Patent Description:
In an integrated circuit (IC), a processor executes multiple threads (e.g., sequences of instructions) concurrently by way of context switching. The concurrent execution of multiple threads is referred to as multithreading and is implemented to facilitate sharing of resources (such as the processor) among the threads. The threads and data sets associated therewith are typically stored in a program memory of the IC and a data memory of the IC, respectively. In some cases, the program and data memories experience various errors (referred to as memory errors) that corrupt instructions and data stored therein, respectively. Such erroneous instructions and data lead to an operational failure of the processor (e.g., the processor may experience a hang condition).

<CIT> discloses a multithreading microprocessor that has a plurality of thread contexts (TCs) each including sufficient state, such as general purpose registers and program counters, to execute a separate thread of execution as one of a plurality of symmetric processors controlled by a multiprocessor operating system. However, the microprocessor hardware does not support the ability for one TC to direct an exception to another TC, i.e., to specify to which of the other TCs the exception is directed. A first thread running on a first TC of the operating system executes architected instructions to halt a second thread (either user or kernel thread) running on a second TC, save state of the second TC, write the second TC state to emulate an exception-including writing a restart register with the address of an exception handler, and unhalt the second TC to execute the exception hander. <CIT> discloses a data processing system that has a processor coupled to a bus, where the data processing system includes access error detection circuitry and access error response circuitry, each coupled to the bus. The access error detection circuitry detects an access error in the data processing system. The access error response circuitry initiates replacement of an existing value on the bus with a predetermined value when the access error has been detected, and continues to replace the existing value on the bus with the predetermined value when the access error has been detected and a persistent mode indicator has been asserted. The predetermined value may correspond to a predetermined instruction value or a predetermined data value. In one embodiment, different values for the predetermined value may be used depending on the current operating mode of the data processing system.

<CIT> discloses a memory interface module that is configured to read one of the instructions stored in a memory in accordance with a memory address designated by a fetch request issued from a processor. An error detection module is configured to detect an error in the read instruction. An instruction transmission module is configured to send to the processor, upon detection of an error in the read instruction, a first instruction to hold on a stack the same memory address as the one designated by the fetch request and a second instruction to jump to an error correction routine for correcting an error of the read instruction.

According to the invention there is provided an integrated circuit (IC) and a memory management method as defined by the appended claims.

The following detailed description of the embodiments of the present disclosure will be better understood when read in conjunction with the appended drawings. The present disclosure is illustrated by way of example, and not limited by the accompanying figures, in which like references indicate similar elements.

<FIG> illustrates a schematic block diagram of an integrated circuit (IC) <NUM> in accordance with an embodiment of the present disclosure. The IC <NUM> may include a processor <NUM>, an error control circuit <NUM>, a first memory <NUM>, and a second memory <NUM>.

The first memory <NUM> corresponds to a program memory and may be configured to store a plurality of threads of which a first thread TH1 and a second thread TH2 are shown. The first and second threads TH1 and TH2 may include first and second sets of instructions (not shown), respectively. Each thread stored in the first memory <NUM> may be associated with the processor <NUM> (e.g., the processor <NUM> may execute multithreading based on the plurality of threads). The second memory <NUM> may correspond to a data memory and may be configured to store a plurality of data sets of which a first data set DS1 and a second data set DS2 are shown. The plurality of data sets may be associated with the plurality of threads and may include data to be utilized during the execution of the plurality of threads. For example, the first and second data sets DS1 and DS2 are associated with the first and second threads TH1 and TH2 and may include various data to be utilized during the execution of the first and second threads TH1 and TH2, respectively. Further, the first and second threads TH1 and TH2 may be available for execution when all data samples of the first and second data sets DS1 and DS2 are stored in the second memory <NUM>, respectively.

The IC <NUM> may further include, a first register <NUM>, a second register <NUM>, an inverter <NUM> and a logic gate <NUM>. The IC <NUM> includes a system controller <NUM> and a thread scheduler <NUM>. The IC <NUM> may be included in various devices such as automotive devices, battery management devices, mobile devices, networking devices, or the like.

The following table illustrates various signals and data described in <FIG>:.

The processor <NUM> may be coupled to the error control circuit <NUM> and the thread scheduler <NUM>. The processor <NUM> may include suitable circuitry that may be configured to perform one or more operations. For example, the processor <NUM> may be configured to initiate an execution of a scheduled thread (e.g., the first thread TH1). The first thread TH1 may be scheduled for execution at the processor <NUM> by the thread scheduler <NUM>. To initiate the execution of the first thread TH1, the processor <NUM> may be further configured to generate an instruction request IRQ to retrieve one or more instructions of the first thread TH1 (e.g., the first set of instructions). The instruction request IRQ may include one or more addresses of the first memory <NUM> where the one or more instructions are stored, respectively.

The processor <NUM> may be further configured to provide the instruction request IRQ to the error control circuit <NUM>. Based on the instruction request IRQ, various instructions (e.g., a first instruction INS1) of the first thread TH1 are retrieved from the first memory <NUM> by the error control circuit <NUM>. The instructions may be retrieved sequentially. Further, for each retrieved instruction, it is determined whether the instruction is erroneous or error-free. The instruction may be erroneous as a result of a memory error in the first memory <NUM>. The memory error may correspond to an address fault in an address decoder of the first memory <NUM> or one or more bit-flips in the stored instruction. The memory error in the first memory <NUM> may be a transient error or a permanent error.

In response to the instruction request IRQ, the processor <NUM> may be configured to receive, from the error control circuit <NUM>, the first instruction INS1 or a substitute instruction SUB. The substitute instruction SUB is included in an instruction set of the processor <NUM>. The instruction set of the processor <NUM> includes instructions that are executable by the processor <NUM>. In other words, the substitute instruction SUB is any instruction that does not affect an operation of the processor <NUM> and does not alter an execution of the associated thread (e.g., the first thread TH1). Examples of the substitute instruction SUB may include a SLEEP instruction, a no-operation instruction, a branch instruction, or the like.

