JP3438986B2 - Multiplexed computer system and failure recovery method - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiplexed computer system, and more particularly to a multiplexed computer system which, when a failure occurs in any of the multiplexed computer systems, quickly recovers from the failure. And a method for recovering from a disaster.

[0002]

2. Description of the Related Art In a conventional multiplexed computer system in which a plurality of arithmetic processing units execute the same arithmetic operation in synchronization, each arithmetic processing unit performs a multiplexing operation in synchronization with a clock given by the system. Because of the configuration, it is necessary to provide a means for simultaneously synchronizing all the arithmetic processing devices when synchronization is required at startup or during operation.

In the synchronization during operation, a certain arithmetic processing unit becomes inoperable due to a failure, or a certain arithmetic processing unit is periodically inspected, and then the multiplexing operation is performed again. It is necessary to resynchronize the.

Then, for example, the following method is generally adopted as one method for synchronizing all the arithmetic processing units operating in duplicate.

That is, in a computer system operating in a duplicated manner, the contents stored in a memory device included in an operating arithmetic processing unit (normal system) and the memory contents included in the operating arithmetic processing unit are received. When all the data and all the data are transferred to the memory device of the non-operational processing device (abnormal system) and the stored contents of the normal memory device are completely transferred, both processing devices are in the same state. Then, the reset processing is performed temporarily so that both systems are synchronized by restarting the operating system in both arithmetic processing units. As an example of a patent publication disclosing a technique related to this, Japanese Patent Laid-Open No. 3-18
No. 2958, etc. are mentioned.

[0006]

By the way, in a computer system which is multiplexed and has a fault tolerance function, no matter how short the down time (the time from the occurrence of a failure to the time when the multiplexing operation starts again) is, no matter how short. It is used in various fields such as an air traffic control system and a control of a nuclear processing plant, which has a great adverse effect and increases costs such as plant operation costs.
Therefore, the longer the down time is, the more the actual adverse effects caused by the system down and the potential adverse effects that the adverse effects have on the operation of other systems.

However, according to the above-mentioned conventional method, all the arithmetic processing units are reset in order to perform synchronization,
Furthermore, since it is necessary to perform a process of restarting the operating system that requires a long time to boot, the situation in which the entire system becomes inoperable occurs for a long time, which causes a problem. .

Therefore, an object of the present invention is, in a multiplexed computer system composed of a plurality of arithmetic processing units, when resynchronizing an arithmetic processing unit that has recovered from a failure, it is possible to synchronize by stopping the operation within the shortest possible time. It is an object of the present invention to provide a multiplexed computer system and a failure recovery method that enable the above.

[0009]

In order to achieve the above object, the following system can be considered.

That is, the multiplexed computer system is provided with a plurality of arithmetic processing devices for synchronously performing the same arithmetic processing and a synchronous processing device connected to each of the arithmetic processing devices for performing resynchronization processing. Each processor is
Other processing units, failure times for detecting recovery from failure
A recovery detection unit, the fault recovery detection means other processing unit, when the case is detected recovery from the failure and the own processor has recovered from the failure, respectively, an access request to a predetermined address , A means for performing the synchronous processing device of the self-processing device, and an access means for accessing the address according to the access permission for the address request.

[0011] The synchronization processing apparatus, when the time difference between the access requests Prefecture by the access request and by normal operation to the arithmetic processing unit has recovered from the failure processor is within the time difference predetermined Is the above normal
Operating processor and operation recovered from the failure
Both access means of the processing device are provided with a synchronization means for simultaneously giving the access permission.

[0012]

[0013]

[0014]

The following failure recovery method is also conceivable.

That is, when one of the arithmetic processing devices that performs the same arithmetic processing in synchronization fails, the failure recovery method is to resynchronize the arithmetic processing device recovered from the failure with the arithmetic processing operation of another arithmetic processing device. there, one of the processing units for normal operation, the failure of the other processing units and
When detecting the recovery from the failure, the process will row an access request to a predetermined address, the processing unit has recovered from the failure, the process will row an access request to the address, the normal operation processing the time difference of the access requests Prefecture by the processing unit which recovers processor the access request by from the fault that is, if within a predetermined time difference, wherein for normal operation
Device and the process failed synchronization are connected to the processing unit recovering from device, processing device and the normal operation
At the same time, the above-mentioned
A process of Ru granted permission for the dress request, the free
Mu .

[0017]

[0018]

[0019]

[0020]

A plurality of arithmetic processing devices perform the same arithmetic processing in synchronization, and the synchronous processing device connected to each arithmetic processing device performs resynchronization processing.

The fault detecting means provided in the arithmetic processing unit detects a fault in another arithmetic processing unit.

Note that the arithmetic processing unit has other failure detecting means.
When the failure of the arithmetic processing unit and the recovery from the failure are detected, the access request to the predetermined address is issued at a predetermined time interval, for example.

Further, the arithmetic processing unit issues an access request to the address when the self arithmetic processing unit recovers from the failure.

