CN112596916A - Dual-core lock step error recovery system and method - Google Patents

Abstract

The invention discloses a dual-core lockstep error recovery system and method, relates to the technical field of CPU architecture, and solves the technical problem that the system cannot be quickly restored to a safe state when a lockstep error occurs under a dual-core lockstep mechanism, and the main points of the technical solution are The controller generates corresponding snapshots according to the operating states of the first core and the second core, and stores the snapshots in the storage unit. When a lockstep error occurs between the first core and the second core, the controller extracts the snapshot from the storage unit. Snapshot and provide the snapshot to the first core and the second core, so that the first core and the second core can quickly recover to a safe state without relying on other programs for recovery, the recovery process is simple and the recovery time is fast.

Description

Dual-core lockstep error recovery system and method

technical field

The present disclosure relates to the technical field of CPU architecture, and in particular, to a dual-core lockstep error recovery system and method.

Background technique

In some fields, such as the automotive industry or the civil aviation industry, there are high requirements for the functional safety of components. As the "brain" of these components, the functional safety characteristics of the CPU play a considerable role in meeting the high requirements in these fields. important role. When a functional failure occurs, how to handle the error quickly and reliably and restore the program execution reliably is an important part of the research in the field of functional safety.

Dual-Core Lockstep is a common method to enhance the functional safety of chips. The two cores in the dual-core lockstep state read the same data and execute the same instructions, and a detection unit monitors the states of the two cores in real time. If the states of the two cores are inconsistent (here called a lockstep error, it often means If at least one core has at least an error), a warning is triggered (for example, an interrupt is initiated or a signal is set). Through the lockstep mechanism, the functional safety of the CPU is greatly enhanced.

While enhancing the functional safety of the system, in order to further improve the availability of the system, the system should try to restore the normal operation of the program when a lockstep error occurs. When a lockstep error occurs, the recovery is generally carried out in the following ways: (1) The software processes it in the lockstep error interrupt handler; (2) The alarm signal directly triggers the restart circuit to restart the entire system.

The currently known recovery mechanisms after a CPU lockstep error either rely heavily on software, such as assuming that the CPU can reliably execute an interrupt handler for handling lockstep errors; or require a longer recovery time, such as The lockstep error signal is used to directly trigger the entire system to restart. In this case, a large number of programs need to be re-executed to complete the final recovery execution, which takes a long time.

SUMMARY OF THE INVENTION

The present disclosure provides a dual-core lockstep error recovery system and method, the technical purpose of which is to quickly restore the system to a safe state when a lockstep error occurs under the dual-core lockstep mechanism.

The above-mentioned technical purpose of the present disclosure is achieved through the following technical solutions:

A dual-core lockstep error recovery system, comprising a processor, the processor comprising:

the first core;

a second core, the second core and the first core are in a dual-core lockstep mode;

The first monitoring unit monitors the first core and the second core to determine whether a lockstep error occurs, and if a lockstep error occurs, a first lockstep error signal is triggered, and the first lockstep error is detected. sending a signal to the first core, the second core, and a controller;

When the first core and the second core receive the first lockstep error signal, stop the currently running instruction, and extract a snapshot from the storage unit through the controller for error recovery;

The controller, when not receiving the first lockstep error signal, generates a corresponding snapshot according to the operating state of the first core and the second core, and stores the snapshot to the storage unit; receiving When the first lockstep error signal is detected, the snapshot is extracted from the storage unit and provided to the first core and the second core for error recovery;

The storage unit is used for storing the snapshot.

Further, the system also includes a second monitoring unit, the second monitoring unit is used for: monitoring the controller, monitoring whether an error occurs in the controller, and if an error occurs, an error signal is triggered and the error occurs. signal to the processor or to an external system.

Further, the controller further includes a first controller and a second controller, the first controller and the second controller are in a lockstep mode;

The second monitoring unit is further configured to: monitor the first controller and the second controller to determine whether a lockstep error occurs in the first controller and the second controller. A step error triggers a second lockstep error signal, and the second lockstep error signal is sent to the processor or an external system.

Further, the storage unit further includes a first storage unit and a second storage unit, and both the first storage unit and the second storage unit belong to a stack structure;

The first controller is configured to generate a first snapshot of the first core, and store the first snapshot to the first storage unit; the second controller is configured to generate a second snapshot of the second core snapshot, and store the second snapshot to the second storage unit.

Further, when the first monitoring unit detects a lockstep error of the first core and the second core, the first controller and the second controller do not regenerate within a preset time threshold A snapshot is generated, and a snapshot is generated after the preset time threshold.

Further, the controller is also used for:

Monitoring the popping situation of the snapshots in the storage unit, if the number of times that a certain snapshot is continuously popped from the stack exceeds a preset threshold, the processor or the external system is notified;

Monitor the number of snapshots in the storage unit, and notify the processor or an external system if the storage unit is empty.

