Method for executing commands by a processor core in a computing unit

Abstract

The invention relates to a method for executing commands by a processor core (200) in a computing unit, wherein the processor core (200) has a plurality of execution units (210) and a memory unit (230), the method comprising the following steps: reading in a command to be executed; storing the read-in command in a predefined entry (231, 232, 233, 234, 235) in the memory unit (230); forwarding the read-in command to a respective execution unit (210) of the plurality of execution units (210); executing the forwarded command by the respective execution unit of the plurality of execution units (210); determining execution information relating to the execution of the command; storing the determined execution information in the predefined entry (231, 232, 233, 234, 235) in the memory unit (230); checking the execution of the command depending on the read-in command stored in the predefined entry (231, 232, 233, 234, 235) and depending on the execution information stored in the predefined entry (231, 232, 233, 234, 235).

Description

[0001] R.416106

[0002] - 1 -

[0003] Description

[0004] Method for executing instructions by a processor core in a computing unit

[0005] The present invention relates to a method for executing instructions by a processor core in a computing unit, as well as a computing unit and a computer program for carrying out the method.

[0006] Background of the invention

[0007] A functionally safe execution platform (referred to in English as "Safe Island", "Vital Modules", "Safe Backbone", or "Safe Execution Platform") can be implemented in a computing unit such as a microcontroller or a system-on-a-chip (SoC) to enable software execution at the highest safety level with regard to operational safety or functional safety. For example, in the automotive sector, this safety level can be ASIL-D, the highest safety requirement level for safety-related systems in motor vehicles according to the safety standards of ISO 26262 and the ASIL (Automotive Safety Integrity Level) defined therein.

[0008] Such a reliable execution platform can be implemented, for example, by using two identical processor cores and operating them in a so-called lockstep configuration. The two cores execute the same processes, validate their results against each other, and can output an error signal if deviations are detected. The cores typically have separate clock trees and separate areas on their respective chips. Program code can be written, for example, in an embedded R.416106.

[0009] - 2 -

[0010] NOR flash memory and data stored in an embedded static ROM memory.

[0011] However, such a lockstep concept with an additional, redundant processor core is associated with high energy consumption and a large footprint. Furthermore, the lockstep concept cannot be implemented equally well with all processor types. For example, the lockstep concept can be well suited for mid-range cores, which are used, for instance, for engine control or for controlling braking systems in vehicles. At higher performance levels, however, the lockstep method often scales poorly. High-performance cores can often only be operated in parallel lockstep mode to a limited extent. NOR flash memory also often cannot be scaled to nodes below 28 nm and requires more area than NAND flash. Embedded static RAM is usually limited to a maximum of 10⁻¹⁰ mebibytes.

[0012] Reliable execution platforms based on the lockstep principle are therefore often only conditionally suitable for systems with large program code and large amounts of data, as is the case, for example, in the context of autonomous driving.

[0013] Disclosure of the invention

[0014] According to the invention, a method for executing instructions by a processor core in a computing unit, as well as a computing unit and a computer program for carrying out the method, are proposed, comprising the features of the independent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0015] The processor core has a large number of execution units, or...

[0016] The computer consists of arithmetic logic units (ALUs) and a storage unit. Individual execution units can each be configured, for example, as a floating-point unit (FPU) for processing floating-point numbers, e.g., for addition (floating-point R.416106).

[0017] - 3 -

[0018] The processor core's execution units can function as adders, FP adders, or multipliers (floating-point multipliers, FP multipliers). Furthermore, individual execution units can also be configured, for example, as arithmetic logic units (ALUs) for processing whole numbers or integer values. For instance, individual execution units can also be configured as units for storing and / or loading data. The processor core's memory unit is specifically designed as a buffer unit or buffer memory unit.

[0019] It is understood that the processor core may contain further components, e.g., additional memory units, registers, etc. Furthermore, it is understood that the arithmetic logic unit (ALU) may also contain further components.

[0020] In particular, the computing unit comprises a processor unit, which in turn contains the processor core. The processor unit can be configured as a multi-core processor, which may also include one or more additional processor cores. The computing unit also includes, in particular, a multitude of memory units, e.g., a non-volatile memory unit, such as (NAND) flash memory, and a volatile memory unit, such as (LPDDR) RAM. Software, a program, or program code is expediently stored in the non-volatile memory unit. This program can comprise individual instructions, machine instructions, or commands, which are generated, in particular, during a compilation process by a compiler. To execute the program, the individual instructions can be read from the volatile memory unit into the processor unit and executed by one of the processor cores.

[0021] The invention makes it possible to verify whether instructions are actually executed in the processing unit and, furthermore, whether instructions are executed in the correct sequence. The invention thus enables the safe execution of instructions with regard to operational safety or functional safety. When safety or security is mentioned in this context, it should be understood in particular as operational safety or functional safety, as defined in R.416106.