Further, the access means included in the arithmetic processing unit accesses the address in response to the access permission from the processing unit.

[0025] Then, the synchronization processing apparatus, the time difference between the access requests Prefecture by the arithmetic processing device has recovered from the access request and the failure by the arithmetic processing unit, wherein for normal operation, Ru der within time difference predetermined In this case, the access permission is given to the access means of both the normally operating arithmetic processing unit and the arithmetic processing unit recovered from the failure at the same time .

[0026] ie, to adjust the operation timing of both the processing unit.

[0027]

That is, the resynchronization means resynchronizes the operations of both arithmetic processing devices with the access from the access means provided in the arithmetic processing device operating normally and the arithmetic processing device recovered from the failure as a reference signal for synchronization. To do.

[0029]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows a block diagram of a multiplexed computer system 10 according to the present invention.

The multiplexed computer system 10 is
It is configured to have a clock device 190, an A system subsystem 20a, and a B system subsystem 20b. Further, both system subsystems and the terminal device 170 are the terminal connection device 180.
Connected through.

The A-system subsystem 20a has an arithmetic processing unit 30a for performing a predetermined arithmetic processing.
And at least a plurality of multiplexed bus control devices 100a and 110a and a plurality of I / O devices 160a. Similarly, the B system subsystem 20b performs a predetermined arithmetic processing. The arithmetic processing unit 30b, the plurality of multiplexed bus control units 100b and 110b, and the plurality of I's.
The I / O device 160b is provided at least.

Corresponding constituent elements of the two systems (having the same numbers) have the same function, and both systems have the same configuration.

The clock device 190 supplies clocks having the same frequency and the same phase to the A-system subsystem 2
0a and B system subsystem 20b.

The A-system subsystem 20a and the B-system subsystem 20b have the same configuration as described above, and perform the same operation, that is, the synchronous operation according to the cycle of the clock supplied by the clock device 190. There is. That is, the A system subsystem 20a and the B system subsystem 20
With b, a double system operation is performed which performs the same arithmetic processing.

The terminal device 170 can perform maintenance operation of the multiplexed computer system 10, for example, by an operator operating this device.

When the user operates the terminal device 170 to request the multiplexed computer system 10 to perform a predetermined process, the multiplexed computer system 10 performs the requested process. 20a and the B subsystem 20b are executed simultaneously. For this reason, even if a failure occurs in one subsystem and the processing is stopped, the processing is continuously executed by the other subsystem and the requested processing is performed.

More specifically, the A-system subsystem 20a further includes an I / O bus 140a for connecting a plurality of I / O devices 160a, an I / O device 160a, and a terminal connecting device 180. I connected to the O-bus 140a
/ O interface 150a and a plurality of I / O devices 1
DMA access by 60a (Direct Memory Access)
I / O bus controller 130a having a function of arbitrating
Of the I / O bus controller 130a, the A-system multiplexed bus controller 100a and the B-system multiplexed bus controller 100b, and the I / O bus controller 130b and the A-system multiplexed bus 120a. Multiplexed bus 1 for connecting the multiplexed bus controller 110a and the B-system multiplexed bus controller 110b
20b, the multiplex bus controller 100a that arbitrates the DMA access of the I / O device 160a and the PIO access of the arithmetic processing device 30a, and the DMA access of the I / O device 160b and the PIO access of the arithmetic processing device 30a. Multiplexing bus control device 110a and arithmetic processing device 30
a, a multiplex bus control device 100a, and a system bus 90a for connecting the multiplex bus control device 110a.

As can be seen from the figure, since the B system subsystem 20b has the same configuration as the A system subsystem 20a, only the A system subsystem 20a side is
The configuration will be described.

Further, the signal line 105 is a signal line for transmitting and receiving a control signal to be given to the multiplex bus control device between the multiplex bus control device 100a and the multiplex bus control device 100b. The reference numeral 115 indicates between the multiplexed bus control device 110a and the multiplexed bus control device 110b.
It is a signal line for transmitting and receiving control signals to and from the multiplexed bus control device.

Further, the arithmetic processing unit 30a contains two processors 40a and 50a which perform the same processing in synchronization with the supplied clock, a memory device 60a, an intersystem interface 80a, and a predetermined program. And a ROM 88a that is included in the control unit 70a.
The intersystem interface 80a includes an intersystem bus 85.
Are connected.

The control unit 70a compares the output data output from the two processors 40a and 4050a, and if the data do not match, the processor 40a or the processor 50a
An error detection function that determines that an error has occurred, a function that detects an error in the memory device 60a using an ECC code,
It also has a function of detecting a failure (error) of the system bus 90a by a parity check. The arithmetic processing device 30b has the same components as the arithmetic processing device 30a, and thus has the same function as the arithmetic processing device 30a. In the present invention, the error detection function is not essential, so a detailed description thereof will be omitted.

