CA2367793A1 - Method and apparatus for computer system reliability - Google Patents
Method and apparatus for computer system reliability Download PDFInfo
- Publication number
- CA2367793A1 CA2367793A1 CA002367793A CA2367793A CA2367793A1 CA 2367793 A1 CA2367793 A1 CA 2367793A1 CA 002367793 A CA002367793 A CA 002367793A CA 2367793 A CA2367793 A CA 2367793A CA 2367793 A1 CA2367793 A1 CA 2367793A1
- Authority
- CA
- Canada
- Prior art keywords
- processor
- results
- register
- sequence
- instructions
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 title claims description 18
- 230000001186 cumulative effect Effects 0.000 claims abstract description 23
- 238000012545 processing Methods 0.000 description 10
- 230000008901 benefit Effects 0.000 description 5
- 239000000872 buffer Substances 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 3
- 238000013461 design Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 238000011084 recovery Methods 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 238000013459 approach Methods 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 238000011010 flushing procedure Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1405—Saving, restoring, recovering or retrying at machine instruction level
- G06F11/1407—Checkpointing the instruction stream
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1629—Error detection by comparing the output of redundant processing systems
- G06F11/1641—Error detection by comparing the output of redundant processing systems where the comparison is not performed by the redundant processing components
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1629—Error detection by comparing the output of redundant processing systems
- G06F11/165—Error detection by comparing the output of redundant processing systems with continued operation after detection of the error
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1675—Temporal synchronisation or re-synchronisation of redundant processing components
- G06F11/1683—Temporal synchronisation or re-synchronisation of redundant processing components at instruction level
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
- G06F11/1675—Temporal synchronisation or re-synchronisation of redundant processing components
- G06F11/1691—Temporal synchronisation or re-synchronisation of redundant processing components using a quantum
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/30098—Register arrangements
- G06F9/30105—Register structure
- G06F9/30116—Shadow registers, e.g. coupled registers, not forming part of the register space
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/30098—Register arrangements
- G06F9/3012—Organisation of register space, e.g. banked or distributed register file
- G06F9/30134—Register stacks; shift registers
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/38—Concurrent instruction execution, e.g. pipeline, look ahead
- G06F9/3836—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution
- G06F9/3851—Instruction issuing, e.g. dynamic instruction scheduling or out of order instruction execution from multiple instruction streams, e.g. multistreaming
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/38—Concurrent instruction execution, e.g. pipeline, look ahead
- G06F9/3861—Recovery, e.g. branch miss-prediction, exception handling
- G06F9/3863—Recovery, e.g. branch miss-prediction, exception handling using multiple copies of the architectural state, e.g. shadow registers
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/83—Indexing scheme relating to error detection, to error correction, and to monitoring the solution involving signatures
Abstract
According to one embodiment, a multiprocessing system includes a first processor, a second processor, and compare logic. The first processor is operable to compute first results responsive to instructions, the second processor is operable to compute second results responsive to the instructions, and the compare logic is operable to check at checkpoints for matching of the results.
Each of the processors has a first register for storing one of the processor's results, and the register has a stack of shadow registers. The processor is operable to shift a current one of the processor's results from the first register into the top shadow register, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch. It is advantageous that the shadow register stack is closely coupled to its corresponding register, which provides for fast restoration of results. In a further aspect of an embodiment, each processor has a signature generator and a signature storage unit. The signature generator and storage units are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the match or mismatch determination by the compare logic. The checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor. It is faster, and therefore advantageous, to check respective cumulative signatures at intervals rather than to check each individual result.
Each of the processors has a first register for storing one of the processor's results, and the register has a stack of shadow registers. The processor is operable to shift a current one of the processor's results from the first register into the top shadow register, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch. It is advantageous that the shadow register stack is closely coupled to its corresponding register, which provides for fast restoration of results. In a further aspect of an embodiment, each processor has a signature generator and a signature storage unit. The signature generator and storage units are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the match or mismatch determination by the compare logic. The checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor. It is faster, and therefore advantageous, to check respective cumulative signatures at intervals rather than to check each individual result.
Description
METHOD AND APPARATUS FOR COMPUTER SYSTEM RELIABILITY
BACKGROUND OF THE INVENTION
S Field of the Invention The present invention relates to high reliability processing, by hardware redundancy. More particularly, the invention relates to a processing system with pair-wise processors that operate in a high reliability mode to detect computational errors, and operate independently in a high performance mode.
Related Art Various approaches exist for achieving high reliability processing.
FIG. 1 illustrates one prior art processor 100 for high reliability processing. The processor 100 includes two execution units 130 and 13S, which are both the same type of arithmetic unit. For example, the two execution units could both be floating point units, or integer units. The processor 100 has architected registers 120 for holding committed execution results. The two execution units 130 and 13S both execute the same instruction stream in paxallel. That is, for each instruction an instance of the instruction executes in each respective execution unit 130 and 135. Then, when the two units are ready to commit the result for an instruction to the register file I20, the two versions of the result are compared by compare unit 12S. If the compare unit 12S
determines that the versions are the same, then the unit 12S updates one or more of the registers 120 with the result. If the versions do not match, then other actions axe taken. In one implementation, a counter records whether an error is occurring repeatedly, and if it is, the error is classified as a "hard" failure. In the case of a hard failure, the instruction issue mechanism does not reissue the faulting instruction, but 2S instead executes a "trap" instruction. One such trap leads to a micro code routine for reading out the state of the defective processor and loading it into a spare processor, which restarts execution at the instruction that originally faulted. In an alternative, where no spare processor is available, the trap leads to the operating system migrating the processes on the faulty processor to other processors, which adds to the workload of the other processors.
While this arrangement provides a reliability advantage, it is disadvantageous in that the processor design is more complex than a conventional processor and has greater overhead.
Moreover, it limits the processor 100 throughput to have two execution units 130 in the processor 100 both executing the same instruction stream. Another variation of a processor which is designed for exclusively high reliability operation is shown in Richard N. Gufstason, John S. Liptay, and Charles F. Webb, "Data Processor with Enhanced Error Recovery," U.S. patent 5,504,859, issued April 2, 1996.
FIG. 2 illustrates another arrangement for high reliability processing. In this voting arrangement, three processors 200 each execute the same program in parallel and versions of a result are compared at checkpoints in the program on a bus 160 external to the processors 100. If the versions do not match, then other actions are taken, such as substituting a different processor 100 for the one that produced the disparate version. This arrangement is advantageous in that complexity of the individual processors 200 is reduced, and an error producing processor can be identified. Also, the throughput of one of the processors 200 may be greater than that of the one processor 100 in FIG.
l, since the individual processor 200 does not devote any of its execution units to redundant processing. However, the arrangement of FIG. 2 is redundant at the level of the processors 200, and uses three whole processors 200 to recover from a single fault. Also, the error checking is limited to results which are asserted externally by the processors.
In the related application, a pair of processors use state-of the-art state recovery mechanisms that are already available for recovering from exceptions and apply these mechanisms to operate in lockstep synchrony in a high reliability mode. This is highly advantageous because it achieves the high reliability without extensive modification to existing processor design.
However, it is somewhat limiting because of the required synchrony. That is, in the high reliability mode the processors in the related application must process a stream of instructions in the same sequence.
From the foregoing, it may be seen that a need exists for improvements in high reliability processing.
SUMMARY
The foregoing need is addressed in the present invention. According to the invention, in a first embodiment, a multiprocessing system includes a first processor, a second processor, and compare logic. The first processor is operable to compute firstresults responsive to instructions, the second processor is operable to compute second results responsive to the instructions, and the compare logic is operable to check at checkpoints for matching of the results.
Each of the processors has a first register for storing one of the processor's results, and the register has a stack of shadow registers. The processor is operable to shift a current one of the processor's results from the first register into the top shadow register, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch. It is advantageous that the shadow register stack is closely coupled to its corresponding register, which provides for fast restoration of results.
In a further aspect of an embodiment, each processor has a signature generator and a signature storage unit. The signature generator and storage unit are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the match or mismatch determination by the compare logic. The checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor. It is faster, and therefore advantageous, to check respective cumulative signatures at intervals rather than to check each individual result.
Also, in one embodiment, the instructions have a certain instruction sequence and at least one of the processors may execute instructions in a sequence different than the program sequence, but both of the processors execute store-type instructions according to a sequence in which the store-type instructions occur in the certain instruction sequence. The checkpoints are responsive to store instructions, so that a first sequence of results for the first processor ends at one of the checkpoints with a result for one of the store instructions and a second sequence of results ends at the checkpoint for the second processor with a result for the same one of the store instructions. It is advantageous to trigger checkpoints responsive to store-type instructions so that while an intermediate one of the results of the first sequence of results may be different than a corresponding intermediate one of the results of the second sequence of results, nevertheless the first processor's ending result for the first sequence and the second processor's ending result for the second sequence tend to match unless one of the processors has malfunctioned.
