Field Repairable Logic for Microprocessor Bug Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern microprocessor designs face challenges in fully verifying their correctness due to the complexity of modern designs exceeding the capabilities of existing verification tools, leading to the release of processors with latent bugs, particularly in control logic interactions, which are difficult to handle by formal verification techniques.
Innovation Solution
The introduction of a hardware patching mechanism, known as field-repairable logic (FRL), which includes a state matcher and recovery controller to identify and correct design errors in microprocessor systems by switching to a trusted mode of operation that has been formally verified, allowing for the execution of the full instruction-set architecture at a reduced performance level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If formal verification techniques are used to prove correctness of hardware components, then reliability of verified components is improved, but device complexity increases and scalability is limited
Solution Approach 1:
The patent divides the microprocessor into a formally verified trusted core and unverified extension logic. The trusted core contains only the critical components that have been formally verified, while extension logic handles additional functionality. This segmentation allows formal verification to be applied selectively to high-risk components rather than the entire complex system, resolving the contradiction between achieving high reliability through formal verification and managing the complexity that limits scalability.
Solution Approach 2:
The patent introduces a boundary interface between the trusted core and unverified extensions that acts as an intermediary. This boundary enforces controlled interactions and ensures that unverified logic cannot compromise the trusted core. The intermediary mechanism allows the system to benefit from formal verification of critical components while accommodating unverified extensions, thus scaling verification to complex designs without requiring verification of the entire system.
2Measurement precision
If simulation-based verification is used to exercise design with test sequences, then coverage of test cases is improved, but exhaustiveness is insufficient due to large state space
Solution Approach 1:
The patent applies different verification qualities to different parts of the design. The trusted core receives exhaustive formal verification providing high reliability guarantees, while unverified extensions receive simulation-based verification providing good test coverage but without exhaustiveness guarantees. This local differentiation of verification quality allows the system to achieve high reliability where needed while managing the overall verification effort, resolving the contradiction between test coverage and exhaustiveness.
3Reliability
If trusted mode execution is activated to ensure correctness, then reliability is improved, but performance decreases due to reduced instruction throughput
Solution Approach 1:
The patent implements dynamic mode switching between trusted mode and untrusted mode based on the execution context. The processor can operate in untrusted mode for performance-critical paths that do not involve the trusted core, achieving high instruction throughput. When execution involves the trusted core or requires formal verification guarantees, the system dynamically switches to trusted mode. This dynamic adaptation resolves the contradiction between reliability and performance by applying the appropriate execution mode contextually rather than statically.
Data Source
AI summary
A state matcher for a logic circuit may detect at least one of a buggy state of the logic circuit, a precursor to a buggy state of the logic circuit and a verified state of the logic circuit based on a plurality of signal values indicative of a state of the logic circuit. A recovery controller for a microprocessor may reconfigure the microprocessor to a trusted feature mode in response to receiving a signal indicating that the microprocessor is in a predefined state and operate the microprocessor in the trusted feature mode for a predetermined period of time.