Thread-Level Lockstep With Hardware Comparison for Error Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for functional safety in high-performance processors are excessively complex and costly, requiring dual core lockstep with high design and verification efforts, and fail to identify the specific processor with errors, leading to inefficient error recovery and potential system crashes.
Innovation Solution
Implementing an explicit lockstep architecture with comparator hardware that compares individual results of two processors, allowing for lightweight verification and rapid resource reallocation, and provides hardware-based synchronization for selected safe variables, enabling error detection and containment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dual core lockstep is implemented for functional safety, then diagnostic coverage and safety are improved, but design complexity and verification effort increase excessively
Solution Approach 1:
The patent divides the safety verification task into segments by implementing lockstep execution at the thread level rather than requiring full dual-core processor lockstep. Each thread has its own data registers that are compared, allowing safety verification to be applied selectively to critical sections of code while leaving other parts of the system unchanged.
Solution Approach 2:
The patent applies lockstep verification partially rather than completely - only to safety-critical variables and threads where it is most needed. The hardware comparator selectively compares specific data registers associated with safe variables, rather than comparing all processor states, reducing the overall verification burden while maintaining safety for critical functions.
2Reliability
If dual core lockstep is implemented for functional safety, then safety coverage is improved, but verification effort becomes excessively high
Solution Approach 1:
The verification process is segmented to focus only on critical safety variables. The hardware comparator is configured to monitor specific data registers that hold safe variables, allowing verification effort to be concentrated where it provides the most safety benefit rather than verifying entire processor states.
Solution Approach 2:
The system performs self-verification through automatic hardware comparison of data registers. The hardware comparator continuously monitors and compares values in real-time without requiring external verification tools or manual testing, enabling the system to verify its own safety-critical operations autonomously.
3Reliability
If traditional lockstep is used, then functional safety is achieved, but the specific processor with errors cannot be identified
Solution Approach 1:
The patent introduces an intermediary mechanism - the hardware comparator with mismatch detection logic - that acts as a mediator between the two executing threads. When a mismatch is detected, the comparator generates an interrupt that provides information about the error, enabling identification of which thread produced the incorrect value while still maintaining functional safety through the comparison mechanism.
4Reliability
If full dual core lockstep is implemented, then high diagnostic coverage is achieved, but resource reallocation becomes inefficient
Solution Approach 1:
The system dynamically adjusts the application of lockstep verification based on runtime conditions. Threads can be spawned with or without lockstep verification applied, and the hardware comparator can be configured to monitor specific threads or variables as needed. This dynamic approach allows efficient resource reallocation where verification is applied only where and when safety requires it.
Data Source
AI summary
A method of explicit lockstep for functional safety includes spawning, by a main thread, a first safe thread core and a second safe thread core. The method also includes initializing and mapping a first data register associated with the first safe thread core to each safe variable of a set of predetermined safe variables. The method further includes initializing and mapping a second data register associated with the second safe thread core to each safe variable of the set of predetermined safe variables. The method also includes comparing, by a hardware comparator, a first safe variable value in the first data register to a second safe variable value in the second register. The method further includes issuing an error completion to the first safe thread core and the second safe thread core when the hardware comparator detects a mismatch between the first data register and the second data register.