In an alternative embodiment, the second processor executes the instructions in a sequence identical to a sequence in which the first processor executes the instructions, and the checkpoints are responsive to accumulated number of execution cycles. In this embodiment the checkpoints may also be responsive to store instructions. In one such embodiment, the checkpoints are responsive to store instructions and accumulated number of execution cycles if there has been no store instruction since a last checkpoint.
While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will be described herein in detail. It should be understood, however, that the drawings and detailed description are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the present invention as defined by the appended claims.
BRIEF DESCRIPTION OF THE DRAWINGS
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
FIG. 1 illustrates a prior art processor for high reliability processing.
FIG. 2 illustrates another prior art system for high reliability processing.
FIG. 3 illustrates prior art register files for a processor.
FIG. 4 illustrates processors according to an embodiment of the present invention.
FIG. 5 illustrates an instruction stream and respective results computed by the processors of FIG. 4, according to an embodiment of the present invention.
FIG. 6 illustrates a register file for the processors of FIG. 4, according to an embodiment of the present invention.
FIG. 7, illustrates method steps for handling registers for the processors of FIG. 4, according to an embodiment of the present invention.
AUS9-2000-0644 q DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
In the following detailed description of the preferred embodiments, reference is made to the accompanying drawings illustrating embodiments in which the invention may be practiced. It should be understood that other embodiments may be utilized and changes may be made without departing from the scope of the present invention.
Referring now to FIG. 4, a multiprocessing system 400 is shown according to an embodiment of the present invention. The system 400 includes a first processor 410A, a second processor 4108 (which may or may not be identical to processor 410A), and compare unit 420.
Processor 410A has the following elements connected to one another as shown: fetch logic 432A, instruction cache 434A, decode logic 436A, issue queue 438A, execution and load/store unit 440A, commit logic 442A, signature generator 444A, store latch 446A, data cache 448A and architected register 454A for holding a current result. Architected register 454A has a shadow register 454A.1 for holding a previous result, and shadow register 454A.2 for holding a committed result, as will be further explained. Processor 4108 includes at least its own respective ones of the following elements (not shown): signature generator 4448, store latch 4468, and architected register 4548 for holding a current result. Architected register 4548 has shadow register 4548.1 for holding a previous result, and shadow register 4548.2 for holding a committed result.
It should be understood that while the FIG's and description herein focus on results stored in one exemplary register and its corresponding shadow registers, this is merely for the sake of illustration, and the processors actually include numerous such registers.
Referring now to FIG. 5, The processors 410A and 4108 are shown with a sequence of instructions 510 and respective results, to illustrate aspects of the present invention, according to an embodiment. The first processor 41 OA is operable to compute first results 520A responsive to the instructions 510, and the second processor 4108 is operable to compute second results 5208 responsive to the instructions 510. More specifically, the instructions 510 represent instructions for a program that are in a program sequence, including instruction 510.1, followed by 510.2, followed by 510.3, etc. For instruction 510.1 processor 410A computes result 520A.1 and processor 4108 computes result 5208.1, whereas for instruction 510.2 processor 410A computes result 520A.2 and processor 41 OB computes result 5208.2, and so on. For each of the results signature generator 444A
(FIG. 4) computes an updated signature, which it outputs to store latch 446A.
The compare unit 420 is operable to check at checkpoints for matching of the results. For example, according to the illustrated embodiment, instructions 510.6 and 510.12 are each instances of a store-type instruction that triggers a checkpoint. That is, responsive to computing a result 520A.6 for the instruction 510.6, for example, the signature generator 444A
for processor 410A
updates the signature stored in latch 446A, as it does for each of the results 520A.1, 520A.2, etc.
Likewise, responsive to computing a result 520B.6 for the instruction 510.6, the signature generator 444B for processor 410B updates the signature stored in latch 446B, as it does for each of the results 520B.1, 520B.2, etc. In addition, since instruction 510.6 triggers a checkpoint, responsive to computing result 520A.6 the processor 410A indicates to compare unit 420 that the signature for result 520A.6 is ready. Likewise, responsive to computing result 520B.6 the processor 410B
indicates to compare unit 420 that the signature for corresponding result 520B.6 is ready. Once the corresponding signatures are ready, compare unit 420 compares them to see if they match. It should be noted that the signatures reflect the store values themselves, or else the store values are compared to one another along with the signatures.
There are a variety of well-known compression schemes which may be employed for generating the signatures of the present invention. For example, a linear feedback shift register may be used, according to which a new input is XOR'ed with a bit that is shifted out. This is advantageous because the resulting signature traverses a space in a very random way so that it is unlikely to produce a small excursion from a state the signature is supposed to have and back.
Signature generation as discussed in the related patent application is also relevant to the present invention.
Referring now to FIG. 3, conventional register files 310 and 315 are illustrated for contrasting with aspects of an embodiment of the present invention. In the example, the first register file 310 and the second register file 315 are essentially identical. Register file 310 has a number of registers, including register 330 and 340 which are explicitly illustrated. Each one of the registers has a number of register cells. Details of register cell 320 of register 330 are explicitly illustrated. The exemplary register cell 320 includes a memory cell 322 coupled to an input (i.e., write) port 324 and an output (i.e., read) port 326.
Referring now to FIG. 6, a register file 610 is illustrated, according to an embodiment of the present invention. The register file 610 shown is for processor 41 OA, but is representative of register files in both processors 410A and 410B, and includes a number of registers.
Explicitly illustrated are registers 454A, as was shown in FIG. 4, and register 640. Other registers may also be included in the register file 610 as indicated by the ellipses between registers 454A
and 640. Register 454A
includes a number of register cells 615, each of which has a conventional memory cell, write port and read port as in conventional register cells, such as cells 320 in register 330 (FIG. 3). In contrast to conventional registers, the register cells 615 of register 454A (FIG. 6), for example, have corresponding shadow cells arranged in stacks of shadow cells 630. Shadow cells shown explicitly for the shadow cell stack 630 of register cell 6l S include the top shadow cell 620 and the last i.e., bottom shadow cell 625. There may be others therebetween as indicated by the ellipses between cell 620 and cell 625, or shadow cell 625 may be the very next one below cell 620.
The top shadow cells 620 are connected to their respective register cells 615 by respective control FET's 622 as shown.
The contents of the register cell 615 may be written into the shadow cell 620 under control of the control FET 622. Likewise, the contents of the shadow cell 620 may be written to the next shadow cell under control of the FET interconnecting the shadow cell 620 and the next shadow cell.
As may be seen in FIG. 6, the top shadow register 454A.1 (also shown in FIG.
4) for register 454A includes the top shadow cells 620 of the register 454A register cells 615, and correspondingly the contents of the register 454A may be written to the top shadow register 454A.1, and the contents of the top shadow register 454A:1 may be written to the next shadow register under control of the respective FET's therebetween.
According to this arrangement, register 454A holds one of the processor 41 OA
current results.
The register 454A includes a stack 635 of shadow registers, the stack 635 has at least a top shadow register 454A.1 and a next shadow register, which may be the last, i.e., bottom shadow register (i.e., shadow register 454A.2 in FIG. 4) that includes bottom shadow cells 625 (FIG.
6). The processor 41 OA is operable to perform shifting of the results, including shifting a current one of the processor's results from the first register 454A into the top shadow register 454A. l, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register 454A
responsive to the compare unit 420 determining that the first and second results mismatch.
AUS9-2000-0644 '7 Referring again to FIG. 5, as stated above, for each of the results 520A.1, 520A.2, et.
signature generator 444A (FIG. 4) computes an updated signature, which it outputs to store latch 446A. Likewise, for each of the results SZOB.1, 5208.2, et. signature generator 4448 (FIG. 4) computes an updated signature, which it outputs to store latch 4468. According to another aspect, the signature generator 444A for the first processor 410A and the signature generator 4448 for the second processor 4108 are each operable to compute respective cumulative signatures for the sequences of the processors' results 520A and 520B. That is, in the illustrated sequence of instructions 510 (and corresponding sequence of results 520A and 5208) it is implied that a checkpoint (not shown) immediately precedes the sequence of instructions 510 so that the sequence 510 begins after the checkpoint. Furthermore, the sequence 510 includes a sequence of instructions beginning with instruction 510.1 and ending with a checkpoint responsive to the aforementioned store instruction 510.6, after which a next sequence begins with instruction 510.7. For the sequence of instructions 510.1 through 510.6, and corresponding results 520A.1 through 520A.6, for example, the processor 410A is operable to initialize a new signature for the first result 520A.1, and then update the signature, which is stored in the signature storage unit, i.e., store latch 446A, in such a manner that the updated signature reflects the cumulative effect of the sequence of instructions 510.1 through 510.6 and corresponding results. Likewise the same is true for processor 4108 and its respective results and signatures:
According to one embodiment, the processors update their signatures in the following manner. For each instruction that alters the value in a register, processor 410A, for example, sends to its signature generator 444A new information, including altered values and the identities of registers holding those values. The signature generator 444A merges the new information with the already existing signature in the store latch 446A to form an updated signature. Then, responsive to a checkpoint, such as store instruction 510.6, the store latch 446A sends the store value for storage in a cache and/or main store. The store latch 446A includes the cumulative signature with the store value. Meanwhile, processor 4108 has done the same, and the compare unit 420 compares the cumulative signatures from the respective store latches 446A and 4468. If the signatures match this tends to indicate that the results 520A.1 through 520B.6 and results 5208.1 through 5208.6 were the same. If the signatures do not match, then the store result is not forwarded to the store AUS9-2000-0644 g buffer 450. Instead the compare unit 420 resets the processors to the state they had for their last matching checkpoint, and initiates refetching of instructions and flushing of local caches 448A and 448B so that the processor can resume execution at that point.
