JP3332098B2 - Redundant processor unit - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a dual processor device applied for controlling a process, and more particularly, to two processor devices which can be executed independently, which are connected by a system bus. The present invention relates to a dual processor device of a system in which the other processor device stands by without being involved in the actual work.

[0002]

2. Description of the Related Art In a processor device for performing a process control, a processor device for performing a process control operation has a dual structure in order to enhance reliability, and the other processor device is made to stand by in preparation for a failure of one processor device. The configured dual processor device has been widely put to practical use.

When such a dual processor device is constructed, how to combine and operate the two processor devices is a problem. The following is a conventionally considered coupling method. (A) The two processor devices are operated by the same software while synchronizing with each other, and the input / output devices (I / O) connected to these processor devices are also configured to have a duplex configuration, so that both are always synchronized. I do. (B) The same software is separately operated on the control side and the standby side by the two processor devices. Each CPU in the two processor devices operates independently. When the input / output device outputs a signal to the outside of the processor device, the control side operates.
Each processor device executes the processing independently. The processing by the processor device on the control side is equalized to the processor device on the standby side at an arbitrary timing of the system. The standby processor device always prepares for the downfall of the control processor device while always executing the processing by the equalization. (C) The same software is separately operated on the control side and the standby side by the two processor devices. Each CPU in the two processor devices operates independently. The input / output device operates only on the control side, and the other is kept in an executable state. With respect to the data operated in the processing by the processor device on the control side, application software of the processor device on the control side equalizes the data to the processor device on the standby side at an arbitrary timing. The standby processor device always prepares for the downfall of the control processor device while always executing the processing by the equalization. When the processor device on the control side goes down, the processing is continued according to the equalized contents. (D) The same or unique software is independently operated by two processor devices. The two processor devices perform synchronous communication at an arbitrary timing between the application software of each device, and if the processor device on the control side goes down, the processor device on the standby side takes over for it.

[0004]

SUMMARY OF THE INVENTION In the conventional system in which two processor devices are connected as described above, it is necessary to (a)
In the method of (1), it is necessary to synchronize each CPU in the processor device at each instruction, and there is a problem that the processing speed of the CPU is significantly reduced. In the method (b), when the execution right is switched from the processor device in the execution state to the processor device on the standby side, the processor device on the standby side until then switches the already executed process again. Will run. At this time, since a time for standby execution is required, it is not suitable for a process control system that requires real-time processing.

In the method (c), the design of data to be equalized becomes complicated. In particular, in application software created using a high-level language, the compiler determines how to take the data area. To be
There is a problem that it becomes difficult to respond. The method of (d) is
Since the switching of the duplication is realized only by the application software of each device, it cannot be said that the system is a general-purpose duplication configuration.

The present invention has been made in view of these points, and has been made in consideration of the above circumstances.
Switching of control operation to the processor unit maintains continuity.
Operation can be performed instantaneously , and the operating system
The application software running under the management of the beam (OS), without the awareness of the duplication, therefore, a configuration for the duplicated switching control is simple, and an object thereof is to provide a highly reliable redundant processor apparatus .

[0007]

SUMMARY OF THE INVENTION The present invention for achieving the above object is a dual processor device as described below. (1) Two processor devices that can be executed independently are connected by a system bus, and one processor device is a control side involved in actual work, and the other processor device is a standby side not involved in actual work. An OS execution memory means for storing an operating system, a program execution memory means for storing an application program which operates while using a function of the operating system (system call); A CPU device that operates in accordance with a program stored in a memory; and a program execution memory in a standby processor device which stores contents written into its own program execution memory means by the control processor when the user is involved in actual work. Data to be copied to the same address of the vehicle Value-generating means, inter-process-device interrupt generating means for performing an interrupt received when it is involved in actual work to the other processor device in a standby state, and a control device when the application program makes a system call. and a queuing means for synchronizing the interrupt processing performed waiting to its operation in the processor unit and the stand-by side processor unit is synchronized, control
Waiting means side processor unit及 beauty standby side processor unit, for each application program a system call, writes data to the specified address of the own side program execution memory means, then the same mating program execution memory means Check the address, wait until some data is written from the other processor unit, and confirm that it has been written,
Clear the data of the other side of the program execution memory means, subsequently, to carry out the waiting operation to wait until the data of their own side of the program execution memory means is cleared
A duplicated processor device. (2) When the standby processor device receives an interrupt from the inter-process-device interrupt generation means on the control side, it generates a pseudo interrupt to the standby CPU device and waits for the same interrupt processing as the control side. (2) The dual processor device according to (1),

[0008]

[0009]

[0010]

[0011]

An embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a functional block diagram showing basic functions of the device according to the present invention. In the figure, MD1, M
D2 is a two-processor unit that can be executed independently and is connected to each other by a system bus SB. One processor unit, for example, MD1 is involved in actual work (control), and the other processor unit MD2 is involved in actual work. It is the waiting side without waiting.