The substitute instruction SUB is received when it is determined that the first instruction INS1 is erroneous. Further, the first instruction INS1 is received when it is determined that the first instruction INS1 is error-free. For the sake of ongoing discussion, it is assumed that the first instruction INS1 is erroneous. In such a scenario, the processor <NUM> may be further configured to execute the received substitute instruction SUB. The execution of the substitute instruction SUB does not require a data fetch from the second memory <NUM>.

If the erroneous first instruction INS1 is executed by the processor <NUM>, the processor <NUM> may experience a hang condition or operate in an unpredictable manner. In other words, the execution of the erroneous first instruction INS1 may lead to an operational failure of the processor <NUM>. The memory error in the first memory <NUM> may thus be referred to as a fatal error. Hence, in the present disclosure, the replacement of the erroneous first instruction INS1 with the substitute instruction SUB prevents the processor <NUM> from experiencing a hang condition or operating in an unpredictable manner (e.g., prevents the operational failure of the processor <NUM>).

When the first instruction INS1 is erroneous, an execution of the first thread TH1 may be suspended or may remain unaltered. The execution of the first thread TH1 may be suspended if the execution of the substitute instruction SUB instead of the desired instruction hampers the operations of the processor <NUM> and the IC <NUM>. Conversely, the execution of the first thread TH1 may remain unaltered if the execution of the substitute instruction SUB instead of the desired instruction does not hamper the operations of the processor <NUM> and the IC <NUM>. For the sake of ongoing discussion, it is assumed that the execution of the first thread TH1 is suspended.

When the execution of the first thread TH1 is to be suspended, the processor <NUM> may be further configured to receive a suspend request SRQ from the thread scheduler <NUM>. The suspend request SRQ may be generated based on the erroneous first instruction INS1. In response to the suspend request SRQ, the processor <NUM> may be further configured to suspend the execution of the first thread TH1. In other words, the processor <NUM> may suspend the execution of the first thread TH1 based on the erroneous first instruction INS1.

The processor <NUM> may be further configured to generate an acknowledgment ACK based on the successful suspension of the execution of the first thread TH1 and provide the acknowledgment ACK to the thread scheduler <NUM>. In response to the acknowledgment ACK, the processor <NUM> may be further configured to receive a thread switching signal TSW from the thread scheduler <NUM>. Based on the thread switching signal TSW, the processor <NUM> may be further configured to initiate an execution of the second thread TH2. In an embodiment, the processor <NUM> may initiate the execution of the second thread TH2 based on an assertion of the thread switching signal TSW. The operation of the processor <NUM> thus may not be halted due to a memory error in the first memory <NUM>. To initiate the execution of the second thread TH2, a context switching operation (e.g., replacement of a context associated with the first thread TH1 with a context associated with the second thread TH2) may be performed. The context switching operation may be performed by the processor <NUM> or the thread scheduler <NUM>. The processor <NUM> may initiate the execution of the second thread TH2 by generating and providing another instruction request to the error control circuit <NUM>.

After the execution of the first thread TH1 is suspended, the first thread TH1 is disabled. The disabling of the first thread TH1 corresponds to exclusion of the first thread TH1 from the multithreading associated with the processor <NUM>. In other words, the first thread TH1 is unavailable (e.g., is not scheduled) for execution. The first thread TH1 is then re-enabled after the erroneous first instruction INS1 is corrected. The re-enabling of the first thread TH1 corresponds to the inclusion of the first thread TH1 in the multithreading associated with the processor <NUM>. In other words, the first thread TH1 is available (e.g., may be scheduled) for execution.

The error control circuit <NUM> may be coupled to the processor <NUM> and the first and second memories <NUM> and <NUM>. The error control circuit <NUM> may include suitable circuitry that may be configured to perform one or more operations. For example, the error control circuit <NUM> may be configured to receive the instruction request IRQ from the processor <NUM>. Based on the instruction request IRQ, the error control circuit <NUM> may be configured to retrieve various instructions from the first memory <NUM> in a sequential manner. For example, the error control circuit <NUM> may be configured to initially retrieve the first instruction INS1 from the first memory <NUM>. Further, the error control circuit <NUM> may be configured to determine whether the first instruction INS1 is erroneous or error-free. The error control circuit <NUM> may determine whether the first instruction INS1 is erroneous or error-free by implementing various error detection techniques (e.g., a parity check technique).

Based on the determination that the first instruction INS1 is erroneous, the error control circuit <NUM> may be further configured to provide the substitute instruction SUB to the processor <NUM>. Alternatively, the error control circuit <NUM> may be further configured to provide the first instruction INS1 to processor <NUM> based on the determination that the first instruction INS1 is error-free. Further, the error control circuit <NUM> may be configured to generate an error bit EB. In an embodiment, the error bit EB is asserted based on the determination that the first instruction INS1 is erroneous. Conversely, the error bit EB is de-asserted based on the determination that the first instruction INS1 is error-free. As it is assumed that the first instruction INS1 is erroneous, the error control circuit <NUM> may provide the substitute instruction SUB to the processor <NUM> and generate the error bit EB in an asserted state. Based on the error bit EB, the execution of the first thread TH1 may be suspended or may remain unaltered.

When the execution of the first thread TH1 is suspended, the execution of the second thread TH2 is initiated. In response to the initiation of the execution of the second thread TH2, the error control circuit <NUM> may be configured to receive another instruction request from the processor <NUM> to retrieve various instructions of the second thread TH2 from the first memory <NUM>. For each instruction of the second thread TH2, the error control circuit <NUM> may operate in a similar manner as for the first instruction INS1. Further, after the execution of the first thread TH1 is suspended, the first thread TH1 is disabled, the erroneous first instruction INS1 is corrected, and the first thread TH1 is re-enabled.