[0022] - 4 -

[0023] In English, this is referred to as "safety", in contrast to information technology security or information security, which is referred to as "security" in English.

[0024] For this purpose, an instruction to be executed, or machine instruction, is read into the processor core as part of the process. As explained above, the instruction can, for example, be read from a non-volatile memory unit of the arithmetic logic unit (ALU). The instruction to be executed can include, for example, a load from a data memory, a write operation, an arithmetic operation, a load of an immediate instruction from program memory, a branch, a jump, a call, semaphore support, system state control, etc. The processor core can, for example, be used for management, scheduling, or...

[0025] The scheduler unit can read in the instruction to be executed. This management unit can, in particular, read in and manage a large number of different machine instructions to be executed and, for example, create an execution sequence according to which the individual instructions should be carried out. Furthermore, the management unit can, for example, determine which of the execution units should execute which instructions.

[0026] The input command is stored, for example by the management unit, in a predefined entry or at an assigned location or position in the memory unit. Specifically, all data and information relating to the respective command are stored in the respective entry in the memory unit. Different data or information concerning the respective command can, for example, be stored in different fields of the entry. The location or position of this predefined entry in the memory unit can, for example, depend on a location or position of the input command in the respective program.

[0027] Furthermore, the received command is forwarded, for example by the administrative unit, to a specific execution unit among the multitude of execution units for its execution. The forwarded command is processed by R.416106.

[0028] - 5 -

[0029] Each execution unit, among the multitude of execution units, executes the instruction. During this execution, the respective execution unit appropriately generates a corresponding result. Furthermore, execution information regarding the execution of the instruction is determined, particularly by the respective execution unit. This execution information specifically characterizes how the respective execution unit executed the instruction. For example, the execution information can characterize accesses to data or memory registers that were performed during the execution of the instruction. This specific execution information is stored in the designated entry in the memory unit. For example, the execution information, along with the result, can be forwarded from the respective execution unit to the memory unit and stored there in the corresponding entry.

[0030] Depending on the command read into the specified entry and the execution information stored in that entry, the execution of the command is checked and validated. Specifically, the command read into the respective execution unit can be recoded. The specific execution information can represent this recoded command. The originally read command is conveniently stored in the memory unit for comparison with this recoded command. The originally read command stored in the memory unit characterizes, in particular, what should happen during the execution of the command. The recoded command, or the specific execution information, characterizes, in particular, what actually happened during the execution of the workaround.By comparing the originally read command stored in the memory unit with the newly encoded command or with the execution information, it is possible in particular to validate whether the command was actually executed as intended. R.416106.

[0031] - 6 -

[0032] The invention thus enables a particularly advantageous verification and validation of whether instructions to be executed have actually been carried out in the processor core, and furthermore, whether the instructions were executed in the correct sequence. In particular, the invention enables the reliable execution of instructions without a complex lockstep concept of the entire CPU core. In contrast to a lockstep concept, the invention can be implemented in the processing unit much more efficiently with regard to chip area and power consumption. Advantageously, units already present in the processor core are used for validating whether the instructions have been executed, so that no additional hardware is required for carrying out the method. Furthermore, no user-defined instructions are required for carrying out the method.

[0033] The invention enables the particularly advantageous, cost-effective, energy-efficient, and space-saving implementation of a functionally reliable execution platform ("Safe Island," "Vital Modules," "Safe Backbone," or "Safe Execution Platform"). By validating command execution, it is especially possible to execute software at a high or highest level of safety, for example, at the highest safety requirement level ASIL-D according to the ISO 26262 safety standards in the automotive sector.

[0034] According to one embodiment, the processor core, or the processor unit containing the processor core, can be based on a RISC-V instruction set architecture (ISA). An instruction set generally refers to the entirety of machine instructions that a processor unit can execute. The RISC-V instruction set architecture is based on the so-called RISC principle (Reduced Instruction Set Computer, RISC), according to which the instruction set comprises a small number of instructions, usually fewer than 100, which can each be processed easily and quickly by the processor unit. This allows for a simplified processor design, high clock speeds, and fast execution speeds, in contrast to the so-called CISC architecture (Complex Instruction R.416106).

[0035] - 7 -

[0036] RISC-V instruction set architecture (CISC) provides a large number of instructions (over 100) that allow a processor to execute complex processes, although this requires a complex processor design. The RISC-V instruction set architecture is an open standard, or "open source," and allows for easy modification and extension of the instruction set.

