JP5449906B2 - Diagnostic method of signal for abnormal processing and duplex computer system - Google Patents

Description

  The present invention relates to a method for diagnosing an abnormality processing signal in a duplex computer system and a duplex computer system to which the diagnosis method for an abnormality processing signal is applied.

  In order to improve the system reliability (fault tolerance), a duplex computer system is often constructed using two computers. As a method of the configuration, there are a dual system in which two computers execute the same process at the same time, or, in general, when two computers perform different processes and one of them fails, a part of the failed computer Alternatively, there is a duplex system that causes the other computer to process all the processing.

  In such a duplex computer system, it is necessary for each of the two computers to notify each other of their operating state. For example, in the duplex computer system disclosed in Patent Document 1, when an execution computer detects any abnormality in its own operation, it transmits an abnormality notification signal to the standby computer. On the other hand, when receiving the abnormality notification signal, the standby computer performs a takeover / switching process for the task being executed by the executing computer and then transmits an initialization signal to the executing computer.

  In a duplex computer system, such an abnormality notification signal or initialization signal is a signal that is generally used. However, such a signal is not activated in a normal operation state, and is not activated by any computer. It is activated only when any abnormality occurs. Therefore, even if the activation function of these signals is lost due to some trouble, it is not detected in the normal state.

  Here, in a digital system such as a computer, activating a signal means that if the normal state is a “Low” level signal (positive logic signal), the signal is set to “High” level. If the state is a signal of “High” level (negative logic signal), it means that the signal is set to “Low” level.

  Incidentally, the abnormality notification signal and the initialization signal are in an inactive state in a normal state, and are activated when, for example, an abnormality occurs in an execution computer. However, if the function for activating the abnormality notification signal is lost at that time, the executing computer cannot transmit the abnormality notification signal to the standby computer. In this case, the system reliability (fault tolerance) cannot be improved by the duplex computer system. Therefore, regarding abnormality notification signals and initialization signals (hereinafter, these signals are collectively referred to as abnormality processing signals in this specification), it is always diagnosed that these signals can be activated. It will be necessary.

  Incidentally, as a method for detecting a failure in a data transmission path connecting two devices, for example, a loopback test as disclosed in Patent Document 2 is known. In the loopback test, the first device that executes the loopback test instructs the counterpart device to connect the reception line and the transmission line internally, and sends a predetermined value to the counterpart device via the transmission line. Send data. At this time, since the reception line and the transmission line are connected in the counterpart apparatus, the transmitted data is returned as it is to the first apparatus via the reception line. Therefore, the first device can detect the presence or absence of a failure in the transmission line and the reception line by determining whether the returned data is the same as the transmitted data.

JP-A-6-259274 JP 2002-16664 A

  When applying the loopback test as described above to the diagnosis of the activation function of the signal for abnormal processing in the duplex computer system, for example, the execution computer controls the other computer The problem arises as to how to communicate the loopback test. In other words, the partner computer cannot loop back the input signal as an output signal unless the partner computer is informed of performing the loopback test.

  In the case of a duplex computer system, it is necessary that at least one of the computers performs a diagnostic process of the function for activating an abnormality processing signal between predetermined task executions. Therefore, the diagnostic process is not allowed to be intervened by human operation, and needs to be completed only by computer program control.

  Therefore, the present invention provides a diagnostic method for an abnormality processing signal in a duplex computer system that can be realized by computer program control without adding a new signal or human intervention, and the abnormality processing. It is another object of the present invention to provide a duplex computer system to which a diagnostic method for a signal is applied.

  According to the present invention, there is provided a method for diagnosing an abnormality processing signal in a duplex computer system configured by connecting a first computer and a second computer to each other via a data transmission / reception communication bus. A first abnormality processing signal output from the first computer and input to the second computer, used when an abnormality occurs in the second computer, and output from the second computer; Then, the activation diagnosis is performed for the second abnormality processing signal input to the first computer.

In the duplex computer system, the first computer includes a command holding unit in which a diagnosis start command or a diagnosis completion command for instructing start or completion of the abnormality processing signal diagnosis is set, and the abnormality processing signal diagnosis. A diagnostic data holding unit in which diagnostic data is set, and is set when the diagnosis start command is set in the command holding unit and cleared when the diagnosis completion command is set A diagnosis mode flag storage unit; a command transmission unit configured to transmit the diagnosis start command or diagnosis completion command set in the command holding unit to the second computer via the data transmission / reception communication bus; and the first Is stored in the diagnostic data holding unit when the diagnostic mode flag storage unit is set. As diagnostic data there are outputted to the second computer as the first abnormality processing signal, a first signal switching unit for switching the output signal of the first abnormality processing signals,
Is provided.

The second computer includes a command reception unit that receives the diagnosis start command or the diagnosis completion command transmitted from the first computer via the data transmission / reception communication bus, and the command reception unit includes the diagnosis When the second diagnosis mode flag storage unit that is set when a start command is received and cleared when the diagnosis completion command is received and when the second diagnosis mode flag storage unit is set, A signal second for switching the output signal of the second abnormality processing signal so that the first abnormality processing signal inputted from the computer is looped back as it is as the second abnormality processing signal . And a switching unit.

When performing the activation diagnosis, the first computer sets the diagnosis start command in the command holding unit and sets the first diagnosis mode flag storage unit, and the command A process of transmitting a diagnosis start command set in the holding unit to the second computer via the command transmission unit, and causing the second computer to set the second diagnostic mode flag storage unit; and the diagnostic data A process of setting diagnostic data in the holding unit, outputting the set diagnostic data to the second computer as the first abnormality processing signal, and responding to the output first abnormality processing signal wherein a process of acquiring a second abnormality processing signal as the response data is looped back from the second computer, the response data of the response data Te Compared to wait value, when they match, executes a process of determining a first abnormality processing signal and the second abnormality processing signal can be both activated.

  As described above, since the diagnosis of the abnormality processing signal is realized by the control of the first computer, no human operation intervention is particularly required. In addition, since an existing data transmission / reception communication bus is used to transmit that the first computer has set the diagnostic mode to the second computer, no new signal is added.

  According to the present invention, diagnosis of a signal for processing an abnormality in a duplex computer system can be realized by program control of one computer without the addition of a new signal or human intervention.

