register is required to write corresponding operation numbers into the register before the processor sends commands, and different operation numbers correspond to different commands.

[0070] After writing the corresponding operation numbers into the operation access register, the next step must be to write the operation controller to execute the corresponding operation command.

[0071] The processing state register is used to capture and save operation request signals, and the clearing of the processing state register must be preceded by writing the corresponding operation number into the access operation register and then writing the corresponding command into the operation control register.

[0072] The lockstep enable register is used to control the behavior of the comparison unit, the processing unit, and the monitoring unit, and the setting of the lockstep enable register must be preceded by writing the corresponding operation number into the access operation register and then writing the corresponding command into the operation control register.

[0073] When the lockstep enable register value is 0, the lockstep control and processing device are not enabled.

[0074] The configuration state timer threshold register is the maximum working time of the processing unit in the configuration state, and this threshold should be less than the threshold of the internal processing behavior monitoring logic timer of the lockstep processor monitoring unit.

[0075] The processing state timer enable register is used to control the enabling of the timer in the processing unit during the processing state;

[0076] The processing state timer threshold register is the maximum working time of the processing unit in the processing state, and this threshold should be less than the threshold of the processing behavior monitoring logic timer inside the lockstep processor monitoring unit.

[0077] The processing unit running status register stores the current running state of the processing unit state machine;

[0078] Among them, the register operation state machine is the process by which the register module requests the lockstep controller processing unit to initiate an operation after receiving the register read / write operation from the processor, and performs a handshake operation with the lockstep controller processing unit's operation state machine.

[0079] As attached Figure 4 In the IDLE state of the register operation state machine, it receives the request command from the processor and sends the operation request and command to the lockstep controller processing unit. Then it enters the PH1 state to wait for the lockstep controller processing unit to respond. When it receives the response signal from the lockstep controller processing unit, it enters the PH2 state and cancels the request. After waiting for the lockstep controller processing unit to respond, it enters the IDLE state.

[0080] The lockstep controller processing unit also includes a lockstep controller state control unit, a configuration state timer, a processing state timer, and a lockstep controller command operation state machine.

[0081] As attached Figure 3 The state machine state of the lockstep controller state control unit includes configuration state, idle state, processing state, and failure state.

[0082] The initial state of the internal state control unit of the lockstep controller is idle.

[0083] In the idle state, the processing unit can receive a request from the register module to enter the configuration state and enter the configuration state.

[0084] In the configuration state, by receiving the processor's read and write operations on the lockstep controller register module, the behavior of the lockstep control and processing device is determined, including the configuration of the processing state timer enable register and the configuration of the processing state timer threshold register.

[0085] In the configuration state, the processing unit cannot configure the configuration state timer threshold register;

[0086] If the processing unit fails to complete the operation within the configuration state timer threshold while in the configuration state state, it enters the idle state, and the processing state timer enable register and the processing state timer threshold register are both set to their initial values.

[0087] In the configuration state, if an operation request is received, the behavior of the lockstep controller processing unit is determined by the behavior of the lockstep controller processing unit after configuration is completed.

[0088] In the idle state, if the processing status register stores an operation request (i.e., a non-zero value) and the processing status timer is enabled, the system enters the processing state; otherwise, it enters the invalid state.

[0089] In the processing state, the processor initiates a checkpoint interrupt operation request and a rollback interrupt operation request. After completing the checkpoint interrupt operation or the rollback interrupt operation, the processor issues a command to clear the processing status register and enters the idle state.

[0090] If the processing operation is not completed within the processing state time threshold during the processing state, it enters a failure state.

[0091] In the event of a failure, the processing unit initiates a system reset;

[0092] The configuration state timer starts counting when entering the configuration state. When the count reaches the threshold, the processing state timer, the enable register, and the processing state timer threshold register are all set to their initial values ​​and the system enters the processing state. If the system enters the idle state before the count reaches the threshold, the count is cleared.

[0093] The processing state timer starts counting when it enters the processing state after receiving a periodic checkpoint operation request and a processor output mismatch signal. When the count reaches the threshold, it enters the failure state.

[0094] As attached Figure 4 As shown, the lockstep controller command operation state machine is used to receive and execute the processor operation commands decoded by the register module. In the IDLE state, upon receiving an operation request, it enters the PH1 state, receives the command after the cross-clock domain operation, enters the PH2 state, decodes the command, enters the PH3 stage, executes the command, enters the PH4 stage, initiates an acknowledgment signal, enters the PH5 stage, the operation request ends, and it enters the IDLE state.

