System and method for detecting errors using CPU signature

• US 6,173,416 B1
• Filed: 03/22/1999
• Issued: 01/09/2001
• Est. Priority Date: 07/17/1992
• Status: Expired due to Fees

• Current Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Williams, Emrys J., Liddell, David C.
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US09/273,781
• Time in Patent Office: 659 Days
• Field of Search: 714/2, 714/1, 714/3, 714/7, 714/8, 714/10, 714/11, 714/12, 714/13, 714/15, 714/25, 714/31, 714/32, 714/47, 398/500.05
• US Class Current: 714/11
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1415 at system level
• CPC Class Codes: G06F 11/1604 where the fault affects the clock signals of a processing unit and the redundancy is at or within the level of clock signal generation hardware
• CPC Class Codes: G06F 11/1645 and the comparison itself uses redundant hardware
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/1679 at clock signal level
• CPC Class Codes: G06F 11/181 Eliminating the failing redundant component
• CPC Class Codes: G06F 11/185 and the voting is itself performed redundantly
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements

Abstract

A fault-tolerant computer architecture is described wherein the effect of hardware faults is diminished. The architecture employs a main data bus having a plurality of interface slots for interconnecting conventional computer sub-systems. The number and type of sub-systems may vary considerably, however, a central processor sub-system which encompasses the inventive elements of the invention is always included. The central processor sub-system employs a plurality of central processing modules operating in parallel in a substantially synchronized manner. One of the central processing modules operates as a master central processing module, and is the only module capable of reading data from and writing data to the main data bus. The master central processing module is initially chosen arbitrarily from among the central processing modules. Each central processing module contains a means by which the module can compare data on the main data bus with data on a secondary bus within each module in order to determine if there is an inconsistency indicating a hardware fault. If such an inconsistency is detected, each module generates state outputs which reflect the probability that a particular module is the source of the fault. A synchronization bus which is separate from the main data bus interconnects the central processing modules and transmits the state outputs from each module to every other central processing module.

Claims

1. A fault tolerant computer comprising:

two or more cpusets,

wherein each said cpuset has a microprocessor configured to perform one or more operations,

wherein in normal operation, said microprocessors are configured to perform said one or more operations identically and synchronously, and

wherein each said microprocessor is configured to generate a signature signal which corresponds to said one or more operations;

wherein each said signature signal is representative of a start of said one or more operations; and

one or more logic circuits coupled to said cpusets,

wherein said one or more logic circuits are configured to receive said signature signals of said microprocessors and to determine when said signature signals differ, and

wherein when said one or more logic circuits determine that said signature signals differ, said one or more logic circuits assert one or more error signals that cause one or more of said cpusets to enter an error state.

2. The fault tolerant computer of claim 1 wherein said one or more logic circuits are configured to determine when said signature signals differ by masking one or more of said signature signals and comparing only those of said signature signals that are not masked.

3. The fault tolerant computer of claim 1 wherein each of said cpusets contains a corresponding one of said one or more logic circuits and wherein if one of said one or more logic circuits determines that said signature signals differ, said one of said one or more logic circuits causes each of said cpusets to enter said error state.

4. The fault tolerant computer of claim 3 wherein each of said cpusets is coupled to a synchronization bus which is configured to convey said signature signals from each of said microprocessors to each of said logic circuits.

5. The fault tolerant computer of claim 4 wherein each said microprocessor is configured to generate said corresponding signature signal by producing a pulse for each data transfer executed by said microprocessor.

6. The fault tolerant computer of claim 1 wherein said cpusets are configured to enter said error state by storing an indication of said error state.

7. The fault tolerant computer of claim 1 wherein said cpusets are configured to suspend normal operation upon entry into said error state and to resume normal operation when said cpusets are brought into synchronism.

8. A method for determining whether two or more components in a computer system are operating synchronously, the method comprising:

generating a signal in each of said two or more components, said signal being representative of a start of an operation of said component;

comparing said signals generated by each of said components;

determining whether said signals generated by each of said components are identical; and

generating a response if said signals generated by each of said components are not identical.

9. The method of claim 8 wherein each of said components has internal state which is updated in accordance with the operation of said component and wherein said signal is indicative of at least a portion of said state.

10. The method of claim 8 wherein said generating said response comprises generating an error signal.

11. The method of claim 10 wherein said response further comprises executing an error-handling routine.

12. The method of claim 8 wherein said components comprise microprocessors.

13. The method of claim 12 wherein generating said signal in each said microprocessor comprises generating a pulse each time said microprocessor starts a data transfer.

14. The method of claim 8 wherein said comparing said signals comprises masking one or more of said signals so that said masked signals are not considered in said comparing.

15. A system comprising:

a first component configured to perform a function in said system and configured to generate a first signature signal representative of a start of said function by said first component;

a second component configured to perform said function and configured to generate a second signature signal representative of a start of said function by said second component; and

one or more logic circuits, wherein said one or more logic circuits are coupled to said first component and said second component, wherein said one or more logic circuits are configured to determine whether said first signature signal and said second signature signal are identical, and wherein said one or more logic circuits are configured to generate an error signal if said first signature signal and said second signature signal are not identical.

16. The system of claim 15 wherein said first component comprises a first microprocessor and said second component comprises a second microprocessor.

17. The system of claim 16 wherein said system comprises a first cpuset and a second cpuset and wherein said first cpuset contains said first component and said second cpuset contains said second component.

18. The system of claim 17 wherein said system comprises a fault tolerant computer and wherein said first cpuset is configured substantially identically to said second cpuset.

19. The system of claim 18 wherein each said cpuset contains one of said one or more logic circuits, wherein said signature signal corresponding to each of said cpusets is conveyed to each said logic circuit.

20. The system of claim 16 wherein each said microprocessor is configured to generate said signature signal by generating a pulse corresponding to each data transfer executed by said microprocessor.

21. The system of claim 20 wherein said microprocessor comprises a transfer start pin and wherein said signature signal is generated at said transfer start pin.

22. The system of claim 15 wherein said one or more logic circuits are configured to determine when said signature signals differ by masking one or more of said signature signals and comparing only those of said signature signals that are not masked.