Each processor device is configured to perform data processing and control in accordance with application software described in a generalized language (for example, C language) that operates under the control of an operation system (OS). . In addition, each processor device does not cause multiple execution by the OS other than the interrupt processing from the outside, and interrupts the processing continuously executed by the application program because the application program calls the OS or It is only in the case where a process that causes the OS to operate is performed, and data transfer and communication between programs are all performed via the OS.

In each of the processor units MD1 and MD2, reference numeral 11 denotes an OS execution memory unit storing an OS, and 12 denotes a program execution memory unit storing an application program. The application programs stored here operate while using the functions of the OS (while performing system calls), and are prepared according to various applications. Done without doing so. Reference numeral 13 denotes a CPU device that operates according to each program stored in each of the memory units 11 and 12, and has a function of performing data arithmetic processing, various controls, communication processing, and the like.

[0014] When 14 is involved in the actual work,
Data equalization means for transferring the contents of the program execution memory means 12 to the program execution memory means in the partner processor device in the standby state. When the system is started up, the data equalization unit 14 firstly stores the contents of the OS execution memory unit 11 and the program execution memory unit 12 on the processor side (control side) in the single operation state into the standby side. And a function to transfer the data to the processor device.

Reference numeral 15 denotes an input / output device (I / O device) provided corresponding to each of the processor devices MD1 and MD2. Here, an example is shown in which each processor device is connected to a system bus SB that connects two processor devices and is provided inside each processor device. However, it may be provided outside the processor device, or each processor device may be independently provided. They may be combined and operate independently.

16 is a process for executing a similar interrupt to the other processor device in the standby state when an interrupt is received from the I / O device 15 while its own processor device is involved in actual work. This is an inter-device interrupt generating means. When the standby processor device receives an interrupt from the inter-process-device interrupt generating means 16 on the control side, the standby processor device generates a pseudo interrupt for its own CPU device and performs the same interrupt processing as the control side. The interrupt processing in this case is normally performed completely asynchronously with the operation of the application.

Reference numeral 17 denotes queuing means for queuing the control processor and the standby processor so that their operations are synchronized when the application program makes a system call. The two processor devices are the respective CPU devices 1 on both the control side and the standby side.
3, each processor device is independently operated by one CPU device.
If these operations are performed normally, the operations are synchronized. However, when interrupt processing or the like occurs in one of the processor devices, synchronization is lost.

Therefore, in the apparatus of the present invention, every time the OS is called, a waiting for synchronization by the waiting means 17 is performed. In the case where the waiting is performed, when an interrupt is generated from the CPU device 13, the processor device performs its own I / O.
When the device 15 is accessed (in this case, data transfer is performed from the control side to the standby side), the I / O from the program operating in the program execution memory unit 12 is performed.
This is the case when an access request is made to the device 15.

FIG. 2 is a configuration block diagram showing hardware of one embodiment of the present invention. Each processor MD1, M
D2 is a system bus SB composed of a microprocessor MP and an I / O device 15, each having a duplex configuration.
1 and SB2. Each microprocessor MP is an OS execution memory unit 1 shown in FIG.
1 and a memory 10 functioning as a program execution memory means 12, a control operation means 13 representing functions of performing data arithmetic processing, various controls and communication processing, a data equalizing means 14, and an inter-processor interrupt generating means 16 Is provided.

When the system bus SB is not configured to have a redundant configuration, the I / O device 1 corresponding to each processor device
5 are coupled to the same system bus. Next, the operation of the apparatus configured as described above will be described separately for each processing at the time of starting up the system, performing synchronization, performing switching, and performing single operation.

(Operation at System Start-Up) FIGS. 3 and 4 are flowcharts showing the operation at system start-up. First, the two processor devices perform a self-diagnosis of the hardware, and if there is no abnormality, perform a diagnosis as to whether they become the control side or the standby side (ST1).
1, 12, 21, 22). By diagnosing whether to be the control side or the standby side, for example, the side determined in advance by the hardware or the processor device which is in the operating state first (the CPU which outputs the ready signal CPURDY first) is controlled. Side and the other side are standby sides.