The figure which showed the example of schematic structure of the duplex computer system to which this invention is applied. Examples of detailed configurations of a main signal diagnosis processing unit and a subordinate signal diagnosis processing unit according to an embodiment of the present invention, and examples of configurations of a transmission control unit and a reception control unit for setting the respective diagnosis modes FIG. The figure which showed the example of the frame structure of the data transmission / reception command and signal diagnostic processing command which are used with the duplex computer which concerns on embodiment of this invention. The figure which showed the example of the flowchart of the main routine of the signal diagnostic process which CPU performs in the main system computer which concerns on embodiment of this invention. The figure which showed the example of the flowchart of the signal diagnosis completion command transmission process which CPU performs in the main system computer which concerns on embodiment of this invention. The figure which showed the example of the processing flow processed when the reception control part of the subordinate computer which concerns on embodiment of this invention receives a signal diagnostic process command.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

<1. General Configuration and Operation of Duplicated Computer System>
FIG. 1 is a diagram showing an example of a schematic configuration of a duplex computer system to which the present invention is applied. In the present embodiment, it is assumed that the duplex computer is composed of a primary computer 1 and a secondary computer 2. In this case, the primary computer 1 and the secondary computer 2 may process the same task while being synchronized with each other, or may perform processing different from each other. Alternatively, the slave computer 2 may be a hot standby computer.

  As shown in FIG. 1, the main computer 1 and the subordinate computer 2 include CPUs (Central Processing Units) 11 and 21, main memories 12 and 22, DMA (Direct Memory Access) control units 13 and 23, and transmission control, respectively. Sections 14 and 24, reception control sections 15 and 25, and further includes abnormality detection flags 16 and 26, reset request flags 17 and 27, and main system signal diagnosis processing section 10 for transmitting and receiving an abnormality processing signal. Alternatively, the slave signal diagnosis processing unit 20 is included.

  Here, the master computer 1 and the slave computer 2 are connected to each other via the communication buses 31 and 32 so that data can be transmitted and received between the master computer 1 and the slave computer 2. The DMA controllers 13 and 23 access the main memories 12 and 22 necessary for transmitting and receiving the data.

  That is, data transmission / reception operations performed via the communication buses 31 and 32 are controlled by the transmission control units 14 and 24 and the reception control units 25 and 15. Transmission / reception data used in transmission / reception control of the transmission control units 14 and 24 or the reception control units 25 and 15 is prepared when the DMA control units 13 and 23 directly access the main memories 12 and 22.

  Therefore, as will be described later, the CPUs 11 and 21 issue data transmission / reception operations between the main computer 1 and the subordinate computer 2 only by issuing simple data transmission / reception commands, for example, the main memories 12 and 22. Data transfer between regions is realized.

  As can be seen from the above description, the primary computer 1 and the secondary computer 2 are basically configured to be identical and symmetrical to each other. Therefore, the primary computer 1 and the secondary computer 2 may be switched as appropriate. Hereinafter, only one of the primary computer 1 and the secondary computer 2 will be described, but the description also applies to the other computer.

  As shown in FIG. 1, in the main computer 1, the CPU 11 is connected to the main memory 12 via a CPU bus 18. The CPU 11 executes a predetermined program stored in the main memory 12. By executing the program, predetermined functions of the main computer 1 are realized.

  The CPU 11 is connected to the transmission control unit 14 via the CPU bus 18. As will be described later, the transmission control unit 14 is provided with a command register and a status register connected to the CPU bus 18, and the CPU 11 writes a command related to predetermined data transmission / reception in the command register, thereby allowing the DMA control unit to 13. The transmission control unit 14 and the reception control unit 15 are operated, and the status register is monitored to appropriately control the operation.

  Further, the CPU 11 is connected to the abnormality detection flag 16 and the R request flag (reset request flag) 17 via the CPU bus 18. The CPU 11 can set or clear the abnormality detection flag 16 and the R request flag 17 independently according to a predetermined program as appropriate. In this specification, the flag refers to a storage element that stores a logical state of “1” or “0”, and “setting” a flag means that the flag is in an active state (in this embodiment, a logical state). State “1”), and “clearing” the flag means inactivating the flag (in this embodiment, the logical state “0”).

  Here, the abnormality detection flag 16 is cleared in the initial state, and the CPU 11 detects a self-operation abnormality by a self-diagnosis program or the like, or detects a reading error of the main memory 12 by a parity check or the like. The CPU 11 sets an abnormality detection flag 16 when an abnormality in the operation of the main computer 1 is detected, such as.

  The set of the abnormality detection flag 16 means that the main computer 1 is down. Therefore, the output signal of the abnormality detection flag 16 is output from the main computer 1 as a main system down signal via the main signal diagnosis processing unit 10 and input to the subordinate computer 2. The details of the main system signal diagnosis processing unit 10 will be described later. However, when the operation mode set by the main system signal diagnosis processing unit 10 is not the diagnosis mode, the output signal of the abnormality detection flag 16 is used as it is. It becomes a down signal.

  The main system down signal input to the slave computer 2 is input to, for example, an interrupt terminal (IR terminal) of the CPU 21 via the slave signal diagnostic processing unit 20. The details of the subordinate signal diagnosis processing unit 20 will be described later. However, when the operation mode set by the subordinate signal diagnosis processing unit 20 is not the diagnosis mode, the subordinate signal diagnosis processing unit 20 is input to the subordinate signal diagnosis processing unit 20. The main system down signal is input to the CPU 21 as it is (as the same logic signal).

  When the CPU 21 receives the input of the main system down signal activated from the interrupt terminal (IR terminal), the CPU 21 recognizes that the main system computer 1 is down and resets the main system computer 1 with an R request. Set the flag 27. Note that the R request flag 27 is cleared in the initial state, and the setting of the R request flag 27 means that the main computer 1 is requested to be reset.

  The output signal of the R request flag 27 is output from the slave computer 2 as a master reset signal via the slave signal diagnosis processing unit 20 and input to the master computer 1. When the operation mode set by the slave signal diagnosis processing unit 20 is not the diagnosis mode, the output signal of the R request flag 27 becomes the main system reset signal as it is.

  The main system reset signal input to the main computer 1 is input to, for example, a reset terminal (RS terminal) of the CPU 11 via the main system signal diagnosis processing unit 10. When the operation mode set by the main signal diagnosis processing unit 10 is not the diagnosis mode, the main system reset signal input to the main signal diagnosis processing unit 10 is input to the CPU 11 as it is (as the same logic signal). Is done.

  When the CPU 11 receives an input of the main system reset signal activated from the reset terminal (RS terminal), the CPU 11 executes a predetermined reset process to initialize the entire main computer 1. Generally, at this time, a master-slave replacement process or the like is performed in each of the master computer 1 and the slave computer 2.

  In the above description, the operations of the primary computer 1 and the secondary computer 2 when the abnormality detection flag 16 is set in the primary computer 1 have been described. However, the abnormality detection flag 26 is set in the secondary computer 2. Even in this case, the main computer 1 and the subordinate computer 2 operate in the same manner, and the description thereof is omitted.

