A dual-core lockstep processor fault recovery device and method

Abstract

The present invention is applicable to the field of chip fault recovery technology and provides a dual-core lockstep processor fault recovery device and method. Before recovering from a processor fault, the present invention performs a self-test on the relevant system components required for processor operation. The specific self-test content is configurable and includes chip component self-test, processor self-test, software self-test, etc. Based on the self-test status, abnormal parameters or states are selectively restored to ensure that the current software and hardware states allow system rollback operations. This eliminates the need for multiple recovery points or a full reset to ensure recovery, thereby ensuring the reliability of fault recovery.

Description

Technical Field

[0001] The present invention belongs to the technical field of chip fault recovery, and in particular relates to a dual-core lockstep processor fault recovery device and method. Background Art

[0002] With the continuous advancement of integrated circuit manufacturing processes, the number of transistors that can be integrated on a single silicon chip has increased. However, as transistor feature sizes continue to shrink and threshold voltages continue to decrease, chip reliability issues are becoming increasingly serious. Chip failures caused by the failure of certain functional units within the circuit during operation are considered hard errors and are unrecoverable. In contrast, logic failures caused by logic upsets due to noise interference or high-energy particle bombardment are called soft errors and are recoverable.

[0003] One of the primary methods for processor fault detection is the dual-core lockstep recovery method used in dual-core lockstep processor systems. A dual-core lockstep processor system consists of two processor cores: a primary core and a redundant core. Upon system power-up, both cores are initialized to the same state and receive identical inputs (including instruction codes, bus operations, and asynchronous events). Therefore, at any given processor cycle, the two cores maintain identical states. A mismatch in the output of either core indicates a processor error.

[0004] The process of the conventional dual-core lockstep recovery method is generally as follows:

[0005] (1) Before the processor detects an error, it may generate a backup snapshot of the processor state at a fixed time or according to the software setting recovery point, or use the processor output as a comparison and backup content at each clock cycle.

[0006] (2) When a dual-core mismatch error occurs during dual-core output data comparison or pipeline level comparison, the processor is paused, the system is reset, and the initialization process is performed. After the reset is completed, a rollback operation is performed to restore the processor information to the most recently backed up one or several recovery points.

[0007] (3) The rollback is completed and the processor rewinds to the recovery point.

[0008] In the above process, when any inconsistency is detected between the primary and redundant processor cores, the conventional dual-core lockstep recovery method is to directly reset both cores and then perform a rollback recovery operation. This method is likely to fail because the system cannot confirm whether the current processor is in a recoverable state, whether user data is corrupted, or whether the system is in an unrecoverable state before rolling back. This recovery method is not reliable and the recovery process is also prone to long recovery times.

[0009] For example, patent publication number CN220983766U discloses a cycle fault detection and repair circuit for dual-core lockstep. This patent detects single-cycle dual-core lockstep errors in the processor pipeline structure and can repair single-cycle dual-core lockstep fault detection in the pipeline structure. Because fault detection is based solely on the pipeline structure, this method cannot recover processor pipeline lockstep errors other than those caused by pipeline anomalies by re-execution through target pipeline register data. Without a safe recovery point for field protection, it is impossible to determine whether the current chip state meets the conditions for direct rewinding before rewinding, and normal system rewinding cannot be guaranteed.

[0010] For example, patent publication number CN119248578B discloses a microprocessor fault recovery device, method, and chip. After a lockstep detection error, the program counter is controlled to recover to the recovery point position. The backup adopts one or more recovery points. If multiple recovery points are saved, during the recovery phase, the CPU is paused and the first type of data is restored by reset. The second type of data is then restored based on the backup recovery point data. The device can first rewind to the nearest recovery point. If the rewind is unsuccessful, it can rewind to a more distant recovery point, and so on. This method uses a reset method to recover the first type of parameter data and recovers the second type of parameter data based on the recovery point backup data. This method does not determine whether the current chip meets the rewind conditions and also carries the risk of rewind failure.

[0011] Alternatively, if a three-core architecture is used, a two-out-of-three voting circuit is used to determine which core is faulty, and only the faulty core is corrected. While this eliminates the need for system error correction, it does require an additional processor core, resulting in higher hardware overhead compared to a dual-core solution.