[0037] According to one embodiment, the processor core is designed as a so-called "out-of-order" processor core, which enables so-called "out-of-order" execution of instructions. During such "out-of-order" execution, instructions of a program can be executed in the execution units of the processor core in a different order than they appear in the program or program code, thereby modifying the results of the instructions. In this way, several instructions can be executed in parallel or simultaneously. The invention is also particularly suitable for so-called "in-order" processor cores, which enable so-called "in-order" execution of instructions, whereby the individual instructions of a program are executed in the order of the program or program code.

[0038] According to one embodiment, a mask is defined to specify which bits, parts, or sections of the read instruction are to be compared with which bits, parts, or sections of the specified execution information. This mask can be created, for example, together with or immediately after the instruction to be executed is read, e.g., by the management unit. The specified mask is stored in the designated entry in the memory unit. The verification or validation of the instruction execution depends on the read instruction stored in the designated entry, on the execution information stored in the designated entry, and on the mask stored in the designated entry. In particular, it may not be necessary to compare all bits of the original instruction with corresponding bits of the execution information.The mask allows, in particular, the characterization of those bits of the original instruction that can be used to reliably verify whether the instruction was executed correctly (R.416106).

[0039] - 8 -

[0040] was executed. For example, the mask can be used to characterize those bits of the original instruction that might be changed if the instruction were executed incorrectly.

[0041] According to one embodiment, verifying the execution of the instruction involves comparing a first piece of information, such as an index, entry, or feature, of the read instruction stored in the specified entry with a second piece of information, such as an index, entry, or feature, of the execution information stored in the specified entry. This first piece of information characterizes a specific execution unit among the multitude of execution units that is to execute the instruction. The second piece of information characterizes the specific execution unit among the multitude of execution units that actually executed the instruction. Thus, during validation, it can be verified whether the read instruction was forwarded to the correct execution unit and executed by the correct execution unit. For example, the first piece of information can be stored as corresponding bits in the instruction, such as an "operation code" or "op-code."Each execution unit has a corresponding, hard-coded op-code. The op-code of the execution unit selected to execute the instruction can conveniently be provided as a second piece of execution information. If an incorrect execution unit was selected, i.e., if the instruction was sent to the wrong execution unit, this can be detected by comparing the first and second pieces of information.

[0042] According to one embodiment, the execution information includes memory information regarding memory addresses or register addresses used during execution, in particular regarding source addresses and / or destination addresses used during execution. Verifying the execution of the instruction involves comparing this memory information with the corresponding memory addresses of the instruction read in the specified entry. For example, the memory information may include original, unnamed indices of the instruction used during execution.

[0043] - 9 -

[0044] The source and destination registers used during the execution of the instruction are characterized. These actually used indices can be compared with corresponding values ​​of the originally read instruction. This allows verification, in particular, of whether the correct registers were accessed during the execution of the instruction.

[0045] According to one embodiment, the instruction to be executed has a predefined value to be used, in particular an immediate value, e.g., an arithmetic constant or a memory offset. Determining the execution information includes identifying a corresponding value actually used during the execution of the instruction as execution information. Specifically, after the respective immediate value has been used for the execution of the instruction, it is used as part of the execution information or as part of the re-encoded instruction. If a bit error occurs and a different value is used during execution than that specified in the original instruction, this can be detected by comparing the execution information with the stored original instruction.Furthermore, in the course of such execution using an incorrect value, an incorrect result may occur, which may also be detected during verification of the instruction result, especially if an error can cause all redundant execution units to use the same incorrect immediate instruction.

[0046] According to one embodiment, a program to be executed in the arithmetic unit comprises a plurality of instructions to be executed in a predefined sequence, wherein the read-in instruction is one of these plurality of instructions to be executed at a respective predefined, specific position or location within the predefined sequence of the program to be executed. As explained above, this program can be stored in a non-volatile memory unit of the arithmetic unit. The individual instructions of the program can be read sequentially from this non-volatile memory unit into the processor core, for example, by the processor core's management unit. The predefined entry in R.416106

[0047] - 10 -

[0048] The storage unit, in particular a position or location of this predefined entry in the storage unit, is specified depending on the position of the read instruction in the predefined sequence of the program.

[0049] It is therefore advantageous to store results and information regarding the multitude of instructions to be executed in the memory unit in the same order as the individual instructions are stored in the program. For example, the memory unit can be designed as a re-order buffer (ROB). Such an ROB memory unit can be used, for instance, in an out-of-order processor core. In particular, instructions in such an out-of-order processor core do not have to be executed sequentially, but can be executed in parallel or simultaneously by the various execution units. The individual results of the execution units can be forwarded to the ROB memory and stored there at the original position of the instruction in the program order.For example, when a result arrives in the first entry of the ROB memory, that result and all subsequent results, which may have been previously calculated out of order, can take effect or be released.