For processors 41 OA and 41 OB operating as a pair-wise system, the processors share one store buffer 450 as shown in FIG. 4. Alternatively, the processors coordinate ones of their own respective store buffers (not shown) to.function as the unified store buffer 450. When the processor's operate independently they each use ones of their own respective store buffers.
It has been pointed out that the instructions 510 have a certain program sequence, and that result 520A.1 is for corresponding instruction 510.1, result 520A.2 is for instruction 510.2, etc. As implied by the corresponding sequence of results 520A and 520B, for the embodiment illustrated in FIG. 5, the second processor 41 OB executes the instructions 510 in the identical sequence in which the first processor executes the instructions 510. It has also been stated above that checkpoints are responsive to store-type instructions, according to an embodiment. It should be understood that for an embodiment where the processors execute the instructions in identical sequences, the checkpoints may alternatively or additionally be responsive to an accumulated number of execution cycles.
According to one embodiment checkpoints are triggered for every store-type instruction result and also for every tenth instruction result if the ten instruction results after a certain store instruction do not include a result for another store instruction.
In an alternative embodiment, one or both of the processors 410A and 410B may have an architecture which permits execution of the instructions in a sequence different than the program sequence. Therefore, the results 520A and 524B may be produced in a different sequence than what is illustrated in FIG. 5. Consequently, in order to have a common basis for comparison of the respective results, according to an embodiment of the present invention both of the processors are constrained to execute store-type instructions according to a sequence in which the store-type instructions occur in the certain instruction sequence. For example, in FIG. 5 instructions 510.6 and 510.12 are store-type instructions, and while according to this embodiment the processors 410A and 41 OB may execute instructions 510.1 through 510.6 out of sequence and instructions 510.7 through 510.12 out of sequence, results for instruction 510.6 must be computed before results for any of the instructions 510.7 through 510.12. Furthermore, processor state must also be updated in sequence, even though execution may be out of order, and only registers being committed at a given time participate in updating the signature. Moreover, for out of order execution the architected registers are supplemented with a future file (a.k.a. rename registers) or a history file, depending on architecture. Accordingly, register 454A is a rename register in the future file architecture, or an architected register in the history file architecture.
In this manner, since the first sequence ofresults 520A.1 through 520A.6 (not necessarily in that order) ends with a result for the store instruction 510.6 and the second sequence of results 520B. I through 520B.6 (not necessarily in that order) both end with respective results for the same store instruction 510.6, even though the results may differ in sequence in some respects, the cumulative effect of the first sequence of results and the second sequence of results will be the same upon computing the respective results for the store instruction 510.6, for example, unless one of the processors has malfunctioned. That is, it is advantageous to trigger checkpoints responsive to store-type instructions so that while an intermediate one of the results of the first sequence of results may be different than a corresponding intermediate one of the results of the second sequence of results, nevertheless the first processor's ending result for the first sequence and the second processor's ending result for the second sequence tend to match unless one of the processors has malfunctioned.
The preceding has concerned checkpoint issues arising from sequence of execution of instructions. Another issue that must be handled concerns stalling. That is, in order to preserve throughput rates a method and structure must be provided so that the processors are able to at least begin executing a next sequence of instructions before checking of signatures is completed for a previous sequence. Otherwise, the processors would have to stall while waiting for checking to complete.
In the embodiment ofFIG. 4, the register 454A is labeled "current," and has a shadow register stack with a top shadow register 454A.1 labeled "previous" and a next, i.e., bottom shadow register 454A.2 labeled "committed." The "current" register 454A is for a current result, i.e., it has a value currently being read from or written into. The processor 410A needs to be able to continue to execute instructions while it compares its signature with that of the other processor 410B for a sequence of instructions immediately preceding the sequence from which the current result arises.
In order to continue, the processor 410A needs to use the "current" register 454A, and therefore "previous" shadow register 454A.1 is provided for temporarily holding a result from that immediately preceding sequence. Once the comparison is completed, if the signatures match this tends to indicate that the result in the "previous" shadow register 454A.1 is good, and the result may therefore be committed. On the other hand if the signatures do not match, the processor 41 OA needs to be able to recover to an earlier state which is a known good state, i.e., a committed state. The "committed" shadow register 454A.2 is therefore provided for holding a committed result, i.e., a result from register 454A that may have been computed even earlier than the result in shadow register 454A.1.
Referring now to FIG. 7, method steps relating to the handling of the registers are illustrated according to an embodiment. The processor begins execution at 710, and checks for a checkpoint at 715. If the instruction does not trigger a checkpoint, the processor continues executing at 720.
When the processor does encounter a checkpoint at 715 the processor needs to check the signature at 745 for the sequence of instructions ending at the checkpoint triggering instruction to see if it matches the corresponding signature from the other processor. The processor also needs to continue executing at 720 if resources permit, so the processor checks to see if the processor's stack of shadow registers is full at 725. If the stack is full, the processor stalls at 740 until a shadow register is cleared.
Certainly for the first checkpoint the shadow stack will not be full, and at step 735 the processor, processor 410A (FIG. 4) for example, copies, i.e., shifts, its result in the architected register 454A (also referred to as "current" register in FIG. 4) to the "previous" shadow register 454A.1 to free up the architected register 454A to continue executing instructions at 720. In this manner the processor can at least begin executing a next instruction at 720 before comparing at 745 can be completed for the signature that reflects the result of the sequence of instructions that ended in the checkpoint triggering instruction.
Meanwhile, one of the shadow registers, register 454A.1 or 454A.2 (FIG. 4) for example, will be cleared subsequent to comparing the signature of the processor 410A with that of processor 41 OB
at 745 as follows. If the signatures match, this indicates the results for the signatures currently being compared may be committed, so the "committed" register 454A.2 is cleared, i.e., "deleted," at 750 to make room for the result associated with the subject signature, the result in "previous" register 454A.1 is moved to the "committed" registers at 755, and execution continues at 720. (It should be understood that in an alternative embodiment the results may not be actually moved from the "previous" register to the "committed" register, but rather the function of the registers may just be reassigned. That is, the "committed" register may be marked invalid, and the "previous" register may be now deemed to be the "committed" register.) If the signatures do not match, then the "current" and "previous" registers are cleared or marked invalid, i.e., "deleted," at 760, since the processor needs to be reset to the committed state associated with the checkpoint immediately preceding the instruction sequence for the signatures currently being compared. The results in the "committed" shadow register 454A.2 is then copied to its architected register 454A at 765, the cache 448A is flushed and instructions are refetched at 770, and execution continues at 720.
It should be understood that as a result of one or the other of the above logical paths subsequent to the comparing in step 745, one of the shadow registers has been cleared, so that if the processor had to stall at 740 due to the shadow stack being full, this condition has been remedied.
Those of ordinary skill in the art will appreciate that the hardware particularly in FIG. 4, but also in the other FIG's may vary depending on the implementation. For example, the number of registers in the shadow register stack may be increased so that there may be more than one signature compare operation pending. The depicted example is not meant to imply architectural limitations with respect to the present invention.
It should be understood from the foregoing, that it is a particular advantage of the invention that it permits operating processors in the high reliability mode described hereinabove, wherein results are checked at checkpoints, or the processors may be operated independently. It is also an advantage that the processors that check each other in the high reliability mode may differ in many aspects and yet still remain compatible to the demands of the high reliability processing mode. For example, one processor may be a more complicated processor that executes instructions out of sequence while the other is a more simple processor that executes instructions in order. It is also an advantage that the processors do not have to operate at the same speed. Their results may merely be checked at checkpoints while the processors continue executing.
The description of the present embodiment has been presented for purposes of illustration, but is not intended to be exhaustive or to limit the invention to the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. It should be noted that store-type instructions are selected for triggering checkpoints to eliminate the hazard of a malfunctioning processor computing an erroneous result and changing the state of external memory subsystem. That is, by checking for proper functioning before committing a result to the external memory responsive to a store-type instruction, the hazard is reduced.