A method for error recovery using the dual-core lockstep error recovery system as described above, comprising:

Generate corresponding snapshots according to the operating states of the first core and the second core, and store the snapshots;

monitoring the first core and the second core to determine whether a lockstep error occurs;

When a lockstep error is detected in the first core and the second core, the snapshot is provided to the first core and the second core for error recovery.

The beneficial effects of the present disclosure are: in the dual-core lockstep error recovery system and method described in the present disclosure, the controller generates corresponding snapshots according to the operating states of the first core and the second core, and stores the snapshots in the storage unit, When a lockstep error occurs between the first core and the second core, the controller extracts a snapshot from the storage unit and provides the snapshot to the first core and the second core, so that the first core and the second core can quickly recover to a safe state, No need to rely on other programs for recovery, the recovery process is simple and the recovery time is fast.

Description of drawings

1 is a schematic diagram of a dual-core lockstep error recovery system according to the present invention;

2 is a schematic diagram of Embodiment 1 of the dual-core lockstep error recovery system according to the present invention;

3 is a schematic diagram of Embodiment 2 of the dual-core lockstep error recovery system according to the present invention;

FIG. 4 is a flowchart of the dual-core lockstep error recovery method according to the present invention.

Detailed ways

The technical solutions of the present disclosure will be described in detail below with reference to the accompanying drawings. In the description of the present disclosure, it should be understood that the terms "first" and "second" are only used for the purpose of description, and should not be interpreted as indicating or implying relative importance or implicitly indicating the number of technical features indicated, It is only used to distinguish the different components.

FIG. 1 is a schematic diagram of a dual-core lockstep error recovery system according to the present invention. As shown in FIG. 1 , the system includes a processor, and the processor further includes a first core, a second core, a first monitoring unit, a controller and a storage unit. The first core and the second core are in dual-core lockstep mode. The first monitoring unit monitors the first core and the second core to determine whether a lockstep error occurs. If a lockstep error occurs, the first lockstep error signal is triggered, and a lockstep error occurs. A first lockstep error signal is sent to the first core, the second core and the controller. When the first core and the second core receive the first lockstep error signal, they stop the currently running instruction, and extract a snapshot from the storage unit through the controller for error recovery.

When the controller does not receive the above-mentioned first lockstep error signal, a corresponding snapshot is generated according to the operating state of the first core and the second core, and the snapshot is stored in the storage unit; when the controller receives the above-mentioned first lockstep error When the signal is received, a snapshot is extracted from the storage unit and provided to the first core and the second core for error recovery. A storage unit is a stack structure that stores snapshots.

As a specific embodiment, the controller generates snapshots of the first core and the second core, and pushes the generated snapshots into a snapshot stack (ie, a storage unit). When the number of snapshots is greater than the maximum value that can be stored in the stack, the The snapshot is replaced by the snapshot above it.

When popping (taking a snapshot from the top of the stack, and moving the rest of the snapshots in the stack toward the top of the stack), the controller should provide a popup interface to both cores to ensure that the current transfer on the bus is completed at the right time ) to pop the snapshot.

Specifically, combine the pop-up and push of the snapshot with the function call, push the snapshot into the stack after the function entry completes the necessary initialization, and pop the stack or make the function exit at the function exit (reaching the function exit to prove that the execution of the function does not have a lock-step error). Popped snapshots are invalid. Then the software can set up multiple snapshots to facilitate the protection and fault recovery of function calls, especially nested calls.

2 is a schematic diagram of Embodiment 1 of the dual-core lockstep error recovery system according to the present invention. In this embodiment, the system further includes a second monitoring unit, and the second monitoring unit is used to monitor the controller and monitor whether the controller is An error occurs, and if an error occurs, an error signal is triggered and sent to the processor or external system.

In this application, the external system refers to a control system other than the processor. If the controller fails, the processor itself or other external controllers can reset the circuit of the entire processor to initiate a system restart, etc.

3 is a schematic diagram of Embodiment 2 of the dual-core lockstep error recovery system according to the present invention. In this embodiment, the controller includes a first controller and a second controller, and the first controller and the second controller are also in lockstep model. The storage unit also includes a first storage unit and a second storage unit, and both the first storage unit and the second storage unit belong to a stack structure. The first controller is configured to generate a first snapshot of the first core and store the first snapshot to the first storage unit; the second controller is configured to generate a second snapshot of the second core and store the second snapshot to the second storage unit unit.

When a lockstep error occurs between the first core and the second core, the first core extracts the first snapshot from the first storage unit through the first controller for error recovery, while the second core uses the second controller to extract the first snapshot from the second storage unit. Extract the second snapshot for error recovery. The two controllers provide push and pop interfaces for the two cores, respectively.