[0050] According to one embodiment, a predefined action is performed if, during the execution check, an error in the execution of the instruction is detected. In particular, such an error can be detected if a discrepancy is found between the instruction read in the predefined entry and the execution information stored in the predefined entry. The predefined action could, for example, be the output of an error message, the creation of an entry in an error memory, or the halting or transferring the processing unit to a safe state. In particular, the action could be to re-execute the incorrectly executed instruction and subsequent instructions, and in the event of further errors, to repeat this process several times. R.416106

[0051] - 11 -

[0052] This method is particularly well-suited for use in the automotive sector. The processing unit can be configured as a microcontroller or control unit within a (motor) vehicle. The commands or processes executed by the processing unit can include, for example, safety-critical functions required for the safe operation and control of the vehicle, such as engine control, driver assistance systems, or autonomous driving. The present method can enhance the safety, reliability, and integrity of the control unit.

[0053] In particular, the procedure can fulfill safety requirements in the (motor) vehicle sector, such as those specified in the ISO 26262 standard or especially by the so-called "Automotive Safety Integrity Level" (ASIL), a safety requirement level for safety-related systems in motor vehicles specified by ISO 26262.

[0054] A computing unit according to the invention, e.g. a control unit of a motor vehicle, is, in particular in terms of programming, equipped to carry out a method according to the invention.

[0055] Implementing a method according to the invention in the form of a computer program or computer program product with program code for carrying out all method steps is also advantageous, as this incurs particularly low costs, especially if an executing control unit is already available for other tasks. Finally, a machine-readable storage medium is provided with a computer program stored on it as described above. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical, and electrical storage media, such as hard drives, flash memory, EEPROMs, DVDs, etc. Downloading a program via computer networks (Internet, intranet, etc.) is also possible. Such a download can be wired or wireless (e.g., via a WLAN network, a 3G, 4G, 5G, or 6G connection, etc.). R.416106

[0056] - 12 -

[0057] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawing.

[0058] The invention is schematically illustrated in the drawing using exemplary embodiments and is described below with reference to the drawing.

[0059] Brief description of the drawings

[0060] Figure 1 schematically shows an embodiment of a computing unit according to the invention, which is configured to carry out an embodiment of a method according to the invention.

[0061] Figure 2 schematically shows a processor core of an embodiment of a computing unit according to the invention, which is configured to carry out an embodiment of a method according to the invention.

[0062] Figure 3 schematically shows an embodiment of the method according to the invention as a block diagram.

[0063] Detailed description

[0064] Figure 1 shows a schematic representation of a computing unit, labelled 100, which can be designed, for example, as a system-on-a-chip (SoC).

[0065] For example, the SoC 100 can be intended for a motor vehicle and integrated into a control unit of the vehicle, for example to perform safety-critical functions for the safe operation of the vehicle, e.g. in the course of engine control, in the course of driver assistance functions, in the course of autonomous driving, etc.

[0066] To ensure the safety and integrity of the control unit, to execute software at the highest safety level, and to meet the safety requirements of the (motor) vehicle sector, in particular according to the ASIL-D safety requirement level of the ISO 26262 standard, the SoC 100 can be integrated into an R.416106

[0067] - 13 -

[0068] The system operates in a safe operating mode in which commands are executed according to an embodiment of a method according to the invention. In this way, a functionally safe execution platform 110 ("Safe Island", "Vital Modules", "Safe Backbone" or "Safe Execution Platform") is realized in the SoC 100.

[0069] For this functionally reliable execution platform 110, the example shown includes a processor unit 111, a cache logic unit 112, and a timer 113. The processor unit 111 can expediently (but not necessarily) be a processor core based on a RISC-V instruction set architecture. This RISC-V processor 111 and the cache logic unit 112 are connected, for example, via RAM and cache memory 121 to an interconnect unit 120 of the SoC 100 as further elements of the functionally reliable execution platform 110.

[0070] For example, a flash memory unit 140, e.g., a NAND flash memory, can be connected to the connection unit 120 via an interface 141, and a RAM memory unit 150, e.g., an LPDDR RAM, can be connected via a RAM controller 151. The SoC 100 can also have one or more additional processor cores 130 with associated RAM and cache memory 131, which are connected to the connection unit 120. Furthermore, a memory unit 122 as a further element of the fail-safe execution platform 110 for a boot process (boot flash memory) and a peripheral bus 160 can be connected to the connection unit 120. A variety of peripheral units can be connected to the peripheral bus 160, e.g. an analog-to-digital converter 161, a serial bus system 162 ("Serial Peripheral Interface", SPI), a unit for direct memory access 163 ("Direct Memory Access", DMA), a timer 164 and another fieldbus system 165, e.g. a Flexray fieldbus.It is understood that fewer or even more peripheral units may be provided, indicated by reference numeral 166. For example, an external monitoring unit 180 for detecting and managing a fault or failure of the SoC 100 (watchdog) can be connected via the serial bus system 162. Furthermore, the SoC 100 can have an error management module 170 (EMM) for managing issued error messages. R.416106.