[0095] As attached Figure 5 The lockstep controller monitors the working status of the unit. When lockstep is enabled, i.e. the lockstep control and processing device is working, when an operation request is received, the internal processing behavior monitoring logic timer starts counting. If no processing operation signal is detected within the timer threshold, the lockstep controller monitors the unit's working status.

[0096] A lockstep control and processing method, the method comprising:

[0097] Step 1, after the system is powered on, entering idle state, the processor writes corresponding operation number into operation access register through software operation, which indicates the command of idle state entering configuration state;

[0098] Specifically, in step 1, the following steps are further included:

[0099] Step 11, the configuration state can only be accessed in idle state, in idle state, the processor writes corresponding operation number into operation access register through software operation, which indicates the command of idle state entering configuration state; after the processor writes corresponding operation number into operation access register, the processor writes the command of idle state jumping to configuration state into lockstep control register through software operation; the internal state machine of lockstep controller processing unit jumps to configuration state;

[0100] Through this way of writing corresponding operation number first and then writing corresponding command, it is ensured that the command is not initiated or executed incorrectly due to soft error, and the reliability of dual-core lockstep control and processing device is ensured;

[0101] Step 12, in configuration state, the processor performs configuration operation on the register which can only be written in configuration state, wherein the configuration operation determines the behavior of lockstep controller processing unit, which is adapted to the specific application requirement of the system; the behavior of lockstep controller processing unit includes lockstep enable, processing state timer enable and processing state timer threshold value;

[0102] Step 2, in configuration state, it is judged whether the configuration state timer reaches the threshold value, if yes, the lockstep controller processing unit enters idle state; if no, after the processor completes the configuration operation, the processor makes the lockstep controller processing unit enter idle state through software operation;

[0103] Specifically, if the configuration state timer does not reach the threshold value, the processor writes corresponding operation number into operation access register through software operation, which indicates the command of configuration state entering idle state; after the processor writes corresponding operation number into operation access register, the processor writes the command of configuration state jumping to idle state into lockstep control register through software operation, and the internal state machine of lockstep controller processing unit jumps to idle state;

[0104] Specifically, if the configuration state timer reaches the threshold value, the lockstep controller processing unit internal state machine directly enters the idle state, and the lockstep controller processing unit sends a configuration timeout signal. The lockstep controller register module receives the configuration timeout signal sent by the lockstep controller processing unit. In order to ensure the correct behavior of the lockstep controller processing unit, after receiving the configuration timeout signal, the lockstep controller register module sets the lockstep enable register to zero, i.e., the lockstep is not enabled, sets the processing state timer enable register to zero, i.e., the processing state timer is not enabled, and sets the processing state timer threshold register value to zero.

[0105] In the configuration state, if the device receives an operation request, the processing state register captures and saves the operation request, wherein the operation request includes the master-slave processor comparison mismatch signal sent by the lockstep controller comparison unit and the periodic checkpoint request signal sent by the processor. After the lockstep controller processing unit enters the idle state, the lockstep controller processing unit performs state transition according to the operation request captured by the processing state register and the behavior of the lockstep controller processing unit.

[0106] Step 3, in the idle state, the dual-core lockstep control and processing device waits for an operation request signal. After the lockstep control register module captures and saves the operation request, the lockstep controller processing unit performs state transition, and the lockstep controller monitoring unit internal processing behavior monitoring logic timer starts working.

[0107] Specifically, in the idle state, after the processing state register captures and saves the operation request signal, the dual-core lockstep control and processing device works according to the behavior of the lockstep controller processing unit determined in the configuration state, including lockstep enable, processing state timer start, and processing state timer threshold. The lockstep enable is used to determine whether the dual-core lockstep control and processing unit works. If the lockstep enable is enabled, the lockstep controller monitoring unit internal processing behavior monitoring logic timer starts counting, and the lockstep controller monitoring unit receives the output of the lockstep controller processing unit to ensure that the lockstep controller processing unit works normally, i.e., to ensure that the system runs in a safe state, which is a state in which the system correctly runs and can correctly handle errors.

[0108] Step 4, when the lockstep enable is enabled, it is determined whether the processing state timer is enabled.

[0109] Specifically, the processing state timer enable is used to determine whether the lockstep controller processing unit internal state machine jumps to the processing state to initiate processing operation after receiving the operation request. If the processing state timer is not enabled, i.e., the system does not process the operation request, the lockstep controller processing unit enters the invalid state and executes step 8. If the lockstep enable is enabled and the processing state timer is enabled, i.e., the lockstep controller processing unit processes the operation request, the lockstep controller processing unit enters the processing state and executes step 5.