The system controller <NUM> is coupled to the error control circuit <NUM> and the thread scheduler <NUM>. The system controller <NUM> may be a standalone circuit or may be embedded in a core circuit (not shown) of the IC <NUM>. Further, the system controller <NUM> may be configured to perform one or more operations. For example, the system controller <NUM> may be configured to receive the error bit EB from the error control circuit <NUM>. As it is assumed that the first instruction INS1 is erroneous, the error bit EB is asserted.

Based on the asserted error bit EB, the system controller <NUM> may be further configured to determine whether the execution of the first thread TH1 is to be suspended or is to remain unaltered. The system controller <NUM> may determine that the execution of the first thread TH1 is to be suspended if the execution of the substitute instruction SUB instead of the desired instruction hampers the operations of the processor <NUM> and the IC <NUM>. Conversely, the system controller <NUM> may determine that the execution of the first thread TH1 is to remain unaltered if the execution of the substitute instruction SUB instead of the desired instruction does not hamper the operations of the processor <NUM> and the IC <NUM>. Further, the system controller <NUM> may be configured to generate a first trigger bit TG1 indicating whether the execution of the first thread TH1 is to be suspended or is to remain unaltered and provide the first trigger bit TG1 to the thread scheduler <NUM>. In an embodiment, the first trigger bit TG1 is asserted when the execution of the first thread TH1 is to be suspended. Conversely, the first trigger bit TG1 is de-asserted when the execution of the first thread TH1 is to remain unaltered.

As the system controller <NUM> determines that the execution of the first thread TH1 is to be suspended, the first trigger bit TG1 is asserted. Thus, based on the asserted first trigger bit TG1, the execution of the first thread TH1 is suspended. Further, after the execution of the first thread TH1 is suspended, the first thread TH1 is disabled. After the first thread TH1 is disabled, the system controller <NUM> is further configured to correct the erroneous first instruction INS1 of the first thread TH1. To correct the erroneous first instruction INS1, the system controller <NUM> may be further configured to identify if the memory error in the first memory <NUM> corresponds to the address fault in the address decoder of the first memory <NUM> or the one or more bit-flips in the stored instruction. When the memory error corresponds to the address fault, the system controller <NUM> may correct the erroneous first instruction INS1 by moving the correct instruction to a different address in the first memory <NUM>. When the memory error corresponds to the one or more bit-flips in the stored instruction, the system controller <NUM> corrects the erroneous first instruction INS1 based on error correction code (ECC) data associated with the stored instruction.

The system controller <NUM> is further configured to generate a thread control bit TCT indicative of the successful correction of the erroneous first instruction INS1. In an embodiment, the thread control bit TCT is asserted to indicate that the erroneous first instruction INS1 is corrected. The system controller <NUM> is further configured to provide the thread control bit TCT to the thread scheduler <NUM>. Further, the first thread TH1 is re-enabled based on the thread control bit TCT.

The first register <NUM> may be configured to store a first suspension control bit SC1. The first suspension control bit SC1 may be stored in the first register <NUM> by the core circuit during a boot-up of the IC <NUM>. In an embodiment, the first suspension control bit SC1 is asserted to indicate that the execution of the first thread TH1 is to be suspended when the first thread TH1 is erroneous. Alternatively, the first suspension control bit SC1 is de-asserted to indicate that the execution of the first thread TH1 is to remain unaltered when the first thread TH1 is erroneous.

The second register <NUM> may be configured to store a second suspension control bit SC2. The second suspension control bit SC2 may be stored in the second register <NUM> during the boot-up of the IC <NUM> by the core circuit. In an embodiment, the second suspension control bit SC2 is asserted to indicate that the system controller <NUM> determines whether the execution of the first thread TH1 is to be suspended. Alternatively, the second suspension control bit SC2 is de-asserted to indicate that whether the execution of the first thread TH1 is to be suspended is determined based on the first suspension control bit SC1 stored in the first register <NUM>.

The inverter <NUM> may be coupled to the second register <NUM>. The inverter <NUM> may be configured to receive the second suspension control bit SC2 from the second register <NUM>. Further, the inverter <NUM> may be configured to generate a third suspension control bit SC3 as an inverted version of the second suspension control bit SC2. Thus, the third suspension control bit SC3 is asserted and de-asserted based on the de-assertion and the assertion of the second suspension control bit SC2, respectively.

The logic gate <NUM> may be coupled to the error control circuit <NUM>, the first register <NUM>, the inverter <NUM>, and the thread scheduler <NUM>. The logic gate <NUM> may be configured to receive the error bit EB from the error control circuit <NUM>. Further, the logic gate <NUM> may be configured to receive the first and third suspension control bits SC1 and SC3 from the first register <NUM> and the inverter <NUM>, respectively. Based on the error bit EB and the first and third suspension control bits SC1 and SC3, the logic gate <NUM> may be further configured to generate a second trigger bit TG2. In an embodiment, the logic gate <NUM> is an AND gate. Thus, the second trigger bit TG2 is asserted based on the assertion of each of the error bit EB, the first suspension control bit SC1, and the third suspension control bit SC3. Conversely, the second trigger bit TG2 is de-asserted based on the de-assertion of the error bit EB, the first suspension control bit SC1, or the third suspension control bit SC3. Further, the logic gate <NUM> may be configured to provide the second trigger bit TG2 to the thread scheduler <NUM>. The execution of the first thread TH1 may be suspended based on the second trigger bit TG2.

If the first suspension control bit SC1 is asserted and the second suspension control bit SC2 is de-asserted, the execution of the first thread TH1 is to be suspended when the first thread TH1 is erroneous (e.g., when the error bit EB is asserted). On the other hand, if the first and second suspension control bits SC1 and SC2 are de-asserted, the execution of the first thread TH1 is to remain unaltered when the first thread TH1 is erroneous. Further, if the second suspension control bit SC2 is asserted, the system controller <NUM> determines in real-time whether the execution of the first thread TH1 is to be suspended or is to remain unaltered when the first thread TH1 is erroneous.