[0071] - 14 -

[0072] Flash memory unit 140 contains software, a program, or program code that includes a large number of instructions to be executed in a predefined sequence. To execute the program, each individual instruction is to be read into processor core 111 and executed by the processor core 111.

[0073] In order to check or validate whether the individual instructions are actually executed in the processor core 111, and furthermore whether instructions are executed in the correct order, and thus to execute the individual instructions safely, the computing unit 100 is, in particular programmatically, configured to carry out an embodiment of a method according to the invention, as will be explained below with reference to Figures 2 and 3.

[0074] Figure 2 shows a schematic representation of the processor core 111, which, according to one embodiment of the invention, can be configured as a so-called "out-of-order" core 200, enabling "out-of-order" execution of instructions, whereby instructions of a program can be executed in a different order than they are in the program or the program code.

[0075] The core 200 has a variety of execution units 210. The execution units 210 can include, for example, a floating-point unit (FPU) for addition (FP Adder) 211, an FPU for multiplication (FP Multiplier) 212, an arithmetic logic unit (ALU) 213 for processing whole numbers or integer values, and a unit 214 for storing and / or loading data.

[0076] For the sake of clarity, only four execution units 210 are shown as examples in Figure 2; however, it is understood that the kernel 200 can also include further execution units. Each type of execution unit 210 can have several identical instances, which R.416106

[0077] - 15 -

[0078] They can work on multiple instructions simultaneously. A full CPU core, for example, can have 20 or 30 instances of execution units for integer arithmetic, loading from memory, storing in memory, DSP functions, bit manipulation, bit shifting, etc.

[0079] Each execution unit 210 or each set of execution units 210 is a set of reservation units or reservation stations (English: reservation units).

[0080] "Reservation Station") 220 assigned In the example of Figure 2, a first reservation unit 221 is assigned to the FP adder 211, a second reservation unit 222 is assigned to the FP multiplier 212, a third reservation unit 223 is assigned to the ALU 213, and a fourth reservation unit 224 is assigned to the unit 214 for storing and / or loading data.

[0081] The core 200 also includes a memory unit 230, in particular a buffer unit or a buffer memory unit. The execution units 210 can transfer results to the ROB memory 230 via a common data bus (CDB) 240.

[0082] The memory unit 230 can be configured, in particular, as a re-order buffer (ROB). This ROB memory 230 has a multitude of entries 231, 232, 234, 235, each of which can store data and information relating to a specific instruction. The position of each entry for a specific instruction depends, in particular, on the position of the respective instruction within the program. Results and information relating to the multitude of instructions can thus be stored in the ROB memory 230 in the same order as the individual instructions are stored in the program. The individual instructions of the program do not have to be executed sequentially in the out-of-order processor core 200, but can be executed in parallel or simultaneously by the various execution units 210.The individual results of the execution units 210 can be accessed in the ROB memory 230 at R.416106.

[0083] - 16 -

[0084] The original position of each command is stored in the program's order.

[0085] A management, planning, or scheduler unit 250 is used to read the individual program instructions from the flash memory unit 140. For each instruction read, the management unit 250 can select the next available entry in the ROB memory unit 230 for the instruction's result, as well as one of the execution units 210 to execute the respective instruction. Furthermore, the management unit 250 can create an execution sequence 251 according to which the individual instructions are to be executed. The individual instructions in the execution sequence 251 are then forwarded to the respective selected execution unit 210. For example, instructions for processing floating-point numbers or integer values ​​can be forwarded via an operations bus 252 to the FP adder 211, the FP mu itiplier 212, and the ALU 213.Commands for storing and / or loading data can be forwarded to the storage and / or loading unit 214 via an address unit 253 and the reservation unit 224, where the reservation unit 224 can, for example, serve as a buffer for loading commands.

[0086] Furthermore, a register 260 is provided for floating-point numbers and / or integer values, which can be used as operands, arithmetic variables, or calculated values ​​for executing instructions. For this purpose, individual values ​​from register 260 can be transferred to the execution units 210 via an operand bus 261. The operand bus 261 can also be connected to the common data bus 240.

[0087] Each reservation station 220 contains all the data that the assigned execution unit 210 needs for operation. When the data in the respective reservation station 220 is complete and the respective assigned execution unit 210 is free, this execution unit 210 begins executing a corresponding instruction. This can take one or more clock cycles. Each instruction unit 210 can be accessed via an internal pipeline.

