JP7782564B2 - Processor - Google Patents

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based on and claims the benefit of priority from Japanese Application No. 2021-133613, filed on August 18, 2021, the entire contents of which are incorporated herein by reference.

The present disclosure relates to a processor having a lockstep mechanism.

Integrated circuits (processors, etc.) equipped with a fault detection mechanism (lockstep) have been known for some time (Patent Documents 1 to 3). Lockstep is a mechanism that causes two cores to execute identical operations and compares the outputs to detect faults in the integrated circuit.

Implementations are known that allow multiple pipelines to operate in lockstep or independently, switching between them depending on the required level of functional safety. When a high level of functional safety is required, failures in the entire pipeline are detected by operating them in lockstep and comparing their outputs; otherwise, each pipeline can be used independently, utilizing them as a computing resource, achieving both performance maintenance and functional safety implementation.

JP 2016-35626 A Japanese Patent Application Laid-Open No. 2019-204388 JP 2016-42336 A

After detailed consideration by the inventors, it was found that while lockstep is an implementation that can achieve a high fault detection rate, it requires additional delay circuits to shift the phase of the output signals of the master circuit and checker circuit that operate in lockstep, and logic circuits to compare the output signals, resulting in an increase in circuit size. This problem is more pronounced when the bit width of the output signals from the master circuit and checker circuit is wide. Note that implementations that shift the phase of output signals are used when it is desired to avoid the effects of common cause failures, such as clock failures.

In view of the above background, the present disclosure aims to provide a processor that can address increased circuit size.

The present disclosure employs the following technical solutions to solve the above problems. The claims and the symbols in parentheses in this section are examples that show the correspondence with the specific solutions described in the embodiments below as one aspect, and do not limit the technical scope of the present disclosure.

The processor of the present disclosure is a processor having a lockstep mechanism, comprising a first circuit that performs pipeline operations and a second circuit having the same configuration as the first circuit, wherein each of the first circuit and the second circuit comprises a RAM (11, 21) and an arithmetic circuit that performs an operation using data read from the RAM, passes the operation result to the next pipeline stage, and writes it to the RAM, and comprises a comparison circuit that compares the data read from the RAM of the first circuit with the data read from the RAM of the second circuit.

By comparing data in this way midway through the pipeline, the amount of data to be compared for fault detection can be reduced, making it possible to reduce the circuit size.

The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:
FIG. 1 is a circuit diagram of a processor according to an embodiment. FIG. 2 is a diagram showing an example of implementation of the pipeline register 1. FIG. 3 is a diagram showing the operating waveforms of the processor. FIG. 4 is a circuit diagram of a conventional processor.

A processor according to an embodiment of the present disclosure will be described below.
The processor of this embodiment is a processor having a lockstep mechanism, including a first circuit that performs pipeline operation and a second circuit that has the same configuration as the first circuit, wherein each of the first circuit and the second circuit includes a RAM, an arithmetic circuit that performs an operation using data read from the RAM, passes the operation result to the next pipeline stage, and writes it to the RAM, and a comparison circuit that compares the data read from the RAM of the first circuit with the data read from the RAM of the second circuit. By comparing data in the middle of the pipeline in this way, it is possible to reduce the amount of data to be compared for fault detection and reduce the circuit size.

In the processor of this embodiment, the first circuit and the second circuit each include an error detection circuit that detects a 1-bit error in data read from the RAM, and an error correction circuit that corrects the 1-bit error in a pipeline stage different from the error detection circuit, and the 1-bit error detection result is transmitted from the first circuit to the second circuit, and the second circuit is configured to stall pipeline operation if a 1-bit error is detected in the first circuit.

The processor of this embodiment is equipped with an error detection circuit that detects single-bit errors and an error correction circuit that corrects detected errors. RAM equipped with a circuit that detects and corrects single-bit errors is called ECC memory (Error checking and correction memory). Using ECC memory can reduce failures caused by data errors when the first circuit and second circuit are used independently (split operation).

In this embodiment, the pipeline stages for the single-bit error detection circuit and the error correction circuit are different. While there are configurations in which error detection and error correction are performed in the same pipeline stage, the reason for separating the pipeline stages for error detection and error correction in this embodiment is to achieve high computational performance by operating at a high frequency.

