Software system tolerating transient errors and control process in such a system
AssigneeCentre National D'Etudes Spatiales
InventorMichel Pignol
Life of this patent
Estimating the term…
Abstract
The present invention concerns a software system that tolerates transient errors made up by a processing unit, including: at least two processing units (50, 51) with each one including: a microprocessor (54, 57), a memory (53, 56) protected by a device generating and controlling a code for the detection and correction of errors, a device (55, 58) for monitoring memory accesses, A centralized control device (52) for the processing units and for inputs/outputs, including: macro-synchronization means, data comparison/vote means, correction demand means, decision-making means, means allowing the inputs/outputs to be made. Some links (60, 61) respectively linking each processing unit to the device (52) for controlling the processing units and the inputs/outputs.
Claims13
A computer system adapted to process different types of faults, with a given error coverage rate, the computer system comprising:
- at least two processing unit cores, each processing unit core comprising:
- a microprocessor;
- a memory having one or more segments and protected by a device generating and controlling an error detection and correction code;
- and
- a memory access watch device comprising an intrinsic means for protecting itself against transient errors, comprising:
- an electronic server set adapted to control said memory;
- a means for the segmentation of said memory and verification of a right for access to each of said one or more segments of said memory;
- a means for protecting said one or more segments of said memory allocated to saving recovery context information;
- and
- a means for generating a correction demand signal to said at least two processing unit cores and to a control device, each of said at least one processing unit adapted to execute the same software asynchronously;
- a control device, comprising:
- a centralized electronic server set including at least one clock generator, at least one timer, and at least one watch;
- a means for receiving said correction demand signal;
- a macro-synchronization means for the at least two processing unit cores, said macro-synchronization means adapted to upon receipt of a first one or more messages from a first of said at least two processing unit cores, wait for a predetermined time for receipt of a second one or more messages from a second of said at least two processing unit cores, said first one or more messages equivalent to said second one or more messages, each processing unit core having stopped at the same point in the software to transmit said first one or more messages and said second one or more messages;
- a means for initiating a correction phase for different cases of error, said means adapted to, if said messages are different, simultaneously transmit a correction phase demand to each of said at least two processing unit cores;
- a means for executing said messages and releasing said at least two processing unit cores if said messages are identical;
- a means for direct memory access in said at least two processing unit cores;
- and
- a means for processing inputs and outputs;
- and
- one or more links linking each processing unit core to said at least two processing unit cores and said control device.
A method for making a computer system tolerant to different types of faults, with a given error coverage rate, the method comprising:
- running identical software applications simultaneously on at least two processing unit cores, independently and asynchronously, each of said at least two processing unit cores having a memory having one or more segments, a microprocessor, and a memory access watch device, transient errors affecting memory in said at least two processing unit cores being detected and corrected by use of a detection and correction code stored in memory associated with a software scanning task, proper functioning of said microprocessor being verified via a segmentation of said memory that is associated with monitoring memory accesses that ensures said microprocessor has rights for accessing a current segment of said memory, said one or more memory segments allocated for using in saving a context;
- transmitting a correction demand signal to a control function for said at least two processing unit cores and input-output if a violation of said memory access rights is detected;
- and
- centralizing the following operations in the control function for said processing units and input-output of said processing units:
- accessibility to at least one clock generator, at least one timer and at least one watch;
- reception of said correction demand signal;
- macro-synchronization of different simultaneous executions of software;
- comparison of data generated by said different simultaneous executions of said software;
- when an error is detected, decision-making in order to initialize a correction phase and transmission of a correction phase demand simultaneously to the different simultaneous executions of said software;
- performance of input-output upon demands from said software;
- and
- direct access to said memory in said at least two processing unit cores.
Dependencies are inferred from the claim text.