  In FIG. 1, the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 include a main system down signal, a subordinate reset signal, a subordinate down signal, and a CPU 11 that connect the main computer 1 and the subordinate computer 2. It is provided to diagnose the main system reset signal. That is, when performing the diagnosis, the CPU 11 sets the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 to the diagnosis mode.

<2. Configuration and operation of signal diagnostic processing section>
FIG. 2 shows an example of detailed configurations of the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20, and the configuration of the transmission control unit 14 and the reception control unit 25 for setting the respective diagnosis modes. It is the figure which showed the example. Here, first, with reference to FIG. 2, the circuit configuration of the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20, and the operation during diagnosis of these circuits will be described.

  As shown in FIG. 2, a diagnostic mode flag 101 and a diagnostic mode flag 201 are provided in each of the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20. The diagnosis mode flags 101 and 201 are cleared in the initial state, and the operation of the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 is switched to the diagnosis mode by setting these flags. .

  Although details will be described later, basically, when the diagnosis mode flag 101 of the main signal diagnosis processing unit 10 is set, the diagnosis mode flag 201 of the subordinate signal diagnosis processing unit 20 is slightly delayed. Is also set. Similarly, when the diagnosis mode flag 101 is cleared, the diagnosis mode flag 201 is also cleared with a slight delay. Accordingly, in the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20, the diagnosis mode is formed almost simultaneously although there is a slight time difference, and the CPU 11 is predetermined when both are in the diagnosis mode. Execute the diagnostic process.

  By the way, the diagnostic processing referred to in the present embodiment includes a main system down signal, a sub system reset signal, a sub system down signal, and a main system reset signal that connect the main computer 1 and the sub computer 2 (in this specification, these This signal is a process for diagnosing whether or not the signal of (1) can be actually activated.

  In the present embodiment, the diagnosis process is realized by a so-called loopback test. In the loopback test, first, a first abnormality processing signal (for example, a main system down signal) output from the main computer 1 and input to the sub computer 2 and output from the sub computer 2 are output. When there is a second abnormality processing signal (for example, a subordinate down signal) input to the system computer 1, these signals are short-circuited in advance inside the subordinate computer 2. By short-circuiting, the first abnormality processing signal output from the main computer 1 can be looped back to the second abnormality processing signal via the slave computer 2. That is, a loopback path starting from the primary computer 1 and reaching the secondary computer 2 and returning to the primary computer 1 is formed.

  Therefore, an activation signal is supplied from the main computer 1 side to the output side signal (for example, main system down signal) of the loopback path, and the activation signal is input to the loopback path (for example, the slave side). It is determined whether or not the signal is returned via a system down signal. When the activation signal is returned, signals included in the loopback path (for example, the main system down signal and the sub system down signal) are It is determined that activation is possible. If the activation signal does not return, it is determined that there is some failure in the loopback path.

  In order to realize such a loopback test, the main signal diagnosis processing unit 10 is provided with a selector 104, a mask gate 109, a diagnosis data register 102, and a diagnosis result register 103. The slave signal diagnosis processing unit 20 is provided with a selector 202 and a mask gate 207.

  When the diagnostic mode flag 101 is set and the diagnostic mode is set in the main signal diagnosis processing unit 10, the selector 104 receives an abnormality detection flag signal and an R request flag signal input from the inside of the main computer 1. Block the passage and instead pass the signal output from the diagnostic data register 102. Here, the diagnostic data register 102 is, for example, a 2-bit register, and is a register for arbitrarily generating a substitute signal for the abnormality detection flag signal and the R request flag signal in the diagnostic mode.

  The diagnostic data register 102 is connected to the CPU 11 via the CPU bus 18. Therefore, the CPU 11 can write arbitrary data to the diagnostic data register 102. As a result, the CPU 11 can arbitrarily activate or deactivate the main system down signal and the sub system reset signal output from the main computer 1 in the diagnosis mode.

  In FIG. 2, the main system down signal and the subordinate reset signal are output from the main computer 1 as two signals of a positive logic signal and a negative logic signal obtained by inverting it with the inverter 105. Are input to the slave computer 2. It is not essential to perform such signal duplication, but the signal transmission reliability can be improved by duplicating the signals.

  In the configuration of main signal diagnostic processing unit 10 shown in FIG. 2, selector 104 is provided at a position before the abnormality detection flag signal and the R request flag signal are branched into a positive logic signal and a negative logic signal. However, it may be provided on the positive logic signal and the negative logic signal after being branched into the positive logic signal and the negative logic signal. However, in that case, four selectors 104 are required, and furthermore, the diagnostic data register 102 also needs 4 bits.

  Next, when the positive logic signal and the negative logic signal of the main system down signal output from the main signal diagnosis processing unit 10 are input to the sub signal diagnosis processing unit 20, the sub signal diagnosis processing unit 20 The input signal is slightly delayed (for example, 100 ns) by the synchronization filter 204 including an RC circuit, a synchronization latch circuit, and the like, and then input to the OR gate 205 to be ORed.

  Here, a small circle mark at the input portion of the negative logic signal of the OR gate 205 represents an inverter. Therefore, although the OR gate 205 is transmitted by different signals such as a positive logic signal and a negative logic signal, the OR gate 205 takes the logical sum of substantially the same signal (here, the main system down signal). The output of the OR gate 205 is input to an interrupt terminal (IR terminal) of the CPU 21 (see FIG. 1) through the mask gate 207. Therefore, when not in the diagnostic mode, the CPU 21 can know that the main computer 1 is down when the activation signal of at least one of the positive logic signal and the negative logic signal of the main system down signal arrives. This means that the main system down signal is transmitted from the main computer 1 to the sub computer 2 even if there is some failure in one of the signal lines of the positive logic signal or the negative logic signal.

  Similarly, when the positive logic signal and the negative logic signal of the slave reset signal output from the master signal diagnosis processing unit 10 are input to the slave signal diagnosis processing unit 20, the slave signal diagnosis processing unit 20 The input signal is slightly delayed (for example, 100 ns) by a synchronization filter 204 including a so-called RC circuit or a latch circuit for synchronization, and then input to the AND gate 206 to be ANDed.