In the processor of this embodiment, the error detection circuit and the error correction circuit have different pipeline stages, so when correcting a 1-bit error, the pipeline operation must be stalled. Therefore, when a 1-bit error is detected in the first circuit, the pipeline operation of the first circuit is stalled, causing a loss of synchronization with the pipeline operation of the second circuit. In this case, it is not possible to compare the data in the first and second circuits midway through the pipeline.

Therefore, the processor of this embodiment transmits the detection result of a 1-bit error from the first circuit to the second circuit, and if a 1-bit error is detected in the first circuit, it also stalls pipeline operation in the second circuit to prevent synchronization loss.

In addition, the processor of this embodiment transmits read data from the RAM of the first circuit, or the corrected read data if a 1-bit error has been corrected in the first circuit, from the first circuit to the second circuit, and the second circuit uses the data transmitted from the first circuit and is configured not to correct the 1-bit error even if it is detected in the second circuit during lockstep operation.

With this configuration, even if a one-bit error is detected in the second circuit, the pipeline of the second circuit is not stalled, so there is no synchronization loss between the first circuit and the second circuit.

In the processor of this embodiment, the comparison circuit is provided on a line that transmits data from the first circuit to the second circuit. This configuration allows data to be input to the comparison circuit using a bypass line that transmits data from the first circuit to the second circuit.

In the processor of this embodiment, the second circuit may include a selection circuit that switches between lockstep operation and split operation. This enables split operation, in which the first circuit and the second circuit operate independently.

Hereinafter, a processor according to an embodiment of the present disclosure will be described with reference to the drawings.
1 is a circuit diagram of a processor according to an embodiment. The processor includes a master circuit 10 and a checker circuit 20. The master circuit 10 and the checker circuit 20 are identical circuits that perform pipeline processing on input data and output the data. The master circuit 10 and the checker circuit 20 operate in lockstep. That is, the same data is input to the master circuit 10 and the checker circuit 20, and a difference between the data in the master circuit 10 and the data in the checker circuit 20 is detected. If a difference exists, a fault is detected.

A delay circuit 31 is provided on the input data line 30 to the checker circuit 20, and the input to the checker circuit 20 is delayed (for example, by 1 to 2 cycles) relative to the input to the master circuit 10. This is because if the same data is input to the master circuit 10 and the checker circuit 20 at the same time, and they are affected by the same cause (for example, a clock signal malfunction), there is a risk that a fault cannot be detected by data comparison. When data is input with a shift in timing and compared, the effects of a common fault cause are avoided by delaying the output of the master circuit 10 by the amount of the input timing shift.

The master circuit 10 has a RAM 11, an ECC error detection circuit 12, an ECC error correction circuit 13, and an execution unit 14. The RAM 11 holds data used by the execution unit 14, etc. The execution unit 14 is a circuit that performs calculations using data read from the RAM 11. The calculation results by the execution unit 14 are output as processing results, or may be written to the RAM 11 and later read from the RAM 11.

The ECC error detection circuit 12 detects ECC errors (1-bit/2-bit errors). If the ECC error detection circuit 12 detects a 1-bit error, it asserts an SED (Single Error Detection) signal.

When the SED signal is asserted, the ECC error correction circuit 13 corrects the data based on the ECC code and writes the corrected data back to the pipeline register 1.

Figure 2 shows an example implementation of pipeline register 1. Pipeline register 1 has a buffer preg_sk that temporarily holds data read from RAM 11. During normal operation when the SED signal is not asserted, if there is no data in buffer preg_sk, the data read from RAM 11 is stored in register preg, and if there is data in buffer preg_sk, the data read from RAM 11 is stored in buffer preg_sk. When the SED signal is asserted and corrected data is written back, the corrected data is stored in register preg, and the data read from RAM 11 is stored in buffer preg_sk. Next, to explain data reading, data is read from register preg, and in the cycle in which data is read from register preg, the data in buffer preg_sk is moved to register preg.

Also, when the SED signal is asserted, the pipeline control circuit 15 receives the SED signal and stalls the pipeline upstream of pipeline register 1. Since the input data to execution unit 14 contains an error, the operation is canceled. Also, in the next cycle, the corrected data is sent from pipeline register 1 to execution unit 14, which then performs the operation.