[0012] Therefore, a reliable and efficient error recovery scheme based on a dual-core lockstep processor is needed. Summary of the Invention

[0013] In view of the above problems, the object of the present invention is to provide a dual-core lockstep processor fault recovery device and method, aiming to solve the above technical problems.

[0014] The present invention adopts the following technical solutions:

[0015] On the one hand, the dual-core lock-step processor fault recovery device includes a dual-core lock-step processor, a recovery management module, a recovery backup module, a recovery self-test module, and a recovery site module, wherein the recovery backup module, the recovery self-test module, and the recovery site module are all connected to the dual-core lock-step processor and the recovery management module, and the dual-core lock-step processor is also connected to the recovery management module;

[0016] The dual-core lockstep processor includes two processor cores. When the system is powered on, the two processor cores are initialized to the same state and receive the same input. A comparator in the dual-core lockstep processor is used to compare all outputs of the two processor cores, detect the dual-core operation matching status, and determine whether a dual-core mismatch error occurs. If no error occurs, the detection is maintained. When the outputs of the two processor cores do not match, the processor operation is suspended, and the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module.

[0017] The recovery and backup module is used to perform on-site backup of processor data after receiving a backup request, and send a backup completion flag to the recovery management module after the backup is completed;

[0018] The recovery self-test module is used to perform self-test operations before recovery in sequence according to the self-test request, and send a self-test result completion flag to the recovery management module after the self-test is completed;

[0019] The recovery site module is used to complete the self-check and, when receiving the recovery site request from the recovery management module, rewind the backup data to the recovery point according to the backup data of the recovery backup module, and send a recovery completion flag to the recovery management module after the recovery is completed;

[0020] The recovery management module is responsible for managing the self-test and recovery process, specifically: detecting whether the processor has run to the software-set recovery point, and if so, sending a backup request to the recovery backup module; and controlling the suspension of processor operation and sending a self-test request to the recovery self-test module upon receiving a dual-core mismatch error signal; sending a recovery site request to the recovery site module upon receiving a self-test result completion flag; and releasing the processor upon receiving a recovery completion flag, allowing the processor to run from the recovery point and complete error recovery.

[0021] On the other hand, the dual-core lockstep processor fault recovery method includes the following steps:

[0022] Step S1: Initialize the chip and run the user program after initialization is completed;

[0023] Step S2: The recovery management module detects whether the processor has reached the recovery point set by the software. If so, it sends a backup request to the recovery backup module.

[0024] Step S3: The recovery and backup module performs an on-site backup of the processor data, and sends a backup completion flag to the recovery management module after the backup is completed;

[0025] Step S4: The dual-core lockstep processor detects the dual-core operation matching status and determines whether a dual-core mismatch error occurs. If no error occurs, the detection is continued.

[0026] Step S5: If an error occurs, the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module;

[0027] Step S6: The recovery management module controls the suspended processor operation and sends a self-test request to the recovery self-test module;

[0028] Step S7: The recovery self-test module performs the self-test operation before recovery in sequence according to the self-test request, and sends a self-test result completion flag to the recovery management module after the self-test is completed;

[0029] Step S8: The recovery management module sends a recovery site request to the recovery site module;

[0030] Step S9: The recovery site module rewinds the backup data of the recovery point according to the backup data of the recovery backup module, and sends a recovery completion flag to the recovery management module after the recovery is completed;

[0031] Step S10: The recovery management module releases the processor, and the processor runs from the recovery point to complete error recovery.

[0032] Furthermore, in step S6, the recovery management module sends a corresponding self-test request to the recovery self-test module as required according to the self-test configuration; wherein the self-test request includes at least one of a chip component self-test request, a processor self-test request, and a software self-test request.

[0033] Furthermore, the specific process of step S7 is as follows:

[0034] S71. When the recovery self-test module receives a chip component self-test request, the recovery self-test module detects the status of key chip components and sends the self-test results to the recovery management module. If the self-test is normal, and if the self-test configuration includes a processor self-test, the recovery management module sends a processor self-test request to the recovery self-test module.

