Scheduling of duplicate threads
A safety thread scheduler configured to schedule a check thread for a critical thread being run on one of a plurality of execution units, the check thread being a duplicate of the critical thread, wherein the safety thread scheduler is configured to schedule the check thread to begin being run on a second one of the plurality of execution units before the end of a safety time-window for scheduling the check thread. The safety thread scheduler is further configured to allow the check thread, when the check thread is running on the second one of the plurality of execution units, to be interrupted by a further thread and to re-schedule the check thread to be resumed by expiry of a re-scheduling time limit.
1 . A safety thread scheduling circuit configured to schedule a check thread for a critical thread being run on one of a plurality of execution units, the check thread being a duplicate of the critical thread;
the safety thread scheduling circuit being configured to schedule the check thread to begin being run on a second one of the plurality of execution units before the end of a safety time-window for scheduling the check thread; and
the safety thread scheduling circuit being further configured to allow the check thread, when the check thread is running on the second one of the plurality of execution units, to be interrupted by a further thread and to re-schedule the check thread to be resumed by expiry of a re-scheduling time limit;
wherein the safety thread scheduling circuit is operable to perform the re-scheduling of the check thread by interrupting another thread, other than the critical thread, running on one of the execution units other than the first execution unit, thereby resuming execution of the check thread on the execution unit upon which the other thread was running.
2 . The safety thread scheduling circuit of claim 1 , wherein the safety thread scheduling circuit is operable such that the interrupted other thread is the further thread on the second execution unit, such that the check thread resumes on the second execution unit.
3 . The safety thread scheduling circuit of claim 1 , wherein the safety thread scheduling circuit is operable such that the interrupted other thread is a thread, other than the critical thread and the further thread, running on a third one of the execution units other than the first and second execution units, such that the check thread is migrated to the third execution unit.
4 . The safety thread scheduling circuit of claim 1 , wherein the re-scheduling time limit is either:
a) the expiry of a safety time-window of a predetermined length running from a point at which the execution of the critical thread begins, or
b) the expiry of the safety time-window plus any time already spent executing the check thread, or
c) a time in between a) and b).
5 . The safety thread scheduling circuit of claim 4 , operable to initially schedule the check thread to begin executing, before the interruption by the further thread, any time between the point at which the execution of the critical thread begins and the expiry of the safety time-window.
6 . The safety thread scheduling circuit of claim 5 , configured to perform the initial scheduling of the check thread by:
i) if at least one of the execution units is detected to be idle by the point at which the execution of the critical thread begins, to select an idle one of the execution units as the second execution unit to begin the execution of the check thread; but
ii) if none of the execution units is detected to be idle by the point at which the execution of the critical thread begins, to wait and detect whether one becomes newly idle before the expiry of the safety time-window if so and thereupon select the newly idle execution unit as the second execution unit to begin the execution of the check thread; but
iii) if none of the execution units becomes idle by the expiry of the safety time-window, to interrupt a non-critical thread executing on a non-idle one of the execution units and select the non-idle execution unit as the second execution unit to begin the execution of the check thread.
7 . The safety thread scheduling circuit of claim 6 , configured to raise a panic condition if none of the execution units becomes idle nor is found to be executing a non-critical thread before the expiry of the safety time-window.
8 . The safety thread scheduling circuit of claim 1 , configured to perform the re-scheduling of the check thread by migrating the check thread to a third of said execution units other than the first and second execution units, resuming execution of the check thread on the third execution unit.
9 . The safety thread scheduling circuit of claim 1 , wherein the further thread is a thread other than a check thread.
10 . The safety thread scheduling circuit of claim 1 , wherein the further thread is a critical thread.
11 . The safety thread scheduling circuit of claim 1 , wherein the further thread is a non-critical thread.
12 . A processing system comprising the execution units and the safety thread scheduling circuit as set forth in claim 1 .
13 . The processing system of claim 12 , further comprising comparison circuitry configured to compare a first result with a second result, the first result being a result of the execution of the critical thread on the first execution unit, and the second result being a result of the execution of the check thread on the second execution unit;
wherein the comparison circuitry is configured to raise error signal if the first and second results do not match according to said comparison.
14 . The processing system of claim 13 , wherein the first result comprises an indication of memory accesses performed by the critical thread and the second result comprises an indication of memory accesses performed by the check thread.
15 . The processing system of claim 13 , wherein the first and second results are output and compared in compressed form.
16 . A method of manufacturing, using an integrated circuit manufacturing system, a safety thread scheduling circuit as set forth in claim 1 , comprising inputting an integrated circuit dataset definition of said safety thread scheduler into an integrated circuit manufacturing system, so as to configure said integrated circuit manufacturing system to manufacture said safety thread scheduling circuit.
17 . An integrated circuit manufacturing system configured to manufacture a safety thread scheduling circuit as set forth in claim 1 .
18 . A non-transitory computer readable storage medium having stored thereon a computer readable integrated circuit dataset description that, when processed in an integrated circuit manufacturing system, causes the integrated circuit manufacturing system to manufacture an integrated circuit embodying a processor comprising safety thread scheduling circuitry configured to schedule a check thread for a critical thread being run on one of a plurality of execution units, the check thread being a duplicate of the critical thread;
the safety thread scheduling circuitry being configured to schedule the check thread to begin being run on a second one of the plurality of execution units before the end of a safety time-window for scheduling the check thread; and
the safety thread scheduling circuitry being further configured to allow the check thread, when the check thread is running on the second one of the plurality of execution units, to be interrupted by a further thread and to re-schedule the check thread to be resumed by expiry of a re-scheduling time limit;
wherein the safety thread scheduling circuit is operable to perform the re-scheduling of the check thread by interrupting another thread, other than the critical thread, running on one of the execution units other than the first execution unit, thereby resuming execution of the check thread on the execution unit upon which the other thread was running.
19 . A method comprising:
scheduling a check thread for a critical thread being run on one of a plurality of execution units, the check thread being a duplicate of the critical thread, wherein the scheduling of the check thread comprises scheduling the check thread to begin being run on a second one of the plurality of execution units before the end of a safety time-window for scheduling the check thread; and
when the check thread is running on the second one of the plurality of execution units, interrupting the check thread by a further thread and re-scheduling the check thread to be resumed by expiry of a re-scheduling time limit;
wherein the re-scheduling of the check thread comprises interrupting another thread, other than the critical thread, running on one of the execution units other than the first execution unit, thereby resuming execution of the check thread on the execution unit upon which the other thread was running.