The ECC error correction circuit 13 corrects single-bit errors. The execution unit 14 is a circuit that performs calculations, performs calculations using data read from RAM 11, and writes the calculation results back to RAM 11.

The master circuit 10 also has a pipeline control circuit 15 and three pipeline registers 0 to 2, which are configured to control pipeline operation. The pipeline control circuit 15 controls the progression and stopping of the pipeline. Pipeline registers 0 to 2 are storage units that hold control information and data to be pipeline processed. Pipeline register 0 is located between the input of the master circuit 10 and RAM 11. Pipeline register 1 is located between the ECC error detection circuit 12 and the ECC error correction circuit 13. Pipeline register 2 is located between the execution unit 14 and the output of the master circuit 10.

The operation of the master circuit 10 has three pipeline stages ps1 to ps3. Pipeline stage ps1 is a process for writing data from pipeline register 0 to RAM 11. Pipeline stage ps2 is a process for reading data from RAM 11, performing ECC error detection, and storing the data in pipeline register 1. Pipeline stage ps3 is a process for reading data from pipeline register 1, performing ECC data correction if an ECC data error is detected, and executing an operation in the execution unit 14 if no ECC data error is detected.

When an ECC error is detected in pipeline stage ps2, pipeline stage ps3 corrects the ECC data and writes the corrected data back to pipeline register 1. At this time, the execution unit 14 does not execute the operation, and the pipeline operation stalls. The pipeline control circuit 15 controls the stall of the pipeline operation.

Figure 3 shows the operating waveforms of the processor during normal operation (top) and error correction (bottom). During normal operation, as shown in the upper operating waveform of Figure 3, data d0 written to pipeline register 0 is written to RAM 11 in the next cycle, then written to pipeline register 1 in the following cycle, and then written to pipeline register 2 in the following cycle, with processing occurring sequentially in each cycle.

When correcting an error, data d1 written to pipeline register 0 is written to RAM 11 and then written to pipeline register preg (see Figure 2) in the next cycle. If an ECC error is detected in the data read from RAM 11, error correction is performed in the next cycle to generate data d1_c, which is then written back to pipeline register preg. At this time, data d2 following data d1 is first written to buffer preg_sk. The corrected data d1_c is written to pipeline register 2 one cycle later than in normal operation. In this cycle, data d2 stored in buffer preg_sk is moved to pipeline register 1. As described above, when an ECC error is detected, pipeline operation stalls for one cycle.

The master circuit 10 and checker circuit 20 are connected by a line that transmits the SED signal asserted from the ECC error detection circuit 12 of the master circuit 10 to the checker circuit 20. A delay circuit 33 is provided on this line 32, which applies a delay of the same number of cycles as the delay of the input data. The master circuit 10 and checker circuit 20 are also connected by a bypass line 34 that transmits data read from the RAM 11 of the master circuit 10 (or the corrected data if the read data contains an ECC error) to the checker circuit 20. A delay circuit 35 is also provided on this line 34, which applies a delay of the same number of cycles as the delay of the input data.

A comparison circuit 36 is provided on the bypass line 34. The comparison circuit 36 receives data read from RAM 11 of the master circuit 10 and data read from RAM 21 of the checker circuit 20, and detects the difference between them. If a difference exists, the comparison circuit 36 asserts an error signal.

Next, we will explain the checker circuit 20. When the checker circuit 20 performs lockstep operation together with the master circuit 10, it performs the following processing to prevent the pipeline operations of the master circuit 10 and the checker circuit 20 from becoming out of synchronization.
(i) If an ECC error occurs in the master circuit 10, the pipeline operation is stalled even if an ECC error does not occur in the checker circuit 20.
(ii) Even if an ECC error occurs in the checker circuit 20, the ECC error correction is not performed and the pipeline operation is not stalled.

The basic configuration of the checker circuit 20 is the same as that of the master circuit 10, so the checker circuit 20 will be described, focusing on the configuration for realizing the above-mentioned operations.
The checker circuit 20 has a first selection circuit 26 and a second selection circuit 27. The first selection circuit 26 and the second selection circuit 27 are circuits that switch outputs depending on whether or not lock-step operation is in progress. Whether or not lock-step operation is in progress is set by an LSEN (Lock Step Enable) flag.