[0035] S72. When the recovery self-test module receives the processor self-test request, the recovery self-test module controls the processor to load a test program, and after the test is completed, outputs the processor test self-test result to the recovery management module. If the self-test is normal, and if the self-test configuration includes a software self-test, the recovery management module sends a software self-test request to the recovery self-test module.

[0036] S73. When the recovery self-test module receives the software self-test request, the recovery self-test module sets the processor program counter to the software self-test program counter address. The software self-test program detects the current software environment. If the current software environment meets the conditions for directly restoring to the recovery point, the self-test result completion flag is sent to the recovery management module.

[0037] Furthermore, in step S71, if the self-test of the key components of the chip is abnormal, the recovery management unit restores the chip configuration according to the backup data of the recovery backup module. After the configuration is completed, the chip status is re-tested and waits for it to be ready, and the chip components are self-tested again. If it is still unsuccessful after multiple restorations, the self-test is deemed to have failed.

[0038] Furthermore, in step S72, if the processor self-test is abnormal, the recovery management module controls the processor to perform self-test again through the recovery self-test module according to the configured self-test frequency and number. If the processor self-test is still unsuccessful after multiple times, the self-test is deemed to have failed.

[0039] Furthermore, in step S73, if the software self-check is abnormal, that is, it is detected that the current software environment does not have the conditions for directly rolling back to the recovery point, the current software running environment is restored according to the software and the backup data of the recovery backup module. After the recovery is completed, the software self-check is performed again. If there is no abnormality, the self-check result completion flag is sent to the recovery management module; if the software self-check is still unsuccessful after multiple recoveries, the self-check is deemed to have failed.

[0040] Furthermore, in step S6, if the recovery management module is configured with a pre-recovery self-test, the recovery management module sends a self-test request to the recovery self-test module; otherwise, the process directly proceeds to step S8.

[0041] Furthermore, in step S5, if the dual-core mismatch error occurs in the processor before the recovery point set by the software, a software and hardware reset is performed, and then the process goes to step S1.

[0042] The beneficial effects of the present invention are as follows: in the technical solution of the present invention, before the processor fault is recovered, the relevant system components required for the operation of the processor will be self-checked, and the specific self-check content can be configured, including chip component self-check, processor self-check, software self-check, etc., and the abnormal parameters or status are selectively restored according to the self-check status to ensure that the current software and hardware status allows the system to roll back operations, without the need to use multiple recovery points or overall reset to ensure recovery, thereby ensuring the reliability of fault recovery.

[0043] Compared with direct resetting or direct rewinding, the technical solution of the present invention adds a configurable multi-level software and hardware self-test process before rewinding, and selectively resets or restores chip components based on the self-test results, which has higher flexibility and effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a principle block diagram of a dual-core lockstep processor fault recovery device provided by an embodiment of the present invention;

[0045] Figure 2 is a flowchart of a dual-core lockstep processor fault recovery method provided by an embodiment of the present invention;

[0046] Figure 3 It is a specific execution flow chart of the recovery self-test module. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0048] In order to illustrate the technical solution of the present invention, specific embodiments are provided below.

[0049] like Figure 1 As shown, this embodiment provides a dual-core lock-step processor fault recovery device, including a dual-core lock-step processor, a recovery management module, a recovery backup module, a recovery self-test module, and a recovery site module. The recovery backup module, the recovery self-test module, and the recovery site module are all connected to the dual-core lock-step processor and the recovery management module. The dual-core lock-step processor is also connected to the recovery management module, wherein:

[0050] Dual-core lockstep processor: Contains two processor cores, one primary and one redundant. When the system is powered on, both processor cores are initialized to the same state and receive the same inputs (such as instruction codes, bus operations, asynchronous events, etc.). An error in either processor will cause the two processors to differ in state. The comparator in the dual-core lockstep processor is used to compare all outputs of the two processor cores, detect the matching status of the dual-core operation, and determine whether a dual-core mismatch error has occurred. If no error has occurred, the detection is maintained. If the outputs of the two processor cores do not match, the processor operation is suspended, and the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module.

