Self-checked, lock step processor pairs

• US 6,233,702 B1
• Filed: 06/07/1995
• Issued: 05/15/2001
• Est. Priority Date: 12/17/1992
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Williams, Frank A., Watson, William Joel, Fowler, Daniel L., Bunton, William Patterson, Sonnier, David Paul, Jones, Curtis Willard Jr., Garcia, David J., Bruckert, William F., Horst, Robert W.
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US08/485,055
• Time in Patent Office: 2,169 Days
• Field of Search: 395/182.09, 371/67.1, 371/68.1, 371/68.2, 714/1, 714/2, 714/6, 714/10, 714/11, 714/12, 714/13, 714/25, 714/37, 714/43, 714/48
• US Class Current: 714/48
• CPC Class Codes: G01R 31/31727 Clock circuits aspects, e.g. test clock circuit details, timing aspects for signal generation, circuits for testing clocks G01R31/31725 takes precedence; concerning scan test G01R31/318552, for tester hardware G01R31/31922
• CPC Class Codes: G01R 31/318533 using scanning techniques, e.g. LSSD, Boundary Scan, JTAG
• CPC Class Codes: G06F 1/12 Synchronisation of different clock signals provided by a plurality of clock generators
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1044 with specific ECC/EDC distribution
• CPC Class Codes: G06F 11/1604 where the fault affects the clock signals of a processing unit and the redundancy is at or within the level of clock signal generation hardware
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/1645 and the comparison itself uses redundant hardware
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/167 Error detection by comparing the memory output
• CPC Class Codes: G06F 11/1679 at clock signal level
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/1687 at event level, e.g. by interrupt or result of polling
• CPC Class Codes: G06F 11/1695 which are operating with time diversity
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2043 where the redundant components share a common memory address space
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups
• CPC Class Codes: G06F 11/2736 using a dedicated service processor for test
• CPC Class Codes: G06F 12/0815 : Cache consistency protocols
• CPC Class Codes: G06F 12/1483 : using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2201/845 : Systems in which the redundancy can be transformed in increased performance
• CPC Class Codes: H04L 12/56 : Packet switching systems
• CPC Class Codes: H04L 47/10 : Flow control; Congestion control
• CPC Class Codes: H04L 49/90 : Buffering arrangements
• CPC Class Codes: H04L 49/901 : using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9057 : Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A multiprocessor system includes a number of sub-processor systems, each substantially identically constructed, and each comprising a central processing unit (CPU), and at least one I/O device, interconnected by routing apparatus that also interconnects the sub-processor systems. A CPU of any one of the sub-processor systems may communicate, through the routing elements, with any I/O device of the system, or with any CPU of the system.

Communications between I/O devices and CPUs is by packetized messages. Interrupts from I/O devices are communicated from the I/O devices to the CPUs (or from one CPU to another CPU) as message packets.

CPUs and I/O devices may write to, or read from, memory of a CPU of the system. Memory protection is provided by an access validation method maintained by each CPU in which CPUs and/or I/O devices are provided with a validation to read/write memory of that CPU, without which memory access is denied.

Claims

1. A central processor unit, comprising:

a memory for storing instructions and data;

a pair of processors operating in lock-step synchronism with each other to execute each instruction of an instruction stream and to periodically write identical N-bit data words comprising first and second portions to the memory at substantially the same moment in time;

first and second interface elements receiving the N-bit data words from corresponding ones of the pair of processors for communication to the memory such that the first portion of the N-bit data word is written to the memory by the first interface element together with the second portion of the N-bit data from the second interface element;

the first interface element including first compare means for receiving and comparing the second portion of the N-bit data word from the second interface element with the second portion of the N-bit data word received from the corresponding one of the pair of processors to assert an first error signal if a miscompare is detected; and

the second interface element including means for receiving and comparing the first portion of the N-bit data word from the first interface element with the first portion of the N-bit data word received from the corresponding one of the pair of processors to assert a second error signal if a miscompare is detected.

2. The central processor unit of claim 1, wherein the first and second portions are each N/2 bits.

3. The central processor unit of claim 1, the memory comprising a first memory half and a second memory half, and including a first memory controller coupled to communicate the first portion of the N-bit data words between the first memory half and the first interface element, and a second memory control coupled to communicate the second portion of the N-bit data words between the second memory half and the second interface element,.

4. The central processor unit of claim 1, the first and second interface elements each including an error circuit for receiving and producing therefrom an M-bit error code for each N-bit word written to memory.

5. The central processor unit of claim 4, wherein the first interface element writes the first portion of the N-bit word to the memory in association with a first portion of the M-bit error code, and the second interface element writes the second portion of the data word to the memory in association with a second portion of the M-bit error code.

6. The central processor unit of claim 5, the error circuit of each of the first and second interface elements being coupled to receive from the memory the N-bit data words and the M-bit error code for checking the N-bit data words for error.

7. The central processor unit of claim 6, wherein the M-bit error code is an error-correcting code that corrects single-bit errors in the N-bit data word and detects double-bit errors in the N-bit data word.

8. The central processor unit of claim 1, wherein the first and second interface elements each include error code generating means to receive the N-bit data words for producing therefrom an M-bit error code, the first and second interface elements respectively writing first and second portions of the M-bit error code to memory in association with the first and second portions of the N-bit data word.

9. A processor unit, comprising:

first and second processor elements operating in lock-step synchronism with each other to execute each instruction of an instruction stream, and to periodically produce identical N-bit data words comprising first and second portions, at substantially the same moment in time;

a memory for storing the N-bit data words;

a first interface unit coupling the first processor element to the memory to create an M-bit error code from N-bit data words received from the first processor and to communicate the first portion for storage in the memory in associate with a first part of the M-bit error code;

a second interface unit coupling the second processor element to the memory to create the M-bit error code from N-bit data words received from the second processor to communicate the second portion for storage in the memory in associate with a second part of the M-bit error code; and

the first and second interface units each including an error circuit for receiving N-bit data words from memory together with the associated M-bit error code to check the N-bit data word for errors.

10. The processor unit of claim 9, wherein the first interface unit includes a first compare circuit receiving the second portion of the N-bit data word from the second interface unit for comparison with the second portion of the N-bit data word received from the first processor element to produce an error indication when a miscompare is detected.

11. The processor unit of claim 10, wherein the second interface unit includes a second compare circuit receiving the first portion of the N-bit data word from the first interface unit for comparison with the first portion of the N-bit data word received from the second processor element to produce an error indication when a miscompare is detected.

12. In a data processing system having first and second data processor elements operating in substantially lock-step synchronism to sequential execute an identical series of instructions, instruction by instruction, to each periodically produce, at substantially the same time, N-bit data elements, each N-bit data element have first and second portions, the data processing system having a memory for storing the N-bit data elements;

a method for checking operation of the first and second data processor elements, including the steps of;

communicating the first portion of the N-bit data element from the first data processor element to the memory for storage;

communicating the second portion of the N-bit data element from the second data processor element to the memory for storage in association with the corresponding first portion; and

comparing the first portion and second portions of each of the N-bit data words from the first data processor element with the first and second portions of the corresponding N-bit data words from the second data processor element; and

producing an error indication when a miscompare is detected.

13. The method of claim 12, including creating first and second M-bit error codes for each N-bit data word from each of the first and second data processor elements, respectively, the first and second error codes having first and second parts, and storing in memory the first part of the first M-bit error code in association with the first portion of the N-bit data word from the first processor unit, and storing in memory the second part of the second M-bit error code in association with the second portion of the N-bit data word from the second data processor element.