Multiprocessor with pair-wise high reliability mode, and method therefore

• US 6,772,368 B2
• Filed: 12/11/2000
• Issued: 08/03/2004
• Est. Priority Date: 12/11/2000
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Posluszny, Steven Douglas, Hofstee, Harm Peter, Dhong, Sang Hoo, Nair, Ravi
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): Manoskey, Joseph D
• Application Number:
  US09/734,117
• Publication Number:
  US 20020073357A1
• Time in Patent Office: 1,331 Days
• Field of Search: 714/10, 714/11, 714/12, 714/15, 714/20, 714/736, 714/797, 714/804, 714/820, 712/20
• US Class Current: 714/11
• CPC Class Codes: G06F 11/1407 Checkpointing the instruction stream
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 2201/845 Systems in which the redundancy can be transformed in increased performance
• CPC Class Codes: G06F 9/30189 according to execution mode, e.g. mode flag
• CPC Class Codes: G06F 9/3861 Recovery, e.g. branch miss-prediction, exception handling error detection or correction G06F11/00
• CPC Class Codes: G06F 9/3885 using a plurality of independent parallel functional units

Abstract

In one embodiment a multiprocessing apparatus includes a first processor and a second processor. Each of the processors have their own data and instruction caches to support independent operation. In a normal mode the processors independently execute separate instruction streams. Each of the processors has a respective signature generator. The system also includes a compare unit coupled to the signature generators. In a high reliability mode, both processors execute the same instruction stream. That is, each processor computes a version of a result for ones of the instructions in the stream. Responsive to the respective versions, the respective signature generators assert signatures to the compare unit, so that a faulting instruction may be detected. In another aspect, each processor has its own respective commit logic. The compare unit signals the commit logic in each respective processor that the possibility has been eliminated of a calculation interrupt arising for that instruction, once the compare unit receives signatures for corresponding versions of a result, but only if the signatures match. This permits the commit logic to commit the result. If the signatures do not match, the compare unit signals the commit logic that the corresponding instruction has faulted. The commit logic permits instructions prior to the faulting instruction in program order to continue execution, but initiates flushing of results that were produced by the faulting instruction and at least some instructions subsequent in program order to the faulting instruction.

Claims

1. A multiprocessing system comprising:

a first processor having a first set of architected registers and a first execution pipeline;

a second processor having a second set of architected registers and a second execution pipeline;

mode control logic, wherein in a first mode the processors independently execute separate instruction streams, and in a second mode both processors execute one instruction stream, wherein in the second mode!for ones of the instructions in the stream each processor computes corresponding versions of a result;

compare logic for indicating whether the respective versions of an instruction match;

first commit logic and first state recovery means for the first processor; and

second commit logic and second state recovery means for the second processor, wherein such a state recovery means for one of the processors operates in both the first and second modes and is for preserving state information and for restoring the state information to the processor; and

architected registers, the restoring being responsive to a faulting instruction causing instructions to be aborted in the processor'"'"'s pipeline, wherein such a faulting instruction includes an instruction causing an arithmetic calculation overflow or underflow wherein responsive to the compare unit indicating a disparity between the versions of one of the results the compare unit signals the first and second commit logics that the corresponding instruction has faulted, and the commit logics permit instructions prior to the faulting instruction in program order to continue execution, but initiate;

i) flushing of instructions, and results of the flushed instructions, for instructions following the faulting instruction in program order and ii) the restoring of the state information by the state recovery means.

2. The system of claim 1, comprising:

a first signature generator for the first processor;

a second signature generator for the second processor, each the signature generators being coupled to the compare unit, wherein responsive to the respective versions, the signature generators assert signatures to the compare unit, so that such a disparity between the versions of one of the results may be detected.

5. The system of claim 2, wherein such a signature includes a bit indicating parity for the signature'"'"'s corresponding version of the result.