It should be understood that it would be within the spirit and scope of the invention to encompass an embodiment wherein checkpoints are triggered responsive to other types of instructions.
To reiterate, the embodiments were chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention. Various other embodiments having various modifications may be suited to a particular use contemplated, but may be within the scope of the present invention.
BACKGROUND OF THE INVENTION
S Field of the Invention The present invention relates to high reliability processing, by hardware redundancy. More particularly, the invention relates to a processing system with pair-wise processors that operate in a high reliability mode to detect computational errors, and operate independently in a high performance mode.
Related Art Various approaches exist for achieving high reliability processing.
FIG. 1 illustrates one prior art processor 100 for high reliability processing. The processor 100 includes two execution units 130 and 13S, which are both the same type of arithmetic unit. For example, the two execution units could both be floating point units, or integer units. The processor 100 has architected registers 120 for holding committed execution results. The two execution units 130 and 13S both execute the same instruction stream in paxallel. That is, for each instruction an instance of the instruction executes in each respective execution unit 130 and 135. Then, when the two units are ready to commit the result for an instruction to the register file I20, the two versions of the result are compared by compare unit 12S. If the compare unit 12S
determines that the versions are the same, then the unit 12S updates one or more of the registers 120 with the result. If the versions do not match, then other actions axe taken. In one implementation, a counter records whether an error is occurring repeatedly, and if it is, the error is classified as a "hard" failure. In the case of a hard failure, the instruction issue mechanism does not reissue the faulting instruction, but 2S instead executes a "trap" instruction. One such trap leads to a micro code routine for reading out the state of the defective processor and loading it into a spare processor, which restarts execution at the instruction that originally faulted. In an alternative, where no spare processor is available, the trap leads to the operating system migrating the processes on the faulty processor to other processors, which adds to the workload of the other processors.
While this arrangement provides a reliability advantage, it is disadvantageous in that the processor design is more complex than a conventional processor and has greater overhead.
Moreover, it limits the processor 100 throughput to have two execution units 130 in the processor 100 both executing the same instruction stream. Another variation of a processor which is designed for exclusively high reliability operation is shown in Richard N. Gufstason, John S. Liptay, and Charles F. Webb, "Data Processor with Enhanced Error Recovery," U.S. patent 5,504,859, issued April 2, 1996.
FIG. 2 illustrates another arrangement for high reliability processing. In this voting arrangement, three processors 200 each execute the same program in parallel and versions of a result are compared at checkpoints in the program on a bus 160 external to the processors 100. If the versions do not match, then other actions are taken, such as substituting a different processor 100 for the one that produced the disparate version. This arrangement is advantageous in that complexity of the individual processors 200 is reduced, and an error producing processor can be identified. Also, the throughput of one of the processors 200 may be greater than that of the one processor 100 in FIG.
l, since the individual processor 200 does not devote any of its execution units to redundant processing. However, the arrangement of FIG. 2 is redundant at the level of the processors 200, and uses three whole processors 200 to recover from a single fault. Also, the error checking is limited to results which are asserted externally by the processors.
In the related application, a pair of processors use state-of the-art state recovery mechanisms that are already available for recovering from exceptions and apply these mechanisms to operate in lockstep synchrony in a high reliability mode. This is highly advantageous because it achieves the high reliability without extensive modification to existing processor design.
However, it is somewhat limiting because of the required synchrony. That is, in the high reliability mode the processors in the related application must process a stream of instructions in the same sequence.
From the foregoing, it may be seen that a need exists for improvements in high reliability processing.
SUMMARY
The foregoing need is addressed in the present invention. According to the invention, in a first embodiment, a multiprocessing system includes a first processor, a second processor, and compare logic. The first processor is operable to compute firstresults responsive to instructions, the second processor is operable to compute second results responsive to the instructions, and the compare logic is operable to check at checkpoints for matching of the results.
Each of the processors has a first register for storing one of the processor's results, and the register has a stack of shadow registers. The processor is operable to shift a current one of the processor's results from the first register into the top shadow register, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch. It is advantageous that the shadow register stack is closely coupled to its corresponding register, which provides for fast restoration of results.
In a further aspect of an embodiment, each processor has a signature generator and a signature storage unit. The signature generator and storage unit are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the match or mismatch determination by the compare logic. The checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor. It is faster, and therefore advantageous, to check respective cumulative signatures at intervals rather than to check each individual result.
Also, in one embodiment, the instructions have a certain instruction sequence and at least one of the processors may execute instructions in a sequence different than the program sequence, but both of the processors execute store-type instructions according to a sequence in which the store-type instructions occur in the certain instruction sequence. The checkpoints are responsive to store instructions, so that a first sequence of results for the first processor ends at one of the checkpoints with a result for one of the store instructions and a second sequence of results ends at the checkpoint for the second processor with a result for the same one of the store instructions. It is advantageous to trigger checkpoints responsive to store-type instructions so that while an intermediate one of the results of the first sequence of results may be different than a corresponding intermediate one of the results of the second sequence of results, nevertheless the first processor's ending result for the first sequence and the second processor's ending result for the second sequence tend to match unless one of the processors has malfunctioned.
In an alternative embodiment, the second processor executes the instructions in a sequence identical to a sequence in which the first processor executes the instructions, and the checkpoints are responsive to accumulated number of execution cycles. In this embodiment the checkpoints may also be responsive to store instructions. In one such embodiment, the checkpoints are responsive to store instructions and accumulated number of execution cycles if there has been no store instruction since a last checkpoint.
While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will be described herein in detail. It should be understood, however, that the drawings and detailed description are not intended to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope of the present invention as defined by the appended claims.
BRIEF DESCRIPTION OF THE DRAWINGS
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
FIG. 1 illustrates a prior art processor for high reliability processing.
FIG. 2 illustrates another prior art system for high reliability processing.
FIG. 3 illustrates prior art register files for a processor.
FIG. 4 illustrates processors according to an embodiment of the present invention.
FIG. 5 illustrates an instruction stream and respective results computed by the processors of FIG. 4, according to an embodiment of the present invention.
FIG. 6 illustrates a register file for the processors of FIG. 4, according to an embodiment of the present invention.
FIG. 7, illustrates method steps for handling registers for the processors of FIG. 4, according to an embodiment of the present invention.
AUS9-2000-0644 q DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
In the following detailed description of the preferred embodiments, reference is made to the accompanying drawings illustrating embodiments in which the invention may be practiced. It should be understood that other embodiments may be utilized and changes may be made without departing from the scope of the present invention.
Referring now to FIG. 4, a multiprocessing system 400 is shown according to an embodiment of the present invention. The system 400 includes a first processor 410A, a second processor 4108 (which may or may not be identical to processor 410A), and compare unit 420.
Processor 410A has the following elements connected to one another as shown: fetch logic 432A, instruction cache 434A, decode logic 436A, issue queue 438A, execution and load/store unit 440A, commit logic 442A, signature generator 444A, store latch 446A, data cache 448A and architected register 454A for holding a current result. Architected register 454A has a shadow register 454A.1 for holding a previous result, and shadow register 454A.2 for holding a committed result, as will be further explained. Processor 4108 includes at least its own respective ones of the following elements (not shown): signature generator 4448, store latch 4468, and architected register 4548 for holding a current result. Architected register 4548 has shadow register 4548.1 for holding a previous result, and shadow register 4548.2 for holding a committed result.
It should be understood that while the FIG's and description herein focus on results stored in one exemplary register and its corresponding shadow registers, this is merely for the sake of illustration, and the processors actually include numerous such registers.
Referring now to FIG. 5, The processors 410A and 4108 are shown with a sequence of instructions 510 and respective results, to illustrate aspects of the present invention, according to an embodiment. The first processor 41 OA is operable to compute first results 520A responsive to the instructions 510, and the second processor 4108 is operable to compute second results 5208 responsive to the instructions 510. More specifically, the instructions 510 represent instructions for a program that are in a program sequence, including instruction 510.1, followed by 510.2, followed by 510.3, etc. For instruction 510.1 processor 410A computes result 520A.1 and processor 4108 computes result 5208.1, whereas for instruction 510.2 processor 410A computes result 520A.2 and processor 41 OB computes result 5208.2, and so on. For each of the results signature generator 444A
(FIG. 4) computes an updated signature, which it outputs to store latch 446A.
The compare unit 420 is operable to check at checkpoints for matching of the results. For example, according to the illustrated embodiment, instructions 510.6 and 510.12 are each instances of a store-type instruction that triggers a checkpoint. That is, responsive to computing a result 520A.6 for the instruction 510.6, for example, the signature generator 444A
for processor 410A
updates the signature stored in latch 446A, as it does for each of the results 520A.1, 520A.2, etc.