[0088] - 17 -

[0089] have the capability to output a result at each clock cycle, even though the calculation has taken several clock cycles.

[0090] Thanks to the management unit 250, the instructions in this pipeline do not need to appear sequentially in the program. This allows many instructions from the sequential instruction stream to be executed simultaneously. The results are transmitted via the shared data bus 240. Since multiple execution units 210 feed the shared data bus 240, it is possible that an execution unit 210 might have to wait because the shared data bus 240 is occupied. To avoid this, each execution unit 210 can have its own output buffer in which the respective result is stored until the shared data bus 240 is free. To further improve throughput, the shared data bus 240 can transport multiple results simultaneously. Each result is forwarded to the ROB memory 230 and stored there at the original position of the respective instruction in the program.For example, when a result arrives in the first entry 231 of ROB memory 230, this result and all subsequent results, which may have been calculated out of order beforehand, become effective or are released. Their slots in ROB memory 230 are now free for new instructions waiting to be executed.

[0091] In addition to feeding the ROB memory 230, the shared data bus 240 can perform another task. For example, all reservation stations 220 waiting for a missing operand can search the shared data bus 240. When the missing operand appears on the shared data bus 240, it is copied to the respective reservation station 220, e.g., to an operand register of that reservation station 220.

[0092] Figure 3 shows an embodiment of a method according to the invention as a schematic block diagram, in the course of which it is validated whether the individual instructions are actually executed in the processor core 200. R.416106

[0093] - 18 -

[0094] In a first step 302, for example by the management unit 250, an instruction to be executed from the program stored in the flash memory unit 140 of the SoC 100 is read.

[0095] In step 304, the read instruction is stored in a predefined entry in the ROB memory unit 230. The position of this entry in memory unit 230 is determined based on the position of the read instruction in the predefined program sequence. For example, the read instruction might be at the beginning of the program. In this case, the instruction is stored in the first entry 231 in ROB memory 230.

[0096] In step 306, the command read in step 302 is further forwarded to the respective execution unit 210. As explained above, for example, the management unit 250 can select the respective execution unit 210 and forward the command accordingly. For example, the command can be forwarded to unit 211.

[0097] In step 308, the forwarded command is executed by the respective execution unit 211. As a result, the respective execution unit 211 generates a corresponding result.

[0098] In step 310, execution information regarding the execution of the command is determined, e.g. by the respective execution unit 211 itself.

[0099] In step 312, the specified execution information is stored in the predefined entry 231 in the storage unit 230. For example, the respective execution unit 211 can forward the generated result together with the execution information to the storage unit 230 via the common data bus 240 for this purpose.

[0100] In step 314, the execution of the command depends on the command read in the specified entry 231 and on R.416106.

[0101] - 19 -

[0102] The execution information stored in the specified entry 231 has been checked or validated.

[0103] If, in the course of this process, it is recognized that the command was executed correctly, e.g., if the stored, read command matches the execution information, the system continues with the regular operation of the SoC 100 in step 316.

[0104] If, however, an incorrect execution of the command is detected during the check, e.g., if a discrepancy is detected between the command read in the specified entry 231 and the execution information stored in the specified entry 231, a specified action is carried out in step 318, e.g., an error message can be issued, an entry can be created in an error memory, and / or the SoC 100 can be brought into a safe state.

[0105] In particular, as a measure, the incorrectly executed command and the subsequent commands can be re-executed, especially several times in the event of further errors.

[0106] For example, in check 314, it may not be necessary to compare all bits of the original instruction with corresponding bits of the execution information. Therefore, a mask can be defined to specify which bits, parts, or sections of the read instruction should be compared with which bits, parts, or sections of the specific execution information. For instance, this mask can be created in step 302 along with the reading of the instruction to be executed, e.g., by management unit 250. The specified mask can then be stored in step 304, along with the read instruction, in the specified entry 231 in memory unit 230. The validation in step 314 is then performed based on the mask stored in entry 231.

[0107] For example, during check 314, initial information from the command stored in entry 231 can be combined with a second piece of information from the R.416106.

[0108] - 20 -

[0109] The execution information stored in entry 231 can be compared. The first piece of information can characterize a specific execution unit that is supposed to execute the instruction. The second piece of information can characterize the respective execution unit 211 that actually executed the instruction. This allows verification that the read instruction was forwarded to the correct execution unit. For example, the first piece of information can be stored as corresponding bits in the instruction, e.g., as the so-called "Operation Code" or "Op Code." The Op Code of the execution unit 211 selected to execute the instruction can be stored as the second piece of information in the execution information.