The thread scheduler <NUM> may be coupled to the processor <NUM>, the system controller <NUM>, and the logic gate <NUM>. The thread scheduler <NUM> may be a standalone circuit or may be embedded in the core circuit of the IC <NUM>. Further, the thread scheduler <NUM> may be configured to perform one or more operations. For example, the thread scheduler <NUM> may be configured to schedule the first thread TH1 for execution at the processor <NUM>. During the execution of the first thread TH1, the thread scheduler <NUM> may be further configured to receive the first trigger bit TG1 from the system controller <NUM> and the second trigger bit TG2 from the logic gate <NUM>. The first and second trigger bits TG1 and TG2 indicate whether an execution of a thread having an erroneous instruction (e.g., the execution of the first thread TH1 having the erroneous first instruction INS1) is to be suspended or is to remain unaltered.

As the first instruction INS1 is erroneous and the execution of the first thread TH1 is to be suspended, the first trigger bit TG1 or the second trigger bit TG2 is asserted. The first trigger bit TG1 indicates that whether the execution of the first thread TH1 is to be suspended is determined by the system controller <NUM> in real-time. Conversely, the second trigger bit TG2 indicates that whether the execution of the first thread TH1 is to be suspended is determined based on the first suspension control bit SC1 stored in the first register <NUM> during the boot-up of the IC <NUM>. Thus, based on the assertion of the first trigger bit TG1 or the second trigger bit TG2, the thread scheduler <NUM> may be further configured to generate the suspend request SRQ. In other words, the thread scheduler <NUM> may generate the suspend request SRQ based on the erroneous first instruction INS1 (e.g., the error bit EB). Further, the thread scheduler <NUM> may be configured to provide the suspend request SRQ to the processor <NUM>. The processor <NUM> suspends the execution of the first thread TH1 in response to the suspend request SRQ (e.g., in response to the erroneous first instruction INS1).

As a response to the suspend request SRQ, the thread scheduler <NUM> may be further configured to receive the acknowledgment ACK from the processor <NUM>. The acknowledgment ACK may indicate the successful suspension of the execution of the first thread TH1. Further, the thread scheduler <NUM> may be configured to disable the first thread TH1 based on the suspension of the execution of the first thread TH1 (e.g., the acknowledgment ACK). The disabling of the first thread TH1 corresponds to the exclusion of the first thread TH1 from the multithreading associated with the processor <NUM>. The thread scheduler <NUM> may be further configured to generate, based on the suspension of the execution of the first thread TH1, the thread switching signal TSW to schedule a subsequent thread (e.g., the second thread TH2) for execution at the processor <NUM>. Further, the thread scheduler <NUM> may be configured to provide the thread switching signal TSW to the processor <NUM>. Based on the thread switching signal TSW, the execution of the second thread TH2 is initiated by the processor <NUM>.

The thread scheduler <NUM> is further configured to receive the thread control bit TCT from the system controller <NUM>. The thread control bit TCT indicates that the erroneous first instruction INS1 is corrected. Based on the thread control bit TCT, the thread scheduler <NUM> is further configured to re-enable the first thread TH1. The re-enabling of the first thread TH1 corresponds to the inclusion of the first thread TH1 in the multithreading associated with the processor <NUM>.

To re-enable the first thread TH1, the thread scheduler <NUM> is further configured to modify the context associated with the first thread TH1. The context associated with the first thread TH1 may be stored in the second memory <NUM> or an internal memory of the processor <NUM>. The modification of the context may correspond to the modification of a general-purpose register, a floating-point register, a program counter, and a status register associated with the first thread TH1. The modification of the context may result in the execution of the first thread TH1 resuming from an initial instruction of the first thread TH1, from the instruction where the memory error occurred, or any other portion of the first thread TH1. The re-enabling of the first thread TH1 does not affect the operations of the processor <NUM> and the execution of other threads of the plurality of threads. In other words, the re-enabling of the first thread TH1 does not require a reset of the processor <NUM> or the IC <NUM>.

In operation, the processor <NUM> may generate the instruction request IRQ to retrieve the one or more instructions of the first thread TH1. The error control circuit <NUM> may receive the instruction request IRQ from the processor <NUM> and retrieve the first instruction INS1 from the first memory <NUM> based on the instruction request IRQ. Further, the error control circuit <NUM> may determine whether the first instruction INS1 is erroneous or error-free. As it is assumed that the first instruction INS1 is erroneous, the error control circuit <NUM> may provide the substitute instruction SUB to the processor <NUM>, and the processor <NUM> may execute the substitute instruction SUB. The execution of the substitute instruction SUB does not require a data fetch from the second memory <NUM>. Thus, the replacement of the erroneous first instruction INS1 with the substitute instruction SUB prevents the operational failure of the processor <NUM>.

The error control circuit <NUM> may further generate the error bit EB in an asserted state. The system controller <NUM> may receive the error bit EB that is indicative of the erroneous first instruction INS1. Based on the erroneous first instruction INS1, the system controller <NUM> may determine whether the execution of the first thread TH1 is to be suspended or is to remain unaltered and generate the first trigger bit TG1. Further, the logic gate <NUM> may generate the second trigger bit TG2 based on the first and third suspension control bits SC1 and SC3 and the error bit EB. The first trigger bit TG1 or the second trigger bit TG2 controls whether the execution of the first thread TH1 is to be suspended or is to remain unaltered.

As the execution of the first thread TH1 is to be suspended, the first trigger bit TG1 or the second trigger bit TG2 is asserted. In such a scenario, the thread scheduler <NUM> may generate the suspend request SRQ and provide the suspend request SRQ to the processor <NUM>. In response to the suspend request SRQ, the processor <NUM> may suspend the execution of the first thread TH1. Further, the processor <NUM> may generate the acknowledgment ACK indicative of the successful suspension of the execution of the first thread TH1 and provide the acknowledgment ACK to the thread scheduler <NUM>.