Likewise, responsive to computing a result 520B.6 for the instruction 510.6, the signature generator 444B for processor 410B updates the signature stored in latch 446B, as it does for each of the results 520B.1, 520B.2, etc. In addition, since instruction 510.6 triggers a checkpoint, responsive to computing result 520A.6 the processor 410A indicates to compare unit 420 that the signature for result 520A.6 is ready. Likewise, responsive to computing result 520B.6 the processor 410B
indicates to compare unit 420 that the signature for corresponding result 520B.6 is ready. Once the corresponding signatures are ready, compare unit 420 compares them to see if they match. It should be noted that the signatures reflect the store values themselves, or else the store values are compared to one another along with the signatures.
There are a variety of well-known compression schemes which may be employed for generating the signatures of the present invention. For example, a linear feedback shift register may be used, according to which a new input is XOR'ed with a bit that is shifted out. This is advantageous because the resulting signature traverses a space in a very random way so that it is unlikely to produce a small excursion from a state the signature is supposed to have and back.
Signature generation as discussed in the related patent application is also relevant to the present invention.
Referring now to FIG. 3, conventional register files 310 and 315 are illustrated for contrasting with aspects of an embodiment of the present invention. In the example, the first register file 310 and the second register file 315 are essentially identical. Register file 310 has a number of registers, including register 330 and 340 which are explicitly illustrated. Each one of the registers has a number of register cells. Details of register cell 320 of register 330 are explicitly illustrated. The exemplary register cell 320 includes a memory cell 322 coupled to an input (i.e., write) port 324 and an output (i.e., read) port 326.
Referring now to FIG. 6, a register file 610 is illustrated, according to an embodiment of the present invention. The register file 610 shown is for processor 41 OA, but is representative of register files in both processors 410A and 410B, and includes a number of registers.
Explicitly illustrated are registers 454A, as was shown in FIG. 4, and register 640. Other registers may also be included in the register file 610 as indicated by the ellipses between registers 454A
and 640. Register 454A
includes a number of register cells 615, each of which has a conventional memory cell, write port and read port as in conventional register cells, such as cells 320 in register 330 (FIG. 3). In contrast to conventional registers, the register cells 615 of register 454A (FIG. 6), for example, have corresponding shadow cells arranged in stacks of shadow cells 630. Shadow cells shown explicitly for the shadow cell stack 630 of register cell 6l S include the top shadow cell 620 and the last i.e., bottom shadow cell 625. There may be others therebetween as indicated by the ellipses between cell 620 and cell 625, or shadow cell 625 may be the very next one below cell 620.
The top shadow cells 620 are connected to their respective register cells 615 by respective control FET's 622 as shown.
The contents of the register cell 615 may be written into the shadow cell 620 under control of the control FET 622. Likewise, the contents of the shadow cell 620 may be written to the next shadow cell under control of the FET interconnecting the shadow cell 620 and the next shadow cell.
As may be seen in FIG. 6, the top shadow register 454A.1 (also shown in FIG.
4) for register 454A includes the top shadow cells 620 of the register 454A register cells 615, and correspondingly the contents of the register 454A may be written to the top shadow register 454A.1, and the contents of the top shadow register 454A:1 may be written to the next shadow register under control of the respective FET's therebetween.
According to this arrangement, register 454A holds one of the processor 41 OA
current results.
The register 454A includes a stack 635 of shadow registers, the stack 635 has at least a top shadow register 454A.1 and a next shadow register, which may be the last, i.e., bottom shadow register (i.e., shadow register 454A.2 in FIG. 4) that includes bottom shadow cells 625 (FIG.
6). The processor 41 OA is operable to perform shifting of the results, including shifting a current one of the processor's results from the first register 454A into the top shadow register 454A. l, so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register 454A
responsive to the compare unit 420 determining that the first and second results mismatch.
AUS9-2000-0644 '7 Referring again to FIG. 5, as stated above, for each of the results 520A.1, 520A.2, et.
signature generator 444A (FIG. 4) computes an updated signature, which it outputs to store latch 446A. Likewise, for each of the results SZOB.1, 5208.2, et. signature generator 4448 (FIG. 4) computes an updated signature, which it outputs to store latch 4468. According to another aspect, the signature generator 444A for the first processor 410A and the signature generator 4448 for the second processor 4108 are each operable to compute respective cumulative signatures for the sequences of the processors' results 520A and 520B. That is, in the illustrated sequence of instructions 510 (and corresponding sequence of results 520A and 5208) it is implied that a checkpoint (not shown) immediately precedes the sequence of instructions 510 so that the sequence 510 begins after the checkpoint. Furthermore, the sequence 510 includes a sequence of instructions beginning with instruction 510.1 and ending with a checkpoint responsive to the aforementioned store instruction 510.6, after which a next sequence begins with instruction 510.7. For the sequence of instructions 510.1 through 510.6, and corresponding results 520A.1 through 520A.6, for example, the processor 410A is operable to initialize a new signature for the first result 520A.1, and then update the signature, which is stored in the signature storage unit, i.e., store latch 446A, in such a manner that the updated signature reflects the cumulative effect of the sequence of instructions 510.1 through 510.6 and corresponding results. Likewise the same is true for processor 4108 and its respective results and signatures:
According to one embodiment, the processors update their signatures in the following manner. For each instruction that alters the value in a register, processor 410A, for example, sends to its signature generator 444A new information, including altered values and the identities of registers holding those values. The signature generator 444A merges the new information with the already existing signature in the store latch 446A to form an updated signature. Then, responsive to a checkpoint, such as store instruction 510.6, the store latch 446A sends the store value for storage in a cache and/or main store. The store latch 446A includes the cumulative signature with the store value. Meanwhile, processor 4108 has done the same, and the compare unit 420 compares the cumulative signatures from the respective store latches 446A and 4468. If the signatures match this tends to indicate that the results 520A.1 through 520B.6 and results 5208.1 through 5208.6 were the same. If the signatures do not match, then the store result is not forwarded to the store AUS9-2000-0644 g buffer 450. Instead the compare unit 420 resets the processors to the state they had for their last matching checkpoint, and initiates refetching of instructions and flushing of local caches 448A and 448B so that the processor can resume execution at that point.
For processors 41 OA and 41 OB operating as a pair-wise system, the processors share one store buffer 450 as shown in FIG. 4. Alternatively, the processors coordinate ones of their own respective store buffers (not shown) to.function as the unified store buffer 450. When the processor's operate independently they each use ones of their own respective store buffers.
It has been pointed out that the instructions 510 have a certain program sequence, and that result 520A.1 is for corresponding instruction 510.1, result 520A.2 is for instruction 510.2, etc. As implied by the corresponding sequence of results 520A and 520B, for the embodiment illustrated in FIG. 5, the second processor 41 OB executes the instructions 510 in the identical sequence in which the first processor executes the instructions 510. It has also been stated above that checkpoints are responsive to store-type instructions, according to an embodiment. It should be understood that for an embodiment where the processors execute the instructions in identical sequences, the checkpoints may alternatively or additionally be responsive to an accumulated number of execution cycles.
According to one embodiment checkpoints are triggered for every store-type instruction result and also for every tenth instruction result if the ten instruction results after a certain store instruction do not include a result for another store instruction.
In an alternative embodiment, one or both of the processors 410A and 410B may have an architecture which permits execution of the instructions in a sequence different than the program sequence. Therefore, the results 520A and 524B may be produced in a different sequence than what is illustrated in FIG. 5. Consequently, in order to have a common basis for comparison of the respective results, according to an embodiment of the present invention both of the processors are constrained to execute store-type instructions according to a sequence in which the store-type instructions occur in the certain instruction sequence. For example, in FIG. 5 instructions 510.6 and 510.12 are store-type instructions, and while according to this embodiment the processors 410A and 41 OB may execute instructions 510.1 through 510.6 out of sequence and instructions 510.7 through 510.12 out of sequence, results for instruction 510.6 must be computed before results for any of the instructions 510.7 through 510.12. Furthermore, processor state must also be updated in sequence, even though execution may be out of order, and only registers being committed at a given time participate in updating the signature. Moreover, for out of order execution the architected registers are supplemented with a future file (a.k.a. rename registers) or a history file, depending on architecture. Accordingly, register 454A is a rename register in the future file architecture, or an architected register in the history file architecture.
In this manner, since the first sequence ofresults 520A.1 through 520A.6 (not necessarily in that order) ends with a result for the store instruction 510.6 and the second sequence of results 520B. I through 520B.6 (not necessarily in that order) both end with respective results for the same store instruction 510.6, even though the results may differ in sequence in some respects, the cumulative effect of the first sequence of results and the second sequence of results will be the same upon computing the respective results for the store instruction 510.6, for example, unless one of the processors has malfunctioned. That is, it is advantageous to trigger checkpoints responsive to store-type instructions so that while an intermediate one of the results of the first sequence of results may be different than a corresponding intermediate one of the results of the second sequence of results, nevertheless the first processor's ending result for the first sequence and the second processor's ending result for the second sequence tend to match unless one of the processors has malfunctioned.