[0110] If, for example, the respective execution unit 210 executes a type of arithmetic as an instruction, no further validation may be required. Any error in the execution would lead to an incorrect result. This incorrect result can be detected, for example, during result verification by having at least two execution units 210 execute the same instruction and compare their results. This ensures, for example, that these multiple execution units 210 are not executing the same incorrect instruction. For this purpose, for example, an instruction decoder can be operated in lock-step mode, or two instruction decoders for the same instruction can be used to control two reservation units 220. For example, the processor core 200 may already have instruction decoders, e.g., if it is configured as a superscalar core, so that no additional hardware is required.

[0111] Even if the instruction is, for example, a load instruction, no further validation may be required. If the address or size of the loaded data is incorrect, the destination register will contain an incorrect value, which would be detected during a verification of the instruction result. R.416106

[0112] - 21 -

[0113] Even if the instruction is, for example, a save instruction, no further validation may be required. For instance, checksums can be used to verify the result of the save instruction.

[0114] Even with an unconditional branch command, a call, or a return, no further validation may be required. Any error in such a command can lead to an incorrect check result, which can be detected, for example, during the command's read operation.

[0115] A conditional branch instruction might, for example, involve arithmetic. The arithmetic result might not have an associated register name, but it could appear in ROB memory 230 like any other arithmetic result. A decision can then be made whether or not to proceed with the branch. A non-speculative kernel, for instance, might not execute any further instructions until the result arrives in ROB memory 230. A speculative kernel, on the other hand, might execute some instructions of the determined branch and discard these instructions if the speculation was incorrect. For example, the path of a result to a branch action (condition result to branch action) can be protected, such as by a lock-step principle in the associated logic.

[0116] Besides arithmetic, instructions can use registers and / or predefined, immediate values, but they do not produce a result that can be compared in a verification process. Such instructions can include, for example, atomic instructions that read from or write to memory in a hardware-assisted, synchronized manner. Furthermore, such instructions can modify a processor state, such as a privilege level, a cache flush, power management, superscalarity control, etc. Validation measures, such as those described below, can be used to validate these and other instructions. R.416106

[0117] - 22 -

[0118] If, for example, the instruction to be executed has a predefined value to be used, such as an immediate value like an arithmetic constant or a memory offset, determining the execution information in step 310 can include determining a corresponding value actually used during instruction execution. After the respective immediate value has been used for instruction execution in step 308, the value actually used can be stored as part of the execution information or as part of the re-encoded instruction. If a bit error occurs and a different value is used during execution than specified in the original instruction, this can be detected in step 314 by comparing the execution information with the stored, original instruction.Furthermore, in the course of such execution using an incorrect value, an incorrect result may occur, which may also be detected during verification of the instruction result, especially if an error can cause all redundant execution units to use the same incorrect immediate instruction.

[0119] The execution information can include memory information regarding memory addresses or register addresses used during execution, particularly source and / or destination addresses. To validate the execution of the instruction in step 314, this memory information can be compared with corresponding memory addresses of the instruction read in the specified entry 231. For example, the memory information can characterize the original, unnamed indices of source and destination registers used during instruction execution. These actually used indices can be compared with corresponding values ​​of the originally read instruction. This allows verification, in particular, of whether the correct registers were accessed during instruction execution.

[0120] - 23 -

[0121] In particular, each physical register can provide its current value as well as its index. This index can be hard-coded and can be used to recode a register index within the opcode. Specifically, if an incorrect register is accessed, an incorrect index will be provided, which can be detected in step 314 during the comparison of the original instruction with the execution information. For example, in a superscalar processor core with 220 reservation units, a register cannot be used directly. Instead, it can be copied into the respective 220 reservation unit of the respective 210 execution unit. To verify that the correct register was used, the read register index can also be copied into the 220 reservation unit.When the respective execution unit 210 executes the instruction, it conveniently provides this register index as part of the execution information. The same applies to a second source register, if present.

[0122] For example, in a superscalar kernel with out-of-order execution and register renaming, an operand might not reside in the register file but be the result of an operation not yet executed. In this case, an index of the corresponding entry in the ROB memory 230 can be stored in the respective reservation unit 220, waiting for the required result. This index can be determined by the management unit 250. The respective reservation unit 220 can search the common data bus 240, and when the expected value arrives, the reservation unit 220 can replace its index to the ROB with the result register index from the execution unit 210. The following paragraph explains where this index can originate. In this case, the reservation unit 220 could, for example, contain both the physical index of the register and the renamed index in the ROB memory 230.The former can be stored in the execution information for comparison with the original command stored in the ROB memory 230.

[0123] In a simple kernel, the result of an instruction can be stored in a respective register, which is defined by this part of the operation code R.416106.