The first selection circuit 26 receives the SED signal from the master circuit 10 and the SED signal from the checker circuit 20. During lockstep operation, the first selection circuit 26 inputs the SED signal from the master circuit 10 to the pipeline control circuit 25. This causes the pipeline control circuit 25 to stall the pipeline operation of the checker circuit 20 in response to the occurrence of an ECC error in the master circuit 10. During split operation, the first selection circuit 26 inputs the SED signal from the checker circuit 20 to the pipeline control circuit 25.

The second selection circuit 27 receives data bypassed from the master circuit 10 and data read from the RAM 21 of the checker circuit 20 (the data after error correction if an error occurred). During lockstep operation, the second selection circuit 27 inputs data from the master circuit 10 to the execution unit 24. In other words, data from the pipeline register 1 of the checker circuit 20 is replaced with data bypassed from the master circuit 10. As a result, the execution unit 24 of the checker circuit 20 performs calculations using the data bypassed from the master circuit 10, regardless of whether an ECC error has occurred, allowing pipeline operation to be performed without stalling. Note that the checker circuit 20 only detects and notifies errors, and the timing of pipeline operation and the input data to the execution unit 24 are the same as those of the master circuit 10.

Figure 4 is an example circuit diagram of a conventional processor with a lockstep mechanism. Conventional processors detect faults by comparing the output of the master circuit 10 with the output of the checker circuit 20 using a comparison circuit 36. This meant there was no need to worry about synchronization of pipeline operations, but there was a problem in that the circuit size became large when the bit width of the output data from the master circuit 10 and checker circuit 20 was large.

The processor of this embodiment does not compare the outputs of the master circuit 10 and the checker circuit 20, but rather compares the output data from the pipeline register 1. Therefore, the circuit reduction effect is greater when the bit width of the output data from the pipeline register 1 is smaller than the bit width of the output data from the master circuit 10 and the checker circuit 20. The area reduction effect increases in configurations with multiple of the above configurations, i.e., in lane or tile configurations.

According to the inventors' verification, a high fault detection rate can be achieved depending on the circuit configuration of the execution units 14 and 24, even without comparing the output data of the master circuit 10 and the checker circuit 20. In particular, the fault detection rate improves when the configuration makes it easy for data from RAMs 11 and 21 to be resupplied to the execution units 14 and 24.

The master circuit 10 and checker circuit 20 are configured to stall pipeline operation when an ECC error occurs because the ECC error detection circuits 12, 22 and ECC error correction circuits 13, 23 are executed in separate pipeline stages. However, in the processor of this embodiment, it is possible to synchronize the master circuit 10 and checker circuit 20, enabling both high performance and fault detection to be achieved.

The present disclosure is useful as a processor having a lockstep mechanism.

Claims (5)

A processor having a lockstep mechanism, comprising a first circuit (10) that performs a pipeline operation and a second circuit (20) that has the same configuration as the first circuit,
Each of the first circuit and the second circuit comprises:
RAM (11, 21) in one pipeline stage ;
an arithmetic circuit (14, 24) in a pipeline stage other than the one pipeline stage, which performs an arithmetic operation using data read from the RAM, outputs the arithmetic operation result as a processing result , and also writes the result into the RAM;
Equipped with
A processor comprising a comparison circuit (36) for comparing data read from the RAM of the first circuit with data read from the RAM of the second circuit. Each of the first circuit and the second circuit comprises:
an error detection circuit (12, 22) for detecting a single-bit error in data read from the RAM;
an error correction circuit (13, 23) for correcting a single-bit error in a pipeline stage different from the error detection circuit;
Equipped with
transmitting a detection result of a single bit error from the first circuit to the second circuit;
2. The processor according to claim 1, wherein the second circuit stalls a pipeline operation when a one-bit error is detected in the first circuit. transmitting, from the first circuit to the second circuit, read data from the RAM of the first circuit, or, if one-bit error correction has been performed in the first circuit, corrected read data;
3. The processor of claim 2, wherein the second circuit uses data transmitted from the first circuit and does not correct a single-bit error even if the single-bit error is detected during lockstep operation. The processor of claim 3, wherein the comparison circuit is provided on a line (34) that transmits data from the first circuit to the second circuit. The processor according to any one of claims 1 to 4, wherein the second circuit includes a selection circuit (26, 27) for switching between lockstep operation and split operation.