The processor device on the control side (for example, M
In D1), if the memory is volatilized, system loading is performed, CPURDY is declared, and preparation for the control side is completed (ST13, ST14). The processor device MD2 on the standby side receives a signal from the processor device on the control side, is set as the standby side, and performs an initialization process (ST23).

The processor device MD1 on the control side comprises:
When the preparation on the control side is completed, the initialization processing of various software and the initialization processing of the I / O device to be connected to itself are performed, and the operation is started as a single system (S
T15-18). During this time, the standby processor unit MD2
It checks whether there is a data equalization request (APC request). On the other hand, the processor device MD on the standby side
2 confirms that the processor device on the control side is in an operating state (online), and upon completion of the initialization processing, uses its own inter-processor device interrupt generation means 16 to execute the processor device on the control side. A data equalization request (APC request) is made to MD1 (ST24).

In the control-side processor device MD1, A
When the PC request is received, data equalization processing is performed by interruption processing at a fixed cycle (ST19, ST20). FIG.
3 is a conceptual diagram of the configuration of each program execution memory means 12 at the time of system startup. The control-side processor device MD1 that has received the data equalization request from the standby-side processor device MD2 uses its own data equalization means 14 and causes its own CPU device 13 to wait for the contents of the program execution memory means 12. It is copied to the same address of the program execution memory means 12 of the side processor device MD2 by a periodic interrupt process.

Here, if it is attempted to perform all the data copy processing at one time, the normal processing of the control processor may be hindered. For this reason, the data copy process at the time of startup is performed gradually while operating the system. During such copy processing, the system operates until the data transfer is completed, and the contents (data) written by the own CPU unit 13 in the program execution memory unit 12 are transferred to the data equalization unit 14. The program execution memory means 1 of the standby processor device MD2.
2 are equalized to the same address.

When such data copy processing at the time of system startup is completed, the two processor units MD1 and MD
The contents of the respective program execution memory means 12 in D2 become the same (equivalent). At this timing, the processor devices on the control side and the standby side are executed from the same address, so that the two processor devices are synchronized. Execute (FCS operation)
Is started (ST25, 26, 27). The initialization process of the I / O device in the standby processor device MD2 is performed immediately during the operation after the synchronous execution is started.

(Operation at Synchronous Execution) FIG. 6 is a conceptual diagram showing an operation at the time of synchronous execution. In this figure, reference numeral 120 denotes a block generally showing application software stored in the program execution memory unit 12, and 110 denotes a kernel processing execution unit that executes the OS stored in the OS execution memory unit 11. . Reference numeral 121 denotes a system call receiving unit that receives a system call from the application software 120, and reference numeral 122 denotes a dispatcher that controls execution of the application software 120 in the OS. Reference numeral 111 denotes a driver for transmitting / receiving data between the two processor devices and accessing the I / O device 15, and the kernel processing execution unit 11 replaces the application software 120.
0 (OS). Reference numeral 160 denotes an interrupt processing unit, which is a block that receives interrupts from the CPU device 13, the I / O device 15, and the inter-processor device interrupt generation means 16 and processes the interrupts.

In a normal operation, the application software 120 executes a predetermined application via the system call receiving unit 121 while using the function of the OS. In such an operation, when the application software 120 makes a system call, the queuing means 17 is activated and the two processor devices M
A waiting process is performed so that the operations of D1 and MD2 are synchronized.

FIG. 7 is a flowchart in a case where such a waiting process (synchronous process) is performed by software in each of the processor devices on the control side and the standby side. The control side and the standby side perform similar processing in parallel as shown in the figure. First, a memory area (synchronization area) prepared for performing synchronization processing in its own program execution memory means 12 is provided. Memory). It is assumed that the address of this synchronous memory area differs depending on the location where synchronization is performed.

Next, the contents of the synchronous memory (same address) of the program execution memory means 12 of the partner processor device are read, and it is monitored whether data exists there. If the data exists (when the data is written), the synchronous memory is cleared, the content of the own synchronous memory is read, and then the data is waited until the data no longer exists (the own synchronous memory is cleared). .

In this example, the queuing process is realized by software. For example, hardware for transferring data for the synchronization process is provided at each synchronization point, and the same operation as described above is performed. You may do so. By such a waiting process, the application software 1 executed in the two processor devices
20 execution will be synchronized. Also,
Although a plurality of applications can be controlled by the dispatcher 122, also in this case, control is synchronized between the plurality of applications.