  Here, a small circle mark at the input part of the negative logic signal of the AND gate 206 represents an inverter. Therefore, although the AND gate 206 is transmitted by different signals such as a positive logic signal and a negative logic signal, the AND gate 206 takes a logical product of substantially the same signal (here, a secondary reset signal). The output of the AND gate 206 is input to the reset terminal (RS terminal) of the CPU 21 (see FIG. 1) via the mask gate 207. Therefore, when not in the diagnostic mode, the CPU 21 knows the reset request for itself when the activation signals of both the positive logic signal and the negative logic signal of the slave reset signal arrive. This is because the slave reset signal does not become effective only when one of the positive logic signal and the negative logic signal arrives, and the slave reset signal does not become valid until the both signals arrive. Accepted by computer 2.

  The mask gate 207 allows the output signals of the OR gate 205 and the AND gate 206 to pass through when the diagnostic mode flag 201 is cleared (not in the diagnostic mode), but the diagnostic mode flag 201 is set. Sometimes (in diagnostic mode), the passage of these signals is blocked (masked). Therefore, no matter how the CPU 11 of the main computer 1 activates or deactivates the main system down signal or the subordinate reset signal in the diagnosis mode, the operation of the subordinate computer 2 is not affected. .

  Next, in the slave signal diagnosis processing unit 20, the abnormality detection flag signal and the R request flag signal input from the inside of the slave computer 2 are branched into a positive logic signal and a negative logic signal by the inverter 203, respectively. Is input to one input terminal of the selector 202. On the other hand, a signal that is input from the main computer 1 to the subordinate computer 2 and needs to be looped back is input to the other terminal of the selector 202.

  The selector 202 passes the positive logic signal and the negative logic signal of the abnormality detection flag signal and the R request flag signal when not in the diagnostic mode, and blocks the passage of these signals when in the diagnostic mode, and instead loops back. Pass the signal of interest.

  That is, in the example of FIG. 2, the positive logic signal and the negative logic signal of the main system down signal are looped back to the positive logic signal and the negative logic signal of the subordinate down signal, respectively, via the selector 202. Further, the positive logic signal and the negative logic signal of the slave reset signal are looped back to the positive logic signal and the negative logic signal of the main reset signal via the selector 202, respectively. Here, the signal to be looped back is looped back through a similar signal, and the positive logic (negative logic) signal is looped back through a positive logic (negative logic) signal. You don't have to do that.

  The signals output from these selectors 202 are output from the slave computer 2 as the positive logic signal and negative logic signal of the slave down signal, and as the positive logic signal and negative logic signal of the master reset signal. Input to the computer 1.

  Thus, the positive logic signal and the negative logic signal of the slave down signal input to the main signal diagnosis processing unit 10 are slightly delayed (for example, 100 ns) by the synchronization filter 106, and then both are OR gates 107. Is input. However, the negative logic signal is input after being converted into a positive logic signal by a small circle (inverter) at the input of the OR gate 107. Since the role of the OR gate 107 is the same as that of the OR gate 205 in the slave signal diagnosis processing unit 20, description thereof will be omitted.

  Similarly, the positive logic signal and the negative logic signal of the main system reset signal input to the main system signal diagnosis processing unit 10 are slightly delayed (for example, 100 ns) by the synchronization filter 106 and then to the AND gate 108. Entered. However, the negative logic signal is input after being converted into a positive logic signal by a small circle mark (inverter) of the input part of the AND gate 108. The role of the AND gate 108 is the same as that of the AND gate 206 in the slave signal diagnosis processing unit 20.

  The mask gate 109 passes the output signals of the OR gate 107 and the AND gate 108 when the diagnostic mode flag 201 is cleared (not in the diagnostic mode), but the diagnostic mode flag 201 is set. Sometimes (in diagnostic mode), the passage of these signals is blocked (masked). Therefore, in the diagnosis mode, the CPU 11 of the main computer 1 activates the main system down signal and the sub system reset signal, and these signals are looped back as activation signals of the sub system down signal and the main system reset signal. Even so, the operation of the main computer 1 is not affected.

  Further, the positive logic signal and the negative logic signal of the subordinate down signal, and the positive logic signal and the negative logic signal of the main system reset signal have signals that branch at positions before and after the synchronization filter 106. The branched signal is input to the diagnostic result register 103. In this case, the diagnosis result register 103 requires 8 bits, but it is not essential to input both the signals before and after the synchronization filter 106 to the diagnosis result register 103. Alternatively, the later one signal may be input to the diagnosis result register 103. In that case, the diagnosis result register 103 may be 4 bits.

  The diagnosis result register 103 is connected to the CPU 11 via the CPU bus 18. Therefore, the CPU 11 reads out the data of the diagnostic result register 103 to determine whether the activation signal previously sent through the diagnostic data register 102 has returned through the loopback path formed in the diagnostic mode. Can do.

<3. Data Send / Receive Command Functions and Operations>
Further, the data transmission / reception command will be described with reference to FIG. 2 and FIG. In the duplex computer shown in FIG. 2, the abnormal processing signal (the main system down signal, the sub system reset signal, the sub system down signal, and the main system reset signal) that the CPU 11 connects the main computer 1 and the sub computer 2 is shown. When performing diagnosis, it is necessary to configure the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 and set the diagnosis mode flags 101 and 201 included in each.

  In this case, since the CPU 11 and the diagnosis mode flag 101 are hardware included in the same main computer 1, it is easy to set or clear the diagnosis mode flag 101 from the CPU 11. For example, the diagnostic mode flag 101 may be connected to the CPU bus 18 and the diagnostic mode flag 101 may be a register that the CPU 11 can read and write. On the other hand, the diagnostic mode flag 201 included in the slave computer 2 cannot be set or cleared directly from the CPU 11.

  Therefore, in the present embodiment, as a kind of data transmission / reception command (see FIG. 3) transmitted from the transmission control unit 14 of the primary computer 1 to the reception control unit 25 of the secondary computer 2 at the time of data transmission / reception, A signal diagnosis processing command for diagnosing a signal is provided, and the CPU 11 can set or clear the diagnosis mode flag 201 included in the slave computer 2 by the signal diagnosis processing command.

  At this time, in this embodiment, the transmission control unit 14 of the master computer 1 is connected to the reception control unit 25 of the slave computer 2 by, for example, a communication bus 31 for data transmission in parallel with 8 bits. Reference numeral 31 is attached with an ACK (Acknowledge) signal for response. Similarly, the transmission control unit 24 of the slave computer 2 is connected to the reception control unit 15 of the main computer 1 via, for example, an 8-bit parallel data transmission communication bus 32. An ACK signal for response is attached.

  FIG. 3 is a diagram illustrating an example of a frame configuration of a data transmission / reception command and a signal diagnosis processing command used in the duplex computer according to the embodiment of the present invention. These command frames are composed of a fixed length of 320 bits (40 bytes) as shown in FIG. The frame includes a command field (4 bits), an address field (28 bits), a data field (256 bits), and a CRC field (32 bits).