As a specific embodiment, when the first monitoring unit detects a lockstep error of the first core and the second core, the first controller and the second controller no longer generate snapshots within a preset time threshold, and within the preset time Snapshots are generated after the threshold.

Since there is a certain delay from the occurrence of a lockstep error on the first core and the second core to when the first monitoring unit detects the lockstep error and triggers the first lockstep error signal, in order to avoid stack snapshots during this time period, the snapshot The stack should be delayed for a certain number of clock cycles, and the snapshot should be pushed to the stack after ensuring that there are no lockstep errors within these clock cycles.

As a specific embodiment, the controller also monitors the popping status of snapshots in the storage unit, and notifies the processor or an external system for processing if the number of times a snapshot is popped continuously exceeds a preset threshold. In addition, the controller also monitors the number of snapshots in the storage unit, and notifies the processor or an external system for processing if the storage unit is empty.

FIG. 4 is a flowchart of the dual-core lockstep error recovery method according to the present invention. As shown in FIG. 4 , step S100 : generating corresponding snapshots according to the operating states of the first core and the second core, and storing the snapshots .

Step S101: Monitor the first core and the second core to determine whether a lockstep error occurs.

Step S102: When a lockstep error is detected in the first core and the second core, the snapshot is provided to the first core and the second core for error recovery.

In step S102, the first monitoring unit triggers a first lockstep error signal when detecting that the first core and the second core have a lockstep error, and sends the first lockstep error signal to the first core and the second core. After the first core and the second core receive the first lockstep error signal, they stop the currently running instructions, pop a snapshot from the snapshot stack, and use this in a safe manner (for example, it is necessary to ensure that the bus access initiated by the processor is completed after the completion of the process). then resume) to resume the two core running scenarios and resume running.

The above are exemplary embodiments of the present disclosure, and the protection scope of the present disclosure is defined by the claims and their equivalents.

Claims (7)

1. a dual-core lockstep error recovery system, is characterized in that, comprises a processor, and described processor comprises: the first core; a second core, the second core and the first core are in a dual-core lockstep mode; The first monitoring unit monitors the first core and the second core to determine whether a lockstep error occurs, and if a lockstep error occurs, a first lockstep error signal is triggered, and the first lockstep error is detected. sending a signal to the first core, the second core, and a controller; When the first core and the second core receive the first lockstep error signal, stop the currently running instruction, and extract a snapshot from the storage unit through the controller for error recovery; The controller, when not receiving the first lockstep error signal, generates a corresponding snapshot according to the operating state of the first core and the second core, and stores the snapshot to the storage unit; receiving When the first lockstep error signal is detected, the snapshot is extracted from the storage unit and provided to the first core and the second core for error recovery; The storage unit is used for storing the snapshot. 2. The dual-core lockstep error recovery system according to claim 1, wherein the system further comprises a second monitoring unit, and the second monitoring unit is used for: monitoring the controller, monitoring the control Whether the processor has an error, if an error occurs, an error signal is triggered and the error signal is sent to the processor or an external system. 3. The dual-core lockstep error recovery system according to claim 2, wherein the controller further comprises a first controller and a second controller, the first controller and the second controller are in a lockstep mode; The second monitoring unit is further configured to: monitor the first controller and the second controller to determine whether a lockstep error occurs in the first controller and the second controller. A step error triggers a second lockstep error signal, and the second lockstep error signal is sent to the processor or an external system. 4. The dual-core lockstep error recovery system according to claim 3, wherein the storage unit further comprises a first storage unit and a second storage unit, both of the first storage unit and the second storage unit belong to the stack structure; The first controller is configured to generate a first snapshot of the first core, and store the first snapshot to the first storage unit; the second controller is configured to generate a second snapshot of the second core snapshot, and store the second snapshot to the second storage unit. 5. The dual-core lockstep error recovery system according to claim 4, wherein when the first monitoring unit detects a lockstep error of the first core and the second core, the first The controller and the second controller no longer generate snapshots within a preset time threshold, and then generate snapshots after the preset time threshold. 6. The dual-core lockstep error recovery system of claim 1, wherein the controller is also used for: Monitoring the popping situation of the snapshots in the storage unit, if the number of times that a certain snapshot is continuously popped from the stack exceeds a preset threshold, the processor or the external system is notified; Monitor the number of snapshots in the storage unit, and notify the processor or an external system if the storage unit is empty. 7. A method for error recovery using the dual-core lockstep error recovery system according to any one of claims 1-6, characterized in that, comprising: Generate corresponding snapshots according to the operating states of the first core and the second core, and store the snapshots; monitoring the first core and the second core to determine whether a lockstep error occurs; When a lockstep error is detected in the first core and the second core, the snapshot is provided to the first core and the second core for error recovery.

Images