I / O connected to each processor device
As for the device 15, a driver 111 for accessing each I / O device (this driver is a kernel processing execution unit (O
S) (started by S) 110), synchronization can be achieved with respect to I / O processing between the control side and the standby side. At this time, the input data captured by the I / O device 15 on the control side is transferred to the standby side via the driver 111, and equalization of the input data can be performed between the two processor devices.

In the case where an interrupt is generated asynchronously from the I / O device 15 side in the control-side processor device, the interrupt processing is performed by the function of the interrupt processing unit 160 by the OS, and the inter-processor device interrupt generation means 16 A pseudo interrupt is generated for the standby processor device. When the OS is called, the queuing unit 17 performs queuing and synchronizes the interrupt processing. As a result, the I
The timing of access to the / O device 15 can be adjusted. It should be noted that the exceptional interrupt that occurs in the CPU device 13 must occur in both the control side and the standby side because the same application software is being executed at the same time. Will be done.

As described above, every time the application software 120 makes a system call, or during the process of accessing the I / O device by starting the driver by performing the communication, the synchronization by the queuing unit 17 is achieved. (Processing at Switching) The processor device MD1 on the control side
Although not shown, it has a self-diagnosis function by a known technique, and when detecting its own abnormality, notifies the standby processor device MD2 of the switching of the execution right. The processor device MD2 that has been on the standby side until that time receives the notification of this switching, and continues the process as the control side. The switching in this case can be taken over while maintaining the continuity because the processor device that has been on the standby side executes the same application software in synchronization with the processor device MD1. The continuity of the processing by the I / O device that has been on the standby side can be maintained by retrying the processing before the switching.

(Processing in Single Operation) From a state in which two processor devices are operating in synchronization, a case where one of the processor devices is down is changed to a single operation in which the other processor device operates on the control side. Become. In this state, the processor device having the control right responds by stopping the function of the queuing means 17 and not executing the synchronization process in response to the information that the other is down or not present.

Next, the operation when various system abnormalities occur will be described. When a system error occurs, the power of each processor device is cut off, the watch dog timer that monitors the operation of various hardware times out, or the error is detected by the self-diagnosis of the CPU itself. Similarly, when an abnormality is detected in the I / O device. In these cases, synchronization may be lost between the two processor devices.

FIG. 8 is a flowchart showing a switching operation when a power failure (ACfail) occurs in the standby processor unit MD2. In this case, upon confirming the power failure (ACfail), the standby processor MD2 sends a system down notification to the control processor MD1 (ST31, 32). After that, it waits for the AC to be restored, and when the AC is restored, an initial start is performed (ST33, ST34). On the other hand, when the control-side processor device MD1 continues its normal operation as the control-side device and receives a system down notification from the standby-side processor device MD2 during the operation, the single-operation mode is set. Control operation is continued (ST35)
~ 37).

FIG. 9 is a flowchart showing a switching operation when a power failure (ACfail) occurs in the control processor MD1. In this case, upon detecting the power supply abnormality, the control-side processor device notifies the standby-side processor device of an ACfail indicating the power supply abnormality (S
T41). Thereafter, a shutdown process is performed on the currently operating I / O device, and the power supply is restored (S
T42, 43). If the power supply does not recover even after a certain period of time has elapsed, the CPU ready signal is turned off and down (ST44, 45). When the power is restored, the power supply is notified to the standby processor device, the recovery process is performed on the I / O device, and the operation on the control side is continued as it is (ST46, 47).

Upon receiving the ACfail notification from the control processor, the standby processor monitors whether the control processor is in a down state (whether the CPU ready signal is turned off). Becomes the control side and starts the control operation (ST5).
1, 52). Also, when the power supply recovery notification is received from the control processor side, between the two processor units,
Restarting is performed because a synchronization error has already occurred (ST5).
3).

FIG. 10 is a flowchart showing the switching operation when the time of the watch dog timer has expired. If the watchdog timer only on the control side has timed out due to a failure in hardware, etc., the system unit on the control side is down, and the processor device that was on the standby side until now becomes the control side and takes over the control operation. Become.

FIG. 11 is a flowchart showing the switching operation when the system goes down due to runaway or force majeure in the control processor device. In this case, the control processor device turns the system itself down in response to the detection of the CPU error, and the standby processor device checks this system down, and becomes the control side and takes over the control operation. .

FIG. 12 shows a control-side processor device which has a CP
9 is a flowchart illustrating a switching operation when a U abnormality is detected, a CPU exception occurs, synchronization is lost, and an error is detected by self-diagnosis. In any case, the control side causes the system to go down, and the standby processor unit receives the system down and becomes the control side and takes over the control operation.