  Here, a command code for identifying a command is stored in the command field. In the address field, the head address of the area of the main memory 22 of the partner system (secondary computer 2) to which data to be transmitted / received is written or read is stored. In the data field, data transmitted / received by the command is stored. The CRC field is a CRC (Cyclic Redundancy Check) code for error check added to the data of the preceding field.

  In the present embodiment, the signal diagnosis processing command is a kind of data transmission / reception command. Therefore, first, referring to FIG. 3B to FIG. 3D and FIG. explain.

  The own system read / other party write data transmission command has the frame configuration of FIG. 3B, and the CPU 11 reads the data read from the main memory 12 of the own system (main computer 1) as the other system (subordinate system). This command is sent to the computer 2) and written to the main memory 22.

  When executing this command, the CPU 11 first writes a predetermined command code in the command register 141, and also writes the head address of its own main memory 12 storing the data to be transmitted and the transmitted data. The head address of the counterpart main memory 22 is written in an address register (not shown). Next, when the CPU 11 sets an activation bit (not shown) of the access activation register 143, the operations of the DMA control unit 13 and the data transmission unit 144 are activated.

  That is, the DMA control unit 13 reads a predetermined number of data from the designated head address of the main memory 12 and writes it in a transmission buffer (not shown) of the data transmission unit 144. Further, the data transmission unit 144 generates the frame of FIG. 3B instructed by the command decoding unit 142, and transmits the generated frame to the reception control unit 25 of the counterpart system (secondary computer 2). Each time the data transmission unit 144 transmits a frame, the data transmission unit 144 instructs the transmission TO (Time Out) monitoring unit 145 to monitor a timeout error in the ACK response to the frame.

  On the other hand, the data receiving unit 251 of the counterpart (secondary computer 2) receives the frame transmitted from the data transmitting unit 144, temporarily stores the received frame in a reception buffer memory (not shown), and receives a reception error based on the CRC. Check. If there is no error in reception as a result of the check, the data transmission unit 144 instructs the ACK transmission unit 253 to transmit ACK, and also instructs the command decoding unit 252 to decode the command. To do. If the decoded command means a counterpart memory write, the command decoding unit 252 instructs the DMA control unit 23 to write the data temporarily stored in the reception buffer memory to the main memory 22. Subsequently, the DMA control unit 23 writes the data temporarily stored in the reception buffer memory to the area of the main memory 22 designated by the counterpart head address included in the received frame, and ends the series of command operations.

  On the own system (main computer 1) side, when the ACK receiving unit 146 receives the ACK transmitted from the ACK transmitting unit 253, the fact is reflected in the status register 147, so the CPU 11 monitors the status register 147. By doing so, it is possible to know the end of the command operation. Further, when receiving the ACK, the ACK receiving unit 146 resets the monitoring timer in the transmission TO monitoring unit 145.

  The counterpart system read request command has the frame configuration of FIG. 3C, and the CPU 11 reads out data from the main memory 22 of the counterpart system and transmits it to the counterpart system (subordinate computer 2). The command to request. In this command, since only the start address of the memory area storing the data to be read from the counterpart main memory 22 is transmitted to the counterpart system, dummy data is set in the data field of the transmission frame. The

  When executing this command, the CPU 11 writes a predetermined command code in the command register 141, writes the head address of the main memory 22 in which data for requesting transmission to the counterpart system is stored, in an address register (not shown), A start bit (not shown) of the access start register 143 is set. As a result, the operations of the DMA control unit 13 and the transmission control unit 14 are activated, and the operation of the reception control unit 25 and the DMA control unit 23 is activated by transmitting this command to the reception control unit 25 of the partner system. Is done.

  Here, the operations of the DMA control units 13 and 25, the transmission control unit 14 and the reception control unit 25 are almost the same as the operations in the case of the local read / counter system write data transmission command described above. In this case, since substantial data transfer is not performed, the operations of the DMA controllers 13 and 23 are omitted in both the local system and the partner system.

  The read request response command has the frame configuration of FIG. 3D, and the CPU 11 responds to the counterpart read request command (see FIG. 3C) received in advance, and the counterpart read request command. Is a command for transmitting data requested by. Therefore, the operations of the DMA control units 13 and 25, the transmission control unit 14 and the reception control unit 25 in the own system and the other system by this command are the same as the operations in the case of the own system read / other system write data transmission command described above. It is almost the same. However, in the case of this command, since it is not necessary to designate the head address of the main memory 22 in the counterpart system again, dummy data is set in the address field of the transmission frame.

  Although other types of data transmission / reception commands can be assumed, their illustration is omitted here.

<4. Functions and operations of signal diagnostic processing commands>
Subsequently, the signal diagnosis processing command will be described with reference to FIGS. 3 (e), 3 (f), and FIG. 2. In the present embodiment, a signal diagnosis start command and a signal diagnosis completion command are provided as signal diagnosis processing commands.

  When the CPU 11 of the main computer 1 writes a predetermined command in the command register 141, the command decoding unit 142 decodes the command. If the command is a signal diagnosis start command, the diagnostic mode flag 101 Set. As a result, the operation mode of the main signal diagnosis processing unit 10 becomes the diagnosis mode. In addition, the data transmission unit 144 generates a frame including the command, and transmits the generated frame to the data reception unit 251 of the slave computer 2. At this time, dummy data is set in the address field and data field included in the transmission frame.

  On the other hand, in the slave computer 2, when the data receiving unit 251 receives the frame including the signal diagnosis start command, the command decoding unit 252 decodes the command included in the received frame, which is the signal diagnosis. If it is a start command, the diagnostic mode flag 201 is set. As a result, the operation mode of the slave signal diagnosis processing unit 20 also becomes the diagnosis mode.

  As described above, both the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 are set to the diagnosis mode. Therefore, at this time, the CPU 11 executes predetermined signal diagnosis processing. Details of the processing will be described in detail with reference to FIG.

  Similarly, when the CPU 11 of the main computer 1 writes a predetermined command in the command register 141, the command decoding unit 142 decodes the command. If the command is a signal diagnosis completion command, the diagnosis is performed. The mode flag 101 is cleared. As a result, the diagnosis mode of the main signal diagnosis processing unit 10 is canceled. In addition, the data transmission unit 144 generates a frame including the command, and transmits the generated frame to the data reception unit 251 of the slave computer 2. At this time, dummy data is set in the address field and data field included in the transmission frame.