The preceding has concerned checkpoint issues arising from sequence of execution of instructions. Another issue that must be handled concerns stalling. That is, in order to preserve throughput rates a method and structure must be provided so that the processors are able to at least begin executing a next sequence of instructions before checking of signatures is completed for a previous sequence. Otherwise, the processors would have to stall while waiting for checking to complete.
In the embodiment ofFIG. 4, the register 454A is labeled "current," and has a shadow register stack with a top shadow register 454A.1 labeled "previous" and a next, i.e., bottom shadow register 454A.2 labeled "committed." The "current" register 454A is for a current result, i.e., it has a value currently being read from or written into. The processor 410A needs to be able to continue to execute instructions while it compares its signature with that of the other processor 410B for a sequence of instructions immediately preceding the sequence from which the current result arises.
In order to continue, the processor 410A needs to use the "current" register 454A, and therefore "previous" shadow register 454A.1 is provided for temporarily holding a result from that immediately preceding sequence. Once the comparison is completed, if the signatures match this tends to indicate that the result in the "previous" shadow register 454A.1 is good, and the result may therefore be committed. On the other hand if the signatures do not match, the processor 41 OA needs to be able to recover to an earlier state which is a known good state, i.e., a committed state. The "committed" shadow register 454A.2 is therefore provided for holding a committed result, i.e., a result from register 454A that may have been computed even earlier than the result in shadow register 454A.1.
Referring now to FIG. 7, method steps relating to the handling of the registers are illustrated according to an embodiment. The processor begins execution at 710, and checks for a checkpoint at 715. If the instruction does not trigger a checkpoint, the processor continues executing at 720.
When the processor does encounter a checkpoint at 715 the processor needs to check the signature at 745 for the sequence of instructions ending at the checkpoint triggering instruction to see if it matches the corresponding signature from the other processor. The processor also needs to continue executing at 720 if resources permit, so the processor checks to see if the processor's stack of shadow registers is full at 725. If the stack is full, the processor stalls at 740 until a shadow register is cleared.
Certainly for the first checkpoint the shadow stack will not be full, and at step 735 the processor, processor 410A (FIG. 4) for example, copies, i.e., shifts, its result in the architected register 454A (also referred to as "current" register in FIG. 4) to the "previous" shadow register 454A.1 to free up the architected register 454A to continue executing instructions at 720. In this manner the processor can at least begin executing a next instruction at 720 before comparing at 745 can be completed for the signature that reflects the result of the sequence of instructions that ended in the checkpoint triggering instruction.
Meanwhile, one of the shadow registers, register 454A.1 or 454A.2 (FIG. 4) for example, will be cleared subsequent to comparing the signature of the processor 410A with that of processor 41 OB
at 745 as follows. If the signatures match, this indicates the results for the signatures currently being compared may be committed, so the "committed" register 454A.2 is cleared, i.e., "deleted," at 750 to make room for the result associated with the subject signature, the result in "previous" register 454A.1 is moved to the "committed" registers at 755, and execution continues at 720. (It should be understood that in an alternative embodiment the results may not be actually moved from the "previous" register to the "committed" register, but rather the function of the registers may just be reassigned. That is, the "committed" register may be marked invalid, and the "previous" register may be now deemed to be the "committed" register.) If the signatures do not match, then the "current" and "previous" registers are cleared or marked invalid, i.e., "deleted," at 760, since the processor needs to be reset to the committed state associated with the checkpoint immediately preceding the instruction sequence for the signatures currently being compared. The results in the "committed" shadow register 454A.2 is then copied to its architected register 454A at 765, the cache 448A is flushed and instructions are refetched at 770, and execution continues at 720.
It should be understood that as a result of one or the other of the above logical paths subsequent to the comparing in step 745, one of the shadow registers has been cleared, so that if the processor had to stall at 740 due to the shadow stack being full, this condition has been remedied.
Those of ordinary skill in the art will appreciate that the hardware particularly in FIG. 4, but also in the other FIG's may vary depending on the implementation. For example, the number of registers in the shadow register stack may be increased so that there may be more than one signature compare operation pending. The depicted example is not meant to imply architectural limitations with respect to the present invention.
It should be understood from the foregoing, that it is a particular advantage of the invention that it permits operating processors in the high reliability mode described hereinabove, wherein results are checked at checkpoints, or the processors may be operated independently. It is also an advantage that the processors that check each other in the high reliability mode may differ in many aspects and yet still remain compatible to the demands of the high reliability processing mode. For example, one processor may be a more complicated processor that executes instructions out of sequence while the other is a more simple processor that executes instructions in order. It is also an advantage that the processors do not have to operate at the same speed. Their results may merely be checked at checkpoints while the processors continue executing.
The description of the present embodiment has been presented for purposes of illustration, but is not intended to be exhaustive or to limit the invention to the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. It should be noted that store-type instructions are selected for triggering checkpoints to eliminate the hazard of a malfunctioning processor computing an erroneous result and changing the state of external memory subsystem. That is, by checking for proper functioning before committing a result to the external memory responsive to a store-type instruction, the hazard is reduced.
It should be understood that it would be within the spirit and scope of the invention to encompass an embodiment wherein checkpoints are triggered responsive to other types of instructions.
To reiterate, the embodiments were chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention. Various other embodiments having various modifications may be suited to a particular use contemplated, but may be within the scope of the present invention.
Claims (20)
1. A method for multiprocessing comprising the steps of a) computing first results by a first processor responsive to instructions, wherein the processor has a first register for storing one of the processor's results, and wherein the first register has a first stack of shadow registers with at least a top shadow register and a next shadow register;
b) computing second results by a second processor responsive to the instructions, wherein the second processor has a second register for storing one of the second processor's results, and wherein the second register has a second stack of shadow registers with at least a top shadow register and a next shadow register;
c) shifting a current one of the first processor's results from the first register into the first register's top shadow register responsive to a checkpoint;
d) shifting a current one of the second processor's results from the second register into the second register's top shadow register responsive to the checkpoint;
e) checking for matching of a first sequence of the first processor's results and a second sequence of the second processor's results, wherein the respective first and second sequences of results include the shifted results of steps c) and d) respectively.
b) computing second results by a second processor responsive to the instructions, wherein the second processor has a second register for storing one of the second processor's results, and wherein the second register has a second stack of shadow registers with at least a top shadow register and a next shadow register;
c) shifting a current one of the first processor's results from the first register into the first register's top shadow register responsive to a checkpoint;
d) shifting a current one of the second processor's results from the second register into the second register's top shadow register responsive to the checkpoint;
e) checking for matching of a first sequence of the first processor's results and a second sequence of the second processor's results, wherein the respective first and second sequences of results include the shifted results of steps c) and d) respectively.
2. The method of claim 1, comprising the step of:
computing a first cumulative signature for the first sequence of the first processor's results;
and computing a second cumulative signature for the second sequence of the second processor's results, and wherein step e) comprises comparing the first and second cumulative signatures.
computing a first cumulative signature for the first sequence of the first processor's results;
and computing a second cumulative signature for the second sequence of the second processor's results, and wherein step e) comprises comparing the first and second cumulative signatures.
3. The method of claim 2, wherein the instructions have a certain instruction sequence and at least one of the processors may execute instructions in a sequence different than the program sequence, and wherein the checkpoints are responsive to store instructions, the method comprising the step of executing store-type instructions by both processors according to whatever sequence in which the store-type instructions occur in the certain instruction sequence, so that a first sequence of results for the first processor ends at one of the checkpoints with a result for one of the store instructions and a second sequence of results ends at the checkpoint for the second processor with a result for the same one of the store instructions.
4. The method of claim 3, wherein the computing the first cumulative signature comprises computing for the first processor's store instruction result, and wherein computing the second cumulative signature comprises computing for the second processor's store instruction result.
5. The method of claim 3, wherein step e) comprises comparing the first processor's result and the second processor's result for the store instruction.
6. The method of claim 2, wherein the second processor executes the instructions in a sequence identical to a sequence in which the first processor executes the instructions, and the checkpoints are responsive to accumulated number of execution cycles.
7. The method of claim 6, wherein the checkpoints are responsive to store instructions.
8. The method of claim 2, wherein the checkpoints are responsive to store instructions and accumulated number of execution cycles if there has been no store instruction since a last checkpoint.
9. The method of claim 2, wherein the processors at least begins executing a next instruction before comparing is completed for respective ones of the signatures that reflect the shifted results of steps c) and d) respectively.
10. The method of claim 3, wherein the processors at least begins executing a next instruction before comparing is completed for respective ones of the signatures that reflect the shifted results of steps c) and d) respectively.