FIG. 13 is a flowchart showing a switching operation when an abnormality occurs in the I / O device connected to the control processor device. In this case, switching of the I / O device is performed by the driver 111, and the processor device on the control side confirms the state on the standby side (confirms that the CPU is in the ready state) and then lowers itself.
When the standby processor detects that the controller is down, the standby processor itself becomes the controller and takes over the control operation.

[0044]

According to the present invention, the data is received by the control processor device.
Interrupt on the standby processor side, and
Waiting between the side processor unit and the standby processor unit
To synchronize the interrupt processing. Also,
The control processor device has its own program execution memory means
The contents written to the
To the same address in the RAM execution memory means.
As a result, when the control side goes down
Switching of the control operation to the standby processor unit can be continued
Can be done immediately while maintaining

Also, if the application program is
When a system call is made, the queuing means operates and two
Waiting for processor synchronization
You. As a result, a processor device with a dual configuration can be used.
Under the control of the operating system (OS)
The sense of duplication in operating application software
Configuration for redundant switching control
A simple and reliable dual processor system can be realized.
You.

[Brief description of the drawings]

FIG. 1 is a functional block diagram showing basic functions of an apparatus according to the present invention.

FIG. 2 is a configuration block diagram showing hardware of one embodiment of the present invention.

FIG. 3 is a flowchart showing an operation at the time of starting the system.

FIG. 4 is a flowchart showing an operation at the time of starting the system.

FIG. 5 is a conceptual diagram of a configuration of each program execution memory unit when the system is started.

FIG. 6 is a conceptual diagram showing an operation during synchronous execution.

FIG. 7 is a flowchart illustrating an operation of a waiting process (synchronous process) performed in each processor device on the control side and the standby side.

FIG. 8 is a flowchart illustrating a switching operation when a power failure occurs in the standby processor device.

FIG. 9 is a flowchart illustrating a switching operation when a power failure occurs in the control processor device.

FIG. 10 is a flowchart showing a switching operation when a watch dog timer times out.

FIG. 11 is a flowchart showing a switching operation when the system goes down due to runaway or force majeure in the control processor device.

FIG. 12 is a flowchart illustrating a switching operation when a control processor device detects a CPU abnormality, a CPU exception occurs, synchronization is lost, and an error is detected by self-diagnosis.

FIG. 13 is a flowchart illustrating a switching operation when an abnormality occurs in the I / O device.

[Explanation of symbols]

 MD1, MD2 Processor unit SB system bus 11 OS execution memory unit 12 Program execution memory unit 13 CPU unit 14 Data equalization unit 15 Input / output device (I / O device) 16 Interrupt generator between process devices 17 Waiting unit.

──────────────────────────────────────────────────続 き Continuation of the front page (72) Inventor Toshihiko Matsuda 2-9-132 Nakamachi, Musashino-shi, Tokyo Investigator in Yokogawa Electric Corporation Hiroaki Hamakishi (56) References JP-A-57-86968 (JP) JP-A-52-48445 (JP, A) JP-A-1-258057 (JP, A) JP-A-2-202638 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB G06F 11/16-11/20 G06F 15/16-15/177 G06F 9/46

Claims (2)

(57) [Claims] 1. Two processor devices that can be executed independently are connected by a system bus, and one processor device is a control side involved in actual work, and the other processor device is a standby side not involved in actual work. An OS execution memory means storing an operating system, a program execution memory means storing an application program operating while using a function of the operating system (system call), A CPU device that operates in accordance with a program stored in each of the memories, and a program in the standby processor device which stores the content written by the control processor device in its own program execution memory means when the controller processor is involved in actual work. Copy to the same address in the execution memory means An inter-process device interrupt generating unit for performing an interrupt received when the user is involved in actual work to a partner processor device in a standby state; and wherein the application program makes a system call. and a queuing means for synchronizing the interrupt processing performed waiting to its operation in the control-side processor unit and the standby side processor unit when synchronizes, waiting means of the control-side processor unit及 beauty standby side processor unit, Each time the application program makes a system call, it writes data to the specified address of its own program execution memory means, then checks the same address of the other party's program execution memory means, and sends some data from the other processor device. Wait until it is written, When you confirm the filled-in for, call clears the data of the other side of the program execution memory means, Subsequently, a waiting operation to wait until the data of their own side of the program execution memory means is cleared
And a dual processor device. 2. The standby processor device, upon receiving an interrupt from the control-side process device interrupt generating means,
2. The dual processor device according to claim 1, wherein a pseudo interrupt is generated for the CPU device on the standby side, and the same interrupt processing as on the control side is performed on the standby side.