In response to the acknowledgment ACK, the thread scheduler <NUM> may generate and provide the thread switching signal TSW to the processor <NUM>. Based on the thread switching signal TSW, the processor <NUM> may initiate the execution of the second thread TH2. During the execution of the second thread TH2, the processor <NUM> may generate another instruction request to retrieve various instructions of the second thread TH2 and provide the generated instruction request to the error control circuit <NUM>. The error control circuit <NUM> may process the instruction request associated with the second thread TH2 in a similar manner as the instruction request IRQ associated with the first thread TH1.

In response to the acknowledgment ACK, the thread scheduler <NUM> may disable the first thread TH1. After the first thread TH1 is disabled, the system controller <NUM> may correct the erroneous first instruction INS1. Further, the system controller <NUM> generates the thread control bit TCT indicative of the successful correction of the erroneous first instruction INS1 and provides the thread control bit TCT to the thread scheduler <NUM>. The thread scheduler <NUM> re-enables the first thread TH1 based on the thread control bit TCT. To re-enable the first thread TH1, the thread scheduler <NUM> modifies the context associated with the first thread TH1.

The re-enabled first thread TH1 may then be scheduled for execution at the processor <NUM> after the execution of the second thread TH2 is complete. To schedule the first thread TH1 for execution, the thread scheduler <NUM> may generate and provide another thread switching signal (such as the thread switching signal TSW) to the processor <NUM>. The processor <NUM> may initiate the execution of the first thread TH1. For example, the processor <NUM> may regenerate the instruction request IRQ and provide the instruction request IRQ to the error control circuit <NUM>. The error control circuit <NUM> may again retrieve the first instruction INS1 from the first memory <NUM> and determine whether the first instruction INS1 is erroneous or error-free. As the first instruction INS1 is corrected, the error bit EB is de-asserted and the error control circuit <NUM> may be further configured to provide the first instruction INS1 to the processor <NUM> for execution. In such a scenario, the execution of the first thread TH1 remains unaltered.

During the execution of the first instruction INS1, the processor <NUM> may be further configured to generate a data request DRQ to retrieve associated data of the first data set DS1 from the second memory <NUM>. The data request DRQ may include one or more addresses associated with the data required for executing the first instruction INS1. Further, the error control circuit <NUM> may be configured to receive the data request DRQ from the processor <NUM> during the execution of the first instruction INS1 and retrieve first data D1 of the first data set DS1 from the second memory <NUM> based on the data request DRQ.

The error control circuit <NUM> may be further configured to determine whether the first data D1 is erroneous or error-free. The first data D1 may be erroneous as a result of a memory error in the second memory <NUM>. The memory error may correspond to an address fault in an address decoder of the second memory <NUM> or one or more bit-flips in the stored data. For the sake of ongoing discussion, it is assumed that the first data D1 is erroneous. In such a scenario, the error control circuit <NUM> may generate another error bit (such as the error bit EB) in an asserted state and provide the first data D1 to the processor <NUM>.

Based on the erroneous first data D1, the processor <NUM> may be further configured to suspend the execution of the first thread TH1 in a similar manner as described above. For example, the system controller <NUM> may determine whether the execution of the first thread TH1 is to be suspended or is to remain unaltered and generate and provide a third trigger bit (not shown) to the thread scheduler <NUM>. The IC <NUM> may further include another logic gate (not shown) that operates in a similar manner as the logic gate <NUM>, and may be configured to generate a fourth trigger bit (not shown). Based on an assertion of the third trigger bit or an assertion of the fourth trigger bit, the thread scheduler <NUM> may generate and provide another suspend request (such as the suspend request SRQ) to the processor <NUM>. The processor <NUM> may thus suspend the execution of the first thread TH1.

After the execution of the first thread TH1 is suspended, the processor <NUM> may initiate the execution of a subsequent thread (e.g., the second thread TH2) and the thread scheduler <NUM> may disable the first thread TH1 in a similar manner as described above. For example, after the execution of the first thread TH1 is suspended, the processor <NUM> may generate and provide another acknowledgment (such as the acknowledgment ACK) to the thread scheduler <NUM>. In response, the thread scheduler <NUM> may generate and provide the thread switching signal TSW to the processor <NUM> for initiating the execution of the second thread TH2. Additionally, the thread scheduler <NUM> may disable the first thread TH1.

After the first thread TH1 is disabled, the erroneous first data D1 may be corrected and the first thread TH1 may be re-enabled in a similar manner as described above. For example, after the first thread TH1 is disabled, the system controller <NUM> corrects the erroneous first data D1. Further, the system controller <NUM> may generate and provide another thread control bit (such as the thread control bit TCT) to the thread scheduler <NUM>. In response, the thread scheduler <NUM> may re-enable the first thread TH1.

When the re-enabled first thread TH1 is again scheduled for execution at the processor <NUM>, the processor <NUM> may regenerate the instruction request IRQ and provide the instruction request IRQ to the error control circuit <NUM>. In such a scenario, as the first instruction INS1 and the first data D1 are corrected, the execution of the first instruction INS1 may be successful. Further, after the first instruction INS1 is executed successfully, the error control circuit <NUM> may retrieve a subsequent instruction of the first thread TH1 from the first memory <NUM> and determine whether the retrieved instruction is erroneous or error-free. Thus, each remaining instruction of the first thread TH1 may be executed in a manner similar to the first instruction INS1.

Memory errors in other threads (e.g., the second thread TH2) and data sets associated with the threads (e.g., the second data set DS2) may be managed in a similar manner as described above.