6. The system of claim 2, wherein such a signature includes a number of parity bits for respective subsets of its version.

7. The system of claim 2, wherein such a signature includes a sum for all the bits of its version of the result.

8. The system of claim 2, wherein such a signature includes the entire version of the result itself.

9. The system of claim 2, comprising

complete logic for generating an error correction code for an instruction result, wherein for such a instruction result, the signature generators produce their respective signatures in response to their respective result versions, including the error correction codes for the versions.

10. The apparatus of claim 1, wherein such a faulting instruction causing the aborting instructions in the pipeline of one of the processors includes an instruction causing an i/o device request, a page fault, a misaligned memory access, a use of an undefined instruction and a memory protection violation.

3. The system of claim comprising:

first bus logic unit for the first processor;

second bus logic unit for the second processor; and

bus arbitration logic, wherein in the first mode each one of the processors generates bus requests independently through its respective bus logic unit, and bus arbitration logic arbitrates between the independent bus requests, and in the second mode one of the bus logic units controls bus requests and reads the bus for both processors in the system.

4. The system of claim 3, comprising:

external interrupt logic, wherein the external interrupt logic responds to external interrupt requests and signals both processors concurrently to respond to an interrupt request.

11. A method for multiprocessor operation, comprising the steps of:

a) selecting an operating mode for first and second processors;

b) executing separate instruction streams by the two processors, responsive to selecting a first mode in step a);

c) executing instructions of one instruction stream by the two processors concurrently, responsive to selecting a second mode in step a), wherein each of the two processors computes a respective version of a result for corresponding ones of the instructions in the stream, and wherein the processors have respective states prior to execution of each instruction;

d) preserving state information for the respective states of the processors in respective state recovery means;

e) restoring respective ones of the states to architected registers of the respective processors by the respective state recovery means, the restoring being responsive to a faulting instruction causing instructions to be aborted in a pipeline of one of the processors, wherein the respective state recovery means operate in both modes and such a faulting instruction includes an instruction causing an arithmetic calculation overflow or underflow;

f) asserting signatures to a compare unit responsive to the respective versions of an instruction result;

g) restoring respective ones of the states to the architected registers of the respective processors by the respective state recovery means responsive to the processors being in the second mode and the compare unit indicating that respective ones of the versions of a result do not match; and

h) re-executing, by the respective processors, the instruction for which the respective result versions did not match; and

h) committing one of the results in each processor, responsive to the processors being in the second mode, and the compare unit indicating a correctly calculated instruction.

12. The method of claim 11, comprising the steps of:

arbitrating between independent bus requests for each of the two respective processors responsive to the processors being in the first mode, so that each processor will have independent bus accesses through respective bus logic units of the respective processors; and

controlling bus requests and reading the bus by a single one of the bus logic units for both of the processors responsive to the system being in the second mode, so that the two processors have lockstep bus accesses.

13. The method of claim 12, comprising the step of synchronously signaling both processors to respond to an interrupt request, responsive to an asynchronous external interrupt request, so that the processors do not have to take further action to synchronize to one another in response to the asynchronous external interrupt request.

14. The method of claim 11, wherein such a signature includes a bit indicating parity for the signature'"'"'s corresponding version of the result.

15. The method of claim 11, wherein such a signature includes a number of parity bits for respective subsets of the signature'"'"'s corresponding suit version.

16. The method of claim 11, wherein such a signature includes a sum for all the bits of its version of the result.

17. The method of claim 11, wherein such a signature includes the entire version itself.

18. The method of claim 11, wherein the respective versions of an instruction result include an error correction code, the method comprising the step of producing respective signatures by the signature generators in response to their respective result versions, including the error correction codes for the versions.

19. The method of claim 11, wherein such a faulting instruction causing the aborting of instructions in the pipeline of one of the processors includes an instruction causing an i/o device request, a page fault, a misaligned memory access, a use of an undefined instruction or a memory protection violation.