11. A multiprocessing system comprising:
a first processor;
a second processor; and compare logic, wherein the first processor is operable to compute first results responsive to instructions, and the second processor is operable to compute second results responsive to the instructions, and the compare logic is operable to check at checkpoints for matching of the results;
and wherein each processor comprises:
a first register for storing the processor's results, wherein the register includes a stack of shadow registers, wherein the processor is operable to perform shifting of the results, including shifting a current one of the processor's results from the first register into the stack so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch.
a first processor;
a second processor; and compare logic, wherein the first processor is operable to compute first results responsive to instructions, and the second processor is operable to compute second results responsive to the instructions, and the compare logic is operable to check at checkpoints for matching of the results;
and wherein each processor comprises:
a first register for storing the processor's results, wherein the register includes a stack of shadow registers, wherein the processor is operable to perform shifting of the results, including shifting a current one of the processor's results from the first register into the stack so that an earlier one of the processor's results can be restored from one of the shadow registers to the first register responsive to the compare logic determining that the first and second results mismatch.
12. The system of claim 11, wherein each processor comprises:
a signature generator; and a signature storage unit, wherein the signature generator and storage units are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the determining by the compare logic, and wherein the checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor.
a signature generator; and a signature storage unit, wherein the signature generator and storage units are operable to cooperatively compute a cumulative signature for a sequence of the processor's results, and the processor is operable to store the cumulative signature in the signature storage unit pending the determining by the compare logic, and wherein the checking for matching of the results includes the compare logic comparing the cumulative signatures of each respective processor.
13. The system of claim 12, wherein the instructions have a certain instruction sequence and at least one of the processors may execute instructions in a sequence different than the program sequence, but both of the processors execute store-type instructions according to a sequence in which the store-type instructions occur in the certain instruction sequence, and wherein the checkpoints are responsive to store instructions, so that a first sequence of results for the first processor ends at one of the checkpoints with a result for one of the store instructions and a second sequence of results ends at the checkpoint for the second processor with a result for the same one of the store instructions.
14. The system of claim 13, wherein the cumulative signature for the first processor's sequence of results includes a result for the store instruction, and wherein the cumulative signature for the second processor's sequence of results includes a result for the store instruction.
15. The system of claim 13, wherein the checking for matching of the results includes comparing the first processor's result and the second processor's result for the store instruction.
16. The system of claim 12, wherein the second processor executes the instructions in a sequence identical to a sequence in which the first processor executes the instructions, and the checkpoints are responsive to accumulated number of execution cycles.
17. The system of claim 16, wherein the checkpoints are responsive to store instructions.
18. The system of claim 12, wherein the checkpoints are responsive to store instructions and accumulated number of execution cycles if there has been no store instruction since a last checkpoint.
19. The system of claim 12, wherein responsive to a checkpoint, for each respective processor a result in the processor's first register for a current instruction is shifted into the first register's top shadow register and the processor at least begins executing a next instruction before comparing is completed for respective ones of the signatures that reflect the respective current results.
20. The system of claim 13, wherein responsive to a checkpoint, for each respective processor a result in the processor's first register for a current instruction is shifted into the first register's top shadow register and the processor at least begins executing a next instruction before comparing is completed for respective ones of the signatures that reflect the respective current results.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| US09/791,143 | 2001-02-22 | ||
| US09/791,143 US6751749B2 (en) | 2001-02-22 | 2001-02-22 | Method and apparatus for computer system reliability |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CA2367793A1 true CA2367793A1 (en) | 2002-08-22 |
Family
ID=25152814
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA002367793A Abandoned CA2367793A1 (en) | 2001-02-22 | 2002-01-15 | Method and apparatus for computer system reliability |
Country Status (3)
| Country | Link |
|---|---|
| US (1) | US6751749B2 (en) |
| JP (1) | JP3706586B2 (en) |
| CA (1) | CA2367793A1 (en) |
Families Citing this family (55)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6948092B2 (en) * | 1998-12-10 | 2005-09-20 | Hewlett-Packard Development Company, L.P. | System recovery from errors for processor and associated components |
| EP1246033A1 (en) * | 2001-08-23 | 2002-10-02 | Siemens Aktiengesellschaft | Method for monitoring consistent memory contents in a redundant system |
| US7155721B2 (en) * | 2002-06-28 | 2006-12-26 | Hewlett-Packard Development Company, L.P. | Method and apparatus for communicating information between lock stepped processors |
| US7085959B2 (en) * | 2002-07-03 | 2006-08-01 | Hewlett-Packard Development Company, L.P. | Method and apparatus for recovery from loss of lock step |
| DE10332557A1 (en) * | 2003-07-11 | 2005-02-17 | Siemens Ag | Method and computer system for operating a security system |
| US20050028146A1 (en) * | 2003-08-01 | 2005-02-03 | Quick Shawn G. | Systems and methods for software and firmware testing using checkpoint signatures |
| US20070074013A1 (en) * | 2003-08-25 | 2007-03-29 | Lonnie Goff | Dynamic retention of hardware register content in a computer system |
| US7287184B2 (en) * | 2003-09-16 | 2007-10-23 | Rockwell Automation Technologies, Inc. | High speed synchronization in dual-processor safety controller |
| US7213168B2 (en) * | 2003-09-16 | 2007-05-01 | Rockwell Automation Technologies, Inc. | Safety controller providing for execution of standard and safety control programs |
| JP4625620B2 (en) * | 2003-10-10 | 2011-02-02 | 株式会社日立製作所 | Fail-safe control device |
| US7904775B2 (en) * | 2004-04-21 | 2011-03-08 | Stmicroelectronics Sa | Microprocessor comprising signature means for detecting an attack by error injection |
| US7290166B2 (en) * | 2004-07-28 | 2007-10-30 | Intel Corporation | Rollback of data |
| JP2008518307A (en) * | 2004-10-25 | 2008-05-29 | ローベルト ボッシュ ゲゼルシャフト ミット ベシュレンクテル ハフツング | Method and apparatus for switching in a computer system having at least two processing units |
| JP3897046B2 (en) * | 2005-01-28 | 2007-03-22 | 横河電機株式会社 | Information processing apparatus and information processing method |
| US7971095B2 (en) * | 2005-02-16 | 2011-06-28 | Honeywell International Inc. | Fault recovery for real-time, multi-tasking computer system |
| FR2884000A1 (en) * | 2005-04-05 | 2006-10-06 | St Microelectronics Sa | Cryptographic coprocessor control execution monitoring method for integrated circuit, involves carrying error signal if abnormal flow of execution is detected and preventing access to register as long as signal is given with active value |
| FR2883998A1 (en) * | 2005-04-05 | 2006-10-06 | St Microelectronics Sa | Coprocessor`s control execution securing method for e.g. microcontroller, involves placing coprocessor in default error mode from commencement of execution of control accomplished by coprocessor |
| WO2007018652A1 (en) * | 2005-08-05 | 2007-02-15 | Honeywell International, Inc. | Distributed and recoverable digital control system |
| WO2007094808A1 (en) * | 2005-08-05 | 2007-08-23 | Honeywell International Inc. | Monitoring system and methods for a distributed and recoverable digital control system |
| WO2007018651A1 (en) * | 2005-08-05 | 2007-02-15 | Honeywell International, Inc. | Method for redunancy management of distributed and recoverable digital control system |
| DE102005037250A1 (en) * | 2005-08-08 | 2007-02-15 | Robert Bosch Gmbh | Method and device for controlling a memory access in a computer system having at least two execution units |
| US7962731B2 (en) * | 2005-10-20 | 2011-06-14 | Qualcomm Incorporated | Backing store buffer for the register save engine of a stacked register file |
| US7996731B2 (en) | 2005-11-02 | 2011-08-09 | Advanced Micro Devices, Inc. | Error detection in high-speed asymmetric interfaces |
| US7844804B2 (en) * | 2005-11-10 | 2010-11-30 | Qualcomm Incorporated | Expansion of a stacked register file using shadow registers |