In a first variation, the first instruction INS1 may be error-free instead of being erroneous. In such a scenario, the error control circuit <NUM> may be configured to provide the first instruction INS1 to the processor <NUM> instead of the substitute instruction SUB. Further, the processor <NUM> may be configured to execute the first instruction INS1 in a similar manner as described above. Additionally, the processor <NUM> may be configured to receive other instructions of the first thread TH1 if the instructions are error-free and execute the received instructions.

In a second variation, the first data D1 may be error-free instead of being erroneous. In such a scenario, the error control circuit <NUM> may provide the first data D1 to the processor <NUM> and retrieve a subsequent instruction from the first memory <NUM>.

In a third variation, it may be determined that the execution of the first thread TH1 is to remain unaltered when the first instruction INS1 or the first data D1 is erroneous. In both scenarios, the error control circuit <NUM> retrieves a subsequent instruction of the first thread TH1 from the first memory <NUM>.

In a fourth variation, for each erroneous instruction other than the first instruction INS1, the error control circuit <NUM> may provide a different substitute instruction.

In a fifth variation, the IC <NUM> may include additional registers for storing the first trigger bit TG1 and the thread control bit TCT. In such a scenario, the thread scheduler <NUM> may receive the first trigger bit TG1 and the thread control bit TCT from the registers.

<FIG> illustrates a schematic circuit diagram of the error control circuit <NUM> in accordance with an embodiment of the present disclosure. The error control circuit <NUM> may include a memory controller <NUM>, a third register <NUM>, and a multiplexer <NUM>.

The memory controller <NUM> may be coupled to the processor <NUM>, the first memory <NUM>, the second memory <NUM>, the system controller <NUM>, the logic gate <NUM>, and the multiplexer <NUM>. The memory controller <NUM> may include suitable circuitry that may be configured to perform one or more operations. For example, the memory controller <NUM> may be configured to receive the instruction request IRQ from the processor <NUM>. Based on the instruction request IRQ, the memory controller <NUM> may be configured to retrieve various instructions from the first memory <NUM> in a sequential manner. For example, the memory controller <NUM> may be configured to initially retrieve the first instruction INS1 from the first memory <NUM>. Further, the memory controller <NUM> may be configured to determine whether the first instruction INS1 is erroneous or error-free.

The memory controller <NUM> may be further configured to generate the error bit EB. Based on the determination that the first instruction INS1 is erroneous, the error bit EB is asserted. Conversely, the error bit EB is de-asserted based on the determination that the first instruction INS1 is error-free. As it is assumed that the first instruction INS1 is erroneous, the error bit EB is asserted. Based on the assertion of the error bit EB, the substitute instruction SUB is provided to the processor <NUM> as the response to the instruction request IRQ. Further, the memory controller <NUM> may be configured to provide the asserted error bit EB to the system controller <NUM> and the logic gate <NUM>. Based on the error bit EB, the execution of the first thread TH1 may be suspended or may remain unaltered.

When the execution of the first thread TH1 is suspended, the execution of the second thread TH2 is initiated and the memory controller <NUM> may be further configured to receive another instruction request from the processor <NUM> to retrieve various instructions of the second thread TH2 from the first memory <NUM>. For each instruction of the second thread TH2, the memory controller <NUM> may operate in a similar manner as for the first instruction INS1. Further, after the execution of the first thread TH1 is suspended, the first thread TH1 is disabled, the erroneous first instruction INS1 is corrected, and the first thread TH1 is re-enabled.

The re-enabled first thread TH1 may then be scheduled for execution at the processor <NUM> after the execution of the second thread TH2 is complete. In such a scenario, the processor <NUM> may regenerate the instruction request IRQ and provide the instruction request IRQ to the memory controller <NUM>. The memory controller <NUM> may again retrieve the first instruction INS1 from the first memory <NUM> and determine whether the first instruction INS1 is erroneous or error-free. As the first instruction INS1 is corrected, the memory controller <NUM> may generate the error bit EB in a de-asserted state and the first instruction INS1 is provided to the processor <NUM> for execution. In such a scenario, the execution of the first thread TH1 remains unaltered.

During the execution of the first instruction INS1, the memory controller <NUM> may be further configured to receive the data request DRQ from the processor <NUM>. Based on the data request DRQ, the memory controller <NUM> may be further configured to retrieve the first data D1 of the first data set DS1 from the second memory <NUM>. The memory controller <NUM> may be further configured to determine whether the first data D1 is erroneous or error-free. As it is assumed that the first data D1 is erroneous, the memory controller <NUM> may be further configured to generate another error bit (such as the error bit EB) in an asserted state and provide the first data D1 to the processor <NUM>. Based on the erroneous first data D1, the execution of the first thread TH1 may be suspended or may remain unaltered.

When the execution of the first thread TH1 is suspended, the execution of a subsequent thread of the plurality of threads is initiated and the first thread TH1 is disabled. After the first thread TH1 is disabled, the erroneous first data D1 is corrected and the first thread TH1 is re-enabled. When the re-enabled first thread TH1 is again scheduled for execution at the processor <NUM>, the processor <NUM> may regenerate the instruction request IRQ and provide the instruction request IRQ to the memory controller <NUM>. In such a scenario, as the first instruction INS1 and the first data D1 are corrected, the execution of the first instruction INS1 may be successful. Further, after the first instruction INS1 is executed successfully, the memory controller <NUM> may retrieve a subsequent instruction of the first thread TH1 from the first memory <NUM> and determine whether the retrieved instruction is erroneous or error-free. Thus, each remaining instruction of the first thread TH1 may be executed in a manner similar to the first instruction INS1.

The third register <NUM> may be coupled to the multiplexer <NUM>. The third register <NUM> may be configured to store the substitute instruction SUB. The substitute instruction SUB may be stored in the third register <NUM> during the boot-up of the IC <NUM> by the core circuit.