Further, intersystem interfaces 80a and 80b provided in the arithmetic processing unit 30a and the arithmetic processing unit 30b.
Functions as an interface for exchanging information such as the operating state of subsystems with each other. Information transmission between the inter-system interfaces 80a and 80b is performed via the inter-system bus 85.

The signal line 880a is a signal line for the intersystem interface 80a to notify the operating state of the subsystem to the multiplex bus control device 100a and the multiplex bus control device 110a, and the signal line 880b is an intersystem line. The interface 80b indicates the operating states of the subsystems by the multiplexed bus controller 100b and the multiplexed bus controller 110.
It is a signal line for notifying b, and both signal lines perform the same role.

The inter-system interfaces 80a and 80b respectively include at least a start-up processing program and a failure recovery processing program in advance in the ROM 8
8a and 88b are provided. The startup processing program is a program for starting the subsystem, and is executed when the subsystem is started. Further, the failure recovery processing program, for example, when the operation is stopped due to a failure in one subsystem, continue the processing after the user who is the system maintainer replaces the failed part of the subsystem. This program is executed in order to perform the synchronization operation again with the other subsystem that is operating (this is referred to as "synchronization" or "resynchronization"). The system configuration may be configured such that the start-up processing program and the failure recovery processing program are started by, for example, being operated by operating the terminal device 170.

Next, with reference to FIG. 2, the configuration and operation of the intersystem interface 80a and intersystem interface 80b, which are the main part of the present invention, and the configuration and operation of their associated components will be described.

The inter-system interface 80a is a synchronization flag 8 which is a flag indicating that both the A-system arithmetic processing unit 30a and the B-system arithmetic processing unit 30b are in synchronous operation.
1a, a synchronization request flag 82a, which is a flag indicating that the B-system arithmetic processing unit 30b requests the A-system arithmetic processing unit 30a for synchronization, and the A-system arithmetic processing unit 30a stores B Synchronization wait flag 8 which is a flag indicating that the system arithmetic processing unit 30b is requested to be synchronized.
3a, a failure flag 84a that is a flag that indicates that the A-system arithmetic processing device 30a has failed, and a recovery flag 89a that is a flag that indicates that the A-system arithmetic processing device 30a is recovering from the failure. It is configured to have various logical operation elements.

The signal line 73a is connected to the control unit 7
0a is a signal line for transmitting an error detection signal notifying the inter-system interface 80a that an error occurred in the A-system arithmetic processing device 30a has been detected.
Indicates that both the A-system arithmetic processing unit 30a and the B-system arithmetic processing unit 30b are in a state of attempting synchronization, and the intersystem interface 80a indicates that the multiplex bus control unit 100
a and 110a is a signal line for transmitting a synchronization mode signal, and the signal line 108a is a synchronization line for the multiplexing bus control device 100a or 110a to notify the intersystem interface 80a of successful synchronization. It is a signal line that transmits a success signal.

The intersystem interface 80b has the same structure.

The fault flag 84a is set when the error detection signal 73a on the signal line 73a is asserted and reset by the register write operation by the processors 40a and 50a.

Similarly, the failure flag 84b indicates that the signal line 73
Set when the error detect signal on b is asserted,
It is reset by the register write operation by the processors 40b and 50b.

The synchronization flag 81a is the synchronization request flag 8
2a and the synchronization wait flag 83a are set, and are set when the synchronization success signal 108a is asserted. Here, the setting of various flags means the content of each flag, for example, a state in which the digital signal “1” is stored, and the reset means the content of each flag.
It may be considered that it corresponds to the state in which the digital signal “0” is stored. In addition, the set and reset operations are performed in this way.

In this embodiment, the OR gate functions as a reset switch, that is, the OR gate output (state of output "1") performs the reset operation, and AN
The D gate functions as a set switch, that is, A
It is assumed that the reset operation is performed by the ND gate output (state of output "1").

Similarly, the synchronization flag 81b is set when the synchronization request flag 82b and the synchronization wait flag 83b are set and the synchronization success signal 108b is asserted.

When the failure flag 84a or 84b is set, both the synchronization flags 81a and 81b are reset. Synchronization request flag 82b and synchronization wait flag 8
3a and the recovery flag 89a indicate that the processors 40a, 50
It is set / reset by the register write operation by a.

Similarly, the synchronization request flag 82a, the synchronization wait flag 83b, and the recovery flag 89b indicate the processor 4
It is set / reset by the register write operation by 0b and 50b.

Processors 40a, 50a and 40b, 50
b, the state of all the flags shown in FIG. 2 can be checked by the register read operation.

The synchronization mode signal 86a is asserted when the synchronization request flag 82a and the synchronization wait flag 83a are set, and negated when the synchronization request flag 82a or the synchronization wait flag 83a is reset. Similarly, the synchronization mode signal 86b includes the synchronization request flag 8
It is asserted when 2b and the synchronization wait flag 83b are set, and negated when the synchronization request flag 82b or the synchronization wait flag 83b is reset.