[0051] In this embodiment, the output information that needs to be compared includes but is not limited to: some signals related to the internal state information of the processor, all signals related to the memory read / write port, all signals related to the bus interface unit, etc.

[0052] Recovery backup module: used to perform on-site backup of processor data after receiving a backup request, and send a backup completion flag to the recovery management module after the backup is completed.

[0053] On-site backup includes hard backup and / or soft backup. The hard backup includes, but is not limited to, general registers, special registers, program counter, stack pointer, processor status word, data segment, and other information required for processor recovery. The soft backup includes, but is not limited to, chip clock management, reset management, power management, and software configuration required for software recovery, such as user data, cache parameters, thread process information, semaphores, and other status information.

[0054] (3) Recovery self-test module: used to perform self-test operations before recovery in sequence according to the self-test request. After the self-test is completed, the self-test result completion flag is sent to the recovery management module.

[0055] Self-test operations include but are not limited to chip self-test, processor self-test, software self-test, etc. Among them, chip self-test mainly checks the external operating conditions provided by the current chip to the processor. The chip self-test content includes but is not limited to the status and configuration check of the chip clock unit, power supply unit, reset unit, memory control unit, etc. The processor self-test mainly detects whether the processor can operate normally. The detection content includes but is not limited to instruction set operation test, bus access, cache read and write test, etc. The software self-test mainly checks whether the recovery software state has the recovery conditions. The software self-test content includes but is not limited to key storage data, key custom variables, user cache data, software process threads, semaphores and other information for program operation.

[0056] The self-checking level and the main content of each level can be optionally configured, that is, the specific self-checking operation level can be configured, and the specific detection content of the selected self-checking operation can be configured.

[0057] (4) Recovery site module: After completing the self-test, when receiving the recovery site request from the recovery management module, it rolls back the backup data of the recovery point according to the backup data of the recovery backup module, and sends the recovery completion flag to the recovery management module after the recovery is completed.

[0058] (5) Recovery management module, responsible for managing the self-test and recovery process, specifically: detecting whether the processor has run to the recovery point set by the software, and if so, sending a backup request to the recovery backup module; and controlling the suspension of the processor operation and sending a self-test request to the recovery self-test module when receiving a dual-core mismatch error signal; and sending a recovery site request to the recovery site module when receiving a self-test result completion flag; and releasing the processor when receiving a recovery completion flag, so that the processor runs from the recovery point and completes error recovery.

[0059] As can be seen from the above device structure, through the recovery management module, when an error occurs in the dual-core lockstep processor, the processor operation can be suspended, and the entire recovery and self-test process can be managed. The recovery self-test module can realize self-testing of each layer of the chip before recovery rollback, and selectively restore the chip parameters based on the self-test results. When the self-test configuration includes chip component self-test, it can ensure that the chip status meets the processor operation requirements. When the self-test configuration includes processor self-test, it can ensure that the processor status meets the operation requirements of the software program rollback to the recovery point. When the self-test configuration includes software self-test, it can ensure that the software environment meets the requirements of rollback to the recovery point and ensure that the rollback is normal.

[0060] Therefore, the device improves the efficiency of recovery, performs hardware and software self-checks and selects configurable options before error recovery, and has high flexibility in selecting rewind speed and rewind reliability.

[0061] In addition, based on the above device, this embodiment also provides a dual-core lockstep processor fault recovery method, combined with Figure 1 、 Figure 2 As shown, the method of this embodiment includes the following steps:

[0062] Step S1: Initialize the chip and run the user program after initialization is completed.

[0063] Step S2: The recovery management module detects whether the processor has run to the recovery point set by the software. If it has run to the recovery point, a backup request is sent to the recovery backup module.

[0064] Step S3: The recovery and backup module performs an on-site backup of the processor data, and sends a backup completion flag to the recovery management module after the backup is completed.

[0065] The above steps S1-S3 are the data backup process. A recovery point is set in the software. Every time a recovery point is reached, a processor data on-site backup is performed so that it can be restored according to the recovery point later. If the recovery point is not reached, step S2 is continued.

