Granted Patent B2

US 8,234,521 · App. 12/242,043 · Granted Jul 31, 2012

Abstract

Claims (22)

1. A fault-tolerant computer system comprising:

a first subsystem comprising a first processor, a first cache, a first memory;

a second subsystem comprising a second processor, a second cache, a second memory;

a detector adapted to detect errors in the first and second subsystems before error propagation in the first subsystem or the second subsystem can cause contents of the first and the second memory to differ; and

a fault tolerant logic component in communication with the first and second subsystems, the fault tolerant logic component adapted to distinguish a transient error from a non-recoverable error and select between a first re-sync procedure and a second re-sync procedure such that the first re-sync procedure is selected if the error is transient and the second re-sync procedure is selected if the error is a non-recoverable error and contents of the first and second memories are different and wherein the first re-sync procedure is selected if a non-recoverable error is not declared within a delay period that is less than about 90 milliseconds.

2. The system of claim 1 wherein the detector is configured to determine when an early out of lock event occurs.

3. The fault-tolerant computer system of claim 1 wherein the second re-sync procedure comprises a full memory copy.

4. The fault-tolerant computer system of claim 1 wherein the first re-sync procedure comprises a partial memory copy which transfers at least one order of magnitude less data than a full memory copy.

5. The fault-tolerant computer system of claim 1 wherein the fault tolerant logic component is selected from the group consisting of a VLSI circuit, an ASIC, a motherboard chipset, software, firmware, and combinations thereof.

6. The system of claim 1 wherein the fault tolerant logic component is adapted to flush the first cache and the second cache prior to re-syncing the first and second subsystems.

7. The system of claim 2 further comprising a system management interrupt handler configured to copy one or more memory locations that may contain differences following detection of an early out of lock event.

8. A method of returning a fault tolerant system to lock step operation, the fault tolerant system having first and second subsystems, including respective memories and respective caches, the method comprising the steps of:

detecting an out of lock event before error propagation in the first and second subsystems causes contents of the memories of the first and second subsystems to differ;

ceasing process execution on the first and second subsystems; and

selecting between a microsync procedure and a full resync procedure in response to whether the error that caused the out of lock event is a transient error or a non-recoverable error, wherein the microsync procedure is selected if a non-recoverable error is not declared within a delay period that is less than about 90 milliseconds;

selecting the second subsystem as having priority; and

replicating the internal processing state data associated with the second subsystem to the first subsystem.

9. The method of claim 8 further comprising the step of flushing the caches of the first and second subsystems and restarting the first subsystem and the second subsystem in lockstep.

10. The method of claim 8 further comprising the step of replicating I/O writes generated after the detection of the out of lock event to the first subsystem.

11. The method of claim 8 further comprising the step of replicating data associated with at least one of: code executing in one of the subsystems when processing ceases, a portion of System Management Mode data and a portion of the application data space.

12. The method of claim 8 further comprising the step of restoring lock step operation within a re-sync period, if no non-recoverable error is declared.

13. The method of claim 12 wherein the re-sync period ranges from about 10 milliseconds to about 200 milliseconds.

Assignments (7)