  On the other hand, in the slave computer 2, when the data receiving unit 251 receives the frame including the signal diagnosis completion command, the command decoding unit 252 decodes the command included in the received frame, which is used as the signal diagnosis. If it is a completion command, the diagnostic mode flag 201 is cleared. As a result, the diagnostic mode of the slave signal diagnostic processing unit 20 is canceled.

  Note that after the diagnosis mode flag 201 is set, for example, when a failure occurs in the communication bus 31, the data reception unit 251 cannot receive the frame including the signal diagnosis completion command, and the diagnosis mode The flag 201 may not be cleared. In preparation for this, the slave signal diagnosis processing unit 20 is provided with a diagnosis completion TO (Time Out) monitoring unit 254. The diagnosis completion TO monitoring unit 254 forcibly clears the diagnosis mode flag 201 when the diagnosis mode flag 201 is not cleared even after a time sufficiently longer than the time required for the predetermined signal diagnosis processing has elapsed. .

  FIG. 4 is a diagram showing an example of a flowchart of a main routine of signal diagnosis processing executed by the CPU 11 in the main computer 1.

  As shown in FIG. 4, the CPU 11 clears the diagnostic data register 102 before starting the signal diagnostic process (step S10). Subsequently, a signal diagnosis start command transmission process is executed (step S11). Here, in the signal diagnosis start command transmission process, the diagnosis mode flag 101 of the main signal diagnosis processing unit 10 is set and the diagnosis mode flag 201 of the subordinate signal diagnosis processing unit 20 is set, so This is a process for generating a state in which a loopback test of signals (main system down signal, sub system reset signal, sub system down signal, and main system reset signal) can be performed.

  Hereinafter, the flow of the signal diagnosis start command transmission process (step S11) will be described in detail. First, the CPU 11 sets a signal diagnosis start command in the command register 141 (step S31), and sets transmission frame generation data such as address field data in a predetermined register (step S32). However, in the present embodiment, such data is not particularly necessary, so dummy data may be set or the setting process (step S32) may be omitted. As described above, when the signal diagnosis start command is set in the command register 141 (step S31), the command decoding unit 142 sets the diagnosis mode flag 101 of the main signal diagnosis processing unit 10 (step S41). .

  Next, the CPU 11 sets an activation bit of the access activation register 143 (step S33), and further sets a monitoring timer of the transmission TO monitoring unit 145 (step S34). Here, when the activation bit of the access activation register 143 is set, the transmission frame of the signal diagnosis start command is transmitted to the reception control unit 25 of the slave computer 2 (step S42). The processing in the reception control unit 25 will be described later. When the reception control unit 25 receives the signal diagnosis start command without error, the diagnosis mode flag 201 of the slave signal diagnosis processing unit 20 is set, and the reception control unit ACK is transmitted from 25 (see FIG. 6).

  Here, when the ACK receiving unit 146 receives ACK, the fact is reflected in the status register 147. Therefore, the CPU 11 monitors the reception of ACK by reading the status register 147 (step S35). That is, if the CPU 11 does not detect reception of ACK (No in step S36) and does not reach a predetermined timeout (No in step S39), the CPU 11 repeatedly executes step S36.

  On the other hand, when the CPU 11 detects the reception of ACK (Yes in step S36), the CPU 11 determines that the diagnosis mode flag 201 is set in the slave signal diagnosis processing unit 20, and sets the start bit of the access start register. While clearing (step S37), the monitoring timer of the transmission TO monitoring unit 145 is cleared (step S38). Thereby, the CPU 11 ends the signal diagnosis start command transmission process.

  If the monitoring timer of the transmission TO monitoring unit 145 has timed out in step S36 (Yes in step S39), it is determined that the diagnostic mode flag 201 has not been set in the slave signal diagnostic processing unit 20. Then, after setting a predetermined error code, error processing is executed (step S21: via E1 circled in FIG. 4).

  When the signal diagnosis start command transmission process (step S11) is completed, the CPU 11 performs a loopback test of the abnormality processing signal (main system down signal, sub system reset signal, sub system down signal, and main system reset signal). Start. The CPU 11 first sets test data in the diagnostic data register 102 (step S12). Here, when the diagnostic data register 102 is composed of 2 bits corresponding to the main system down signal and the sub system reset signal, the main system down signal and the sub system reset signal are activated in the 2 bits. Test data “11 (binary)” is set. The initial value of the diagnostic data register 102 at the start of loopback is “00 (binary)” (see step S10).

  As shown in FIG. 2, the data of the diagnostic data register 102 includes the positive logic signal and the negative logic signal of each of the main system down signal and the subordinate reset signal, and the positive logic of each of the subordinate down signal and the main system reset signal. Looped back to the diagnosis result register 103 via the signal and the negative logic signal. Therefore, the CPU 11 waits for a time (for example, 10 μs) longer than the delay time of the loop back (step S13), and then reads data from the diagnosis result register 103 (step S14).

  Here, when the waiting time in step S13 is sufficiently longer than the delay time of the loopback (for example, 10 μsec is considered to be sufficiently long), the loopback signal is sent before the synchronization filter 106. The diagnosis result register 103 is set by a signal after the synchronization filter 106 and is configured with 4 bits because it is stable at any time. In this case, when the activation signal set in the diagnosis data register 102 is looped back without error, “1010 (binary)” is set in the diagnosis result register 103.

  Therefore, the CPU 11 compares the data read from the diagnosis result register 103 with a predetermined expected value, and if it matches the expected value (Yes in step S15), any signal included in the loopback path is activated. Judge that it is possible.

  Further, the CPU 11 confirms that any of the activated signals included in the loopback path can be inactivated. That is, the CPU 11 clears the diagnostic data register 102 (step S16), waits for a predetermined time (for example, 10 μs) (step S17), and then reads data from the diagnostic result register 103 (step S18). Then, the data is compared with a predetermined expected value, and if it matches the expected value (Yes in step S19), it is determined that any signal included in the loopback path can be inactivated.

  As described above, the loopback test of the abnormality processing signal (main system down signal, sub system reset signal, sub system down signal, and main system reset signal) to be diagnosed is completed by the processing of steps S12 to S19. . Therefore, the CPU 11 executes a signal diagnosis completion command transmission process (step S20) and ends the signal diagnosis process of FIG.

  However, if the data read from the diagnosis result register 103 does not match the expected value (No in each step of steps S15 and S19), an abnormality processing signal (main system down signal, subordinate system) to be diagnosed Since there are signals that cannot be activated or deactivated in the reset signal, the subordinate down signal, and the main system reset signal, the CPU 11 executes predetermined error processing (step S21), and the signal diagnosis is completed. Command transmission processing is executed (step S20), and the signal diagnosis processing of FIG. 4 is terminated.