[0066] As previously described, on-site backup includes hard backup and / or soft backup. For example, if a hard backup is configured, in this embodiment, after the hard backup is completed, if a soft backup is not configured, the backup recovery module sends a backup completion flag to the recovery management module. If a soft backup is also configured, the backup recovery module may cause the processor to perform the soft backup by, but not limited to, issuing a soft backup interrupt. After the soft backup is completed, the backup recovery module sends a backup completion flag to the recovery management module.

[0067] It should be noted that when the processor runs to the recovery point, the recovery management module detects that the recovery backup module has completed the backup, or the software configuration recovery management module does not perform the backup, then the recovery management module does not send a backup request to the recovery backup module and does not pause the processor.

[0068] Step S4: The dual-core lock-step processor detects the dual-core operation matching status and determines whether a dual-core mismatch error occurs. If no error occurs, the detection is continued.

[0069] In this step, if no dual-core mismatch error occurs, the process proceeds to step S4.

[0070] Step S5: If an error occurs, the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module.

[0071] In this step, if a mismatch error is detected when the dual-cores are running inconsistently, the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module. If the dual-core mismatch error occurs before the software-set recovery point, a software and hardware reset is performed, and then the process goes to step S1.

[0072] Step S6: The recovery management module controls the suspension of the processor operation and sends a self-test request to the recovery self-test module.

[0073] If the recovery management module is configured with a pre-recovery self-test, the recovery management module suspends the processor operation and sends a self-test request to the recovery self-test module; otherwise, the process directly proceeds to step S8.

[0074] Step S7: The recovery self-test module performs the self-test operation before recovery in sequence according to the self-test request, and sends a self-test result completion flag to the recovery management module after the self-test is completed.

[0075] As previously mentioned, the self-test level and specific content are configurable. Based on the self-test configuration, the recovery management module sends corresponding self-test requests to the recovery self-test module as required. The self-test requests include at least one of a chip component self-test request, a processor self-test request, and a software self-test request.

[0076] Combine Figure 3 As shown, the specific process of step S7 is as follows:

[0077] S71. When the recovery self-test module receives a chip component self-test request, the recovery self-test module detects the status of the key components of the chip and sends the self-test results to the recovery management module. If the self-test is normal, and if the self-test configuration includes a processor self-test, the recovery management module sends a processor self-test request to the recovery self-test module.

[0078] If chip component self-test is configured, the recovery management module sends a chip component self-test request to the recovery self-test module, which then checks the status of the key chip components. If the self-test is normal, and the processor self-test is configured, the process proceeds to step S72 by sending a processor self-test request to the recovery self-test module.

[0079] If the chip's key components self-test abnormally, the recovery management unit will restore the chip configuration according to the backup data of the recovery backup module. After the configuration is completed, it will re-test and wait for the chip status to be ready, and then perform chip component self-test again. If it is still unsuccessful after multiple restorations, the self-test is deemed to have failed (the number of repeated self-tests is configurable).

[0080] Here, the abnormal state of the key components of the chip may include but is not limited to abnormal states such as clock lock abnormality, power abnormality, reset abnormality, memory cache error, etc.

[0081] S72. When the recovery self-test module receives the processor self-test request, the recovery self-test module controls the processor to load the test program, and outputs the processor test self-test result to the recovery management module after the test is completed. If the self-test is normal, if the self-test configuration includes software self-test, the recovery management module sends a software self-test request to the recovery self-test module.

[0082] The recovery management module sends a processor self-test request to the recovery self-test module. The recovery self-test module controls the processor to load the test program. After completion, the processor test program outputs the self-test result and makes a judgment. If the self-test is normal and the software self-test is configured, the process proceeds to step S73; otherwise, it proceeds to step S8.

[0083] If the processor self-test is abnormal, the recovery management module will control the processor to perform self-test again through the recovery self-test module according to the configured self-test frequency and number. If the processor self-test is still unsuccessful after multiple times, the self-test is deemed to have failed.

[0084] In this embodiment, the processor self-test method can be implemented by, but is not limited to, loading the program counter address of the processor instruction test program into the processor, solidifying the test instruction set and results into a fixed storage space, and the like. If the processor self-test fails, the recovery management module can be configured to perform multiple self-tests on the processor, with a configurable frequency and number of self-tests.