By such an operation, a failure is detected, a synchronization mode signal is output to the multiplexing control device side for synchronization, and when the synchronization is successful, the multiplexing control device side The process of receiving the synchronization success signal can be performed.

Next, FIG. 3 shows a configuration diagram of the multiplexed bus control devices 100a and 100b according to the present invention and peripheral components thereof.

The multiplexed bus controller 100a includes an address / data buffer 101a, an arbitration unit 102a for arbitrating access between the arithmetic processing unit 30a and the I / O bus controller 130a, an arithmetic processing unit 30a and an arithmetic processing unit 30b. And a synchronization means 103a for performing synchronization.

The synchronizing means 103a and the inter-system interface 80a are connected to the signal line 86a and the signal line 108 described above.
They are connected by a, and signals corresponding to the respective signal lines are transmitted and received.

The signal line 91a and the signal line 9 shown in FIG.
2a and the signal line 93a are signal lines which respectively configure the system bus 90a, and the signal line 91a is an address / data line which is a signal line for transmitting address / data information,
The signal line 92a is a signal line for transmitting an access request signal from the arithmetic processing unit 30a to the multiplex bus controller 100a, and the signal line 93a is a signal line for transmitting an access permission signal from the multiplex bus controller 100a to the arithmetic processing unit 30a. Signal line.

Further, the signal line 121a, the signal line 122a and the signal line 123a are signal lines constituting the system bus 90a, and the signal line 121a is an address / data line which is a signal line for transmitting address / data information. When,
The signal line 122a is a signal line for transmitting an access request signal from the I / O bus controller 130a to the multiplexed bus controller 100a, and the signal line 123a is the multiplexed bus controller 1
A signal line for transmitting an access permission signal from 00a to the I / O bus controller 130a.

The signal line 106a is a signal line for transmitting to the B system an accessible signal indicating that the arbitration means 102a has decided to give the arithmetic processing unit 30a an access right. When the access request signal for outputting an access request is output from the arithmetic processing unit 30a and the I / O bus control unit 130a, the multiplexed bus control device 100a arbitrates the access request by the arbitration means 102a.

The arbitration means 102a is the arithmetic processing unit 30a.
Arbitration means 1 when it is decided to give access right to
02a asserts the accessible signal (106a).

When the access enable signal (106a) is asserted, the synchronization means 103a asserts the access permission signal (signal line 93a) by the control operation described later. Then, when the access permission signal 93a is asserted, the arbitration unit 102a receives the access enable signal 10
6a is negated.

On the other hand, when the arbitration means 102a decides to give the access right to the I / O bus controller 130a, the arbitration means 102a causes the access permission signal (123).
Assert a).

The multiplexed bus control devices 100b, 11
0a and 11b perform the same operation as that of the multiplexed bus control device 100a as described above.

If the arithmetic processing unit 30a and the arithmetic processing unit 30b are operating in synchronization, the multiplexed bus control unit 1
00a and the operation of the multiplexed bus control device 100b are also performed in synchronization. The multiplexed bus control device 100a and the multiplexed bus control device 100b are set to the primary mode and the secondary mode, respectively, when the system is started up. In the primary mode, signals can be input / output through the multiplexed bus 120a. In the secondary mode, only signals can be input from the multiplexing bus 120a, and signals cannot be output to the multiplexing bus 120a.

That is, when the I / O bus controller 130a is accessed simultaneously from both the arithmetic processing unit 30a and the arithmetic processing unit 30b, only the arithmetic processing unit 30a actually performs the access operation. The / O bus controller 130a simultaneously accesses the arithmetic processing units 30a and 30b.

As described above, the multiplex bus controller arbitrates access requests from the arithmetic unit and the I / O bus controller, and the arbitration means gives the access right to the arithmetic processing unit of its own system. And an operation of transmitting an access permission signal to the arithmetic processing unit.

Next, FIG. 4 shows the structure of the synchronization means 103a. The synchronization means 103a includes a control unit 1031
a and a timer unit 1032a.

The timer section 1032a has an arbitration means 102.
It has a function of notifying the control unit 1031a that the arbitration means 102b has not asserted the accessible signal 106b within a timeout time set in advance by the user after the a has asserted the accessible signal 106a.

That is, the timer unit 1032a activates a time measuring means (not shown) having a function of measuring time, which is built in when the accessible signal 106a is asserted, and a predetermined time-out time from the time of activation. When the time has passed, assert the timeout signal (1033a),
Also, when the accessible signal 106b is asserted,
The time measuring means is reset. The timeout time may be set by a writing operation to a register included in the timer unit 1032a.

The control unit 1031a includes the synchronization mode signal (86a), the accessible signal (106a), the accessible signal (106b), and the timer unit 10.
The time-out signal (1033a) from 32a is input, and the access permission signal (9
3a) and a synchronization success signal (108a) are output.

The control unit 1031a can be realized by a combinational circuit of various logic elements,
The specific control operation mode in 31a is as follows.

(1) First case: synchronization mode signal 8
When the accessible signal (106a) is asserted when 6a is not asserted, the control unit 1
031a asserts only the access permission signal 93a.