The multiplexer <NUM> may be coupled to the memory controller <NUM>, the third register <NUM>, and the processor <NUM>. The multiplexer <NUM> may be configured to receive the first instruction INS1 and the error bit EB from the memory controller <NUM>. Further, the multiplexer <NUM> may be configured to receive the substitute instruction SUB from the third register <NUM>. Based on the error bit EB, the multiplexer <NUM> may be further configured to provide the first instruction INS1 or the substitute instruction SUB to the processor <NUM>. Based on the assertion of the error bit EB, the multiplexer <NUM> may provide the substitute instruction SUB to the processor <NUM>. Alternatively, based on the de-assertion of the error bit EB, the multiplexer <NUM> may provide the first instruction INS1 to the processor <NUM>.

For each other instruction, the multiplexer <NUM> may receive the instruction and the associated error bit from the memory controller <NUM> and the substitute instruction SUB from the third register <NUM>. Further, based on the received error bit, the multiplexer <NUM> may provide the retrieved instruction or the substitute instruction SUB to the processor <NUM>.

Although <FIG> illustrates that the error control circuit <NUM> includes a single register storing one substitute instruction, the scope of the present disclosure is not limited to it. In various other embodiments, the error control circuit <NUM> may include various registers storing various substitute instructions, and various multiplexers for providing different substitute instructions to the processor <NUM> in place of the erroneous thread instructions.

<FIG>, collectively, represents a flowchart <NUM> that illustrates a memory error management method in accordance with an embodiment of the present disclosure. The memory error management method may be implemented by the IC <NUM> to manage memory errors occurring in the first and second memories <NUM> and <NUM>. Referring now to <FIG>, at step <NUM>, the first memory <NUM> may store the first and second threads TH1 and TH2, and the second memory <NUM> may store the first and second data sets DS1 and DS2 associated with the first and second threads TH1 and TH2, respectively.

At step <NUM>, the processor <NUM> may generate, when the first thread TH1 is scheduled for execution, the instruction request IRQ to retrieve the one or more instructions of the first thread TH1 (e.g., the first set of instructions). At step <NUM>, the error control circuit <NUM> may receive the instruction request IRQ from the processor <NUM>. At step <NUM>, the error control circuit <NUM> may retrieve one instruction (e.g., the first instruction INS1) from the first memory <NUM> based on the instruction request IRQ. At step <NUM>, the error control circuit <NUM> may determine whether the retrieved instruction (e.g., the first instruction INS1) is erroneous or error-free. If at step <NUM>, the error control circuit <NUM> determines that the retrieved instruction is error-free, step <NUM> is performed.

Referring now to <FIG>, at step <NUM>, the error control circuit <NUM> may provide the retrieved instruction (e.g., the first instruction INS1) to the processor <NUM>. At step <NUM>, the processor <NUM> may execute the received instruction (e.g., the first instruction INS1). The execution of the first instruction INS1 may be successful or unsuccessful. At step <NUM>, based on the successful execution of the first instruction INS1, the error control circuit <NUM> may retrieve a subsequent instruction of the first thread TH1 from the first memory <NUM>. Step <NUM> is performed after step <NUM>.

If at step <NUM>, the error control circuit <NUM> determines that the first instruction INS1 is erroneous, step <NUM> is performed. At step <NUM>, the error control circuit <NUM> may generate the error bit EB in an asserted state. At step <NUM>, the error control circuit <NUM> may provide the substitute instruction SUB to the processor <NUM>. At step <NUM>, the processor <NUM> may execute the substitute instruction SUB. Thus, the operational failure of the processor <NUM> is prevented by the replacement of the erroneous first instruction INS1 with the substitute instruction SUB. At step <NUM>, the system controller <NUM> and the logic gate <NUM> may receive, from the error control circuit <NUM>, the error bit EB that is indicative of the erroneous first instruction INS1.

Referring now to <FIG>, at step <NUM>, the system controller <NUM> or the first suspension control bit SC1 may determine whether the execution of the first thread TH1 is to be suspended. If at step <NUM>, it is determined that the execution of the first thread TH1 is to remain unaltered, step <NUM> is performed. If at step <NUM>, it is determined that the execution of the first thread TH1 is to be suspended, step <NUM> is performed.

At step <NUM>, the thread scheduler <NUM> may generate the suspend request SRQ to suspend the execution of the first thread TH1. The suspend request SRQ may be generated based on the assertion of the first trigger bit TG1 generated by the system controller <NUM>. Alternatively, the suspend request SRQ may be generated based on the assertion of the second trigger bit TG2 generated by the logic gate <NUM> (e.g., the assertion of the first suspension control bit SC1 stored in the first register <NUM> and the de-assertion of the second suspension control bit SC2 stored in the second register <NUM>). At step <NUM>, the thread scheduler <NUM> may provide the suspend request SRQ to the processor <NUM>. At step <NUM>, the processor <NUM> may suspend the execution of the first thread TH1. At step <NUM>, the processor <NUM> may generate the acknowledgment ACK indicative of the successful suspension of the execution of the first thread TH1. At step <NUM>, the processor <NUM> may provide the acknowledgment ACK to the thread scheduler <NUM>.

At step <NUM>, the thread scheduler <NUM> may generate the thread switching signal TSW based on the acknowledgment ACK. At step <NUM>, the thread scheduler <NUM> may provide the thread switching signal TSW to the processor <NUM>. At step <NUM>, the processor <NUM> may initiate the execution of the second thread TH2 based on the thread switching signal TSW.

Referring now to <FIG>, at step <NUM>, the thread scheduler <NUM> may disable the first thread TH1 based on the acknowledgment ACK. At step <NUM>, the system controller <NUM> may correct the erroneous instruction (e.g., the erroneous first instruction INS1). At step <NUM>, the system controller <NUM> generates the thread control bit TCT indicative of the successful correction of the erroneous first instruction INS1. At step <NUM>, the thread scheduler <NUM> receives the thread control bit TCT from the system controller <NUM>. At step <NUM>, the thread scheduler <NUM> re-enables the first thread TH1 based on the thread control bit TCT. To re-enable the first thread TH1, the thread scheduler <NUM> modifies the context associated with the first thread TH1.