[0085] S73. When the recovery self-test module receives the software self-test request, the recovery self-test module sets the processor program counter to the software self-test program counter address. The software self-test program detects the current software environment. If the current software environment meets the conditions for directly restoring to the recovery point, the self-test result completion flag is sent to the recovery management module.

[0086] The recovery management module sends a software self-test request to the recovery self-test module. The recovery self-test module sets the processor program counter to the software self-test program counter address. The software self-test program detects the current software environment. If the current software environment meets the conditions for directly restoring to the recovery point, a self-test completion flag is sent to the recovery management module, and the processor is paused before entering step S8.

[0087] In step S73, if the software self-check is abnormal, that is, it is detected that the current software environment does not have the conditions for directly rolling back to the recovery point, the current software running environment is restored according to the software and the backup data of the recovery backup module. After the recovery is completed, the software self-check is performed again. If there is no abnormality, the self-check result completion flag is sent to the recovery management module; if the software self-check is still unsuccessful after multiple recovery, the self-check is deemed to have failed.

[0088] In the above three steps, if it is finally determined that the self-test has failed, it means that the current state does not support the system rollback operation and an alarm is given.

[0089] Step S8: The recovery management module sends a recovery site request to the recovery site module.

[0090] Step S9: The recovery module rewinds the backup data from the backup module to the recovery point and sends a recovery completion flag to the recovery management module after the recovery is complete. The restored content includes but is not limited to general registers, special registers, program counter, stack pointer, processor status word, data segment, etc.

[0091] Step S10: The recovery management module releases the processor, and the processor runs from the recovery point to complete error recovery.

[0092] As can be seen from the above process, the method of the present invention performs multi-level self-checks on the relevant system components required for processor operation before repairing the dual-core lockstep fault, and selectively restores abnormal parameters or states based on the self-check status, ensuring that the current chip software and hardware status allows fault recovery before performing system rollback operations, thereby ensuring the reliability of fault recovery. There is no need to use multiple recovery points or overall reset to ensure recovery, and it has higher efficiency and effectiveness.

[0093] The present invention performs software and hardware self-checks before dual-core lockstep error rollback, and performs selective state recovery based on the self-check results, thereby ensuring normal rollback at multiple levels and improving the reliability and efficiency of dual-core lockstep fault recovery.

[0094] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A dual-core lockstep processor fault recovery device, characterized in that: The device includes a dual-core lock-step processor, a recovery management module, a recovery backup module, a recovery self-test module, and a recovery site module, wherein the recovery backup module, the recovery self-test module, and the recovery site module are all connected to the dual-core lock-step processor and the recovery management module, and the dual-core lock-step processor is also connected to the recovery management module; The dual-core lockstep processor includes two processor cores. When the system is powered on, the two processor cores are initialized to the same state and receive the same input. A comparator in the dual-core lockstep processor is used to compare all outputs of the two processor cores, detect the dual-core operation matching status, and determine whether a dual-core mismatch error occurs. If no error occurs, the detection is maintained. When the outputs of the two processor cores do not match, the processor operation is suspended, and the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module. The recovery and backup module is used to perform on-site backup of processor data after receiving a backup request, and send a backup completion flag to the recovery management module after the backup is completed; The recovery self-test module is used to perform self-test operations before recovery in sequence according to the self-test request, and send a self-test result completion flag to the recovery management module after the self-test is completed; The recovery site module is used to, after completing the self-check, roll back the backup data of the recovery point according to the backup data of the recovery backup module when receiving the recovery site request from the recovery management module, and send a recovery completion flag to the recovery management module after the recovery is completed; The recovery management module is responsible for managing the self-check and recovery process, specifically for detecting whether the processor has reached the recovery point set by the software, and if so, sending a backup request to the recovery backup module; and for controlling the suspension of the processor operation and sending a self-test request to the self-test recovery module when receiving a dual-core mismatch error signal; It is also used to send a recovery site request to the recovery site module when receiving a self-test result completion mark; and to release the processor when receiving a recovery completion mark, so that the processor runs from the recovery point to complete error recovery.