(2) Second case: When the synchronization mode signal (86a) is asserted and the access enable signal (106a) and the access enable signal (106b) are asserted, the control unit (1031a) Access permission signal (93a) and synchronization success signal (108a)
Assert.

(3) Third case: When the synchronization mode signal (86a) is asserted, and the access enable signal (106a) and the timeout signal (1033a) are asserted, the control unit (1031a) Only the permission signal 93a is asserted.

As described above, the synchronization means asserts the synchronization success signal (108a) based on various signals,
It has a function of transmitting the signal to the inter-system interface.

Next, FIG. 5 shows a flowchart for explaining the failure recovery operation by executing the failure recovery processing program when an error occurs in the B-system arithmetic processing unit 30b.

In the figure, the left side shows the operation in the A system arithmetic processing device, and the right side shows the operation in the B system arithmetic processing device.

First, when an error (occurrence of a failure) is detected in the B-system arithmetic processing unit 30b (step 501)
0), the error detection signal (73b) is asserted, and the failure flag 84b is set (step 5020).

Further, in step 5030, the synchronization flags 81a and 81b are reset.

Then, the B-system arithmetic processing unit 30b stops the processing (step 5040), and the A-system arithmetic processing unit 30b
a independently continues the processing. at this point,
Double system operation is not performed.

The user who manages the system is
Work is performed to replace a failed part of the B-system arithmetic processing unit 30b, such as a failed processor or memory, with a device having the same function and operating normally (step 505).
0), after the work is completed, the B-system arithmetic processing device 30b is activated by operating the terminal device 170 or the like (step 50).
60).

The B-system arithmetic processing unit 30b is started up as follows.
The system may be configured so that the operation can be performed by operating the terminal device 170, or a startup switch is provided in the B-system arithmetic processing device 30b, and a program that performs a process corresponding to the startup operation is executed by operating the startup switch. You may leave it like this.

When the start-up operation is performed, the B-system arithmetic processing unit 30b executes the initialization program contained in the ROM 88b to cause the processors 40b and 50b to operate.
The cache memory provided in the memory device and the storage contents of the memory device 60b are cleared, the failure flag 84b is reset, and the recovery flag 89a is set (step 507).
0).

On the other hand, the processors 40a and 50a of the A-system arithmetic processing unit 30a perform an operation of appropriately reading and monitoring the contents of the B-system failure flag 84b, for example, while watching the normally performed processing. (Step 508
0). Of course, the operation of reading and monitoring the content of the failure flag 84b may be performed at predetermined time intervals.

When the failure flag 84b is reset (5090), a memory copy process for copying the contents of the memory device 60a to the memory device 60b is performed (step 5100).

The memory copy process is the processor 40.
a and 50a read the memory device 60a in units of a predetermined area at predetermined time intervals, and the read contents are read by the control unit 70a, the system bus 90a, the multiplexing bus control devices 100a and 110a, and the multiplexing buses 120a and 120.
b through the multiplexed bus controllers 100b and 11
0b, system bus 90b, control unit 70
This is a process of writing to the memory device 60b via b.

By such processing, preparation for synchronization of both systems is performed.

Further, the control unit 70a operates from the processors 40a, 50a or the I / O device 160a from the start of the memory copy to the successful synchronization of the A-system arithmetic processing unit 30a and the B-system arithmetic processing unit 30b. ,
The write data to the memory device 60a also has a function of writing to the memory device 60b through the above path.

By the above processing, the stored contents of the memory device 60b and the stored contents of the memory device 60a match.

Next, when the processors 40a and 50a complete the read operation of the entire storage area of the memory device 60a,
That is, the entire contents stored in the memory device 60a are stored in the memory device 60a.
When writing to b, the processors 40a and 50a execute the synchronization task (step 5110).

The synchronization task is performed by the A system arithmetic processing unit 30a.
And the B-system arithmetic processing device 30b are resynchronized. Since the processors 40a and 50a have not failed, it is only necessary to execute the synchronization task at intervals of normal processing, but it is not always possible to realize the synchronization by executing the first synchronization task. As described above, the synchronization task may be executed (step 5120 etc.). It suffices to perform programming so as to perform such retry processing.

For example, if synchronization is not realized within a predetermined time, a retry process may be automatically performed.

The second and subsequent synchronization tasks do not have to be executed continuously, but may be executed between normal processing. The synchronization task includes a process of setting a synchronization request flag of another system, as will be described later. By this process, the processors 40a and 50a set the synchronization request flag 82b when the synchronization task is executed. To do.

Further, the B-system processors 40b and 50b
Periodically reads the content of the synchronization request flag 82b (step 5130), and when the synchronization request flag 82b is set (5140), the processors 40b, 50b.
Also executes the synchronization task (step 5150).

By the synchronization task, the A-system arithmetic processing unit 3
0a and B system arithmetic processing unit 30b are synchronized, A system processors 40a and 50a and B system processor 40b,
50b terminates the synchronization task (step 5160),
Start normal processing.