The flowchart <NUM> describes the management of erroneous instruction (e.g., the first instruction INS1). The re-enabled first thread TH1 may then be scheduled for execution at the processor <NUM> after the execution of the second thread TH2 is complete. In such a scenario, as the first instruction INS1 is corrected, the first instruction INS1 is provided to the processor <NUM> for execution and the execution of the first thread TH1 remains unaltered. The execution of the first instruction INS1 may be successful or unsuccessful. During the execution of the first instruction INS1, the associated data of the first data set DS1 may be retrieved from the second memory <NUM> and it may be determined whether the retrieved data is erroneous or error-free. If the retrieved data (e.g., the first data D1) is error-free, the first data D1 is provided to the processor <NUM> and the execution of the first thread TH1 remains unaltered. If the retrieved data (e.g., the first data D1) is erroneous, the first data D1 is provided to the processor <NUM> and the execution of the first thread TH1 may be suspended in a similar manner as described above.

After the execution of the first thread TH1 is suspended, the processor <NUM> may initiate the execution of a subsequent thread and the thread scheduler <NUM> may disable the first thread TH1 in a similar manner as described above. Further, after the first thread TH1 is disabled, the system controller <NUM> may correct the erroneous first data D1 and the thread scheduler <NUM> may re-enable the first thread TH1 based on the successful correction of the erroneous first data D1 in a similar manner as described above.

When the re-enabled first thread TH1 is again scheduled for execution, the processor <NUM> may regenerate the instruction request IRQ and provide the instruction request IRQ to the error control circuit <NUM>. In such a scenario, as the first instruction INS1 and the first data D1 are corrected, the execution of the first instruction INS1 may be successful and the error control circuit <NUM> may retrieve a subsequent instruction of the first thread TH1 from the first memory <NUM>.

Conventionally, to recover a processor of an integrated circuit (IC) from an operational failure experienced as a result of executing an erroneous thread, the entire IC may be reset or an IC subsystem that includes the processor may be reset. The reset of the IC subsystem or the entire IC takes up a significant amount of clock cycles. The significant turnaround time associated with the reset of the IC subsystem or the entire IC is undesirable for safety-critical applications (e.g., automotive applications). Further, the operations of all the other threads that are being executed by the processor are disrupted by an error in one thread. As a result, the throughput of the processor significantly degrades.

In the present disclosure, the replacement of the erroneous instruction (e.g., the first instruction INS1) with the substitute instruction SUB and the suspension of the execution of the erroneous thread (e.g., the first thread TH1) prevents the operational failure of the processor <NUM> due to memory errors. Hence, a need to reset the entire IC <NUM> or an IC subsystem (e.g., the processor <NUM>) is reduced. The IC <NUM> may thus be implemented in the safety-critical applications. When the execution of one thread is suspended, another thread is scheduled for execution at the processor <NUM>. As a result, the operation of the processor <NUM> may not be halted due to the memory errors. Further, as the entire IC <NUM> or the IC subsystem might not be required to be reset, the operations of other threads (e.g., the second thread TH2) associated with the processor <NUM> remain uninterrupted. Consequently, the throughput of the processor <NUM> is significantly greater than that of processors that experience operational failures due to memory errors.

An integrated circuit (IC) includes a memory that stores a thread and a processor that generates an instruction request to retrieve one or more instructions of the thread. The IC further includes an error control circuit that receives the instruction request from the processor and retrieves an instruction of the thread from the memory based on the instruction request. Further, the error control circuit determines whether the retrieved instruction is erroneous. Based on the determination that the retrieved instruction is erroneous, the error control circuit provides a substitute instruction to the processor as a response to the instruction request. The substitute instruction is included in an instruction set of the processor. The processor executes the received substitute instruction and suspends an execution of the thread.

Claim 1:
An integrated circuit, IC (<NUM>), comprising:
a first memory (<NUM>) configured to store a first thread (TH1), wherein the first thread (TH1) comprises a set of instructions;
a processor (<NUM>) configured to generate an instruction request (IRQ) to retrieve one or more instructions of the set of instructions; and
an error control circuit (<NUM>) that is coupled to the first memory (<NUM>) and the processor (<NUM>), and configured to:
receive the instruction request (IRQ) from the processor (<NUM>);
retrieve a first instruction (INS1) of the set of instructions from the first memory (<NUM>) based on the instruction request (IRQ);
determine whether the first instruction (INS1) is erroneous; and
provide, based on the determination that the first instruction (INS1) is erroneous, a substitute instruction (SUB) to the processor (<NUM>) as a response to the instruction request (IRQ), wherein the substitute instruction (SUB) is included in an instruction set of the processor (<NUM>), wherein the processor (<NUM>) is further configured to execute the received substitute instruction (SUB), and wherein after the execution of the substitute instruction (SUB), the processor (<NUM>) is further configured to suspend an execution of the first thread (TH1) based on the erroneous first instruction (INS1), wherein the IC (<NUM>) further comprises (i) a thread scheduler (<NUM>) and (ii) a system controller (<NUM>) that is coupled to the thread scheduler (<NUM>),
wherein the system controller (<NUM>) is configured to correct the erroneous first instruction (INS1) after the first thread (TH1) is disabled and generate a thread control bit (TCT) indicative of the successful correction of the erroneous first instruction (INS1),
wherein the thread scheduler (<NUM>) is further configured to receive the thread control bit (TCT) from the system controller (<NUM>) and re-enable the first thread (TH1),
wherein the re-enabling of the first thread (TH1) corresponds to inclusion of the first thread (TH1) in multithreading associated with the processor (<NUM>), and
wherein to re-enable the first thread (TH1), the thread scheduler (<NUM>) is further configured to modify a context associated with the first thread (TH1).