2. A dual-core lockstep processor fault recovery method, characterized in that: The method comprises the following steps: Step S1: Initialize the chip and run the user program after initialization is completed; Step S2: The recovery management module detects whether the processor has reached the recovery point set by the software. If so, it sends a backup request to the recovery backup module. Step S3: The recovery and backup module performs an on-site backup of the processor data, and sends a backup completion flag to the recovery management module after the backup is completed; Step S4: The dual-core lockstep processor detects the dual-core operation matching status and determines whether a dual-core mismatch error occurs. If no error occurs, the detection is continued. Step S5: If an error occurs, the dual-core lockstep processor sends a dual-core mismatch error signal to the recovery management module; Step S6: The recovery management module controls the suspended processor operation and sends a self-test request to the recovery self-test module; Step S7: The recovery self-test module performs the self-test operation before recovery in sequence according to the self-test request, and sends a self-test result completion flag to the recovery management module after the self-test is completed; Step S8: The recovery management module sends a recovery site request to the recovery site module; Step S9: The recovery site module rewinds the backup data of the recovery point according to the backup data of the recovery backup module, and sends a recovery completion flag to the recovery management module after the recovery is completed; Step S10: The recovery management module releases the processor, and the processor runs from the recovery point to complete error recovery.

3. The dual-core lockstep processor fault recovery method according to claim 2, wherein: In step S6, the recovery management module sends a corresponding self-test request to the recovery self-test module as required according to the self-test configuration; wherein the self-test request includes at least one of a chip component self-test request, a processor self-test request, and a software self-test request.

4. The dual-core lockstep processor fault recovery method according to claim 3, wherein: The specific process of step S7 is as follows: S71. When the recovery self-test module receives a chip component self-test request, the recovery self-test module detects the status of key chip components and sends the self-test results to the recovery management module. If the self-test is normal, and if the self-test configuration includes a processor self-test, the recovery management module sends a processor self-test request to the recovery self-test module. S72. When the recovery self-test module receives the processor self-test request, the recovery self-test module controls the processor to load a test program, and after the test is completed, outputs the processor test self-test result to the recovery management module. If the self-test is normal, and if the self-test configuration includes a software self-test, the recovery management module sends a software self-test request to the recovery self-test module. S73. When the recovery self-test module receives the software self-test request, the recovery self-test module sets the processor program counter to the software self-test program counter address. The software self-test program detects the current software environment. If the current software environment meets the conditions for directly restoring to the recovery point, the self-test result completion flag is sent to the recovery management module.

5. The dual-core lockstep processor fault recovery method according to claim 4, characterized in that: In step S71, if the self-test of the key components of the chip is abnormal, the recovery management unit will restore the chip configuration according to the backup data of the recovery backup module. After the configuration is completed, the chip status will be re-tested and waited for to be ready, and the chip components will be self-tested again. If it is still unsuccessful after multiple restorations, it is determined that the self-test has failed.

6. The dual-core lockstep processor fault recovery method according to claim 4, characterized in that: In step S72, if the processor self-test is abnormal, the recovery management module controls the processor to perform self-test again through the recovery self-test module according to the configured self-test frequency and number. If the processor self-test is still unsuccessful after multiple times, the self-test is deemed to have failed.

7. The dual-core lockstep processor fault recovery method according to claim 4, characterized in that: In step S73, if the software self-check is abnormal, that is, it is detected that the current software environment does not have the conditions for directly rolling back to the recovery point, the current software running environment is restored according to the software and the backup data of the recovery backup module. After the recovery is completed, the software self-check is performed again. If there is no abnormality, the self-check result completion flag is sent to the recovery management module; if the software self-check is still unsuccessful after multiple recovery, the self-check is deemed to have failed.

8. The dual-core lockstep processor fault recovery method according to any one of claims 2 to 7, characterized in that: In step S6, if the recovery management module is configured with a pre-recovery self-test, the recovery management module sends a self-test request to the recovery self-test module; otherwise, the process directly proceeds to step S8.

9. The dual-core lockstep processor fault recovery method according to claim 8, characterized in that: In step S5, if the dual-core mismatch error occurs in the processor before the recovery point set by the software, a software and hardware reset is performed, and then the process goes to step S1.

Images