By such a series of processing, even if a failure occurs in one system, failure recovery can be performed and resynchronization can be performed without requiring an excessive processing time for the failure recovery operation in the other system. it can.

FIG. 6 is a flowchart showing the operation contents of the synchronization task.

First, when the synchronization task is executed in the A-system arithmetic processing unit 30a, the processors 40a, 50
According to a, the (other system) synchronization request flag 82b and the (local system) synchronization wait flag 83a are set (step 6010).

Further, the B-system arithmetic processing unit 30b executes the synchronization task, so that the synchronization request flag 8
If 2a is set, the inter-system interface 80
a asserts the synchronization mode signal 86a. next,
A PIO access, which is an access to a specific address, is issued (step 6020).

Here, the specific address is, for example, an address of an internal register of the multiplexed bus control device or an address of an I / O device which is designated in advance in the program of the synchronization task.

The reason for specifying the access destination is to make the access times of the PIO access by the A-system arithmetic processing unit 30a and the PIO access by the B-system arithmetic processing unit 30b equal.

It is preferable that the addresses accessed by the A system and the B system are completely the same.
You may make it access the address (the value of an address has width) which a predetermined area has.

Further, the system components other than the arithmetic processing unit are divided into a plurality of parts, the specific addresses are stored in the respective divided parts, and the process according to the present invention is performed using any one of the specific addresses. May be.

In PIO access, the A-system arithmetic processing unit 30a asserts the access request signal 92a. Then, the arbitration means 102a uses the access request signal 9
For 2a, the accessible signal 106a is asserted. As described above, the synchronization means 103a asserts the access permission signal 93a, and also asserts the synchronization success signal 108a if the condition is satisfied.

When the synchronization success signal 108a is asserted, the synchronization flag 81a is set. The processors 40a and 50a check the contents of the synchronization flag 81a after the PIO access is completed (step 603).
0).

If the synchronization flag 81a is set (Yes), the (other system) synchronization request flag 82b is set.
Then, the (local system) synchronization wait flag 83a and the (local system) recovery flag 89a are reset (step 6040), and the processing of the synchronization task is ended.

On the other hand, if the synchronization flag 81a is not set (No), the contents of the recovery flag 89a are checked (step 6050). If the recovery flag 89a is set (Yes), the PIO access is issued again. (60
20) If the recovery flag 89a is not set (No), the (other system) synchronization request flag 82b, the (local system) synchronization wait flag 83a, and the (local system) recovery flag 89
a is reset (step 6040), and the processing of the synchronization task ends.

In the above operation example, the (PIO) access operation to the specific address is permitted and the PIO access is actually performed to resynchronize the two arithmetic units, that is, the actual PIO access. Although synchronization is performed as a reference signal, when the access permission signals 93a and 93b for a specific address are generated, these permission signals are used as reference signals for resynchronization of both arithmetic units. The timing of the operation of the device may be adjusted.

The processing of the synchronization task is executed by the operation described above.

FIG. 7 is a diagram showing a change state of the operation up to the synchronization performed by the A-system arithmetic processing unit 30a and the B-system arithmetic processing unit 30b by the synchronization task.

In the figure, the left side is the A-system processor 40a,
50a, the multiplexed bus control device 100a, and the inter-system interface 80a change in operating state, and the right side shows the inter-system interface 80b of the B system and the multiplexed bus control device 10.
0b, changes in the operating states of the processors 40b and 50b are shown.

When the A system processors 40a and 50a activate the synchronization task (7010), the synchronization request flag 82b and the synchronization wait flag 83a are set (70).
20).

The B system processors 40b and 50b periodically read the content of the synchronization request flag 82b (7030), and when the synchronization request flag 82b is set, activate the synchronization task (7040). ).

The A-system processors 40a and 50a request PIO access to the multiplexed bus controller 100a (7050), but the B-system processors 40b and 50b set the synchronization request flag 82a and the synchronization wait flag 83b ( 7060) is delayed, the intersystem interface 80a does not assert the synchronization mode signal 86a, so the multiplex bus control device 100a asserts only the access permission signal 93a (7070).

Also, the A-system processors 40a and 50a
Is PIO when the access permission signal 93a is asserted.
Access is executed (7080).

Since the synchronization request flag 82b and the synchronization wait flag 83b of the B-system intersystem interface 80b are set, the B-system intersystem interface 80b is
The synchronization mode signal 86b is asserted (7090).

The B system processors 40b and 50b request PIO access to the multiplexed bus controller 100b (7100), but since the synchronization mode signal 86b is asserted, the multiplexed bus controller 100b is Until the integrated bus control device 100a asserts the accessible signal 106a, the intersystem interface 80b negates the synchronization mode signal 86b, or the timer unit 1032b of the synchronization means 103b notifies the timeout.
Access permission signal 93b and synchronization success signal 108b
Is not asserted (7110).