  The details of the signal diagnosis completion command transmission process will be described separately with reference to FIG. 5, but the process is started when the CPU 11 sets a signal diagnosis completion command in the command register 141 (step S43). . When the signal diagnosis completion command is set in the command register 141, the diagnosis mode flag 101 is cleared by the command decoding unit 142 that has decoded the command (step S44). Further, the signal diagnosis completion command is transmitted to the reception control unit 25 of the slave computer 2, and when the command decoding unit 252 decodes the signal diagnosis completion command, the diagnosis mode flag 201 is cleared. Thus, both the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 release the diagnosis mode, and return to the normal operation mode in which the abnormality processing signal is not looped back.

  FIG. 5 is a flowchart illustrating an example of a signal diagnosis completion command transmission process in the signal diagnosis process executed by the CPU 11. As shown in FIG. 5, the flow configuration of the signal diagnosis completion command transmission process is almost the same as the flow configuration of the signal diagnosis start command transmission process shown in FIG.

  That is, when the CPU 11 sets a signal diagnosis completion command in the command register 141 (step S51), the subsequent processing in steps S52 to S59 is the same as the processing in steps S32 to S39 shown in FIG. Therefore, description of the processing in steps S52 to S59 is omitted.

  The difference between the signal diagnosis start command transmission process and the signal diagnosis completion command transmission process is merely a difference that is set in the command register 141 and transmitted to the slave computer 2. However, since the command decoding units 142 and 252 detect the commands as different commands, the diagnosis mode flags 101 and 201 are set in the signal diagnosis start command in FIG. 4, but in the signal diagnosis completion command in FIG. The diagnosis mode flags 101 and 201 are cleared.

  FIG. 6 is a diagram illustrating an example of a processing flow to be processed when the reception control unit 25 of the slave computer 2 receives a signal diagnosis processing command. This process is a process in the reception control unit 25, and the CPU 21 of the slave computer 2 is not involved in this process.

  As shown in FIG. 6, when the data reception unit 251 of the reception control unit 25 receives the transmission frame of the reception diagnosis start command transmitted from the main computer 1 (step S71), the data reception unit 251 checks the CRC and the like for the received frame. Thus, it is determined whether or not there is a reception error (step S72). If there is no reception error in the determination (Yes in step S72), the command decoding unit 252 sets the diagnosis mode flag 201 (step S73) and sets the monitoring timer of the diagnosis completion TO monitoring unit 254. (Step S74) Furthermore, ACK is transmitted from the ACK transmission unit 253 to the transmission control unit 14 of the main computer 1 (Step S75).

  If it is determined in step S72 that there is a reception error (No in step S72), predetermined error processing is performed (step S76), and the signal diagnosis start command reception processing is terminated. Therefore, in this case, ACK is not transmitted to the transmission control unit 14 of the main computer 1.

  On the other hand, when the data reception unit 251 of the reception control unit 25 receives the transmission frame of the reception diagnosis completion command transmitted from the main computer 1 (step S81), the data reception unit 251 receives the received frame by checking the CRC or the like. The presence / absence of an error is determined (step S82). If there is no reception error in the determination (Yes in step S82), the command decoding unit 252 clears the diagnosis mode flag 201 (step S83), and clears the monitoring timer of the diagnosis completion TO monitoring unit 254. (Step S84) Further, ACK is transmitted from the ACK transmission unit 253 to the transmission control unit 14 of the main computer 1 (Step S85).

  If it is determined in step S82 that there is a reception error (No in step S82), predetermined error processing is performed (step S86), and the signal diagnosis completion command reception processing ends. Therefore, in this case, ACK is not transmitted to the transmission control unit 14 of the main computer 1.

  Further, when a diagnosis completion timeout occurs in the diagnosis completion TO monitoring unit 254, the diagnosis completion TO monitoring unit 254 clears the diagnosis mode flag 201 (not shown). The diagnosis completion time-out in the diagnosis completion TO monitoring unit 254 is, for example, a predetermined time-out monitoring due to some failure after a signal diagnosis start command is transmitted from the primary computer 1 side to the secondary computer 2 side. This occurs when the signal diagnosis completion command is not transmitted in time, or at least when the slave computer 2 cannot receive the signal diagnosis completion command.

  In such a case, the diagnosis mode flag 101 of the main signal diagnosis processing unit 10 is cleared (the main computer 1 is in the normal operation mode), and the diagnosis mode flag 201 of the sub signal diagnosis processing unit 20 is not cleared (subordinate). The computer 2 is in a halfway state (diagnostic mode). Therefore, here, the diagnosis mode flag 201 of the subordinate signal diagnosis processing unit 20 is cleared by time-out monitoring by the diagnosis completion TO monitoring unit 254 so that both can be returned to the normal operation mode. .

  Note that, for example, when 0.1 second is required for the diagnosis processing of the abnormality processing signal (steps S10 to S20 in FIG. 4), the time-out monitoring time of the diagnosis completion TO monitoring unit 254 is used. May be set to a value sufficiently larger than the required time, for example, about 1 to 5 seconds.

  According to the embodiment of the present invention described above, the CPU 11 of the main computer 1 performs the abnormal processing signal (the main down signal, the subordinate reset signal, the subordinate system) that connects the main computer 1 and the subordinate computer 2. Loopback test for the down signal and the main system reset signal), and the loopback test diagnoses whether each signal can be activated with respect to the abnormal processing signal. Signal diagnosis processing can be realized. The feature of this signal diagnosis process is that it does not particularly require a dedicated communication path (communication line) for diagnosis, and the diagnosis process is always performed under the main control of the CPU 11 of the main computer 1. There is a point that can be. Therefore, it can be said that this embodiment can be easily applied to various forms of duplex computer systems.

  As described with reference to FIG. 1, the main computer 1 and the subordinate computer 2 are basically configured to be identical and symmetrical to each other. However, the configurations of the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 are not necessarily symmetrical. This is a configuration on the premise that a signal diagnosis process for an abnormality processing signal is executed under the control of the CPU 11 of the main computer 1. Therefore, in this embodiment, the role of the master / slave cannot be arbitrarily changed as in the relationship between the master computer and the slave computer in a normal duplex computer.

  Therefore, even if the relationship between the primary system (for example, the active system) and the secondary system (for example, the standby system) in the normal duplex computer system is switched by the failure recovery processing, the primary computer 1 and the slave system in this embodiment are replaced. The relationship of the system computer 2 does not change. In the present embodiment, the computer having the main signal diagnosis processing unit 10 shown in FIG. 2 is the main computer 1, and the computer having the sub signal diagnosis processing unit 20 is the sub computer 2. In other words, in this embodiment, the slave computer (for example, standby system) in the normal duplex computer system becomes the main computer 1 in this embodiment, and leads the signal diagnosis processing of the abnormality processing signal. Can be done.