[0110] Step 5, in the processing state, the lockstep controller processing unit outputs a processing operation signal, the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped timing;

[0111] The processing operation is one of a checkpoint interruption request operation and a rollback interruption request operation.

[0112] Specifically, if the processing state register captures and saves a periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs a checkpoint interruption operation request signal to save the running data of the processor core at the checkpoint to the ECC-protected memory after entering the processing state; wherein the running data includes register data and running state data of the processor core; the running state data of the processor core includes processor stack space data and memory data segment data.

[0113] If the processing state register captures and saves a master-slave processor comparison mismatch signal issued by the lockstep controller comparison unit, the lockstep controller processing unit outputs a rollback interruption operation request signal to restore the running data of the processor core to the running data at the checkpoint before the rollback interruption, so that the processor is restored to the correct running state saved before; at the same time, after the lockstep controller monitoring unit receives the processing operation signal issued by the lockstep controller processing unit, the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped timing.

[0114] Step 6, in the processing state, the lockstep controller processing unit determines whether the processing state timer reaches the threshold value;

[0115] Specifically, in the processing state, the processing operation behavior is monitored by the processing state timer, and the processing state timer threshold value is used to determine the maximum time of the processing operation; when the lockstep controller processing unit enters the processing state, the processing state timer starts to work, and it is determined whether the processing state timer reaches the threshold value; if yes, the system fails to process the error, that is, the processor enters an error running state or deadlock, the lockstep controller processing unit enters the invalid state, the processing state timer is cleared and stopped, and step 8 is executed; if not, the processing state timer continues to work, and step 7 is executed.

[0116] Step 7, waiting for the processing operation to be completed, and the processor clears the processing state register state through software operation.

[0117] Specifically, the processor clears the processing status register state by software, the processor clears the processing status register state by software, i.e. handles the error in a software manner, the dual-core lockstep control and processing device controls and handles the error in a system manner, makes the system work in a safe state, enters an idle state, the processing status timer is cleared and stopped, and step 3 is executed;

[0118] Step 8, in the failure state, the lockstep controller processing unit outputs a system reset signal, and the lockstep controller internal processing behavior monitoring logic timer is cleared and stopped;

[0119] Specifically, in the failure state, the lockstep controller processing unit outputs a system reset signal, so that the system is reset, the internal error of the processor is cleared, the situation of incorrect operation or deadlock of the processor caused by the internal error is solved, the system returns to the initial running state after power-on, and the system runs in a safe state, i.e. a state in which the system runs correctly and can correctly handle errors. Meanwhile, the lockstep controller receives the system reset signal output by the lockstep controller processing unit, the lockstep controller internal processing behavior monitoring logic is cleared and stopped.

[0120] In a dual-core locked-step microcontroller, a master-slave processor comparison mismatch error is handled by combining checkpoint and rollback interrupt operations. In practical applications, this embodiment employs the highly reliable locked-step control and processing device proposed in this invention to process checkpoint operation requests and master-slave processor comparison mismatch errors issued by the comparison unit. To verify the effectiveness of the technical solution in this embodiment, a simulated fault injection method is used to simulate actual soft errors occurring within the processor. At random moments during correct processor operation, random bits of all register units within the processor are toggled for two clock cycles. Simultaneously, fault injection is performed at the same time on the same bits of the same registers in both the microcontroller using the highly reliable locked-step control and processing device and the microcontroller without the device. Thus, when the internal registers toggle, the processor outputs the same result in both microcontrollers executing the same test case. The results were the same; FIR operation benchmark program and Matrix operation benchmark program were used as test cases respectively. At the same time, the test cases included read and write memory, read and write peripherals, read and write cache, data operation and conditional branch instructions to more comprehensively cover the fault tolerance function points. The number of errors that were successfully handled by rollback after the random injected fault was detected, the number of errors that were handled by reset due to failure to handle by rollback, the ratio of the number of errors that were handled by reset due to failure to handle by rollback to the total number of errors, and the ratio of the number of unrecovered errors to the total number of errors are recorded in Table 1. When the microcontroller uses a high-reliability lockstep control and processor device, as shown in Table 1, when this device is used, it can effectively solve the problem that checkpoint and rollback operations cannot handle errors when the internal error processor enters an error running state and a deadlock state. This proves that the device can solve the problem of processor error running and deadlock state errors and ensure that the system runs normally in a safe state.