The A system processors 40a and 50a are
After the O access is completed, the content of the synchronization flag 81a is read, and if the synchronization flag 81a is not set, the synchronization request flag 82b and the synchronization wait flag 83a are reset (7120), and the synchronization task is terminated (713).
0), the task of normal processing is activated (7140).

The intersystem interface 80b negates the synchronization mode signal 86b when the synchronization request flag 82b is reset (7150). When the synchronization mode signal 86b is negated, the multiplexed bus control device 100b asserts only the access permission signal 93b (7160).

When the access permission signal 93b is asserted, the B system processors 40b and 50b execute the PIO access (7170). Processor 40b, 50b
Reads the content of the synchronization flag 81b after the PIO access is completed, and if the synchronization flag 81b is not set, tries the PIO access request again (7180).

The A system processors 40a and 50a terminate the task of the normal processing at a good time (for example, after completion of the processing for one subroutine) (719).
0), the synchronization task is activated again (7200).

The operation of each component with respect to the synchronization task activation process again will be described below.

When the A system processors 40a and 50a set the synchronization request flag 82b and the synchronization wait flag 83a (7210), the synchronization request flag 82a and the synchronization wait flag 83b have already been set.
The intersystem interfaces 80a and 80b assert the synchronization mode signal (86a) and the synchronization mode signal (86b) (7220).

The A system processors 40a and 50a
However, when the PIO access is requested to the multiplexed bus control device 100a (7230), the multiplexed bus control device 10
0a asserts the accessible signal (106a9 (7240)) as a result of access arbitration.

At this time, the synchronization means 103a of the multiplexed bus control device 100a continues to access the access permission signal until the multiplexed bus control device 100b asserts the accessible signal (106b) or the timer unit 1032a notifies the timeout. (93a) and the synchronization success signal (108
Neither of a) is asserted.

Now, the B-system processors 40b and 50b
However, when the PIO access is requested to the multiplexed bus control device 100b (7250), the multiplexed bus control device 10
0b asserts the accessible signal (106b) as a result of access arbitration (7260).

At this time, the synchronization means 103a of the multiplex bus control device 100a and the synchronization means 103b of the multiplex bus control device 100b are synchronized with the access permission signal (93a) and the access permission signal (93b). The success signal (108a) and the synchronization success signal (108b) are all asserted simultaneously (7270).

When the access permission signal (93a) and the access permission signal (93b) are asserted at the same time,
A system processors 40a and 50a and B system processor 4
0b and 50b simultaneously execute PIO access (7
280).

Furthermore, when the synchronization success signal (108a) and the synchronization success signal (108b) are asserted, the intersystem interface 80a and the intersystem interface 80b.
Sets the synchronization flag 81a and the synchronization flag 81b (7290).

Next, the A system processors 40a and 50a
And the processors 40b and 50b of the B system read the contents of the synchronization flag 81a and the synchronization flag 81b of the own system after the PIO access ends, and the synchronization flags 81a and 8b are read.
If 1b is set, the synchronization request flag 82a,
The synchronization request flag 82b, the synchronization wait flag 83a, the synchronization wait flag 83a, and the recovery flag 89a and the recovery flag 89b are reset (7300), the processing of the synchronization task is ended (7310), and the normal processing task is executed. It is activated (7320). After that, the A-system arithmetic processing unit 30a and the B-system arithmetic processing unit 30b perform a synchronous operation.

In the above description, mainly 2
Although the system for performing the operation of the heavy system has been described, it goes without saying that the present invention can be applied to a multiplexed computer system of a triple system or more.

As described above, when performing PIO access, the arithmetic processing unit utilizes the fact that it is in the access permission waiting state until it receives the access permission signal which is a signal for the access request. By simultaneously asserting the access permission signals 93a and 93b for PIO access to 30a and 30b, it is possible to cause the arithmetic processing units 30a and 30b to execute PIO access at the same time and realize the synchronization of the arithmetic processing units 30a and 30b. to enable.

For this reason, it is possible to realize the synchronization of both devices by eliminating the reset operation for synchronization as in the conventional case and stopping the normal operation within an extremely short time. Furthermore, according to the present invention, it is not necessary to provide a special reset means for synchronizing a plurality of arithmetic processing devices as in the conventional case, and a plurality of types of flags and a simple combination circuit are added to a normal system configuration. It can be simply configured by including the provided means, and the increase in cost when providing the means for performing synchronization can be reduced.

[0140]

According to the present invention, in a computer system having a fault-tolerant function composed of a plurality of arithmetic processing units, a response signal for accessing a predetermined address is simultaneously transmitted to the plurality of arithmetic processing units. , By re-synchronizing the processing unit that has recovered from the failure, system reset for synchronization is not required, and re-synchronization can be performed by stopping the operation within an extremely short time. Allows processing to take place.

Further, it is possible to reduce the cost increase when providing the means for performing the synchronization.

[Brief description of drawings]

FIG. 1 is a configuration diagram of an embodiment according to the present invention.