[0124] - 24 -

[0125] is addressed. As described above, the hard-wired index of the result register can be read back and used to recode the instruction in the form of execution information. During out-of-order execution and register renaming, the target register can be an entry in the ROB memory 230. This entry can be written back to the actual physical register when the ROB entry is acknowledged. However, this may be too late for validation, which occurs before acknowledgment. To validate the result register index in a timely manner, the index of the physical result register can also be stored in the reservation unit 220. The execution unit 210 takes this value and passes it to the common data bus 240. The common data bus 240 can then pass this value to the respective reservation unit 220 and to the ROB memory 230.In the ROB memory 230, the value is compared with the target register portion of the original instruction. In the reservation unit 220, the index can be compared with the index of the original physical register described in the previous paragraph. If the values ​​do not match, an error in the instruction execution can be detected, and the predefined action can be taken, e.g., an error message can be issued.

[0126] Within the framework of the described embodiments, it is possible to verify whether instructions are actually executed in the processing unit and, furthermore, whether instructions are executed in the correct sequence. The invention thus enables the reliable execution of instructions with regard to operational and functional safety.

Claims

R.416106 - 25 - Claims 1. Method for executing instructions by a processor core (111, 200) in an arithmetic unit (100), wherein the processor core (111, 200) has a plurality of execution units (210) and a memory unit (230), the method comprising the following steps: Reading (302) a command to be executed; Storing (304) the read command in a predefined entry (231, 232, 233, 234, 235) in the memory unit (230); Forwarding (306) the received command to a respective execution unit (210) of the plurality of execution units (210); Execution (308) of the forwarded command by the respective execution unit of the plurality of execution units (210); Determining (310) execution information regarding the execution of the command, Storing (312) the specified execution information in the specified entry (231 , 232, 233, 234, 235) in the storage unit (230); Check (314) the execution of the command depending on the command read in the specified entry (231 , 232, 233, 234, 235) and depending on the execution information stored in the specified entry (231, 232, 233, 234, 235).

2. The method according to claim 1, further comprising: Determine (302) a mask to specify which bits of the input instruction are to be compared with which bits of the specified execution information; Storing (304) the specified mask in the specified entry (231, 232, 233, 234, 235) in the storage unit (230); Check (314) the execution of the command depending on the read R.416106 stored in the specified entry (231 , 232, 233, 234, 235). - 26 - Command, depending on the execution information stored in the specified entry (231, 232, 233, 234, 235) and depending on the mask stored in the specified entry (231, 232, 233, 234, 235).

3. Method according to claim 1 or 2, wherein checking (314) the execution of the command comprises: Comparing first information about the read command stored in the specified entry (231, 232, 233, 234, 235) with second information about the execution information stored in the specified entry (231, 232, 233, 234, 235), wherein the first piece of information characterizes a specific execution unit of the plurality of execution units (210) which is to execute the instruction, and wherein the second piece of information characterizes the respective execution unit of the plurality of execution units (210) that executed the instruction.

4. A method according to any of the preceding claims, wherein the execution information includes memory information relating to memory addresses used during execution, and wherein checking (314) the execution of the instruction includes: Comparing this memory information with the corresponding memory addresses of the read command stored in the specified entry (231, 232, 233, 234, 235).

5. A method according to any of the preceding claims, wherein the command to be executed has a predetermined value to be used; wherein determining (310) the execution information comprises: Determining a corresponding value used during the execution of the command as execution information.

6. Method according to one of the preceding claims, wherein a program to be executed in the computing unit (100) comprises a plurality of R.416106 - 27 - has instructions to be executed in a predetermined order; wherein the read instruction is one instruction of this plurality of instructions to be executed at a respective position in the predetermined order of the program to be executed; wherein the predetermined entry (231, 232, 233, 234, 235) in the memory unit (230) is predetermined depending on the position of the read instruction in the predetermined order of the program.

7. A method according to any of the foregoing claims, further comprising: Perform (318) a specified action if, during the verification (314) of the execution of the command, an incorrect execution of the command is detected.

8. Computing unit (100) configured to perform all process steps of a process according to any of the preceding claims.

9. Computing unit (100) according to claim 8, comprising a processor core (111) based on a RISC-V instruction set architecture.

10. Computing unit (100) according to claim 8 or 9, comprising a processor core (111) configured as an "out-of-order" processor core (200).

11. Computing unit (100) according to one of claims 8 to 11, comprising a processor core (111, 200) with a memory unit (230), wherein the memory unit (230) is configured as a "re-order buffer".

12. Computer program that causes a computing unit (100) to perform all the process steps of a method according to any one of claims 1 to 7 when executed on the computing unit (100).

13. Machine-readable storage medium with a computer program stored thereon according to the preceding claim.

Images