  Although not shown and described, it is possible to configure the main signal diagnosis processing unit 10 and the subordinate signal diagnosis processing unit 20 of FIG. 2 to be symmetrical to each other. In this case, however, it is inevitable that the circuit scale is slightly increased.

DESCRIPTION OF SYMBOLS 1 Master computer 2 Slave computer 10 Master signal diagnostic processing part 20 Slave signal diagnostic processing part 11, 21 CPU
12, 22 Main memory 13, 23 DMA control unit 14, 24 Transmission control unit 15, 25 Reception control unit 16, 26 Abnormality detection flag 17, 27 R request flag (reset request flag)
31, 32 Communication bus 101, 201 Diagnostic mode flag 102 Diagnostic data register 103 Diagnostic result register 104, 202 Selector 105, 203 Inverter 106, 204 Synchronization filter 107, 205 OR gate 108, 206 AND gate 109, 207 Mask gate 141 Command Register 142 Command decoding unit 143 Access activation register 144 Data transmission unit 145 Transmission TO monitoring unit 146 ACK reception unit 147 Status register 251 Data reception unit 252 Command decoding unit 253 ACK transmission unit 254 Diagnosis completion TO monitoring unit

Claims (4)

In a duplex computer system in which a first computer and a second computer are connected to each other via a data transmission / reception communication bus, used when an abnormality occurs in the first computer or the second computer. A first abnormality processing signal output from the first computer and input to the second computer, and a second signal output from the second computer and input to the first computer. A method for diagnosing an abnormality processing signal for performing an activation diagnosis on an abnormality processing signal,
The first computer is
A command holding unit in which a diagnosis start command or a diagnosis completion command for instructing start or completion of signal processing for abnormality processing is set; and
A diagnostic data holding unit in which diagnostic data for signal processing for abnormality processing is set;
A first diagnosis mode flag storage unit that is set when the diagnosis start command is set in the command holding unit and is cleared when the diagnosis completion command is set;
A command transmission unit configured to transmit the diagnosis start command or the diagnosis completion command set in the command holding unit to the second computer via the data transmission / reception communication bus;
When the first diagnostic mode flag storage unit is set, the diagnostic data held in the diagnostic data holding unit is output to the second computer as the first abnormality processing signal. A first signal switching unit that switches an output signal of the first abnormality processing signal;
With
The second computer is
A command receiver for receiving the diagnosis start command or the diagnosis completion command transmitted from the first computer via the data transmission / reception communication bus;
A second diagnostic mode flag storage unit that is set when the command reception unit receives the diagnosis start command and is cleared when the diagnosis completion command is received;
When the second diagnostic mode flag storage unit is set, the first abnormality processing signal input from the first computer is looped back as it is as the second abnormality processing signal. As described above, a second signal switching unit that switches an output signal of the second abnormality processing signal;
With
The first computer is
A process for setting the diagnosis start command in the command holding unit and setting the first diagnosis mode flag storage unit;
A process of transmitting a diagnosis start command set in the command holding unit to the second computer via the command transmission unit, and causing the second computer to set the second diagnosis mode flag storage unit;
Processing for setting diagnostic data in the diagnostic data holding unit, and outputting the set diagnostic data to the second computer as the first abnormality processing signal;
Processing for acquiring, as response data, a second abnormal-time processing signal that is looped back from the second computer in response to the output first abnormal-time processing signal;
Said comparing response data with the expected value of the response data, when they match, it determines the processing said first abnormality processing signal and the second abnormality processing signal can be both activated When,
A method for diagnosing an abnormality processing signal, characterized in that: The second computer is
A timeout monitoring unit that is set when the command reception unit receives the diagnosis start command and is cleared when the diagnosis completion command is received;
The method for diagnosing an abnormality processing signal according to claim 1, wherein when the timeout monitoring unit detects the elapse of a predetermined timeout time, the second diagnostic mode flag storage unit is cleared. An output from the first computer when an abnormality occurs in the first computer or the second computer, which is constituted by a first computer and a second computer connected to each other via a data transmission / reception communication bus And a first abnormality processing signal input to the second computer and a second abnormality processing signal output from the second computer and input to the first computer. A duplex computer system that performs recovery processing of
The first computer is
A command holding unit in which a diagnosis start command or a diagnosis completion command for instructing start or completion of signal processing for abnormality processing is set; and
A diagnostic data holding unit in which diagnostic data for signal processing for abnormality processing is set;
A first diagnosis mode flag storage unit that is set when the diagnosis start command is set in the command holding unit and is cleared when the diagnosis completion command is set;
A command transmission unit configured to transmit the diagnosis start command or the diagnosis completion command set in the command holding unit to the second computer via the data transmission / reception communication bus;
When the first diagnostic mode flag storage unit is set, the diagnostic data held in the diagnostic data holding unit is output to the second computer as the first abnormality processing signal. A first signal switching unit that switches an output signal of the first abnormality processing signal;
With
The second computer is
A command receiver for receiving the diagnosis start command or the diagnosis completion command transmitted from the first computer via the data transmission / reception communication bus;
A second diagnostic mode flag storage unit that is set when the command reception unit receives the diagnosis start command and is cleared when the diagnosis completion command is received;
When the second diagnostic mode flag storage unit is set, the first abnormality processing signal input from the first computer is looped back as it is as the second abnormality processing signal. As described above, a second signal switching unit that switches an output signal of the second abnormality processing signal;
With
The first computer is
A process for setting the diagnosis start command in the command holding unit and setting the first diagnosis mode flag storage unit;
A process of transmitting a diagnosis start command set in the command holding unit to the second computer via the command transmission unit, and causing the second computer to set the second diagnosis mode flag storage unit;
Processing for setting diagnostic data in the diagnostic data holding unit, and outputting the set diagnostic data to the second computer as the first abnormality processing signal;
Processing for acquiring, as response data, a second abnormal-time processing signal that is looped back from the second computer in response to the output first abnormal-time processing signal;
Said comparing response data with the expected value of the response data, when they match, it determines the processing said first abnormality processing signal and the second abnormality processing signal can be both activated When,
A duplex computer system characterized by executing The second computer is
A timeout monitoring unit that is set when the command reception unit receives the diagnosis start command and is cleared when the diagnosis completion command is received;
The duplex computer system according to claim 3, wherein when the time-out monitoring unit detects the elapse of a predetermined time-out period, the second diagnostic mode flag storage unit is cleared.

Images