Error self-checking and recovery using lock-step processor pair architecture

In a processing system having a Master processor unit, a Shadow processor unit, and a memory, the Master and Shadow processor units each executing an instruction stream that is identical to the other, a method for fault tolerant operation of the processing system that includes the steps of:

• sending Master processor address and data signals to the memory;
• sending the Master processor address and data signals to the memory checker;
• after the Master processor unit has sent the Master processor address and data signals to the memory, checking the Master processor address and data signals against Shadow processor address and data signals communicated by the Shadow processor unit in order to assert a diverge signal if a mismatch is detected;
• the Master processor unit checking to see if the Master processor unit or the Shadow processor unit experienced an error when the diverge signal is asserted;
• saving processor state and data of the Master processor unit to the memory if available, or alternatively, saving the processor state and data of the Shadow processor unit to the memory;
• and
• resetting the Master and Shadow processor units by restoring the saved state to the Master and Shadow processor units.

An article of manufacture comprising a Master processor, a Shadow processor, a memory and a checker to compare address and data signals of the Master processor to address and data signals of the Shadow processor in order to assert a diverge signal if a mismatch is detected, the memory including a computer program for causing the Master and the Shadow processor units to each execute an identical instruction stream and to cause the Master processor to tolerate faults by,

• determining if the Master processor or the Shadow processor experienced an error when the diverge signal is asserted;
• halting operation of the Master and the Shadow processors if the error is determined to be one from which recovery is not possible;
• otherwise, saving processor state and data of the Master processor to the memory;
• and
• resetting the Master and the Shadow processor units to resume operation after restoring the saved processor state and data to the Master and the Shadow processors;
• wherein the checker conducts the comparison between the address and data signals of the Master processor and the address and data signals of the Shadow processor after the Master processor address and data signals have been sent to the memory.

A computer system, comprising:

• a memory;
• a Master processor unit and a Shadow processor unit for generating address and data signals and each coupled to the memory for receiving from the memory an instruction stream for execution;
• a checker element coupled to receive and compare the address signals of the Master processor unit with hose of the Shadow processor unit in order to assert a diverge signal if a mis-match is detected, the checker element conducting the comparison after the Master processor address signals have been sent to the memory;
• the instruction stream including a computer program for causing the Master processor unit to tolerate faults by,
• determining if the Master processor unit or the Shadow processor unit experienced an error when the diverge signal is asserted;
• halting operation of the Master and the Shadow processor units if the error is determined to be one from which recovery is not possible;
• otherwise, saving the processor state and data of the Master processor unit to the memory;
• and
• resetting the Master and the Shadow processor units to resume operation after restoring the saved processor state and data to the Master and the Shadow processor units.

A computer system, comprising:

• a memory;
• a Master and a Shadow processor units each for communicating address and data signals and for receiving from the memory an instruction stream for execution;
• a checker element coupled to receive and compare the address signals of the Master processor unit with those of the Shadow processor unit to assert a diverge signal if a mismatch is detected, the checker element conducting the comparison after the Master processor address signals have been sent to the memory;
• the instruction stream including a computer program for causing the Master processor unit to tolerate faults by,
• determining if the Master processor unit or the Shadow processor unit experienced an error when the diverge signal is asserted;
• saving processor state and data of the Master processor unit to the memory if available, or alternatively, saving the processor state and data of the Shadow processor unit to the memory;
• and
• resetting the Master and the Shadow processor units to resume operation after restoring the saved processor state and data to the Master and the Shadow processor units.