FIG. 2 is a configuration diagram of an embodiment according to the present invention.

FIG. 3 is a configuration diagram of an embodiment according to the present invention.

FIG. 4 is a configuration diagram of an embodiment according to the present invention.

FIG. 5 is a flowchart showing a failure recovery process.

FIG. 6 is a flow chart diagram showing a synchronization task.

FIG. 7 is a flowchart showing a synchronization process.

[Explanation of symbols]

40a ... Processor, 40b ... Processor, 50a ... Processor, 50b ... Processor, 60a ... Memory device,
60b ... Memory device, 70a ... Control unit,
70b ... Control unit, 80a ... Intersystem interface, 80b ... Intersystem interface, 88a ... Fault recovery program storage ROM, 88b ... Fault recovery program storage ROM, 90a ... System bus, 90b ...
System bus, 100a ... Multiplex bus controller, 110
a ... Multiplex bus controller, 100b ... Multiplex bus controller, 110b ... Multiplex bus controller, 120a ... Multiplex bus, 120b ... Multiplex bus, 130a ... I / O bus adapter, 130b ... I / O bus Adapter, 140a ... I
/ O bus, 140b ... I / O bus, 150a ... I / O interface, 150b ... I / O interface,
152a ... I / O interface, 152b ... I / O
Interface, 160a ... I / O device, 160b ...
I / O device, 170 ... Terminal device

Front Page Continuation (72) Inventor Naoto Miyazaki 7-1-1 Omika-cho, Hitachi City, Ibaraki Hitachi, Ltd. Hitachi Research Laboratory (72) Inventor Soichi Takatani 5-2-1 Omika-cho, Hitachi City, Ibaraki Hitachi, Ltd. Omika factory (56) Reference JP-A-6-324901 (JP, A) JP-A-63-196901 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) G06F 15/16-15/177 G06F 11/16-11/20

Claims (6)

(57) [Claims] 1. A plurality of arithmetic processing devices that perform the same arithmetic processing in synchronization, and a synchronization processing device that is connected to each of the arithmetic processing devices and performs resynchronization processing. Each of the arithmetic processing devices comprises: other processing units, failure times for detecting recovery from failure
A recovery detection unit, the fault recovery detection means other processing unit, the fault
If the recovery of the detected and when the own processor has recovered from the failure, respectively, and means for performing an access request to a predetermined address, in accordance with the access permission for the address request and the access to the address And a time difference between the access request by the arithmetic processing device operating normally and the access request by the arithmetic processing device recovered from the failure is within a predetermined time difference. And a synchronization means for simultaneously granting the access permission to the access means of both the arithmetic processing device that operates normally and the arithmetic processing device that has recovered from the failure. 2. A failure recovery method for resynchronizing an arithmetic processing unit recovered from a failure with an arithmetic processing operation of another arithmetic processing unit when one of the arithmetic processing units performing the same arithmetic processing synchronously fails. there are, one of the processing units for normal operation, the other processing unit, when detecting a recovery from the failure, a process of performing an access request to a predetermined address, processing recovery from failure When the time difference between the processing for making an access request to the address and the access request by the normally operating arithmetic processing apparatus and the access request by the arithmetic processing apparatus recovered from the failure is within a predetermined time difference. The synchronous processing device connected to the arithmetic processing device that operates normally and the arithmetic processing device that has recovered from the failure operates normally. A calculation processing device and processing unit has recovered from the failure, at the same time, failure recovery method which comprises the a treatment that gives permission for the address request. 3. The multiplexed computer system according to claim 1, wherein each of the arithmetic processing units resets a synchronization flag when any one of the arithmetic processing units of the plurality of arithmetic processing units fails. And a synchronization flag setting unit that sets the synchronization flag when the time difference between the access request by the normally operating processor and the access request by the processor recovered from the failure is within the predetermined time difference. A multiplexed computer system characterized by the above. 4. The multiplexed computer system according to claim 1, wherein each arithmetic processing unit has a synchronization request flag which is a flag indicating that the other arithmetic processing unit is requested to perform synchronization. A synchronization request flag setting unit for setting, and a synchronization waiting flag setting unit for setting a synchronization waiting flag, which is a flag indicating that the own arithmetic processing unit requests the other arithmetic processing unit to perform synchronization. The means for making the access request of each of the arithmetic processing devices is configured to access the address when a flag is set in both the synchronization request flag setting unit and the synchronization waiting flag setting unit. A multiplexed computer system characterized by making a request. 5. The multiplexed computer system according to claim 4, wherein the synchronization processing device has a flag set in both the synchronization request flag setting unit and the synchronization waiting flag setting unit. , A multiplexing computer system comprising means for reporting to all arithmetic processing units that synchronization has been successful when granting access permission to all arithmetic processing units. 6. The multiplexed computer system according to claim 1, wherein each of the arithmetic processing units reissues an access request for the address when the access permission for the address cannot be received within a predetermined time. A multiplexed computer system comprising a retry means.