| DE102005055067A1 (en) * | 2005-11-18 | 2007-05-24 | Robert Bosch Gmbh | Device and method for correcting errors in a system having at least two execution units with registers |
| US20070220369A1 (en) * | 2006-02-21 | 2007-09-20 | International Business Machines Corporation | Fault isolation and availability mechanism for multi-processor system |
| FR2898706B1 (en) * | 2006-03-17 | 2008-06-13 | Alstom Transport Sa | SECURE CONTROL DEVICE WITH DIVERSIFICATION OF A RAIL SYSTEM |
| US8032889B2 (en) | 2006-04-05 | 2011-10-04 | Maxwell Technologies, Inc. | Methods and apparatus for managing and controlling power consumption and heat generation in computer systems |
| US20080229074A1 (en) * | 2006-06-19 | 2008-09-18 | International Business Machines Corporation | Design Structure for Localized Control Caching Resulting in Power Efficient Control Logic |
| US20070294519A1 (en) * | 2006-06-19 | 2007-12-20 | Miller Laura F | Localized Control Caching Resulting In Power Efficient Control Logic |
| US7444544B2 (en) * | 2006-07-14 | 2008-10-28 | International Business Machines Corporation | Write filter cache method and apparatus for protecting the microprocessor core from soft errors |
| US7793147B2 (en) * | 2006-07-18 | 2010-09-07 | Honeywell International Inc. | Methods and systems for providing reconfigurable and recoverable computing resources |
| US7660971B2 (en) * | 2007-02-01 | 2010-02-09 | International Business Machines Corporation | Method and system for dependency tracking and flush recovery for an out-of-order microprocessor |
| US8239836B1 (en) * | 2008-03-07 | 2012-08-07 | The Regents Of The University Of California | Multi-variant parallel program execution to detect malicious code injection |
| US8176406B2 (en) | 2008-03-19 | 2012-05-08 | International Business Machines Corporation | Hard error detection |
| JP5315748B2 (en) * | 2008-03-28 | 2013-10-16 | 富士通株式会社 | Microprocessor, signature generation method, multiplexed system, and multiplexed execution verification method |
| US8010846B1 (en) * | 2008-04-30 | 2011-08-30 | Honeywell International Inc. | Scalable self-checking processing platform including processors executing both coupled and uncoupled applications within a frame |
| US20100031084A1 (en) * | 2008-08-04 | 2010-02-04 | Sun Microsystems, Inc. | Checkpointing in a processor that supports simultaneous speculative threading |
| US8171328B2 (en) * | 2008-12-31 | 2012-05-01 | Intel Corporation | State history storage for synchronizing redundant processors |
| JP5344936B2 (en) * | 2009-01-07 | 2013-11-20 | 株式会社日立製作所 | Control device |
| JP5509637B2 (en) * | 2009-03-18 | 2014-06-04 | 日本電気株式会社 | Fault tolerant system |
| US8826035B2 (en) * | 2009-12-23 | 2014-09-02 | Intel Corporation | Cumulative integrity check value (ICV) processor based memory content protection |
| EP2442229A1 (en) * | 2010-07-28 | 2012-04-18 | Siemens Aktiengesellschaft | High reliability method of data processing, and controller unit |
| ES2694803T3 (en) * | 2010-10-28 | 2018-12-27 | Data Device Corporation | System, method and apparatus for error correction in multiprocessor systems |
| WO2013048420A1 (en) * | 2011-09-29 | 2013-04-04 | Intel Corporation | Bi-directional copying of register content into shadow registers |
| FR2989488B1 (en) | 2012-04-13 | 2015-02-20 | Commissariat Energie Atomique | DEVICE FOR GENERATING A SIGNATURE AT THE EXECUTION OF A PROGRAM TASK AND METHOD OF COMPARING EXECUTION FLOTS |
| US9274904B2 (en) * | 2013-06-18 | 2016-03-01 | Advanced Micro Devices, Inc. | Software only inter-compute unit redundant multithreading for GPUs |
| US9529654B2 (en) * | 2013-11-27 | 2016-12-27 | Electronics And Telecommunications Research Institute | Recoverable and fault-tolerant CPU core and control method thereof |
| US20160381050A1 (en) | 2015-06-26 | 2016-12-29 | Intel Corporation | Processors, methods, systems, and instructions to protect shadow stacks |
| US10394556B2 (en) | 2015-12-20 | 2019-08-27 | Intel Corporation | Hardware apparatuses and methods to switch shadow stack pointers |
| US10430580B2 (en) * | 2016-02-04 | 2019-10-01 | Intel Corporation | Processor extensions to protect stacks during ring transitions |
| US10296312B2 (en) * | 2016-05-20 | 2019-05-21 | Arizona Board Of Regents On Behalf Of Arizona State University | Methods, apparatuses, and systems for zero silent data corruption (ZDC) compiler technique |
| US10838733B2 (en) * | 2017-04-18 | 2020-11-17 | International Business Machines Corporation | Register context restoration based on rename register recovery |
| US11928472B2 (en) | 2020-09-26 | 2024-03-12 | Intel Corporation | Branch prefetch mechanisms for mitigating frontend branch resteers |
| US20230195388A1 (en) * | 2021-12-17 | 2023-06-22 | Intel Corporation | Register file virtualization : applications and methods |
Family Cites Families (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US3810119A (en) * | 1971-05-04 | 1974-05-07 | Us Navy | Processor synchronization scheme |
| US5568380A (en) * | 1993-08-30 | 1996-10-22 | International Business Machines Corporation | Shadow register file for instruction rollback |
| US5504859A (en) | 1993-11-09 | 1996-04-02 | International Business Machines Corporation | Data processor with enhanced error recovery |
| US5586278A (en) | 1994-03-01 | 1996-12-17 | Intel Corporation | Method and apparatus for state recovery following branch misprediction in an out-of-order microprocessor |
| US5625789A (en) | 1994-10-24 | 1997-04-29 | International Business Machines Corporation | Apparatus for source operand dependendency analyses register renaming and rapid pipeline recovery in a microprocessor that issues and executes multiple instructions out-of-order in a single cycle |
| US5794024A (en) | 1996-03-25 | 1998-08-11 | International Business Machines Corporation | Method and system for dynamically recovering a register-address-table upon occurrence of an interrupt or branch misprediction |
| US5915110A (en) | 1996-07-26 | 1999-06-22 | Advanced Micro Devices, Inc. | Branch misprediction recovery in a reorder buffer having a future file |
| US5860014A (en) | 1996-10-15 | 1999-01-12 | International Business Machines Corporation | Method and apparatus for improved recovery of processor state using history buffer |
| US5870582A (en) | 1997-03-31 | 1999-02-09 | International Business Machines Corporation | Method and apparatus for completion of non-interruptible instructions before the instruction is dispatched |
| US6058491A (en) * | 1997-09-15 | 2000-05-02 | International Business Machines Corporation | Method and system for fault-handling to improve reliability of a data-processing system |
| US6571363B1 (en) * | 1998-12-30 | 2003-05-27 | Texas Instruments Incorporated | Single event upset tolerant microprocessor architecture |
| US6772368B2 (en) * | 2000-12-11 | 2004-08-03 | International Business Machines Corporation | Multiprocessor with pair-wise high reliability mode, and method therefore |
-
2001
- 2001-02-22 US US09/791,143 patent/US6751749B2/en not_active Expired - Lifetime
-
2002
- 2002-01-15 CA CA002367793A patent/CA2367793A1/en not_active Abandoned
- 2002-02-19 JP JP2002042057A patent/JP3706586B2/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| JP3706586B2 (en) | 2005-10-12 |
| US20020116662A1 (en) | 2002-08-22 |
| JP2002312190A (en) | 2002-10-25 |
| US6751749B2 (en) | 2004-06-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6751749B2 (en) | Method and apparatus for computer system reliability | |
| US7447948B2 (en) | ECC coding for high speed implementation | |
| US5504859A (en) | Data processor with enhanced error recovery | |
| US7478276B2 (en) | Method for checkpointing instruction groups with out-of-order floating point instructions in a multi-threaded processor | |
| US7243262B2 (en) | Incremental checkpointing in a multi-threaded architecture | |
| US6625756B1 (en) | Replay mechanism for soft error recovery | |
| JP5147564B2 (en) | Register state error recovery and restart mechanism | |
| US6941489B2 (en) | Checkpointing of register file | |
| US7373548B2 (en) | Hardware recovery in a multi-threaded architecture | |
| US6640313B1 (en) | Microprocessor with high-reliability operating mode | |
| US6058491A (en) | Method and system for fault-handling to improve reliability of a data-processing system | |
| US5692121A (en) | Recovery unit for mirrored processors | |
| US6615366B1 (en) | Microprocessor with dual execution core operable in high reliability mode | |
| US6718494B1 (en) | Method and apparatus for preventing and recovering from TLB corruption by soft error | |
| US7409589B2 (en) | Method and apparatus for reducing number of cycles required to checkpoint instructions in a multi-threaded processor | |
| US6625749B1 (en) | Firmware mechanism for correcting soft errors | |
| US7308607B2 (en) | Periodic checkpointing in a redundantly multi-threaded architecture | |
| JP4603185B2 (en) | Computer and its error recovery method | |
| US20020073357A1 (en) | Multiprocessor with pair-wise high reliability mode, and method therefore | |
| JPH0683663A (en) | Multiprocessor computer system | |
| US6571363B1 (en) | Single event upset tolerant microprocessor architecture | |
| US9594648B2 (en) | Controlling non-redundant execution in a redundant multithreading (RMT) processor | |
| Pflanz et al. | Online check and recovery techniques for dependable embedded processors | |
| EP0645708B1 (en) | Store "UNDO" for cache store error recovery | |
| US20080229134A1 (en) | Reliability morph for a dual-core transaction-processing system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| FZDE | Discontinued |