[0121] Table 1

[0122]

[0123] The above are merely specific steps of the present invention and do not constitute any limitation on the scope of protection of the present invention; all technical solutions formed by equivalent transformation or equivalent substitution fall within the scope of protection of the present invention; the parts of the present invention not described in detail are common knowledge to those skilled in the art.

Claims

1. A high-reliability processor dual-core lockstep control and processing apparatus, the high-reliability processor dual-core lockstep control and processing apparatus being connected with a lockstep controller comparison unit, characterized by, The high-reliability processor dual-core lockstep control and processing device comprises a lockstep controller processing unit, a lockstep controller register module and a lockstep controller monitoring unit; The lockstep controller processing unit comprises a processing state timer, a lockstep controller state control unit, a configuration state timer and a lockstep controller command operation state machine; After the lockstep controller processing unit receives an operation request, it outputs a processing operation and monitors the processing operation behavior; if the processing state timer reaches a threshold value, the lockstep controller processing unit enters a failure state, the processing state timer is cleared and stops working; if the processing state timer does not reach the threshold value, it waits for the processing operation to be completed; The operation request comprises a master-slave processor comparison mismatch signal sent by a lockstep controller comparison unit and a periodic checkpoint request signal sent by a processor; The processing operation comprises a checkpoint interrupt request operation and a rollback interrupt request operation; In the failure state, the lockstep controller processing unit outputs a system reset signal; The internal state machine of the lockstep controller state control unit comprises a configuration state, an idle state, a processing state and a failure state; The configuration state timer starts counting as soon as it enters the configuration state; if the count reaches a threshold value, the processing state timer, the lockstep enable register and the processing state timer threshold register are all set to initial values, and the idle state is entered; if the count does not reach the threshold value, the processor enters the idle state through software operation after completing the configuration operation, and the count is cleared; The lockstep controller register module comprises a processing state register, a lockstep enable register and a processing state timer threshold register; The processing state register is used to capture and save operation request signals; The lockstep enable register is used to control the behavior of the lockstep controller processing unit and the lockstep controller monitoring unit; The processing state timer threshold register is the longest working time of the processing unit in the processing state, and the threshold value should be smaller than the threshold value of the internal processing behavior monitoring logic timer of the lockstep processor monitoring unit; The lockstep controller monitoring unit comprises an internal processing behavior monitoring logic timer, receives operation request signals and processing operation signals, and monitors the behavior of the lockstep controller processing unit; if the monitoring logic timer reaches a timing threshold value, a system reset signal is sent.

2. The high-reliability processor dual-core lockstep control and processing apparatus of claim 1, wherein, The initial state of the internal state machine of the lockstep controller state control unit is the idle state; In the idle state, the processing unit can receive an idle state configuration state request of the register module and enter the configuration state; In the configuration state, the behavior of the lockstep control and processing device is determined by receiving read and write operations of the processor on the lockstep controller register module, including processing state timer enable register configuration and processing state timer threshold register configuration; In the configuration state, the processing unit cannot configure the configuration state timer threshold register; In the configuration state, if the processing unit does not complete the operation within the configuration state timer threshold value, it enters the idle state, and the processing state timer enable register and the processing state timer threshold register are both set to initial values. In the configuration state, if an operation request is received, the behavior of the lockstep controller processing unit is determined by the behavior of the lockstep controller processing unit after the configuration is completed; In the idle state, if the operation request is saved in the processing state register, i.e. a non-zero value, and the processing state timer is enabled, the processing state is entered; if the processing state timer is not enabled, the invalid state is entered; In the processing state, the checkpoint interrupt operation request and the rollback interrupt operation request are initiated, the checkpoint interrupt operation or the rollback interrupt operation is completed, the processor initiates a clear processing state register command, and the idle state is entered; In the processing state, if the processing operation is not completed within the processing state timer threshold time, the invalid state is entered; In the invalid state, the processing unit initiates a system reset.

3. A high-reliability processor dual-core lockstep control and processing method based on the high-reliability processor dual-core lockstep control and processing apparatus of any one of claims 1-2, characterized in that, The high-reliability processor dual-core lockstep control and processing method comprises the following steps: Step 1: The processor dual-core lockstep control and processing device enters the configuration state from the idle state, and the behavior of the lockstep controller processing unit is determined; The behavior of the lockstep controller processing unit includes lockstep enable, processing state timer enable, and processing state timer threshold; Step 2: In the configuration state, if the configuration state timer reaches the threshold, the lockstep controller processing unit enters the idle state; if the configuration state timer does not reach the threshold, the processor completes the configuration operation, and then the lockstep controller processing unit enters the idle state through software operation; Step 3: In the idle state, the dual-core lockstep control and processing device waits for an operation request signal, and after the operation request is captured and saved in the lockstep control register module, the lockstep controller processing unit performs state conversion, and the lockstep controller monitoring unit internal processing behavior monitoring logic timer starts working; The operation request includes a master-slave processor comparison mismatch signal sent by the lockstep controller comparison unit and a periodic checkpoint request signal sent by the processor; Step 4: When the lockstep enable is enabled, if the processing state timer is not enabled, the lockstep controller processing unit enters the invalid state; if the lockstep enable is enabled and the processing state timer is enabled, the lockstep controller processing unit enters the processing state; Step 5: In the processing state, the lockstep controller processing unit outputs a processing operation signal, and the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped; The processing operation includes a checkpoint interrupt request operation and a rollback interrupt request operation; Step 6: In the processing state, the processing operation behavior is monitored by the processing state timer, if the processing state timer reaches the threshold, the lockstep controller processing unit enters the invalid state, the processing state timer is cleared and stopped, and step 8 is executed; if the processing state timer does not reach the threshold, the processing state timer continues to work, and step 7 is executed; Step 7: Wait for the processing operation to be completed, the processor clears the processing state register state through software operation, enters the idle state, the processing state timer is cleared and stopped, and step 3 is executed; Step 8: In the invalid state, the lockstep controller processing unit outputs a system reset signal, and the lockstep controller internal processing behavior monitoring logic timer is cleared and stopped.

4. The high-reliability processor dual-core lockstep control and processing method of claim 3, wherein, In step 1, the following steps are further included: Step 11, in the idle state, write corresponding operation number into the operation access register, which indicates the idle state entering configuration state command; after writing corresponding operation number into the operation access register, write idle state jump to configuration state command into the lockstep control register; the lockstep controller processing unit internal state machine jumps to the configuration state; Step 12, in the configuration state, configure the register to determine the lockstep controller processing unit behavior, adapt to the specific application requirements of the system; lockstep enable is used to determine whether the dual-core lockstep control and processing unit work; processing state timer enable is used to determine that after receiving the operation request, the lockstep controller processing unit internal state machine jumps to the processing state to initiate processing operation; processing state timer threshold is used to determine the maximum time of processing operation.

5. The high-reliability processor dual-core lockstep control and processing method of claim 3, wherein, In step 2, in the configuration state, if an operation request is received, the processing state register captures and saves the operation request, and after the lockstep controller processing unit enters the idle state, the lockstep controller processing unit state transitions according to the operation request captured by the processing state register and the lockstep controller processing unit behavior.

6. The high-reliability processor dual-core lockstep control and processing method of claim 3, wherein, In step 5, if the processing state register captures and saves the periodic checkpoint request signal issued by the processor, the lockstep controller processing unit outputs the checkpoint interrupt operation request signal to save the running data of the processor core at the checkpoint into the ECC protected memory after entering the processing state; the running data includes the register data of the processor core and the processor core running state data; the processor core running state data includes the processor stack space data and the memory data segment data; If the processing state register captures and saves the master-slave processor comparison mismatch signal issued by the lockstep controller comparison unit, the lockstep controller processing unit outputs the rollback interrupt operation request signal to restore the running data of the processor core to the running data at the checkpoint before the rollback interrupt, so that the processor is restored to the correct running state saved before; at the same time, after the lockstep controller monitoring unit receives the processing operation signal issued by the lockstep controller processing unit, the lockstep controller monitoring unit internal processing behavior monitoring logic timer is cleared and stopped.

7. The high-reliability processor dual-core lockstep control and processing method of claim 3, wherein, In step 8, in the failure state, the lockstep controller processing unit outputs a system reset signal to reset the system, clear the internal error of the processor, solve the situation of incorrect running or deadlock of the processor caused by internal error, and restore the system to the initial running state after power on, so that the system runs in a safe state, that is, the system runs correctly and can correctly handle errors, at the same time, the lockstep controller receives the system reset signal output by the lockstep controller processing unit, and the lockstep controller monitoring unit internal processing behavior monitoring logic is cleared and stopped.

Images